Skip to content

Commit 1806adb

Browse files
ToolboxAidToolboxAid
committed
Wire admin runtime environment diagnostics
1 parent d69a02c commit 1806adb

11 files changed

Lines changed: 862 additions & 167 deletions

‎admin/system-health.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ <h2 id="admin-system-health-title">System Health Tables</h2>
123123
<th scope="col">Status</th>
124124
</tr>
125125
</thead>
126-
<tbody>
126+
<tbody data-admin-system-health-runtime-rows>
127127
<tr><td>CLOUDFLARE_R2_ACCESS_KEY_ID</td><td>********</td><td data-health-status="PASS">PASS</td></tr>
128128
<tr><td>CLOUDFLARE_R2_BUCKET</td><td>Configured bucket placeholder</td><td data-health-status="PENDING" title="Reason: R2 bucket value reader is intentionally not wired in this foundation PR." aria-label="PENDING: R2 bucket value reader is intentionally not wired in this foundation PR.">PENDING</td></tr>
129129
<tr><td>CLOUDFLARE_R2_SECRET_ACCESS_KEY</td><td>********</td><td data-health-status="PASS">PASS</td></tr>

‎assets/theme-v2/js/admin-system-health.js‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ class AdminSystemHealthController {
4545
node.dataset.adminSystemHealthStorageStatus,
4646
node,
4747
]));
48+
this.runtimeRows = root.querySelector("[data-admin-system-health-runtime-rows]");
4849
}
4950

5051
init() {
@@ -106,6 +107,7 @@ class AdminSystemHealthController {
106107
["bucket", "list", "read", "write", "delete"].forEach((key) => {
107108
this.setStorageStatus(key, "PENDING", reason);
108109
});
110+
this.renderRuntimePending(reason);
109111
}
110112

111113
renderPostgresStatus(databaseStatus = {}) {
@@ -166,6 +168,60 @@ class AdminSystemHealthController {
166168
});
167169
}
168170

171+
createCell(text) {
172+
const cell = document.createElement("td");
173+
cell.textContent = asText(text);
174+
return cell;
175+
}
176+
177+
createStatusCell(status, reason) {
178+
const cell = document.createElement("td");
179+
cell.dataset.healthStatus = statusValue(status);
180+
this.setStatusNode(cell, status, reason);
181+
return cell;
182+
}
183+
184+
renderRuntimePending(reason) {
185+
if (!this.runtimeRows) {
186+
return;
187+
}
188+
const row = document.createElement("tr");
189+
row.append(
190+
this.createCell("Runtime environment"),
191+
this.createCell("not available"),
192+
this.createStatusCell("PENDING", reason),
193+
);
194+
this.runtimeRows.replaceChildren(row);
195+
}
196+
197+
renderRuntimeEnvironment(runtimeEnvironment = {}) {
198+
if (!this.runtimeRows) {
199+
return;
200+
}
201+
if (runtimeEnvironment?.secretsExposed === true || runtimeEnvironment?.secretEditingAllowed === true) {
202+
this.renderRuntimePending("Safe runtime environment diagnostics were blocked because the response exposed secret controls.");
203+
return;
204+
}
205+
const rows = Array.isArray(runtimeEnvironment.rows) ? runtimeEnvironment.rows : [];
206+
if (!rows.length) {
207+
this.renderRuntimePending("Safe runtime environment diagnostics returned no loaded keys.");
208+
return;
209+
}
210+
const fragment = document.createDocumentFragment();
211+
rows.forEach((runtimeRow) => {
212+
const row = document.createElement("tr");
213+
const keyCell = this.createCell(runtimeRow.key);
214+
keyCell.dataset.adminSystemHealthRuntimeKey = "";
215+
row.append(
216+
keyCell,
217+
this.createCell(runtimeRow.display),
218+
this.createStatusCell(runtimeRow.status, runtimeRow.reason),
219+
);
220+
fragment.append(row);
221+
});
222+
this.runtimeRows.replaceChildren(fragment);
223+
}
224+
169225
load() {
170226
try {
171227
const data = readAdminSystemHealthStatus();
@@ -176,6 +232,7 @@ class AdminSystemHealthController {
176232
this.renderPostgresStatus(data?.databaseStatus || {});
177233
this.renderStorageStatus(data?.storageStatus || {});
178234
this.runStorageDiagnostics();
235+
this.renderRuntimeEnvironment(data?.runtimeEnvironment || {});
179236
} catch (error) {
180237
const message = error instanceof Error ? error.message : "Safe Admin System Health API is unavailable.";
181238
this.renderPending(message);

