Feat v0.7.2 package runners ci gate (#56)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/connections.go

@@ -5,6 +5,7 @@ package handlers
 import (
 	"encoding/base64"
 	"encoding/json"
+	"log"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -30,6 +31,7 @@ func (h *ConnectionHandler) ListConnections(c *gin.Context) {
 	// so users can see which connections are available to them.
 	conns, err := h.stores.Connections.ListAccessible(c.Request.Context(), userID)
 	if err != nil {
+		log.Printf("[connections] ListAccessible failed for user %s: %v", userID, err)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list connections"})
 		return
 	}

server/handlers/packages.go

@@ -524,7 +524,7 @@ func (h *PackageHandler) InstallPackage(c *gin.Context) {
 					pkgPath := filepath.Join(h.bundledDir, libID+".pkg")
 					if _, statErr := os.Stat(pkgPath); statErr == nil {
 						log.Printf("[packages] auto-installing bundled dependency %s for %s", libID, pkgID)
-						if _, installErr := installBundledPackage(pkgPath, h.packagesDir, h.stores, h.runner); installErr != nil {
+						if _, installErr := installBundledPackage(pkgPath, h.packagesDir, h.stores, h.runner, c.GetString("user_id")); installErr != nil {
 							c.JSON(http.StatusBadRequest, gin.H{
 								"error": fmt.Sprintf("dependency %s auto-install failed: %v", libID, installErr),
 							})

server/handlers/packages_bundled.go

@@ -51,6 +51,10 @@ func InstallBundledPackages(bundledDir, packagesDir, allowlist string, stores st
 		return
 	}
 
+	// Resolve first admin user ID for FK-constrained writes (default_surface,
+	// workflow creation).  Falls back to empty string if no admin exists yet.
+	adminUserID := resolveFirstAdminID(stores)
+
 	// Parse allowlist: "" → curated defaults, "*" → all, "a,b" → explicit list
 	allowed := parseBundleAllowlist(allowlist)
 	if allowed != nil {
@@ -78,7 +82,7 @@ func InstallBundledPackages(bundledDir, packagesDir, allowlist string, stores st
 		}
 
 		pkgPath := filepath.Join(bundledDir, entry.Name())
-		result, err := installBundledPackage(pkgPath, packagesDir, stores, runner)
+		result, err := installBundledPackage(pkgPath, packagesDir, stores, runner, adminUserID)
 		if err != nil {
 			log.Printf("[bundled] ⚠️ Failed to install %s: %v", entry.Name(), err)
 			continue
@@ -125,7 +129,7 @@ func parseBundleAllowlist(s string) map[string]bool {
 
 // installBundledPackage installs a single .pkg archive if its package ID
 // doesn't already exist in the database. Returns "installed" or "skipped".
-func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, runner *sandbox.Runner) (string, error) {
+func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, runner *sandbox.Runner, adminUserID string) (string, error) {
 	ctx := context.Background()
 
 	// Open as zip
@@ -197,8 +201,12 @@ func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, run
 		}
 	}
 
-	// Sync permissions — use a minimal gin.Context for the functions that need it
+	// Sync permissions — use a minimal gin.Context for the functions that need it.
+	// Set user_id so FK-constrained writes (workflow creation) reference a real user.
 	fakeCtx := newBackgroundGinContext()
+	if adminUserID != "" {
+		fakeCtx.Set("user_id", adminUserID)
+	}
 	declaredPerms := SyncManifestPermissions(fakeCtx, stores, pkgID, manifest)
 
