Plan D — Deferred Backlog Implementation Plan

ssh obert@192.168.83.20 "cp ~/projects/ai-ahu-document-rag/compose.yaml ~/projects/ai-ahu-document-rag/compose.yaml.bak-plan-d"
scp obert@192.168.83.20:~/projects/ai-ahu-document-rag/compose.yaml /tmp/rag-compose.yaml

      - ahu-net

  ahu-net:
    external: true

scp /tmp/rag-compose.yaml obert@192.168.83.20:~/projects/ai-ahu-document-rag/compose.yaml
ssh obert@192.168.83.20 "cd ~/projects/ai-ahu-document-rag && docker compose config --quiet && echo CONFIG-OK"

ssh obert@192.168.83.20 "cd ~/projects/ai-ahu-document-rag && docker compose up -d --force-recreate ai-ahu-rag"
ssh obert@192.168.83.20 "docker inspect ai-ahu-rag --format '{{range \$k, \$v := .NetworkSettings.Networks}}{{\$k}} {{end}}'"

ssh obert@192.168.83.20 "docker exec ahu-ai-chatbot-public node -e \"fetch('http://ai-ahu-rag:8110/health').then(r=>r.text()).then(t=>{console.log('RAG-OK',t)}).catch(e=>{console.error('RAG-FAIL',e.message);process.exit(1)})\""

curl -sS -N -X POST https://x056.ahu-demo.chatbot-neo.val.id/api/chat/public \
  -H 'Content-Type: application/json' \
  -d '{"message":"Apa syarat pendirian PT?","sessionId":"plan-d3-smoke"}' | head -40

"""build_embedder(): env-gated local TEI vs legacy dev fallback."""


def test_fallback_without_env(monkeypatch):
    for var in ("EMBEDDER_BASE_URL", "EMBEDDER_MODEL", "EMBEDDER_DIM", "EMBEDDER_API_KEY"):
        monkeypatch.delenv(var, raising=False)
    from dash.embedder import build_embedder

    e = build_embedder()
    assert e.id == "text-embedding-3-small"


def test_local_tei_when_env_set(monkeypatch):
    monkeypatch.setenv("EMBEDDER_BASE_URL", "http://192.168.83.20:8100/v1")
    monkeypatch.setenv("EMBEDDER_MODEL", "Qwen/Qwen3-Embedding-4B")
    monkeypatch.setenv("EMBEDDER_DIM", "2560")
    monkeypatch.setenv("EMBEDDER_API_KEY", "EMPTY")
    from dash.embedder import build_embedder

    e = build_embedder()
    assert e.id == "Qwen/Qwen3-Embedding-4B"
    assert e.base_url == "http://192.168.83.20:8100/v1"
    assert e.dimensions == 2560
    assert e.api_key == "EMPTY"


def test_defaults_when_only_base_url_set(monkeypatch):
    for var in ("EMBEDDER_MODEL", "EMBEDDER_DIM", "EMBEDDER_API_KEY"):
        monkeypatch.delenv(var, raising=False)
    monkeypatch.setenv("EMBEDDER_BASE_URL", "http://192.168.83.20:8100/v1")
    from dash.embedder import build_embedder

    e = build_embedder()
    assert e.id == "Qwen/Qwen3-Embedding-4B"
    assert e.dimensions == 2560

cd apps/public-agent && ../../.venv/bin/python -m pytest tests/test_embedder.py -v

"""Embedder factory.

EMBEDDER_BASE_URL set  -> local TEI (OpenAI-compatible /v1/embeddings) — the
                          on-prem production path (tei-qwen3-embed).
EMBEDDER_BASE_URL unset -> legacy OpenAI dev fallback (unchanged behavior).
"""

from os import getenv

from agno.knowledge.embedder.openai import OpenAIEmbedder


def build_embedder() -> OpenAIEmbedder:
    base_url = getenv("EMBEDDER_BASE_URL")
    if not base_url:
        return OpenAIEmbedder(id="text-embedding-3-small")
    return OpenAIEmbedder(
        id=getenv("EMBEDDER_MODEL", "Qwen/Qwen3-Embedding-4B"),
        base_url=base_url,
        api_key=getenv("EMBEDDER_API_KEY", "EMPTY"),
        dimensions=int(getenv("EMBEDDER_DIM", "2560")),
    )

cd apps/public-agent && ../../.venv/bin/python -m pytest tests/test_embedder.py -v

from dash.embedder import build_embedder

        embedder=OpenAIEmbedder(id="text-embedding-3-small"),

        embedder=build_embedder(),

cd apps/public-agent && ../../.venv/bin/python -c "import dash.embedder; print('import-ok')"
cd apps/public-agent && ../../.venv/bin/python -m pytest tests/test_embedder.py -v

git add apps/public-agent/dash/embedder.py apps/public-agent/tests/test_embedder.py apps/public-agent/dash/agents.py
git commit -m "feat(d4): env-gated local TEI embedder for public agent"

cp apps/public-agent/dash/embedder.py apps/internal-agent/dash/embedder.py
cp apps/public-agent/tests/test_embedder.py apps/internal-agent/tests/test_embedder.py

cd apps/internal-agent && ../../.venv/bin/python -m pytest tests/test_embedder.py -v

git add apps/internal-agent/dash/embedder.py apps/internal-agent/tests/test_embedder.py apps/internal-agent/dash/agents.py
git commit -m "feat(d4): env-gated local TEI embedder for internal agent"

cat >> infra/env/shared.env.example <<'EOF'