‎docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-instruction-compliance-checklist.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# PR_26171_GAMMA_016 Instruction Compliance Checklist
2+
3+
## Required Reads
4+
5+
- PASS: Read `docs_build/dev/PROJECT_INSTRUCTIONS.md`.
6+
- PASS: Read `docs_build/dev/PROJECT_MULTI_PC.txt`.
7+
- PASS: Read exact target file `admin/system-health.html`.
8+
- PASS: Read existing runtime target `assets/theme-v2/js/admin-system-health.js`.
9+
- PASS: Read existing safe server contract in `src/dev-runtime/server/local-api-router.mjs`.
10+
- PASS: Read existing target route test `tests/playwright/tools/AdminHealthOperationsPage.spec.mjs`.
11+
12+
## Ownership And Branch
13+
14+
- PASS: Queued PR name includes TEAM token `GAMMA`.
15+
- PASS: TEAM ownership was verified against `PROJECT_MULTI_PC.txt`.
16+
- PASS: User explicitly directed continuation on `team/GAMMA/admin`.
17+
- PASS: Verified clean status and local/origin sync `0 0` after PR015 before PR016 edits.
18+
- PASS: User explicitly directed updating existing draft PR #36 and not creating a separate PR016 GitHub PR.
19+
- PASS: Work remained within the Admin diagnostics/runtime scope.
20+
21+
## Scope Compliance
22+
23+
- PASS: Wired Admin System Health runtime environment visibility.
24+
- PASS: Displayed loaded runtime env keys alphabetically.
25+
- PASS: Masked secret-like values for `PASSWORD`.
26+
- PASS: Masked secret-like values for `SECRET`.
27+
- PASS: Masked secret-like values for `TOKEN`.
28+
- PASS: Masked secret-like values for `KEY`.
29+
- PASS: Masked secret-like values for `SERVICE_ROLE`.
30+
- PASS: Masked secret-like values for `JWT`.
31+
- PASS: Masked secret-like values for `DATABASE_URL`.
32+
- PASS: Showed applied/configured state safely.
33+
- PASS: Did not expose secret values in page text.
34+
- PASS: Did not expose secret values in client-visible API response bodies.
35+
- PASS: Did not introduce SQLite.
36+
- PASS: Preserved Theme V2 only.
37+
- PASS: Preserved Postgres-only database direction.
38+
- PASS: Preserved R2-only storage direction.
39+
- PASS: Added reason text for every non-`PASS` status rendered by PR016 code.
40+
41+
## Validation Compliance
42+
43+
- PASS: Ran `git diff --check`.
44+
- PASS: Ran targeted Admin System Health source validation.
45+
- PASS: Ran targeted Admin System Health Playwright route/behavior validation.
46+
- PASS: Verified no SQLite was introduced by the PR016 diff.
47+
- PASS: Verified no raw env value fields were introduced by the PR016 diff.
48+
- PASS: Verified no secret values are exposed by the page or API payload behavior.
49+
- PASS: Verified every non-`PASS` status has reason text.
50+
- PASS/WARN: Produced Playwright V8 coverage notes for changed runtime JavaScript; server-side router coverage is advisory WARN because browser V8 coverage cannot collect it.
51+
- PASS: Did not run samples.
52+
53+
## Reports And Packaging
54+
55+
- PASS: Created queued-scope PR report.
56+
- PASS: Created manual validation notes.
57+
- PASS: Created instruction compliance checklist.
58+
- PASS: Generate `codex_review.diff` after scoped changes.
59+
- PASS: Generate `codex_changed_files.txt` after scoped changes.
60+
- PASS: Create repo-structured delta ZIP under `tmp/PR_26171_GAMMA_016-admin-runtime-environment-runtime_delta.zip`.
61+
- PASS: Verify no report remains modified after ZIP creation.
62+
63+
## Merge Control
64+
65+
- PASS: No merge performed.
66+
- PASS: Owner-controlled EOD merge approval remains required.