 	// Bundled packages are trusted — auto-grant all declared permissions
@@ -250,7 +258,7 @@ func installBundledPackage(pkgPath, packagesDir string, stores store.Stores, run
 	if (pkgType == "surface" || pkgType == "full") {
 		if raw, err := stores.GlobalConfig.Get(ctx, "default_surface"); err != nil || raw == nil {
 			dflt := models.JSONMap{"id": pkgID}
-			if setErr := stores.GlobalConfig.Set(ctx, "default_surface", dflt, ""); setErr != nil {
+			if setErr := stores.GlobalConfig.Set(ctx, "default_surface", dflt, adminUserID); setErr != nil {
 				log.Printf("[bundled] failed to auto-set default_surface to %s: %v", pkgID, setErr)
 			}
 		}
@@ -324,6 +332,18 @@ func extractPackageAssets(zr *zip.ReadCloser, packagesDir, pkgID string) error {
 	return nil
 }
 
+// resolveFirstAdminID looks up the first user (the bootstrap admin).
+// BootstrapAdmin always runs before InstallBundledPackages, so the
+// first user by creation order is the admin. Returns "" if no users exist.
+func resolveFirstAdminID(stores store.Stores) string {
+	ctx := context.Background()
+	users, _, err := stores.Users.List(ctx, store.ListOptions{Limit: 1})
+	if err != nil || len(users) == 0 {
+		return ""
+	}
+	return users[0].ID
+}
+
 // newBackgroundGinContext creates a minimal gin.Context backed by a
 // background context. Used by startup code that calls functions
 // originally designed for HTTP handlers.

server/handlers/test_runners.go

@@ -0,0 +1,83 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+// TestRunnerHandler serves the admin test-runners result API.
+// Results are stored in memory — they reset on server restart.
+type TestRunnerHandler struct {
+	mu      sync.RWMutex
+	byID    map[string]json.RawMessage // runner-id → last results
+	lastAll json.RawMessage            // last "run all" results
+	updated time.Time
+}
+
+func NewTestRunnerHandler() *TestRunnerHandler {
+	return &TestRunnerHandler{
+		byID: make(map[string]json.RawMessage),
+	}
+}
+
+// StoreResults accepts results JSON from the browser after a test run.
+// POST /api/v1/admin/test-runners/results
+func (h *TestRunnerHandler) StoreResults(c *gin.Context) {
+	var body struct {
+		RunnerID string          `json:"runner_id"`
+		Results  json.RawMessage `json:"results"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid JSON body"})
+		return
+	}
+	if len(body.Results) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "results field required"})
+		return
+	}
+
+	h.mu.Lock()
+	defer h.mu.Unlock()
+
+	h.updated = time.Now()
+	if body.RunnerID == "" || body.RunnerID == "all" {
+		h.lastAll = body.Results
+	} else {
+		h.byID[body.RunnerID] = body.Results
+	}
+
+	c.JSON(http.StatusOK, gin.H{"stored": true, "runner_id": body.RunnerID})
+}
+
+// GetAllResults returns the last stored "run all" results.
+// GET /api/v1/admin/test-runners/results
+func (h *TestRunnerHandler) GetAllResults(c *gin.Context) {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+
+	if h.lastAll == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "no results available"})
+		return
+	}
+	c.Data(http.StatusOK, "application/json", h.lastAll)
+}
+
+// GetRunnerResults returns the last stored results for a specific runner.
+// GET /api/v1/admin/test-runners/results/:id
+func (h *TestRunnerHandler) GetRunnerResults(c *gin.Context) {
+	id := c.Param("id")
+
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+
+	data, ok := h.byID[id]
+	if !ok {
+		c.JSON(http.StatusNotFound, gin.H{"error": "no results for runner: " + id})
+		return
+	}
+	c.Data(http.StatusOK, "application/json", data)
+}

