feat: Production release 2025‑08‑18 — Admin console (chatflows & org credentials), chatflow versioning, settings API, stricter auth, Lacework ops, and release automation

[ct3685]

Title

feat: Production release 2025‑08‑18 — Admin console (chatflows & org credentials), chatflow versioning, settings API, stricter auth, Lacework ops, and release automation

Description

This release promotes the current staging state to production (2025‑08‑18). It introduces an Admin area (UI + API), organization‑level credential gating, chatflow versioning (with new DB columns & endpoints), a user/org settings API, stricter organization‑based authentication, optional Lacework sidecar integration for Fargate/Copilot deployments, and release automation (semantic‑release + CI). Motivation is inferred from the diff; no explicit issue references were found.

Highlights

• Admin Console (UI + API)
  • New admin pages under apps/web/app/(Main UI)/sidekick-studio/(main-layout)/admin/ for Dashboard and Org Credentials; pages render @ui/Admin and @ui/OrgCredentials/OrgCredentialsManager and enforce admin role in SSR, returning an access‑denied message otherwise.
  • New server admin router adds endpoints for chatflows (list with field selection, default template, versioning list/rollback, bulk update) and organization credentials (get/update), all protected with enforceAbility.
  • Client API wrappers added for these admin endpoints: getAdminChatflows, getDefaultChatflowTemplate, bulkUpdateChatflows, getChatflowVersions, getChatflowVersion, rollbackChatflowToVersion, and org credential APIs getOrgCredentials / updateOrgCredentials.
• Chatflow Versioning (+ predictions use published version)
  • DB: ChatFlow adds currentVersion int default 1 and s3Location text (migrations for Postgres, MySQL, MariaDB, SQLite).
  • API: Version endpoints under both admin and chatflows routes; also rollback.
  • Services: predictions/build path now resolves published chatflow via chatflowsService.getChatflowForPrediction (replacing direct repository calls); delete cleans up versioned storage via chatflowStorageService.deleteChatflowStorage.
• Organization Credential Gating
  • Organization entity adds enabledIntegrations jsonb (+ Postgres migration).
  • Admin endpoints to get/update enabled integrations, with validation of credentialName, label, and enabled. :contentReference[oaicite:16]{index=16}
  • UI integrates org‑level filtering of credentials for non‑admins; admins see full list.
• Settings API (Next.js)
  • New /app/api/settings/route.ts: GET returns { userSettings, orgSettings }; POST updates user.appSettings via Prisma; both require authenticated session.
• Authentication Hardening
  • Middleware now derives permissions (adds org:manage for Admin role), and enforces allowed AUTH0_ORGANIZATION_ID list; unauthorized org yields 401.
  • UI: unauthenticated visits to /chat now redirect to login with a return URL. :contentReference[oaicite:21]{index=21}
• Ops: Optional Lacework Sidecar for Copilot/Fargate
  • copilot/flowise/manifest.yml adds sidecar, depends_on, and taskdef_overrides to run the Lacework entrypoint script before starting the app; LaceworkVerbose surfaced.
  • New docs and README section detailing enable/disable, verification, and security notes. :contentReference[oaicite:25]{index=25}
• Release Automation & Dependency Hygiene
  • New .releaserc.json targets the production branch with semantic‑release.
  • New CI workflow .github/workflows/release.yml triggers on push to production (plus a workflow_dispatch dry run).
  • .github/dependabot.yml revamped: daily npm checks to staging with minor/patch grouping and majors ignored; weekly GitHub Actions updates.

UI

• Admin area
  • Admin landing: apps/web/app/(Main UI)/sidekick-studio/(main-layout)/admin/page.tsx renders @ui/Admin.
  • Org Credentials page restricts to Admin (SSR check), rendering OrgCredentialsManager.
  • Admin dashboard cards include links to Manage Chatflows (/admin/chatflows) and Org Credentials.
• Credentials view
  • Adds org‑aware filtering controlled by Flagsmith (useFlags) and new /admin/organizations/credentials APIs.
• Agentflows navigation
  • Canvas routing switches based on agentflowVersion === 'v2'.
• Chat page access
  • Unauthenticated users are redirected to /api/auth/login?redirect_uri=/chat. :contentReference[oaicite:35]{index=35}

API

• Next.js Settings
  • GET /api/settings: returns userSettings and orgSettings for the current user (via Prisma include).
  • POST /api/settings: updates user.appSettings. Both require session.
• Admin routes (Express)
  • Chatflows: GET /admin/chatflows, GET /admin/chatflows/default-template, GET /admin/chatflows/:id/versions, PUT /admin/chatflows/bulk-update, POST /admin/chatflows/:id/rollback/:version.
  • Organizations: GET /admin/organizations/credentials, PUT /admin/organizations/credentials.
• Chatflows routes (non-admin)
  • Adds GET /chatflows/:id/versions, GET /chatflows/:id/versions/:version, POST /chatflows/:id/rollback/:version.
• Predictions/build
  • createPrediction and utilBuildChatflow now use chatflowsService.getChatflowForPrediction, with a comment noting it gets the published version for predictions.

