Admin panel (warp-admin) and the apps/ui design system

apps/ui: Warp's design system for Vue 3 + Tailwind v4. Tokens, fonts, icons and logo come from the brand package, with a Tailwind theme on the tokens and Vue components on the brand component styles. apps/admin: the admin panel as a separate, optional service. warp-admin embeds the built Vue app and proxies only the login endpoints and /_warp/admin/v1 to the homeserver. Pages: dashboard, users, rooms, federation, registration and tokens, server notices, application services, audit log. Also: pnpm workspace, go.work entry, Dockerfile, an `admin` compose profile, Makefile targets, a CI job with a proxy smoke test, and docs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-18 15:05:16 +02:00
1 parent 487e0f410b
commit 7e5e38c921
@@ -207,3 +207,85 @@ jobs:
          # Graceful shutdown: SIGTERM must stop the process cleanly.
          kill -TERM "$server_pid"
          wait "$server_pid"
+
+  admin:
+    name: Admin panel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: server/go.sum
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck and build the frontend
+        run: |
+          pnpm -r typecheck
+          pnpm --filter @warp/admin build
+
+      - name: Verify formatting
+        working-directory: apps/admin
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "These files need gofmt:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet and test warp-admin
+        working-directory: apps/admin
+        run: |
+          go vet ./...
+          go test -count=1 ./...
+
+      - name: Smoke test warp-admin against the homeserver
+        run: |
+          set -euo pipefail
+          make build
+          (cd apps/admin && go build -o ../../bin/warp-admin ./cmd/warp-admin)
+          sed 's/^  server_name: .*/  server_name: ci.example/' warp.yaml.example > warp.yaml
+          ./bin/warp generate-keys
+          ./bin/warp migrate
+          ./bin/warp create-account --username ci-admin --password hunter2hunter2 --admin
+          ./bin/warp serve &
+          ./bin/warp-admin -homeserver http://127.0.0.1:8008 -listen 127.0.0.1:8009 &
+          trap 'kill $(jobs -p) 2>/dev/null || true' EXIT
+
+          for _ in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:8008/healthz >/dev/null 2>&1 &&
+               curl -fsS http://127.0.0.1:8009/healthz >/dev/null 2>&1; then
+              break
+            fi
+            sleep 1
+          done
+
+          # The panel is embedded, and its routes fall back to index.html.
+          curl -fsS http://127.0.0.1:8009/ | grep -q '<div id="app">'
+          curl -fsS http://127.0.0.1:8009/users | grep -q '<div id="app">'
+
+          # Login and the admin API go through the proxy...
+          token="$(curl -fsS http://127.0.0.1:8009/_matrix/client/v3/login -d '{
+            "type": "m.login.password",
+            "identifier": {"type": "m.id.user", "user": "ci-admin"},
+            "password": "hunter2hunter2"
+          }' | sed -n 's/.*"access_token":"\([^"]*\)".*/\1/p')"
+          test -n "$token"
+          curl -fsS http://127.0.0.1:8009/_warp/admin/v1/stats \
+            -H "Authorization: Bearer $token" | grep -q '"admins":1'
+
+          # ...and the rest of the homeserver does not.
+          status="$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8009/_matrix/client/v3/sync \
+            -H "Authorization: Bearer $token")"
+          test "$status" = "404"