From 033acff0e6bae9a9a7c9b9861daedb53bfeab0d7 Mon Sep 17 00:00:00 2001
From: Owais Jamil <desertthunder.dev@gmail.com>
Date: Sun, 21 Jun 2026 11:50:25 -0500
Subject: [PATCH] feat: shared taskbar and session bridging

---
 TODO.md                                       |  2 +
 assets/css/components/shell.css               | 10 ++--
 lib/tempest_web/components/core_components.ex |  6 +--
 lib/tempest_web/components/layouts.ex         | 46 +++++++++++--------
 .../controllers/account_session_controller.ex | 15 ++++++
 .../controllers/admin_session_controller.ex   |  3 ++
 lib/tempest_web/live/account_control_live.ex  | 26 +++++++++--
 lib/tempest_web/live/admin_control_live.ex    | 26 +++++++++--
 lib/tempest_web/plugs/account_browser_auth.ex | 22 +++++++++
 .../controllers/admin_controller_test.exs     | 24 ++++++++++
 .../operator_account_controller_test.exs      | 42 +++++++++++++++++
 .../live/account_control_live_test.exs        |  8 +++-
 .../live/admin_control_live_test.exs          |  5 +-
 13 files changed, 195 insertions(+), 40 deletions(-)

diff --git a/TODO.md b/TODO.md
index 172f887..4ec680e 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1 +1,3 @@
 # Parking Lot (TODO)
+
+- Improve external admin DID login UX: when `TEMPEST_ADMIN_DID` is not hosted locally, `/admin/login` currently asks for a pasted OAuth access token. Add a browser-driven OAuth authorization flow so external admins can sign in without manually obtaining a token.
diff --git a/assets/css/components/shell.css b/assets/css/components/shell.css
index 23dae84..70138e0 100644
--- a/assets/css/components/shell.css
+++ b/assets/css/components/shell.css
@@ -13,6 +13,10 @@
   padding-block-start: calc(2.7rem + clamp(0.75rem, 2vw, 1.35rem));
 }
 
+.operator-account {
+  padding-block-start: calc(2.7rem + clamp(0.75rem, 2vw, 1.35rem));
+}
+
 .tempest-home__desktop,
 .operator-account__desktop {
   display: grid;
@@ -813,12 +817,6 @@
   color: var(--danger);
 }
 
-.operator-account__nav .operator-account__home-link {
-  margin-inline-start: auto;
-  padding-inline-start: var(--space-3);
-  border-inline-start: 1px dotted var(--accent);
-}
-
 .taskbar {
   position: fixed;
   inset-inline: 0;
diff --git a/lib/tempest_web/components/core_components.ex b/lib/tempest_web/components/core_components.ex
index 817336e..cce4d0c 100644
--- a/lib/tempest_web/components/core_components.ex
+++ b/lib/tempest_web/components/core_components.ex
@@ -88,15 +88,15 @@ defmodule TempestWeb.CoreComponents do
   def taskbar(assigns) do
     ~H"""
     <footer class="taskbar">
-      <.link class="taskbar__start" navigate={~p"/"}>
+      <.link class="taskbar__start" href={~p"/"}>
         <img src={~p"/images/icons/at.svg"} alt="" width="18" height="18" /> Start
       </.link>
       <span class="taskbar__app">{@app_label} / {@host}</span>
       <span class="taskbar__tray" aria-label="System tray">
-        <.link id="taskbar-account-link" class="taskbar__tray-link" navigate={~p"/account"} aria-label="Open account">
+        <.link id="taskbar-account-link" class="taskbar__tray-link" href={~p"/account"} aria-label="Open account">
           <img src={~p"/images/icons/lock.svg"} alt="" width="18" height="18" />
         </.link>
-        <.link id="taskbar-admin-link" class="taskbar__tray-link" navigate={~p"/admin"} aria-label="Open admin">
+        <.link id="taskbar-admin-link" class="taskbar__tray-link" href={~p"/admin"} aria-label="Open admin">
           <img src={~p"/images/icons/shield.svg"} alt="" width="18" height="18" />
         </.link>
         <span aria-label="Current UTC time">{@rendered_at}</span>
diff --git a/lib/tempest_web/components/layouts.ex b/lib/tempest_web/components/layouts.ex
index 138b48d..521ee22 100644
--- a/lib/tempest_web/components/layouts.ex
+++ b/lib/tempest_web/components/layouts.ex
@@ -35,31 +35,37 @@ defmodule TempestWeb.Layouts do
     default: nil,
     doc: "the current [scope](https://hexdocs.pm/phoenix/scopes.html)"
 