Data

• Entities
  • ChatFlow: adds currentVersion?: number (default 1), s3Location?: string.
  • Organization: adds enabledIntegrations?: string (jsonb).
• Migrations (all supported DBs)
  • Postgres: add currentVersion + s3Location, and enabledIntegrations columns; registered in migration index.
  • MySQL/MariaDB/SQLite: parallel migrations for currentVersion + s3Location; indexes updated.

Auth & Security

• Org‑based access control (server)
  • Middleware: builds permissions (e.g., org:manage for Admin) and validates user’s org against AUTH0_ORGANIZATION_ID list, rejecting mismatches with 401.
• Admin‑only org credential updates (server)
  • Controller checks for authenticated Admin and existing organizationId prior to updates; returns appropriate errors otherwise.

Build/CI

• Semantic‑release configured for the production branch with GitHub plugin; tags as v${version}.
• CI workflow runs semantic‑release on push to production, with a manual dry‑run job.
• Dependabot groups minor/patch updates and ignores majors; GitHub Actions weekly on Monday @ 09:00.
• Gitignore additions**:** ignore .bwsconfig.cache in root and in scripts/bws-secure/.

Ops & Scripts

• Lacework sidecar (Copilot manifest): defines sidecars.datacollector-sidecar, depends_on, and taskdef_overrides (entrypoint + volume mount).
• Documentation & README for Lacework enable/disable and verification commands. :contentReference[oaicite:59]{index=59}
• BWS Secure docs: additional envs like BWS_PROJECT_ID, BWS_NO_OVERRIDE, suppression flags; .bwsconfig.cache ignored.

Docs

• Broad branding updates from “AnswerAI” → “AnswerAgentAI” across Docusaurus config, OpenAPI docs, and various pages; dark mode switch disabled (disableSwitch: true).
• New/updated deployment docs (Azure/GCP), and PGVECTOR_SETUP.md with platform‑specific install guidance; the Postgres migration now logs next steps rather than failing when pgvector is absent.
• Blog tags.yml extended (e.g., release, platform, ai-ethics, etc.).
• Admin Chatflows docs include field selection guidance and performance notes. :contentReference[oaicite:68]{index=68}

Expected Impact

• Admins can centrally manage chatflows (including versions/rollback) and control which integrations are available org‑wide. :contentReference[oaicite:70]{index=70}
• Predictions/builds use the published chatflow version to improve stability.
• End‑user routing to login for /chat avoids anonymous sessions in the main chat UI. :contentReference[oaicite:72]{index=72}
• Optional Lacework integration improves runtime visibility without blocking the app if absent/misconfigured. :contentReference[oaicite:74]{index=74}

Breaking Changes / Risks

• Auth tightening: Requests from users whose org is not in AUTH0_ORGANIZATION_ID will now get 401 Unauthorized. Ensure this env var lists all permitted org IDs.
• /chat now requires login (redirect applied). If previous behavior allowed viewing without auth, this is a functional change. :contentReference[oaicite:76]{index=76}
• DB schema changes: new columns on chat_flow and organization tables. Migrations must be applied before app start.

Migrations / Deployment Notes

• Run the new migrations for your DB engine (Postgres/MySQL/MariaDB/SQLite) before deploying the new server build.
• Postgres environments without pgvector will now see warnings with installation steps; the migration does not hard‑fail.

Environment / Config Changes

• Auth: Confirm AUTH0_ORGANIZATION_ID (comma‑separated) includes your production org(s).
• Ops (optional): To enable Lacework, set LaceworkAccessToken (and optionally LaceworkServerUrl, LaceworkConfig) in copilot.{env}.env; LaceworkVerbose defaults to true in manifest.
• BWS Secure: new optional envs BWS_PROJECT_ID, BWS_NO_OVERRIDE, BWS_SUPPRESS_ALL, BWS_SUPPRESS_MISSING for local/CI ergonomics.

Testing Notes

• Admin UI
  • Verify access control (Admin can see Dashboard and Org Credentials; non‑Admin sees access denied).
  • From Dashboard, follow cards to /admin/chatflows and /admin/org-credentials.
• Org Credentials
  • GET /admin/organizations/credentials returns current enabled integrations.
  • PUT /admin/organizations/credentials enforces validation; confirm changes affect non‑Admin credential visibility in UI.
• Versioning
  • Create multiple versions, list via GET /admin/chatflows/:id/versions, retrieve a specific version via /chatflows/:id/versions/:version, and test rollback.
• Predictions
  • Confirm predictions/build use the published version with getChatflowForPrediction.
• Settings API
  • Authenticated GET/POST /api/settings returns/updates user.appSettings (and includes orgSettings on GET).
• Auth flows
  • Attempt /chat unauthenticated → expect redirect to login with redirect_uri=/chat. :contentReference[oaicite:97]{index=97}
• Ops
  • With Lacework token set, verify sidecar processes/logs and that the main app still runs if the sidecar is absent.

No new external issue references were found in the diff. If anything above is unclear, it is because the motivation is not explicitly evident from the code changes alone.

[maxtechera]

LGTM

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots
3.5% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[maxtechera]

LGTM!