Revitalize admin shell for plugin tools (#35)

* feat: bridge admin tool auth context

* feat: render plugin config forms

* feat: pass admin grants to embedded tools

Author: intel352

internal/assets_test.go

@@ -16,6 +16,16 @@ func TestEmbeddedAdminShell(t *testing.T) {
 		`id="contribution-nav"`,
 		`id="contribution-list"`,
 		`Authorization`,
+		`workflow.admin.auth.request`,
+		`workflow.admin.auth.response`,
+		`grantedScopes: adminToolGrants`,
+		`adminToolFrames`,
+		`event.origin !== window.location.origin`,
+		`startsWith('/admin')`,
+		`render_mode === 'config-form'`,
+		`renderConfigForm`,
+		`validate_path`,
+		`fetchConfigDescription`,
 	}
 	for _, needle := range required {
 		if !strings.Contains(html, needle) {
@@ -34,6 +44,31 @@ func TestEmbeddedAdminShell(t *testing.T) {
 	}
 }
 
+func TestEmbeddedAdminShellUsesUserFacingToolLanguage(t *testing.T) {
+	html := string(mustReadEmbeddedAsset(t, "ui_dist/index.html"))
+	required := []string{
+		"Admin tools",
+		"Management pages",
+	}
+	for _, needle := range required {
+		if !strings.Contains(html, needle) {
+			t.Fatalf("embedded admin shell missing user-facing copy %q", needle)
+		}
+	}
+	forbidden := []string{
+		"Surfaces",
+		"Registered surfaces",
+		"Active surface",
+		"Contributions",
+		"contributed admin surfaces",
+	}
+	for _, needle := range forbidden {
+		if strings.Contains(html, needle) {
+			t.Fatalf("embedded admin shell exposes implementation jargon %q", needle)
+		}
+	}
+}
+
 func TestEmbeddedAdminShellDoesNotHardcodePluginSurfaces(t *testing.T) {
 	html := string(mustReadEmbeddedAsset(t, "ui_dist/index.html"))
 	forbidden := []string{

internal/module_dashboard.go

@@ -6,6 +6,7 @@ import (
 	"sync"
 
 	"github.com/GoCodeAlone/workflow-plugin-admin/internal/contracts"
+	"google.golang.org/protobuf/types/known/structpb"
 )
 
 var dashboardModules = struct {
@@ -127,6 +128,11 @@ func contributionFromMap(args map[string]any) *contracts.AdminContribution {
 		AppContext: stringValue(args, "app_context"),
 		Actions:    stringSliceValue(args, "actions"),
 	}
+	if metadata := mapValue(args, "metadata"); len(metadata) > 0 {
+		if pbMetadata, err := structpb.NewStruct(metadata); err == nil {
+			contribution.Metadata = pbMetadata
+		}
+	}
 	for _, permission := range permissionValues(args["permissions"]) {
 		contribution.Permissions = append(contribution.Permissions, permission)
 	}
@@ -146,9 +152,17 @@ func contributionToMap(contribution *contracts.AdminContribution) map[string]any
 		"app_context": contribution.AppContext,
 		"actions":     append([]string(nil), contribution.Actions...),
 		"permissions": permissionMaps(contribution.Permissions),
+		"metadata":    contributionMetadataMap(contribution),
 	}
 }
 
+func contributionMetadataMap(contribution *contracts.AdminContribution) map[string]any {
+	if contribution == nil || contribution.Metadata == nil {
+		return map[string]any{}
+	}
+	return contribution.Metadata.AsMap()
+}
+
 func permissionValues(value any) []*contracts.AdminPermission {
 	switch permissions := value.(type) {
 	case []string:
@@ -204,6 +218,23 @@ func stringValue(args map[string]any, key string) string {
 	return value
 }
 
+func mapValue(args map[string]any, key string) map[string]any {
+	switch value := args[key].(type) {
+	case map[string]any:
+		return value
+	case map[any]any:
+		out := make(map[string]any, len(value))
+		for k, v := range value {
+			if s, ok := k.(string); ok {
+				out[s] = v
+			}
+		}
+		return out
+	default:
+		return nil
+	}
+}
+
 func stringSliceValue(args map[string]any, key string) []string {
 	switch value := args[key].(type) {
 	case []string:

internal/module_dashboard_test.go

@@ -98,6 +98,10 @@ func TestDashboardModuleServiceInvoker(t *testing.T) {
 		"category":    "operations",
 		"render_mode": "json-schema",
 		"app_context": "scenario",
+		"metadata": map[string]any{
+			"describe_path": "/api/admin/orders/config",
+			"validate_path": "/api/admin/orders/config/validate",
+		},
 	})
 	if err != nil {
 		t.Fatalf("RegisterContribution: %v", err)
@@ -117,6 +121,13 @@ func TestDashboardModuleServiceInvoker(t *testing.T) {
 	if len(contributions) != 1 || contributions[0]["id"] != "orders" {
 		t.Fatalf("unexpected contributions: %#v", contributions)
 	}
+	metadata, ok := contributions[0]["metadata"].(map[string]any)
+	if !ok {
+		t.Fatalf("metadata type = %T, want map[string]any", contributions[0]["metadata"])
+	}
+	if metadata["validate_path"] != "/api/admin/orders/config/validate" {
+		t.Fatalf("metadata validate_path = %v", metadata["validate_path"])
+	}
 }
 
 func TestDashboardModuleAuthorizeDefaultsDeny(t *testing.T) {