# Local embeddings (D4) — tei-qwen3-embed on Server 2, OpenAI-compatible.
# LAN IP on purpose: TEI is on ai-ahu-rag-net, agents on ahu-net — no
# container-name route exists; the host-published port is durable.
EMBEDDER_BASE_URL=http://192.168.83.20:8100/v1
EMBEDDER_MODEL=Qwen/Qwen3-Embedding-4B
EMBEDDER_DIM=2560
EMBEDDER_API_KEY=EMPTY
EOF

grep -q EMBEDDER_BASE_URL infra/env/shared.env || cat >> infra/env/shared.env <<'EOF'

EMBEDDER_BASE_URL=http://192.168.83.20:8100/v1
EMBEDDER_MODEL=Qwen/Qwen3-Embedding-4B
EMBEDDER_DIM=2560
EMBEDDER_API_KEY=EMPTY
EOF
grep EMBEDDER infra/env/shared.env

git add infra/env/shared.env.example
git commit -m "feat(d4): EMBEDDER_* env for local TEI embeddings"

curl -sS http://192.168.83.20:8100/v1/embeddings -H 'Content-Type: application/json' \
  -d '{"model":"Qwen/Qwen3-Embedding-4B","input":"pendirian PT"}' | head -c 300; echo

./infra/deploy/build-and-ship.sh
./infra/deploy/deploy-staging.sh

ssh obert@192.168.83.20 "docker exec ahu-ai-agent-internal printenv EMBEDDER_BASE_URL EMBEDDER_DIM && docker exec ahu-ai-agent-public printenv EMBEDDER_BASE_URL EMBEDDER_DIM"

ssh obert@192.168.83.20 "docker exec ahu-ai-agent-internal python -m dash.scripts.load_knowledge --recreate"
ssh obert@192.168.83.20 "docker exec ahu-ai-agent-internal python -c \"from dash.agents import dash_learnings; dash_learnings.vector_db.drop(); dash_learnings.vector_db.create(); print('learnings-recreated')\""

ssh obert@192.168.83.20 "docker exec ahu-ai-agent-internal python -c \"
from dash.agents import dash_knowledge
res = dash_knowledge.search('syarat pendirian PT')
print('results:', len(res))
print('first:', str(res[0])[:200] if res else 'NONE')
\""

ssh obert@192.168.83.20 "docker logs --since 10m ahu-ai-agent-internal 2>&1 | grep -i 'openai_api_key\|api.openai.com' || echo CLEAN"
ssh obert@192.168.83.20 "docker logs --since 10m ahu-ai-agent-public 2>&1 | grep -i 'openai_api_key\|api.openai.com' || echo CLEAN"

    environment:
      SURFACE: public
      KNOWLEDGE_DIR: /knowledge

    environment:
      SURFACE: public
      KNOWLEDGE_DIR: /knowledge
      # Registers ONLY the guarded public_dash agent (app/main.py variant gate).
      DASH_VARIANT: public

DATA_PUBLIC_AGENT_ID=data-agent

DATA_PUBLIC_AGENT_ID=public_dash

sed -i 's/^DATA_PUBLIC_AGENT_ID=.*/DATA_PUBLIC_AGENT_ID=public_dash/' infra/env/public.env
grep DATA_PUBLIC_AGENT_ID infra/env/public.env

git add infra/compose.public.yaml infra/env/public.env.example
git commit -m "fix(d2): route public traffic to guarded public_dash agent (DASH_VARIANT=public)"

ssh obert@192.168.83.20 "docker exec ahu-ai-agent-public python -m pytest tests/ -v --ignore=tests/__pycache__ 2>&1 | tail -20"

./infra/deploy/deploy-staging.sh

ssh obert@192.168.83.20 "docker exec ahu-ai-chatbot-public node -e \"fetch('http://public-agent:8000/agents').then(r=>r.json()).then(a=>console.log(JSON.stringify(a.map?a.map(x=>x.id||x.agent_id||x.name):a)))\""

ssh obert@192.168.83.20 "docker exec ahu-ai-chatbot-public node -e \"fetch('http://public-agent:8000/agents/data-agent/runs',{method:'POST'}).then(r=>console.log('data-agent status',r.status))\""

ssh obert@192.168.83.20 "docker logs --since 5m ahu-ai-agent-public 2>&1 | grep -i 'tidak diizinkan\|ValidationError' | head"

ssh obert@192.168.83.20 "docker exec ahu-ai-agent-internal printenv DASH_VARIANT || echo UNSET-OK"

git commit --allow-empty -m "ops(d2): public stack live on guarded public_dash (verified refusal + aggregate pass)"

pnpm --dir apps/internal-web add bcryptjs

import { describe, it, expect, beforeEach, afterEach } from "vitest";
import { mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { StaffStore } from "@/lib/auth/staff-store";

let dir: string;
let store: StaffStore;

beforeEach(() => {
  dir = mkdtempSync(join(tmpdir(), "staff-store-"));
  store = new StaffStore(join(dir, "staff.sqlite"));
});

afterEach(() => {
  rmSync(dir, { recursive: true, force: true });
});

describe("StaffStore", () => {
  it("creates a user and verifies the password via bcrypt", () => {
    const u = store.create({ email: "a@ahu.local", name: "A", role: "admin", password: "rahasia-123" });
    expect(u.token_version).toBe(1);
    expect((u as Record<string, unknown>).pass_hash).toBeUndefined();
    expect(store.verifyPassword("a@ahu.local", "rahasia-123")?.email).toBe("a@ahu.local");
    expect(store.verifyPassword("a@ahu.local", "salah")).toBeNull();
    expect(store.verifyPassword("ghost@ahu.local", "rahasia-123")).toBeNull();
  });