+  attr :chrome, :atom, default: :app, values: [:app, :desktop]
+
   slot :inner_block, required: true
 
   def app(assigns) do
     ~H"""
     <div class="app-shell">
-      <header class="app-header">
-        <a href="/" class="app-header__brand">
-          <img src={~p"/images/logo.svg"} width="32" height="32" alt="" />
-          <span>Tempest PDS</span>
-          <span>v{Application.spec(:tempest, :vsn)}</span>
-        </a>
-        <nav aria-label="Project links">
-          <ul class="app-header__nav">
-            <li><a href={~p"/docs"} class="button">Docs</a></li>
-            <li><a href="https://github.com/owais/tempest" class="button">GitHub</a></li>
-            <li><a href="https://atproto.com/" class="button button--primary">AT Protocol</a></li>
-          </ul>
-        </nav>
-      </header>
-
-      <main class="app-main">
-        <div class="app-stack">
-          {render_slot(@inner_block)}
-        </div>
-      </main>
+      <%= if @chrome == :desktop do %>
+        {render_slot(@inner_block)}
+      <% else %>
+        <header class="app-header">
+          <a href="/" class="app-header__brand">
+            <img src={~p"/images/logo.svg"} width="32" height="32" alt="" />
+            <span>Tempest PDS</span>
+            <span>v{Application.spec(:tempest, :vsn)}</span>
+          </a>
+          <nav aria-label="Project links">
+            <ul class="app-header__nav">
+              <li><a href={~p"/docs"} class="button">Docs</a></li>
+              <li><a href="https://github.com/owais/tempest" class="button">GitHub</a></li>
+              <li><a href="https://atproto.com/" class="button button--primary">AT Protocol</a></li>
+            </ul>
+          </nav>
+        </header>
+
+        <main class="app-main">
+          <div class="app-stack">
+            {render_slot(@inner_block)}
+          </div>
+        </main>
+      <% end %>
 
       <.flash_group flash={@flash} />
     </div>
diff --git a/lib/tempest_web/controllers/account_session_controller.ex b/lib/tempest_web/controllers/account_session_controller.ex
index af11dbf..314abbf 100644
--- a/lib/tempest_web/controllers/account_session_controller.ex
+++ b/lib/tempest_web/controllers/account_session_controller.ex
@@ -2,6 +2,7 @@ defmodule TempestWeb.AccountSessionController do
   use TempestWeb, :controller
 
   alias Tempest.Accounts
+  alias Tempest.AdminAuth
 
   def new(conn, params) do
     render_login(conn, params, nil)
@@ -19,6 +20,7 @@ defmodule TempestWeb.AccountSessionController do
         |> put_session(:account_session_id, browser_session.session.id)
         |> put_session(:account_session_family_id, browser_session.family_id)
         |> put_session(:account_did, browser_session.account.did)
+        |> maybe_put_admin_session(browser_session)
         |> redirect(to: safe_return_to(return_to, ~p"/account"))
 
       {:error, reason} ->
@@ -67,6 +69,19 @@ defmodule TempestWeb.AccountSessionController do
   defp login_error(:rate_limited), do: "Too many attempts. Try again later."
   defp login_error(_reason), do: "The username or password is incorrect."
 
+  defp maybe_put_admin_session(conn, browser_session) do
+    case AdminAuth.configured_did() do
+      {:ok, did} when did == browser_session.account.did ->
+        conn
+        |> put_session(:admin_session_id, browser_session.session.id)
+        |> put_session(:admin_session_family_id, browser_session.family_id)
+        |> put_session(:admin_did, did)
+
+      _other ->
+        conn
+    end
+  end
+
   defp renew_session(conn) do
     conn
     |> configure_session(renew: true)
diff --git a/lib/tempest_web/controllers/admin_session_controller.ex b/lib/tempest_web/controllers/admin_session_controller.ex
index 5f62c0c..f6f3ac6 100644
--- a/lib/tempest_web/controllers/admin_session_controller.ex
+++ b/lib/tempest_web/controllers/admin_session_controller.ex
@@ -45,6 +45,9 @@ defmodule TempestWeb.AdminSessionController do
       {:ok, admin_session} ->
         conn
         |> renew_session()
+        |> put_session(:account_session_id, admin_session.session.id)
+        |> put_session(:account_session_family_id, admin_session.family_id)
+        |> put_session(:account_did, admin_session.did)
         |> put_session(:admin_session_id, admin_session.session.id)
         |> put_session(:admin_session_family_id, admin_session.family_id)
         |> put_session(:admin_did, admin_session.did)
diff --git a/lib/tempest_web/live/account_control_live.ex b/lib/tempest_web/live/account_control_live.ex
index 6e56aac..2ba8432 100644
--- a/lib/tempest_web/live/account_control_live.ex
+++ b/lib/tempest_web/live/account_control_live.ex
@@ -1,12 +1,17 @@
 defmodule TempestWeb.AccountControlLive do
   use TempestWeb, :live_view
 