‎docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-manual-validation-notes.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# PR_26171_GAMMA_016 Manual Validation Notes
2+
3+
## Manual Review Notes
4+
5+
- Reviewed the safe runtime environment payload in `src/dev-runtime/server/local-api-router.mjs`.
6+
- Confirmed the server returns key names, display state, configured state, status, and reason text only.
7+
- Confirmed raw environment values are not included in the runtime environment payload.
8+
- Confirmed secret-like keys are displayed as `********`.
9+
- Confirmed non-secret loaded keys are displayed as `configured` rather than exposing raw values.
10+
- Confirmed Runtime Environment rows render alphabetically from server-owned data.
11+
- Confirmed non-`PASS` status cells include hover/accessibility reason text.
12+
- Confirmed no SQLite runtime or persistence code was introduced.
13+
14+
## Validation Notes
15+
16+
- `git diff --check` passed.
17+
- Targeted Admin System Health source validation passed.
18+
- Targeted Admin System Health Playwright route/behavior spec passed with 3 tests.
19+
- Playwright verified test env secret values were absent from both page text and client-visible Admin System Health API response bodies.
20+
- Playwright V8 coverage report includes `assets/theme-v2/js/admin-system-health.js`.
21+
- Playwright V8 coverage report warns that `src/dev-runtime/server/local-api-router.mjs` is server-side and not collected by browser V8 coverage.
22+
- Samples were not run because samples are outside this queued Admin diagnostics scope.
23+
24+
## User Review Focus
25+
26+
- Review whether listing all loaded runtime environment key names is the desired Admin visibility level.
27+
- Review whether non-secret env values should remain `configured` only, as implemented, to avoid accidental exposure.
28+
- Confirm owner approval before any EOD merge.