  it("rejects invalid roles at the DB layer (CHECK constraint)", () => {
    expect(() =>
      store.create({ email: "x@ahu.local", name: "X", role: "staf" as never, password: "rahasia-123" }),
    ).toThrow();
  });

  it("disable bumps token_version and blocks login; re-enable does not bump", () => {
    const u = store.create({ email: "b@ahu.local", name: "B", role: "staff", password: "rahasia-123" });
    const disabled = store.setActive(u.id, false);
    expect(disabled.active).toBe(0);
    expect(disabled.token_version).toBe(2);
    expect(store.verifyPassword("b@ahu.local", "rahasia-123")).toBeNull();
    const enabled = store.setActive(u.id, true);
    expect(enabled.token_version).toBe(2);
    expect(store.verifyPassword("b@ahu.local", "rahasia-123")).not.toBeNull();
  });

  it("password reset bumps token_version and swaps the credential", () => {
    const u = store.create({ email: "c@ahu.local", name: "C", role: "it_staff", password: "rahasia-123" });
    const after = store.resetPassword(u.id, "baru-12345");
    expect(after.token_version).toBe(2);
    expect(store.verifyPassword("c@ahu.local", "baru-12345")).not.toBeNull();
    expect(store.verifyPassword("c@ahu.local", "rahasia-123")).toBeNull();
  });

  it("update patches name/role only", () => {
    const u = store.create({ email: "d@ahu.local", name: "D", role: "staff", password: "rahasia-123" });
    const after = store.update(u.id, { name: "Dewi", role: "it_staff" });
    expect(after.name).toBe("Dewi");
    expect(after.role).toBe("it_staff");
    expect(after.token_version).toBe(1);
  });

  it("seeds one admin only when the table is empty", () => {
    store.seedAdminIfEmpty("root@ahu.local", "seed-pass-1");
    expect(store.count()).toBe(1);
    store.seedAdminIfEmpty("root2@ahu.local", "seed-pass-2");
    expect(store.count()).toBe(1);
    expect(store.getByEmail("root@ahu.local")?.role).toBe("admin");
  });

  it("counts other active admins (last-admin lockout guard)", () => {
    const a = store.create({ email: "a1@ahu.local", name: "A1", role: "admin", password: "rahasia-123" });
    expect(store.countOtherActiveAdmins(a.id)).toBe(0);
    store.create({ email: "a2@ahu.local", name: "A2", role: "admin", password: "rahasia-123" });
    expect(store.countOtherActiveAdmins(a.id)).toBe(1);
  });
});

cd apps/internal-web && pnpm vitest run tests/auth/staff-store.test.ts

import Database from "better-sqlite3";
import bcrypt from "bcryptjs";
import { mkdirSync } from "node:fs";
import { dirname } from "node:path";

export type StaffRole = "admin" | "it_staff" | "staff";

export const STAFF_ROLES: ReadonlySet<string> = new Set(["admin", "it_staff", "staff"]);

export interface StaffUser {
  id: number;
  email: string;
  name: string;
  role: StaffRole;
  token_version: number;
  active: number; // sqlite boolean: 1 | 0
  created_at: string;
  updated_at: string;
}

type StaffRow = StaffUser & { pass_hash: string };

const BCRYPT_ROUNDS = 10;

export class StaffStore {
  private db: Database.Database;

  constructor(dbPath: string) {
    mkdirSync(dirname(dbPath), { recursive: true });
    this.db = new Database(dbPath);
    this.db.exec(`
      CREATE TABLE IF NOT EXISTS staff_users (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        email TEXT NOT NULL UNIQUE,
        name TEXT NOT NULL,
        role TEXT NOT NULL CHECK (role IN ('admin','it_staff','staff')),
        pass_hash TEXT NOT NULL,
        token_version INTEGER NOT NULL DEFAULT 1,
        active INTEGER NOT NULL DEFAULT 1,
        created_at TEXT NOT NULL,
        updated_at TEXT NOT NULL
      );
    `);
  }

  count(): number {
    return (this.db.prepare("SELECT COUNT(*) AS n FROM staff_users").get() as { n: number }).n;
  }

  seedAdminIfEmpty(email?: string, password?: string): void {
    if (this.count() > 0 || !email || !password) return;
    this.create({ email, name: "Administrator", role: "admin", password });
  }

  create(args: { email: string; name: string; role: StaffRole; password: string }): StaffUser {
    const now = new Date().toISOString();
    const hash = bcrypt.hashSync(args.password, BCRYPT_ROUNDS);
    const info = this.db
      .prepare(
        "INSERT INTO staff_users (email,name,role,pass_hash,token_version,active,created_at,updated_at) VALUES (?,?,?,?,1,1,?,?)",
      )
      .run(args.email, args.name, args.role, hash, now, now);
    const created = this.getById(Number(info.lastInsertRowid));
    if (!created) throw new Error("staff_users insert did not persist");
    return created;
  }

  getById(id: number): StaffUser | null {
    const row = this.db.prepare("SELECT * FROM staff_users WHERE id = ?").get(id) as
      | StaffRow
      | undefined;
    return row ? strip(row) : null;
  }

  getByEmail(email: string): StaffUser | null {
    const row = this.db.prepare("SELECT * FROM staff_users WHERE email = ?").get(email) as
      | StaffRow
      | undefined;
    return row ? strip(row) : null;
  }

  list(): StaffUser[] {
    return (this.db.prepare("SELECT * FROM staff_users ORDER BY id").all() as StaffRow[]).map(strip);
  }