-  alias Tempest.{Accounts, Blobs, RepoStorage, Security, Sequencer}
+  alias Tempest.{Accounts, Blobs, Config, RepoStorage, Security, Sequencer}
 
   @page_limit 50
 
   @impl true
-  def mount(_params, _session, socket), do: {:ok, assign(socket, :page_title, "Account Control Panel")}
+  def mount(_params, _session, socket) do
+    {:ok,
+     socket
+     |> assign(:page_title, "Account Control Panel")
+     |> assign_control_shell()}
+  end
 
   @impl true
   def handle_params(params, uri, socket) do
@@ -24,8 +29,9 @@ defmodule TempestWeb.AccountControlLive do
   @impl true
   def render(assigns) do
     ~H"""
-    <Layouts.app flash={@flash} current_scope={@current_scope}>
+    <Layouts.app flash={@flash} current_scope={@current_scope} chrome={:desktop}>
       {render_account_page(assigns)}
+      <.taskbar app_label="tempest account" host={@host} rendered_at={@rendered_at} />
     </Layouts.app>
     """
   end
@@ -799,11 +805,23 @@ defmodule TempestWeb.AccountControlLive do
       <.link navigate={~p"/account/firehose"} aria-current={if(@active == :firehose, do: "page", else: false)}>
         Firehose
       </.link>
-      <.link id="account-control-home" class="operator-account__home-link" navigate={~p"/"}>Home</.link>
     </nav>
     """
   end
 
+  defp assign_control_shell(socket) do
+    config = Config.load!()
+
+    socket
+    |> assign(:host, config.hostname)
+    |> assign(:rendered_at, rendered_at())
+  end
+
+  defp rendered_at do
+    DateTime.utc_now()
+    |> Calendar.strftime("%Y-%m-%d %H:%M:%SZ")
+  end
+
   defp blob_summary(blobs) do
     counts = Enum.frequencies_by(blobs, & &1.state)
 
diff --git a/lib/tempest_web/live/admin_control_live.ex b/lib/tempest_web/live/admin_control_live.ex
index 443c786..744eadd 100644
--- a/lib/tempest_web/live/admin_control_live.ex
+++ b/lib/tempest_web/live/admin_control_live.ex
@@ -1,12 +1,17 @@
 defmodule TempestWeb.AdminControlLive do
   use TempestWeb, :live_view
 
-  alias Tempest.Admin
+  alias Tempest.{Admin, Config}
   alias Tempest.PersonalBackups
   alias Tempest.PersonalBackups.Account
 
   @impl true
-  def mount(_params, _session, socket), do: {:ok, assign(socket, :page_title, "Admin Control Panel")}
+  def mount(_params, _session, socket) do
+    {:ok,
+     socket
+     |> assign(:page_title, "Admin Control Panel")
+     |> assign_control_shell()}
+  end
 
   @impl true
   def handle_params(params, _uri, socket) do
@@ -178,8 +183,9 @@ defmodule TempestWeb.AdminControlLive do
   @impl true
   def render(assigns) do
     ~H"""
-    <Layouts.app flash={@flash} current_scope={@current_scope}>
+    <Layouts.app flash={@flash} current_scope={@current_scope} chrome={:desktop}>
       {render_admin_page(assigns)}
+      <.taskbar app_label="tempest admin" host={@host} rendered_at={@rendered_at} />
     </Layouts.app>
     """
   end
@@ -1069,11 +1075,23 @@ defmodule TempestWeb.AdminControlLive do
       <.link navigate={~p"/admin/compatibility"} aria-current={if(@active == :compatibility, do: "page", else: false)}>
         Compatibility
       </.link>
-      <.link id="admin-control-home" class="operator-account__home-link" navigate={~p"/"}>Home</.link>
     </nav>
     """
   end
 