server/handlers/test_runners_test.go

@@ -0,0 +1,125 @@
+package handlers
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func setupTestRunnerRouter() (*gin.Engine, *TestRunnerHandler) {
+	gin.SetMode(gin.TestMode)
+	h := NewTestRunnerHandler()
+	r := gin.New()
+	r.POST("/api/v1/admin/test-runners/results", h.StoreResults)
+	r.GET("/api/v1/admin/test-runners/results", h.GetAllResults)
+	r.GET("/api/v1/admin/test-runners/results/:id", h.GetRunnerResults)
+	return r, h
+}
+
+func TestTestRunnerGetAllEmpty(t *testing.T) {
+	r, _ := setupTestRunnerRouter()
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/api/v1/admin/test-runners/results", nil)
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", w.Code)
+	}
+}
+
+func TestTestRunnerStoreAndRetrieveAll(t *testing.T) {
+	r, _ := setupTestRunnerRouter()
+
+	results := `{"summary":{"total":5,"passed":5,"failed":0}}`
+	body, _ := json.Marshal(map[string]interface{}{
+		"runner_id": "all",
+		"results":   json.RawMessage(results),
+	})
+
+	// Store
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("POST", "/api/v1/admin/test-runners/results", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("store: expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	// Retrieve
+	w = httptest.NewRecorder()
+	req, _ = http.NewRequest("GET", "/api/v1/admin/test-runners/results", nil)
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("get all: expected 200, got %d", w.Code)
+	}
+
+	var got map[string]interface{}
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
+	}
+	summary, _ := got["summary"].(map[string]interface{})
+	if summary == nil {
+		t.Fatal("expected summary in results")
+	}
+	if int(summary["failed"].(float64)) != 0 {
+		t.Fatalf("expected 0 failures, got %v", summary["failed"])
+	}
+}
+
+func TestTestRunnerStoreAndRetrieveByID(t *testing.T) {
+	r, _ := setupTestRunnerRouter()
+
+	results := `{"runner":"notes-runner","summary":{"total":3,"passed":3,"failed":0}}`
+	body, _ := json.Marshal(map[string]interface{}{
+		"runner_id": "notes-runner",
+		"results":   json.RawMessage(results),
+	})
+
+	// Store
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("POST", "/api/v1/admin/test-runners/results", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("store: expected 200, got %d", w.Code)
+	}
+
+	// Retrieve by ID
+	w = httptest.NewRecorder()
+	req, _ = http.NewRequest("GET", "/api/v1/admin/test-runners/results/notes-runner", nil)
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("get by id: expected 200, got %d", w.Code)
+	}
+
+	// Unknown ID → 404
+	w = httptest.NewRecorder()
+	req, _ = http.NewRequest("GET", "/api/v1/admin/test-runners/results/unknown", nil)
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("unknown id: expected 404, got %d", w.Code)
+	}
+}
+
+func TestTestRunnerStoreBadBody(t *testing.T) {
+	r, _ := setupTestRunnerRouter()
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("POST", "/api/v1/admin/test-runners/results", bytes.NewReader([]byte(`{}`)))
+	req.Header.Set("Content-Type", "application/json")
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for empty results, got %d", w.Code)
+	}
+}

server/handlers/workflow_packages.go

@@ -253,6 +253,23 @@ func InstallWorkflowFromManifest(ctx *gin.Context, stores store.Stores, pkgID st
 		}
 	}
 
+	// Publish version 1 (snapshot of stages) and activate the workflow
+	// so it's immediately usable after install.
+	stages, _ := stores.Workflows.ListStages(reqCtx, workflowID)
+	snapshot, _ := json.Marshal(stages)
+	ver := &models.WorkflowVersion{
+		WorkflowID:    workflowID,
+		VersionNumber: 1,
+		Snapshot:      snapshot,
+	}
+	if err := stores.Workflows.Publish(reqCtx, ver); err != nil {
+		log.Printf("[workflow-pkg] failed to publish version for %s: %v", pkgID, err)
+	}
+	active := true
+	if err := stores.Workflows.Update(reqCtx, workflowID, models.WorkflowPatch{IsActive: &active}); err != nil {
+		log.Printf("[workflow-pkg] failed to activate %s: %v", pkgID, err)
+	}
+
 	// Store workflow_id in package_settings for reference
 	settingsJSON, _ := json.Marshal(map[string]string{"workflow_id": workflowID})
 	stores.Packages.SetPackageSettings(reqCtx, pkgID, json.RawMessage(settingsJSON))