  /** null when: unknown email, wrong password, or user disabled. */
  verifyPassword(email: string, password: string): StaffUser | null {
    const row = this.db.prepare("SELECT * FROM staff_users WHERE email = ?").get(email) as
      | StaffRow
      | undefined;
    if (!row || !row.active) return null;
    return bcrypt.compareSync(password, row.pass_hash) ? strip(row) : null;
  }

  update(id: number, patch: { name?: string; role?: StaffRole }): StaffUser {
    const cur = this.getById(id);
    if (!cur) throw new Error(`staff user ${id} not found`);
    this.db
      .prepare("UPDATE staff_users SET name = ?, role = ?, updated_at = ? WHERE id = ?")
      .run(patch.name ?? cur.name, patch.role ?? cur.role, new Date().toISOString(), id);
    const after = this.getById(id);
    if (!after) throw new Error(`staff user ${id} vanished during update`);
    return after;
  }

  /** Disabling bumps token_version so existing sessions lose mutation rights immediately. */
  setActive(id: number, active: boolean): StaffUser {
    this.db
      .prepare(
        "UPDATE staff_users SET active = ?, token_version = token_version + ?, updated_at = ? WHERE id = ?",
      )
      .run(active ? 1 : 0, active ? 0 : 1, new Date().toISOString(), id);
    const after = this.getById(id);
    if (!after) throw new Error(`staff user ${id} not found`);
    return after;
  }

  resetPassword(id: number, password: string): StaffUser {
    const hash = bcrypt.hashSync(password, BCRYPT_ROUNDS);
    this.db
      .prepare(
        "UPDATE staff_users SET pass_hash = ?, token_version = token_version + 1, updated_at = ? WHERE id = ?",
      )
      .run(hash, new Date().toISOString(), id);
    const after = this.getById(id);
    if (!after) throw new Error(`staff user ${id} not found`);
    return after;
  }

  countOtherActiveAdmins(excludeId: number): number {
    return (
      this.db
        .prepare(
          "SELECT COUNT(*) AS n FROM staff_users WHERE role = 'admin' AND active = 1 AND id != ?",
        )
        .get(excludeId) as { n: number }
    ).n;
  }
}

function strip(row: StaffRow): StaffUser {
  const { pass_hash: _ignored, ...user } = row;
  return user;
}

let store: StaffStore | null = null;

/** Server-only singleton (better-sqlite3 — never import from middleware/Edge). */
export function getStaffStore(): StaffStore {
  if (!store) {
    store = new StaffStore(process.env.STAFF_DB ?? "/data/staff.sqlite");
    store.seedAdminIfEmpty(process.env.STAFF_ADMIN_EMAIL, process.env.STAFF_ADMIN_PASSWORD);
  }
  return store;
}

cd apps/internal-web && pnpm vitest run tests/auth/staff-store.test.ts

git add apps/internal-web/package.json pnpm-lock.yaml apps/internal-web/src/lib/auth/staff-store.ts apps/internal-web/tests/auth/staff-store.test.ts
git commit -m "feat(d1): staff_users SQLite store with bcrypt + token_version"

import { describe, it, expect } from "vitest";
import { signStaffToken } from "@/lib/auth/jwt";
import { verifySessionToken } from "@/lib/auth/session";

describe("staff session tokens", () => {
  it("round-trips sub/role/name/tv", async () => {
    const token = await signStaffToken({ sub: "a@ahu.local", role: "admin", name: "A", tv: 3 });
    const s = await verifySessionToken(token);
    expect(s).toEqual({ email: "a@ahu.local", role: "admin", name: "A", tv: 3 });
  });

  it("rejects tampered tokens", async () => {
    const token = await signStaffToken({ sub: "a@ahu.local", role: "admin", name: "A", tv: 1 });
    const tampered = token.slice(0, -2) + "xx";
    expect(await verifySessionToken(tampered)).toBeNull();
  });

  it("rejects garbage", async () => {
    expect(await verifySessionToken("not-a-jwt")).toBeNull();
  });
});

cd apps/internal-web && pnpm vitest run tests/auth/session.test.ts

export interface StaffJWTPayload {
  sub: string;
  role: UserRole;
  name: string;
  /** token_version at issue time — mutations re-check it against the DB row. */
  tv: number;
}

export async function signStaffToken(payload: StaffJWTPayload): Promise<string> {
  return await new SignJWT({ role: payload.role, name: payload.name, tv: payload.tv })
    .setProtectedHeader({ alg: "HS256" })
    .setSubject(payload.sub)
    .setIssuedAt()
    .setExpirationTime("8h")
    .sign(getSecret());
}

import { jwtVerify } from "jose";
import { getSecret } from "./jwt";
import type { UserRole } from "@/types/auth";

export const SESSION_COOKIE = "ahu_staff_session";

export interface SessionUser {
  email: string;
  role: UserRole;
  name: string;
  tv: number;
}

/** Verify signature + expiry only (Edge-safe — no store lookup).
 *  Mutations additionally re-check token_version via requireMutationSession. */
export async function verifySessionToken(token: string): Promise<SessionUser | null> {
  try {
    const { payload } = await jwtVerify(token, getSecret(), { algorithms: ["HS256"] });
    if (!payload.sub || typeof payload.role !== "string") return null;
    return {
      email: payload.sub,
      role: payload.role as UserRole,
      name: typeof payload.name === "string" ? payload.name : "",
      tv: typeof payload.tv === "number" ? payload.tv : 0,
    };
  } catch {
    return null;
  }
}

cd apps/internal-web && pnpm vitest run tests/auth/session.test.ts && pnpm typecheck

git add apps/internal-web/src/lib/auth/jwt.ts apps/internal-web/src/lib/auth/session.ts apps/internal-web/src/app/login/page.tsx apps/internal-web/tests/auth/session.test.ts
git commit -m "feat(d1): session token layer with tv claim + Edge-safe verify"

import { NextResponse } from "next/server";
import { getStaffStore } from "@/lib/auth/staff-store";
import { signStaffToken } from "@/lib/auth/jwt";
import { SESSION_COOKIE } from "@/lib/auth/session";
import { auditLog } from "@/lib/audit/log";

export const runtime = "nodejs";

