init

docs/agents/validation/06-client-api-ui-validation.md

@@ -0,0 +1,77 @@
+# Validation Report Template
+
+## Validator
+
+Name: Codex Validation Agent
+
+Stage Reviewed: Agent 06 - Client API And Admin UI
+
+Date: 2026-04-15
+
+## Reviewed Inputs
+
+- `/Users/delete/projects/update_server/docs/agents/WORKFLOW.md`
+- `/Users/delete/projects/update_server/PRODUCT_SPEC.md`
+- `/Users/delete/projects/update_server/IMPLEMENTATION_PLAN.md`
+- `/Users/delete/projects/update_server/DEVELOPMENT_WORKFLOW.md`
+- `/Users/delete/projects/update_server/docs/agents/OPERATOR_QUICKSTART_RU.md`
+- `/Users/delete/projects/update_server/docs/agents/handoffs/06-client-api-ui.md`
+- previous stage validation report: `/Users/delete/projects/update_server/docs/agents/validation/05-api-keys-validation.md`
+- implementation files under `internal/http`, `internal/db`, `internal/releases`, `internal/storage`, `web/templates`, and `web/static`
+- `GOCACHE=/tmp/go-build-agent06-validate GOMODCACHE=/tmp/go-mod-agent06-http go test ./...` -> passed
+- `GOCACHE=/tmp/go-build-agent06-build-validate GOMODCACHE=/tmp/go-mod-agent06-http go build -o /tmp/update-server-agent06-validate ./cmd/server` -> passed
+- `GOCACHE=/tmp/go-build-agent06-migrate-validate GOMODCACHE=/tmp/go-mod-agent06-http go build -o /tmp/update-migrate-agent06-validate ./cmd/migrate` -> passed
+- live smoke checks against `127.0.0.1:18086` after starting `/tmp/update-server-agent06-validate` with a fresh `DATA_DIR`:
+  - `GET /healthz` -> `200 OK`
+  - `GET /api/v1` -> `200 OK` with public JSON index documenting bearer auth and the client routes
+  - `GET /api/v1/projects` without bearer token -> `401 Unauthorized` with `WWW-Authenticate: Bearer`
+  - admin login succeeded and a fresh test dataset was created:
+    - active projects: `desktop-app`, `mobile-app`
+    - archived project: `legacy-app`
+    - releases created for desktop, mobile, and legacy projects
+    - tag-scoped API key with `can_download`
+    - API key without `can_download`
+    - expired API key
+  - `GET /api/v1/projects` with the allowed tag-scoped key -> `200 OK`, returning only active authorized project `desktop-app`
+  - `GET /api/v1/projects` with key lacking `can_download` -> `403 Forbidden`
+  - `GET /api/v1/projects` with expired key -> `401 Unauthorized`
+  - `GET /api/v1/projects/desktop-app/releases/latest` with allowed key -> `200 OK`, returning latest active desktop release `1.1.0 / build-2`
+  - `GET /api/v1/projects/mobile-app/releases/latest` with allowed key -> `404 Not Found`
+  - `GET /api/v1/releases/3` for out-of-scope mobile release -> `404 Not Found`
+  - `GET /api/v1/releases/4` for archived-project release -> `404 Not Found`
+  - `GET /api/v1/releases/2` with allowed key -> `200 OK`, returning authorized release metadata
+  - `GET /api/v1/releases/2/download` with allowed key -> `200 OK`, streamed `desktop-release-1.1.0` with `Content-Disposition: attachment; filename=desktop-app-1.1.0.zip`
+  - `GET /admin/projects/1` with admin session -> `200 OK`, page showed `/api/v1/projects/desktop-app/releases/latest`, `/api/v1/releases/2`, and `/api/v1/releases/2/download`
+  - `GET /admin/api-keys/1` with admin session -> `200 OK`, page showed bearer-auth quick-start guidance and accessible client API paths
+- SQLite inspection of `/tmp/update-server-agent06-live/db.sqlite` confirmed:
+  - latest desktop release persisted as release ID `2`
+  - mobile release persisted as release ID `3`
+  - archived-project release persisted as release ID `4`
+  - validation API keys persisted with the expected permission and expiry states
+
+## Findings
+
+No blocking findings.
+
+The stage satisfies the agreed scope:
+
+- the public `/api/v1` index is usable and documents the client routes;
+- bearer-authenticated client endpoints enforce API key authentication and `can_download`;
+- client project listing returns only active authorized projects;
+- latest-release lookup, metadata lookup, and artifact download work for authorized resources;
+- out-of-scope and archived resources are hidden behind `404`;
+- downloads stream from private artifact storage instead of exposing static URLs;
+- admin pages expose the new client API paths and quick-start guidance.
+
+## Required Fixes
+
+None.
+
+## Optional Improvements
+
+- If the product later needs richer updater logic, add support for semantic-version comparison or explicit release channels instead of using newest persisted `created_at` as the definition of “latest”.
+- Agent 07 should harden the now-working client API with security headers, rate limiting, CSRF coverage for admin POST forms, and deployment-ready reverse proxy guidance.
+
+## Status
+
+`APPROVED`