34 lines
2.0 KiB
Markdown
34 lines
2.0 KiB
Markdown
# Minimal admin panel — 14 October 2026
|
||
|
||
Implemented `/admin` with human administrator sign-in, paged credential metadata,
|
||
project-scoped issuance, one-time secret display, confirmed revocation and latest
|
||
50 credential-management events. The activity log excludes runtime/agent logs.
|
||
|
||
Baseline: application, tests, web and schema directories were already untracked;
|
||
the agent submodule and several architecture documents were already dirty. No commit
|
||
was made and unrelated changes were preserved. The shared operation catalog and
|
||
bundled agent contract/hash were refreshed for the four new HTTP operations.
|
||
|
||
PASS:
|
||
|
||
- `scripts/python-tool pytest -q`: 179 tests.
|
||
- `npm --prefix web run check`: TypeScript, ESLint, 17 frontend tests.
|
||
- `npm --prefix web run build`: production bundle.
|
||
- Ruff check and format check, mypy, module boundary checker.
|
||
- API tests: viewer/mixed-agent denial, no authentication, CSRF/origin, body limit,
|
||
duplicate IDs, secret-free lists/events, self-revocation rejection, durable audit,
|
||
revocation invalidates bearer authentication and existing browser sessions.
|
||
- Shared preview using disposable data: sign-in, credential/project/event reads,
|
||
credential creation (201), one-time secret displayed. No operator keys modified.
|
||
- Live web `/admin` loads at `https://msi.tail0b014a.ts.net:10000/admin`; at a requested
|
||
390×844 viewport the preview reported 391×845 and no document horizontal overflow.
|
||
- Local API restarted through PM2; health succeeds and unauthenticated admin reads
|
||
return authentication errors.
|
||
|
||
LIMITED: the shared preview routed successive calls between multiple clients and
|
||
repeatedly lost the signed-in state or failed snapshot calls. Full browser revocation,
|
||
keyboard walkthrough and authenticated responsive screenshot inspection remain
|
||
unverified. Component/API tests cover creation, confirmation, CSRF and revocation;
|
||
component tests cover reconnect after session expiry. No screen-reader or axe audit
|
||
was performed. The temporary fixture server was stopped after verification.
|