// Floor on response time blunts user-enumeration timing (bcrypt compare only
// runs for known emails). No lockout machinery at POC stage (spec D1).
const LOGIN_MIN_MS = 250;

export async function POST(req: Request) {
  const started = Date.now();
  let body: { email?: string; password?: string } = {};
  try {
    body = await req.json();
  } catch {
    // fall through to invalid-credentials path
  }
  const email = String(body.email ?? "").trim().toLowerCase();
  const password = String(body.password ?? "");

  const user = email && password ? getStaffStore().verifyPassword(email, password) : null;

  const remaining = LOGIN_MIN_MS - (Date.now() - started);
  if (remaining > 0) await new Promise((r) => setTimeout(r, remaining));

  if (!user) {
    auditLog({
      who: email || "unknown",
      scope: "shared",
      action: "auth.login_failed",
      target: "auth",
    });
    return NextResponse.json(
      { error: "Email atau kata sandi tidak valid" },
      { status: 401 },
    );
  }

  const token = await signStaffToken({
    sub: user.email,
    role: user.role,
    name: user.name,
    tv: user.token_version,
  });
  auditLog({ who: user.email, scope: "shared", action: "auth.login", target: "auth" });

  const res = NextResponse.json({
    user: { email: user.email, role: user.role, name: user.name },
  });
  res.cookies.set(SESSION_COOKIE, token, {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
    maxAge: 8 * 60 * 60,
  });
  return res;
}

import { NextResponse } from "next/server";
import { cookies } from "next/headers";
import { SESSION_COOKIE, verifySessionToken } from "@/lib/auth/session";

export async function GET() {
  const jar = await cookies();
  const token = jar.get(SESSION_COOKIE)?.value;
  const session = token ? await verifySessionToken(token) : null;
  if (!session) return NextResponse.json({ user: null }, { status: 401 });
  return NextResponse.json({
    user: { email: session.email, role: session.role, name: session.name },
  });
}

import { NextResponse } from "next/server";
import { SESSION_COOKIE } from "@/lib/auth/session";

export async function POST() {
  const res = NextResponse.json({ ok: true });
  res.cookies.set(SESSION_COOKIE, "", {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
    maxAge: 0,
  });
  return res;
}

cd apps/internal-web && STAFF_DB=/tmp/staff-dev.sqlite STAFF_ADMIN_EMAIL=admin@ahu.local STAFF_ADMIN_PASSWORD=dev-admin-123 AUDIT_DB=/tmp/audit-dev.sqlite pnpm dev &
sleep 8
curl -s -X POST http://localhost:3500/api/auth/login -H 'Content-Type: application/json' -d '{"email":"admin@ahu.local","password":"salah"}' -o /dev/null -w '%{http_code}\n'
curl -s -X POST http://localhost:3500/api/auth/login -H 'Content-Type: application/json' -d '{"email":"admin@ahu.local","password":"dev-admin-123"}' -c /tmp/dev-cookie.txt -w '\n%{http_code}\n'
curl -s -b /tmp/dev-cookie.txt http://localhost:3500/api/auth/me
kill %1

cd apps/internal-web && pnpm typecheck
git add apps/internal-web/src/app/api/auth
git commit -m "feat(d1): login/me/logout session routes (httpOnly cookie)"

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
import { SESSION_COOKIE, verifySessionToken } from "@/lib/auth/session";
import { normalizeRole } from "@/types/auth";

// Legacy admin URL → new scoped URL. Bookmarked links keep working.
const LEGACY_MAP: Record<string, string> = {
  "/admin/knowledge": "/admin/internal/knowledge",
  "/admin/public-policy": "/admin/public/policy",
  "/admin/dashboard": "/admin/observe/dashboard",
  "/admin/learnings": "/admin/observe/learnings",
};

export async function middleware(req: NextRequest) {
  const p = req.nextUrl.pathname;
  for (const [oldPrefix, newPrefix] of Object.entries(LEGACY_MAP)) {
    if (p === oldPrefix || p.startsWith(oldPrefix + "/")) {
      const target = p.replace(oldPrefix, newPrefix);
      return NextResponse.redirect(new URL(target, req.url));
    }
  }

  // Signature + expiry only (Edge-safe, no store lookup). Mutations
  // additionally re-check token_version server-side (requireMutationSession).
  const isApi = p.startsWith("/api/");
  const token = req.cookies.get(SESSION_COOKIE)?.value;
  const session = token ? await verifySessionToken(token) : null;

  if (!session) {
    if (isApi) {
      return NextResponse.json({ error: "Tidak terautentikasi" }, { status: 401 });
    }
    const login = new URL("/login", req.url);
    login.searchParams.set("next", p);
    return NextResponse.redirect(login);
  }