+  defp assign_control_shell(socket) do
+    config = Config.load!()
+
+    socket
+    |> assign(:host, config.hostname)
+    |> assign(:rendered_at, rendered_at())
+  end
+
+  defp rendered_at do
+    DateTime.utc_now()
+    |> Calendar.strftime("%Y-%m-%d %H:%M:%SZ")
+  end
+
   defp present(nil), do: "—"
   defp present(""), do: "—"
   defp present(value) when is_boolean(value), do: inspect(value)
diff --git a/lib/tempest_web/plugs/account_browser_auth.ex b/lib/tempest_web/plugs/account_browser_auth.ex
index 71cbaa7..149c819 100644
--- a/lib/tempest_web/plugs/account_browser_auth.ex
+++ b/lib/tempest_web/plugs/account_browser_auth.ex
@@ -7,6 +7,8 @@ defmodule TempestWeb.Plugs.AccountBrowserAuth do
   import Plug.Conn
 
   alias Tempest.Accounts
+  alias Tempest.Accounts.AuthContext
+  alias Tempest.AdminAuth
   alias TempestWeb.XrpcErrorJSON
 
   use TempestWeb, :verified_routes
@@ -59,6 +61,26 @@ defmodule TempestWeb.Plugs.AccountBrowserAuth do
       {:error, _reason} = error when not is_nil(session_id) or not is_nil(family_id) ->
         error
 
+      {:error, _reason} ->
+        authenticate_admin_session(conn)
+    end
+  end
+
+  defp authenticate_admin_session(conn) do
+    session_id = get_session(conn, :admin_session_id)
+    family_id = get_session(conn, :admin_session_family_id)
+    did = get_session(conn, :admin_did)
+
+    case AdminAuth.authenticate_browser_session(session_id, family_id, did) do
+      {:ok, %{account: account, session: session}} ->
+        {:ok, %AuthContext{account: account, session: session, token_type: :browser_session}}
+
+      {:ok, _external_admin_session} ->
+        {:error, :missing_token}
+
+      {:error, _reason} = error when not is_nil(session_id) or not is_nil(family_id) or not is_nil(did) ->
+        error
+
       {:error, _reason} ->
         {:error, :missing_token}
     end
diff --git a/test/tempest_web/controllers/admin_controller_test.exs b/test/tempest_web/controllers/admin_controller_test.exs
index f0ca084..cfd20fd 100644
--- a/test/tempest_web/controllers/admin_controller_test.exs
+++ b/test/tempest_web/controllers/admin_controller_test.exs
@@ -286,6 +286,13 @@ defmodule TempestWeb.AdminControllerTest do
     assert is_integer(Plug.Conn.get_session(login_conn, :admin_session_id))
     assert is_binary(Plug.Conn.get_session(login_conn, :admin_session_family_id))
     assert Plug.Conn.get_session(login_conn, :admin_did) == account["did"]
+    assert Plug.Conn.get_session(login_conn, :account_did) == account["did"]
+
+    assert Plug.Conn.get_session(login_conn, :account_session_id) ==
+             Plug.Conn.get_session(login_conn, :admin_session_id)
+
+    assert Plug.Conn.get_session(login_conn, :account_session_family_id) ==
+             Plug.Conn.get_session(login_conn, :admin_session_family_id)
 
     browser_session = Plug.Conn.get_session(login_conn)
     refute inspect(browser_session) =~ account["accessJwt"]
@@ -448,6 +455,23 @@ defmodule TempestWeb.AdminControllerTest do
     assert json_response(xrpc_conn, 401)["error"] == "AuthenticationRequired"
   end
 
+  test "local admin browser session also authorizes account UI even without account session keys", %{conn: conn} do
+    admin_conn = admin_login_conn(conn, "admin-account-ui.test", "admin-account-ui@example.com")
+
+    admin_only_conn =
+      admin_conn
+      |> recycle()
+      |> Plug.Test.init_test_session(%{
+        admin_session_id: Plug.Conn.get_session(admin_conn, :admin_session_id),
+        admin_session_family_id: Plug.Conn.get_session(admin_conn, :admin_session_family_id),
+        admin_did: Plug.Conn.get_session(admin_conn, :admin_did)
+      })
+
+    account_conn = get(admin_only_conn, ~p"/account")
+
+    assert html_response(account_conn, 200) =~ "Account Control Panel"
+  end
+
   defp configure_admin_did(did) do
     config =
       :tempest
diff --git a/test/tempest_web/controllers/operator_account_controller_test.exs b/test/tempest_web/controllers/operator_account_controller_test.exs
index 738b6c1..62876ad 100644
--- a/test/tempest_web/controllers/operator_account_controller_test.exs
+++ b/test/tempest_web/controllers/operator_account_controller_test.exs
@@ -80,6 +80,39 @@ defmodule TempestWeb.OperatorAccountControllerTest do
     assert html =~ account["did"]
   end
 