‎docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# PR_26171_GAMMA_016-admin-runtime-environment-runtime
2+
3+
## Summary
4+
5+
Queued scope 016 was applied to the existing draft PR #36 workstream branch:
6+
7+
- PR #36: `PR_26171_GAMMA_011-admin-system-health-foundation`
8+
- Branch: `team/GAMMA/admin`
9+
10+
This queued scope wires Admin System Health runtime environment visibility through the existing safe Admin System Health status endpoint without creating a separate GitHub PR.
11+
12+
## Scope Evidence
13+
14+
- Added a server-owned runtime environment payload to `GET /api/admin/system-health/status`.
15+
- Displayed loaded runtime environment keys alphabetically in the Runtime Environment table.
16+
- Returned safe display states only:
17+
- `configured`
18+
- `not configured`
19+
- `********` for secret-like keys
20+
- Masked keys containing:
21+
- `PASSWORD`
22+
- `SECRET`
23+
- `TOKEN`
24+
- `KEY`
25+
- `SERVICE_ROLE`
26+
- `JWT`
27+
- `DATABASE_URL`
28+
- Added runtime table rendering in `assets/theme-v2/js/admin-system-health.js`.
29+
- Preserved Postgres-only database direction and R2-only storage direction.
30+
- Did not expose raw runtime values in the API response or page.
31+
- Did not introduce SQLite, new persistence, inline CSS, or inline JavaScript.
32+
33+
## Safe Backend Contract
34+
35+
- Extended existing safe status contract: `GET /api/admin/system-health/status`.
36+
- The server payload includes runtime key names, configured state, masked display text, status, and reason text.
37+
- The server payload does not include raw environment variable values.
38+
- The payload includes `secretEditingAllowed: false` and `secretsExposed: false`.
39+
- The browser refuses to render runtime rows if the runtime environment payload reports unsafe secret controls.
40+
41+
## Instruction Start Gate
42+
43+
- Instructions read: PASS
44+
- `docs_build/dev/PROJECT_INSTRUCTIONS.md`: read before queued edits
45+
- `docs_build/dev/PROJECT_MULTI_PC.txt`: read before queued edits
46+
- Current branch: `team/GAMMA/admin`
47+
- Clean status before PR016 edits: PASS
48+
- Local/origin sync before PR016 edits: PASS (`0 0`)
49+
- TEAM token: `GAMMA`
50+
- TEAM ownership: PASS by explicit Master Control/user assignment for diagnostics/admin workstream
51+
- Implementation path: `src/dev-runtime/server/local-api-router.mjs`, `admin/system-health.html`, `assets/theme-v2/js/admin-system-health.js`, `tests/playwright/tools/AdminHealthOperationsPage.spec.mjs`
52+
- Existing draft PR target: PR #36
53+
- Separate PR creation: SKIP by explicit user instruction
54+
- Merge: SKIP, owner-controlled EOD approval remains required
55+
56+
## Validation
57+
58+
- PASS: `git diff --check`
59+
- PASS: targeted diff check verified PR016 introduced no SQLite text.
60+
- PASS: targeted diff check verified PR016 introduced no raw env value field such as `value: env[...]`, `rawValue`, or `actualValue`.
61+
- PASS: targeted source check verified every static non-`PASS` status in `admin/system-health.html` has `title` or `aria-label` reason text.
62+
- PASS: targeted source check verified exactly one runtime table hook.
63+
- PASS: targeted source check verified the server mask marker list includes all required tokens.
64+
- PASS: Playwright verified runtime keys are displayed alphabetically.
65+
- PASS: Playwright verified secret-like test env values are masked in both rendered page text and client-visible Admin System Health API response bodies.
66+
- PASS: Playwright verified non-admin sessions do not call Admin System Health status or storage connectivity endpoints.
67+
- PASS: `npx playwright test tests/playwright/tools/AdminHealthOperationsPage.spec.mjs --config=codex_playwright_system_chrome.config.cjs --project=playwright` (3 passed)
68+
- PASS/WARN: Playwright V8 coverage report lists changed browser runtime JS `assets/theme-v2/js/admin-system-health.js`; `src/dev-runtime/server/local-api-router.mjs` is reported as advisory WARN because Playwright V8 coverage does not collect server-side runtime files.
69+
70+
## Playwright Coverage Notes
71+
72+
- `docs_build/dev/reports/playwright_v8_coverage_report.txt`
73+
- `docs_build/dev/reports/coverage_changed_js_guardrail.txt`
74+
- Changed browser runtime JS coverage: `(90%) assets/theme-v2/js/admin-system-health.js - executed lines 227/227; executed functions 28/31`
75+
- Advisory warning: `(0%) src/dev-runtime/server/local-api-router.mjs - changed runtime JS file was not collected by Playwright V8 coverage; advisory only`
76+
- Coverage is advisory only; no threshold is enforced.
77+
78+
## Skipped Lanes
79+
80+
- Full samples smoke: skipped by request because this Admin diagnostics runtime PR does not touch samples.
81+
- Full Playwright suite: skipped because the targeted Admin System Health route/behavior spec covers the changed page, browser runtime module, and server status payload behavior.
82+
- R2 diagnostics validation beyond the existing targeted Admin page spec: skipped because PR015 already covered R2 runtime wiring and PR016 touched only runtime environment visibility.
83+
- Postgres diagnostics validation beyond the existing targeted Admin page spec: skipped because PR014 already covered Postgres runtime wiring and PR016 touched only runtime environment visibility.
84+
85+
## Required Reports
86+
87+
- `docs_build/dev/reports/codex_review.diff`
88+
- `docs_build/dev/reports/codex_changed_files.txt`
89+
- `docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime.md`
90+
- `docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-manual-validation-notes.md`
91+
- `docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-instruction-compliance-checklist.md`
92+
- `docs_build/dev/reports/playwright_v8_coverage_report.txt`
93+
- `docs_build/dev/reports/coverage_changed_js_guardrail.txt`
94+
95+
## ZIP Artifact
96+
97+
- `tmp/PR_26171_GAMMA_016-admin-runtime-environment-runtime_delta.zip`
98+
- Generated from the current `team/GAMMA/admin` branch delta against the branch merge-base with `origin/main`, preserving the existing PR #36 workstream context.
99+
100+
## EOD Approval
101+
102+
No merge was performed. EOD merge remains owner-controlled and requires explicit approval.