  // Konsol Admin is admin-only; it_staff/staff work in /app/* (types/auth.ts).
  if (normalizeRole(session.role) !== "admin") {
    if (isApi) {
      return NextResponse.json({ error: "Akses ditolak" }, { status: 403 });
    }
    return NextResponse.redirect(new URL("/app/data", req.url));
  }

  return NextResponse.next();
}

export const config = { matcher: ["/admin/:path*", "/api/admin/:path*"] };

cd apps/internal-web && STAFF_DB=/tmp/staff-dev.sqlite STAFF_ADMIN_EMAIL=admin@ahu.local STAFF_ADMIN_PASSWORD=dev-admin-123 AUDIT_DB=/tmp/audit-dev.sqlite pnpm dev &
sleep 8
curl -s http://localhost:3500/api/admin/jobs -o /dev/null -w 'no-cookie api: %{http_code}\n'
curl -s http://localhost:3500/admin/observe/dashboard -o /dev/null -w 'no-cookie page: %{http_code}\n'
curl -s -X POST http://localhost:3500/api/auth/login -H 'Content-Type: application/json' -d '{"email":"admin@ahu.local","password":"dev-admin-123"}' -c /tmp/dev-cookie.txt -o /dev/null
curl -s -b /tmp/dev-cookie.txt http://localhost:3500/api/admin/jobs -o /dev/null -w 'with-cookie api: %{http_code}\n'
curl -s http://localhost:3500/admin/knowledge -o /dev/null -w 'legacy redirect: %{http_code}\n'
kill %1

cd apps/internal-web && pnpm typecheck
git add apps/internal-web/src/middleware.ts
git commit -m "feat(d1): middleware auth on /admin/* and /api/admin/*"

import { cookies } from "next/headers";
import { NextResponse } from "next/server";
import { SESSION_COOKIE, verifySessionToken, type SessionUser } from "./session";
import { getStaffStore } from "./staff-store";

export type MutationAuth =
  | { ok: true; user: SessionUser }
  | { ok: false; response: NextResponse };

/**
 * Mutations re-check the DB row so disable/password-reset revokes access
 * immediately (token_version), not at cookie expiry. Read-only requests stay
 * middleware-JWT-only by design (8h max staleness — accepted trade-off).
 */
export async function requireMutationSession(): Promise<MutationAuth> {
  const jar = await cookies();
  const token = jar.get(SESSION_COOKIE)?.value;
  const session = token ? await verifySessionToken(token) : null;
  if (!session) {
    return {
      ok: false,
      response: NextResponse.json({ error: "Tidak terautentikasi" }, { status: 401 }),
    };
  }
  const row = getStaffStore().getByEmail(session.email);
  if (!row || !row.active || row.token_version !== session.tv) {
    return {
      ok: false,
      response: NextResponse.json({ error: "Sesi tidak berlaku lagi" }, { status: 401 }),
    };
  }
  return { ok: true, user: session };
}

src/app/api/admin/anon-limit/route.ts
src/app/api/admin/data-dash-provider/reload-schema/route.ts
src/app/api/admin/data-dash-provider/restart/route.ts
src/app/api/admin/data-dash-provider/route.ts
src/app/api/admin/data-dash-provider/synthesis/route.ts
src/app/api/admin/jobs/route.ts
src/app/api/admin/knowledge/business/route.ts
src/app/api/admin/knowledge/content/route.ts
src/app/api/admin/knowledge/[id]/route.ts
src/app/api/admin/knowledge/seed-templates/route.ts
src/app/api/admin/knowledge/tables/route.ts
src/app/api/admin/learnings/route.ts
src/app/api/admin/orchestrator/route.ts
src/app/api/admin/policy/[id]/route.ts
src/app/api/admin/policy/route.ts
src/app/api/admin/public-policy/route.ts

import { requireMutationSession } from "@/lib/auth/guard";

  const auth = await requireMutationSession();
  if (!auth.ok) return auth.response;

grep -rn "x-staff-email" apps/internal-web/src/app/api/admin/

export async function POST(req: Request) {
  const auth = await requireMutationSession();
  if (!auth.ok) return auth.response;
  const body = await req.json();
  // ... existing enqueue logic unchanged ...
  auditLog({
    who: auth.user.email,
    // ... rest of the existing auditLog args unchanged ...
  });
  // ...
}

cd apps/internal-web && pnpm typecheck && pnpm test

cd apps/internal-web && STAFF_DB=/tmp/staff-dev.sqlite STAFF_ADMIN_EMAIL=admin@ahu.local STAFF_ADMIN_PASSWORD=dev-admin-123 AUDIT_DB=/tmp/audit-dev.sqlite pnpm dev &
sleep 8
curl -s -X POST http://localhost:3500/api/auth/login -H 'Content-Type: application/json' -d '{"email":"admin@ahu.local","password":"dev-admin-123"}' -c /tmp/dev-cookie.txt -o /dev/null
sqlite3 /tmp/staff-dev.sqlite "UPDATE staff_users SET token_version = token_version + 1"
curl -s -b /tmp/dev-cookie.txt -X POST http://localhost:3500/api/admin/jobs -H 'Content-Type: application/json' -d '{"name":"noop","data":{}}' -o /dev/null -w 'stale-tv mutation: %{http_code}\n'
kill %1

git add apps/internal-web/src/lib/auth/guard.ts apps/internal-web/src/app/api/admin
git commit -m "feat(d1): token_version mutation guard on all /api/admin writes"

import { NextResponse } from "next/server";
import { getStaffStore, STAFF_ROLES, type StaffRole } from "@/lib/auth/staff-store";
import { requireMutationSession } from "@/lib/auth/guard";
import { auditLog } from "@/lib/audit/log";

export const runtime = "nodejs";

export async function GET() {
  return NextResponse.json({ users: getStaffStore().list() });
}

export async function POST(req: Request) {
  const auth = await requireMutationSession();
  if (!auth.ok) return auth.response;