+  test "account login as configured admin also authorizes admin browser routes", %{conn: conn} do
+    old_config = Application.get_env(:tempest, Tempest.Config)
+    on_exit(fn -> Application.put_env(:tempest, Tempest.Config, old_config) end)
+
+    account = create_account!(conn, "account-admin-shared.test", "account-admin-shared@example.com")
+    configure_admin_did(account["did"])
+
+    login_conn =
+      conn
+      |> recycle()
+      |> post(~p"/account/login", %{
+        "account" => %{"identifier" => account["handle"], "password" => @password}
+      })
+
+    assert redirected_to(login_conn) == ~p"/account"
+    assert Plug.Conn.get_session(login_conn, :account_did) == account["did"]
+    assert Plug.Conn.get_session(login_conn, :admin_did) == account["did"]
+
+    assert Plug.Conn.get_session(login_conn, :account_session_id) ==
+             Plug.Conn.get_session(login_conn, :admin_session_id)
+
+    assert Plug.Conn.get_session(login_conn, :account_session_family_id) ==
+             Plug.Conn.get_session(login_conn, :admin_session_family_id)
+
+    html =
+      login_conn
+      |> recycle()
+      |> get(~p"/admin")
+      |> html_response(200)
+
+    assert html =~ "Admin Dashboard"
+  end
+
   test "account logout clears browser-session access", %{conn: conn} do
     account = create_account!(conn, "logout-account.test", "logout-account@example.com")
 
@@ -129,4 +162,13 @@ defmodule TempestWeb.OperatorAccountControllerTest do
     })
     |> json_response(200)
   end
+
+  defp configure_admin_did(did) do
+    config =
+      :tempest
+      |> Application.fetch_env!(Tempest.Config)
+      |> Keyword.put(:admin_did, did)
+
+    Application.put_env(:tempest, Tempest.Config, config)
+  end
 end
diff --git a/test/tempest_web/live/account_control_live_test.exs b/test/tempest_web/live/account_control_live_test.exs
index b1adefc..bc112b6 100644
--- a/test/tempest_web/live/account_control_live_test.exs
+++ b/test/tempest_web/live/account_control_live_test.exs
@@ -25,7 +25,10 @@ defmodule TempestWeb.AccountControlLiveTest do
       |> live(~p"/account")
 
     assert has_element?(view, "#account-dashboard")
-    assert has_element?(view, ~s(a#account-control-home[href="/"]))
+    refute has_element?(view, ".app-header")
+    assert has_element?(view, ~s(.taskbar a[href="/"]))
+    assert has_element?(view, ~s(.taskbar a#taskbar-account-link[href="/account"]))
+    assert has_element?(view, ~s(.taskbar a#taskbar-admin-link[href="/admin"]))
 
     logout_conn =
       login_conn
@@ -62,7 +65,8 @@ defmodule TempestWeb.AccountControlLiveTest do
         |> live(path)
 
       assert has_element?(view, selector)
-      assert has_element?(view, ~s(a#account-control-home[href="/"]))
+      refute has_element?(view, ".app-header")
+      assert has_element?(view, ~s(.taskbar a[href="/"]))
     end
   end
 
diff --git a/test/tempest_web/live/admin_control_live_test.exs b/test/tempest_web/live/admin_control_live_test.exs
index 3d37023..77f2aad 100644
--- a/test/tempest_web/live/admin_control_live_test.exs
+++ b/test/tempest_web/live/admin_control_live_test.exs
@@ -74,7 +74,10 @@ defmodule TempestWeb.AdminControlLiveTest do
     expect_did_document()
 
     {:ok, view, _html} = live(admin_conn, ~p"/admin/personal-backups/new")
-    assert has_element?(view, ~s(a#admin-control-home[href="/"]))
+    refute has_element?(view, ".app-header")
+    assert has_element?(view, ~s(.taskbar a[href="/"]))
+    assert has_element?(view, ~s(.taskbar a#taskbar-account-link[href="/account"]))
+    assert has_element?(view, ~s(.taskbar a#taskbar-admin-link[href="/admin"]))
 
     view
     |> form("#personal-backup-create-form",
-- 
2.51.2