‎docs_build/dev/reports/codex_changed_files.txt‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Base merge-base: e8845dae6e990164072d4ee9b37ec81eda563fc3
2-
Head at artifact refresh: 297108b152b96f52e52e26cf2164eeae8652d6b1
2+
Head at artifact refresh: d69a02c15e8791ab2d9463313a536b71e8553eb0
33

44
Working tree status at artifact generation:
55
M admin/system-health.html
66
M assets/theme-v2/js/admin-system-health.js
7-
A docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime-instruction-compliance-checklist.md
8-
A docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime-manual-validation-notes.md
9-
A docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime.md
7+
A docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-instruction-compliance-checklist.md
8+
A docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-manual-validation-notes.md
9+
A docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime.md
1010
M docs_build/dev/reports/coverage_changed_js_guardrail.txt
1111
M docs_build/dev/reports/playwright_v8_coverage_report.txt
12+
M src/dev-runtime/server/local-api-router.mjs
1213
M tests/playwright/tools/AdminHealthOperationsPage.spec.mjs
1314

1415
Changed files against merge-base:
@@ -29,19 +30,23 @@ A docs_build/dev/reports/PR_26171_GAMMA_014-admin-postgres-diagnostics-runtime.m
2930
A docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime-instruction-compliance-checklist.md
3031
A docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime-manual-validation-notes.md
3132
A docs_build/dev/reports/PR_26171_GAMMA_015-admin-r2-diagnostics-runtime.md
33+
A docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-instruction-compliance-checklist.md
34+
A docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime-manual-validation-notes.md
35+
A docs_build/dev/reports/PR_26171_GAMMA_016-admin-runtime-environment-runtime.md
3236
M docs_build/dev/reports/coverage_changed_js_guardrail.txt
3337
M docs_build/dev/reports/playwright_v8_coverage_report.txt
38+
M src/dev-runtime/server/local-api-router.mjs
3439
M tests/playwright/tools/AdminHealthOperationsPage.spec.mjs
3540

3641
Stat against merge-base:
37-
admin/system-health.html | 366 +++++-----------
38-
assets/theme-v2/js/admin-system-health.js | 466 ++++++---------------
42+
admin/system-health.html | 366 ++++-----------
43+
assets/theme-v2/js/admin-system-health.js | 505 ++++++++-------------
3944
...-foundation-instruction-compliance-checklist.md | 32 ++
4045
...em-health-foundation-manual-validation-notes.md | 34 ++
4146
...171_GAMMA_011-admin-system-health-foundation.md | 65 +++
4247
...son-cleanup-instruction-compliance-checklist.md | 57 +++
4348
...tatus-reason-cleanup-manual-validation-notes.md | 26 ++
44-
...12-admin-system-health-status-reason-cleanup.md | 70 ++++
49+
...12-admin-system-health-status-reason-cleanup.md | 70 +++
4550
...ostics-plan-instruction-compliance-checklist.md | 64 +++
4651
...lth-diagnostics-plan-manual-validation-notes.md | 27 ++
4752
...MMA_013-admin-system-health-diagnostics-plan.md | 82 ++++
@@ -50,8 +55,12 @@ Stat against merge-base:
5055
...GAMMA_014-admin-postgres-diagnostics-runtime.md | 93 ++++
5156
...ics-runtime-instruction-compliance-checklist.md | 62 +++
5257
...-diagnostics-runtime-manual-validation-notes.md | 26 ++
53-
...26171_GAMMA_015-admin-r2-diagnostics-runtime.md | 95 +++++
54-
.../dev/reports/coverage_changed_js_guardrail.txt | 6 +-
55-
.../dev/reports/playwright_v8_coverage_report.txt | 34 +-
56-
.../tools/AdminHealthOperationsPage.spec.mjs | 120 +++++-
57-
20 files changed, 1178 insertions(+), 638 deletions(-)
58+
...26171_GAMMA_015-admin-r2-diagnostics-runtime.md | 95 ++++
59+
...ent-runtime-instruction-compliance-checklist.md | 66 +++
60+
...-environment-runtime-manual-validation-notes.md | 28 ++
61+
..._GAMMA_016-admin-runtime-environment-runtime.md | 102 +++++
62+
.../dev/reports/coverage_changed_js_guardrail.txt | 7 +-
63+
.../dev/reports/playwright_v8_coverage_report.txt | 36 +-
64+
src/dev-runtime/server/local-api-router.mjs | 46 ++
65+
.../tools/AdminHealthOperationsPage.spec.mjs | 151 +++++-
66+
24 files changed, 1502 insertions(+), 629 deletions(-)

0 commit comments

Comments
 (0)