  const body = (await req.json().catch(() => ({}))) as {
    email?: string;
    name?: string;
    role?: string;
    password?: string;
  };
  const email = String(body.email ?? "").trim().toLowerCase();
  const name = String(body.name ?? "").trim();
  const role = String(body.role ?? "");
  const password = String(body.password ?? "");

  if (!email || !name || !STAFF_ROLES.has(role)) {
    return NextResponse.json(
      { error: "email, name, dan role (admin|it_staff|staff) wajib diisi" },
      { status: 400 },
    );
  }
  if (password.length < 8) {
    return NextResponse.json({ error: "Kata sandi minimal 8 karakter" }, { status: 400 });
  }

  try {
    const user = getStaffStore().create({ email, name, role: role as StaffRole, password });
    auditLog({
      who: auth.user.email,
      scope: "shared",
      action: "user.create",
      target: user.email,
      after: { name: user.name, role: user.role },
    });
    return NextResponse.json({ user }, { status: 201 });
  } catch (e) {
    if (/UNIQUE/.test(String(e))) {
      return NextResponse.json({ error: "Email sudah terdaftar" }, { status: 409 });
    }
    throw e;
  }
}

import { NextResponse } from "next/server";
import { getStaffStore, STAFF_ROLES, type StaffRole } from "@/lib/auth/staff-store";
import { requireMutationSession } from "@/lib/auth/guard";
import { auditLog } from "@/lib/audit/log";

export const runtime = "nodejs";

export async function PATCH(
  req: Request,
  ctx: { params: Promise<{ id: string }> },
) {
  const auth = await requireMutationSession();
  if (!auth.ok) return auth.response;

  const { id: idStr } = await ctx.params;
  const id = Number(idStr);
  const store = getStaffStore();
  const before = store.getById(id);
  if (!before) {
    return NextResponse.json({ error: "Pengguna tidak ditemukan" }, { status: 404 });
  }

  const body = (await req.json().catch(() => ({}))) as {
    name?: string;
    role?: string;
    active?: boolean;
    password?: string;
  };

  // Last-admin lockout guard: never leave zero active admins.
  const demotes = body.role !== undefined && body.role !== "admin" && before.role === "admin";
  const disables = body.active === false && before.active === 1 && before.role === "admin";
  if ((demotes || disables) && store.countOtherActiveAdmins(id) === 0) {
    return NextResponse.json(
      { error: "Tidak dapat menonaktifkan/menurunkan admin aktif terakhir" },
      { status: 400 },
    );
  }

  let user = before;

  if (body.name !== undefined || body.role !== undefined) {
    if (body.role !== undefined && !STAFF_ROLES.has(String(body.role))) {
      return NextResponse.json({ error: "Role tidak valid" }, { status: 400 });
    }
    user = store.update(id, {
      name: body.name !== undefined ? String(body.name).trim() : undefined,
      role: body.role !== undefined ? (body.role as StaffRole) : undefined,
    });
    auditLog({
      who: auth.user.email,
      scope: "shared",
      action: "user.update",
      target: user.email,
      before: { name: before.name, role: before.role },
      after: { name: user.name, role: user.role },
    });
  }

  if (typeof body.active === "boolean" && Boolean(before.active) !== body.active) {
    user = store.setActive(id, body.active);
    auditLog({
      who: auth.user.email,
      scope: "shared",
      action: body.active ? "user.enable" : "user.disable",
      target: user.email,
    });
  }

  if (body.password !== undefined) {
    if (String(body.password).length < 8) {
      return NextResponse.json({ error: "Kata sandi minimal 8 karakter" }, { status: 400 });
    }
    user = store.resetPassword(id, String(body.password));
    auditLog({
      who: auth.user.email,
      scope: "shared",
      action: "user.reset_password",
      target: user.email,
    });
  }

  return NextResponse.json({ user });
}

cd apps/internal-web && pnpm typecheck
cd apps/internal-web && STAFF_DB=/tmp/staff-dev.sqlite STAFF_ADMIN_EMAIL=admin@ahu.local STAFF_ADMIN_PASSWORD=dev-admin-123 AUDIT_DB=/tmp/audit-dev.sqlite pnpm dev &
sleep 8
curl -s -X POST http://localhost:3500/api/auth/login -H 'Content-Type: application/json' -d '{"email":"admin@ahu.local","password":"dev-admin-123"}' -c /tmp/dev-cookie.txt -o /dev/null
curl -s -b /tmp/dev-cookie.txt -X POST http://localhost:3500/api/admin/users -H 'Content-Type: application/json' -d '{"email":"budi@ahu.local","name":"Budi","role":"staff","password":"rahasia-123"}' -w '\ncreate: %{http_code}\n'
curl -s -b /tmp/dev-cookie.txt http://localhost:3500/api/admin/users | head -c 400; echo
curl -s -b /tmp/dev-cookie.txt -X PATCH http://localhost:3500/api/admin/users/2 -H 'Content-Type: application/json' -d '{"active":false}' -w '\ndisable: %{http_code}\n'
curl -s -b /tmp/dev-cookie.txt -X PATCH http://localhost:3500/api/admin/users/1 -H 'Content-Type: application/json' -d '{"active":false}' -w '\nlast-admin: %{http_code}\n'
sqlite3 /tmp/audit-dev.sqlite "SELECT action, who, target FROM audit ORDER BY id DESC LIMIT 4"
kill %1

git add apps/internal-web/src/app/api/admin/users
git commit -m "feat(d1): staff users CRUD API with audit + last-admin guard"

