Add secure administrator operations console

Provide TOTP-authenticated, role-controlled user and credit workflows with paginated audit data and SQL-backed statistics so operations can manage growth safely.

build.gradle.kts

@@ -20,6 +20,50 @@ application {
     mainClass.set("io.ktor.server.netty.EngineMain")
 }
 
+val adminWebDirectory = layout.projectDirectory.dir("admin-web")
+val adminWebInstall = tasks.register<Exec>("adminWebInstall") {
+    workingDir(adminWebDirectory)
+    inputs.files(
+        adminWebDirectory.file("package.json"),
+        adminWebDirectory.file("package-lock.json"),
+    )
+    outputs.dir(adminWebDirectory.dir("node_modules"))
+    commandLine("npm", "ci", "--no-audit", "--no-fund")
+}
+val adminWebBuild = tasks.register<Exec>("adminWebBuild") {
+    dependsOn(adminWebInstall)
+    workingDir(adminWebDirectory)
+    inputs.files(
+        adminWebDirectory.file("index.html"),
+        adminWebDirectory.file("tsconfig.json"),
+        adminWebDirectory.file("vite.config.ts"),
+    )
+    inputs.dir(adminWebDirectory.dir("src"))
+    outputs.dir(adminWebDirectory.dir("dist"))
+    commandLine("npm", "run", "build")
+}
+val adminWebTest = tasks.register<Exec>("adminWebTest") {
+    dependsOn(adminWebInstall)
+    workingDir(adminWebDirectory)
+    inputs.files(
+        adminWebDirectory.file("tsconfig.json"),
+        adminWebDirectory.file("vite.config.ts"),
+    )
+    inputs.dir(adminWebDirectory.dir("src"))
+    commandLine("npm", "run", "test")
+}
+val adminWebResources = tasks.register<Sync>("adminWebResources") {
+    dependsOn(adminWebBuild)
+    from(adminWebDirectory.dir("dist"))
+    into(layout.buildDirectory.dir("generated/admin-web/admin"))
+}
+
+sourceSets {
+    main {
+        resources.srcDir(layout.buildDirectory.dir("generated/admin-web"))
+    }
+}
+
 kotlin {
     jvmToolchain(21)
     compilerOptions {
@@ -40,7 +84,10 @@ dependencies {
     implementation("io.ktor:ktor-server-auth-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-auth-jwt-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-status-pages-jvm:$ktorVersion")
-    implementation("io.ktor:ktor-server-call-logging-jvm:$ktorVersion")
+    implementation("io.ktor:ktor-server-call-logging-jvm:$ktorVersion") {
+        // Jansi is Windows-only console coloring here; excluding it keeps /tmp noexec-safe.
+        exclude(group = "org.fusesource.jansi", module = "jansi")
+    }
     implementation("io.ktor:ktor-server-rate-limit-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-websockets-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-forwarded-header-jvm:$ktorVersion")
@@ -85,6 +132,7 @@ dependencies {
 }
 
 tasks.test {
+    dependsOn(adminWebTest)
     useJUnitPlatform()
     testLogging {
         events("failed", "skipped")
@@ -93,6 +141,17 @@ tasks.test {
     finalizedBy(tasks.jacocoTestReport)
 }
 
+tasks.processResources {
+    dependsOn(adminWebResources)
+}
+
+tasks.register<JavaExec>("generateAdminCredentials") {
+    group = "deployment"
+    description = "Generate private admin bootstrap and operator handoff files"
+    classpath = sourceSets["main"].runtimeClasspath
+    mainClass.set("com.osglab.account.tools.AdminCredentialGenerator")
+}
+
 jacoco {
     toolVersion = "0.8.15"
 }