"use client";
import * as React from "react";

interface StaffUser {
  id: number;
  email: string;
  name: string;
  role: "admin" | "it_staff" | "staff";
  token_version: number;
  active: number;
  created_at: string;
  updated_at: string;
}

const ROLES = ["admin", "it_staff", "staff"] as const;

export default function UsersPage() {
  const [users, setUsers] = React.useState<StaffUser[] | null>(null);
  const [error, setError] = React.useState("");
  const [busy, setBusy] = React.useState(false);
  const [form, setForm] = React.useState({ email: "", name: "", role: "staff", password: "" });

  const refresh = React.useCallback(async () => {
    const r = await fetch("/api/admin/users");
    if (!r.ok) { setError(`Gagal memuat (${r.status})`); return; }
    const j = (await r.json()) as { users: StaffUser[] };
    setUsers(j.users);
  }, []);

  React.useEffect(() => { void refresh(); }, [refresh]);

  async function call(method: string, url: string, body: unknown): Promise<void> {
    setBusy(true);
    setError("");
    const r = await fetch(url, {
      method,
      headers: { "content-type": "application/json" },
      body: JSON.stringify(body),
    });
    if (!r.ok) {
      const j = (await r.json().catch(() => ({}))) as { error?: string };
      setError(j.error ?? `Gagal (${r.status})`);
    }
    setBusy(false);
    void refresh();
  }

  async function createUser(e: React.FormEvent) {
    e.preventDefault();
    await call("POST", "/api/admin/users", form);
    setForm({ email: "", name: "", role: "staff", password: "" });
  }

  function resetPassword(u: StaffUser) {
    const pw = window.prompt(`Kata sandi baru untuk ${u.email} (min. 8 karakter):`);
    if (pw) void call("PATCH", `/api/admin/users/${u.id}`, { password: pw });
  }

  return (
    <section className="max-w-6xl">
      <h1 className="text-lg font-semibold mb-1">Pengguna Staf</h1>
      <p className="text-sm text-muted-foreground mb-4">
        Akun konsol staf (SQLite, bcrypt). Nonaktifkan atau reset sandi untuk
        mencabut sesi mutasi secara langsung (token_version).
      </p>

      <form onSubmit={createUser} className="flex flex-wrap items-end gap-2 mb-6 p-3 rounded border">
        <label className="text-xs flex flex-col gap-1">
          Email
          <input required type="email" className="border rounded px-2 py-1 text-sm" value={form.email}
            onChange={(e) => setForm({ ...form, email: e.target.value })} />
        </label>
        <label className="text-xs flex flex-col gap-1">
          Nama
          <input required className="border rounded px-2 py-1 text-sm" value={form.name}
            onChange={(e) => setForm({ ...form, name: e.target.value })} />
        </label>
        <label className="text-xs flex flex-col gap-1">
          Role
          <select className="border rounded px-2 py-1 text-sm" value={form.role}
            onChange={(e) => setForm({ ...form, role: e.target.value })}>
            {ROLES.map((r) => <option key={r} value={r}>{r}</option>)}
          </select>
        </label>
        <label className="text-xs flex flex-col gap-1">
          Kata sandi
          <input required minLength={8} type="password" className="border rounded px-2 py-1 text-sm"
            value={form.password} onChange={(e) => setForm({ ...form, password: e.target.value })} />
        </label>
        <button disabled={busy} type="submit"
          className="px-3 py-1.5 rounded border text-sm hover:bg-black/5 disabled:opacity-50">
          Tambah Pengguna
        </button>
      </form>

      {error && <p role="alert" className="text-sm text-destructive mb-3">{error}</p>}

      {users === null ? (
        <p className="text-sm text-muted-foreground">Memuat…</p>
      ) : (
        <table className="w-full text-sm border-collapse">
          <thead>
            <tr className="text-left border-b">
              <th className="py-2 pr-3">Email</th>
              <th className="py-2 pr-3">Nama</th>
              <th className="py-2 pr-3">Role</th>
              <th className="py-2 pr-3">Status</th>
              <th className="py-2 pr-3">tv</th>
              <th className="py-2">Aksi</th>
            </tr>
          </thead>
          <tbody>
            {users.map((u) => (
              <tr key={u.id} className="border-b">
                <td className="py-2 pr-3 font-mono text-[13px]">{u.email}</td>
                <td className="py-2 pr-3">{u.name}</td>
                <td className="py-2 pr-3">
                  <select className="border rounded px-1 py-0.5 text-sm" value={u.role} disabled={busy}
                    onChange={(e) => void call("PATCH", `/api/admin/users/${u.id}`, { role: e.target.value })}>
                    {ROLES.map((r) => <option key={r} value={r}>{r}</option>)}
                  </select>
                </td>
                <td className="py-2 pr-3">{u.active ? "aktif" : "nonaktif"}</td>
                <td className="py-2 pr-3 font-mono text-[13px]">{u.token_version}</td>
                <td className="py-2 flex gap-2">
                  <button disabled={busy}
                    className="px-2 py-1 rounded border text-xs hover:bg-black/5 disabled:opacity-50"
                    onClick={() => void call("PATCH", `/api/admin/users/${u.id}`, { active: !u.active })}>
                    {u.active ? "Nonaktifkan" : "Aktifkan"}
                  </button>
                  <button disabled={busy}
                    className="px-2 py-1 rounded border text-xs hover:bg-black/5 disabled:opacity-50"
                    onClick={() => resetPassword(u)}>
                    Reset sandi
                  </button>
                </td>
              </tr>
            ))}
          </tbody>
        </table>
      )}
    </section>
  );
}