text-wrap: pretty;

  }

}

/* ── Operator ─────────────────────────────────────────────────────────────── */

/* A table, because the question this surface answers is comparative: who

 * signed up, when, and how much have they done. Cards would put each account

 * in its own box and make the columns impossible to scan down. */

@layer components {

  .admin-count {

    color: var(--text-dim);

    font-size: 0.8125rem;

    font-variant-numeric: tabular-nums;

  }

  /* The table scrolls inside its own container rather than widening the page:

     a horizontal scrollbar on the document is a layout failure, on a table it

     is the design. */

  .admin-table-scroll {

    overflow-x: auto;

    margin-inline: -16px;

    padding-inline: 16px;

  }

  .admin-table {

    width: 100%;

    border-collapse: collapse;

    font-size: 0.875rem;

  }

  .admin-table th {

    padding: 8px 12px 8px 0;

    border-bottom: 1px solid var(--line);

    color: var(--text-dim);

    font-size: 0.75rem;

    font-weight: 500;

    letter-spacing: 0.04em;

    text-align: start;

    text-transform: uppercase;

    white-space: nowrap;

  }

  .admin-table td {

    padding: 10px 12px 10px 0;

    border-bottom: 1px solid var(--line-faint);

    color: var(--text-muted);

    vertical-align: middle;

    white-space: nowrap;

  }

  .admin-table tr:last-child td {

    border-bottom: 0;

  }

  /* Counts line up on their digits so a column can be compared by eye. */

  .admin-table__number {

    text-align: end;

    font-variant-numeric: tabular-nums;

  }

  .admin-identity {

    display: flex;

    align-items: center;

    gap: 8px;

  }

  .admin-identity__names {

    display: flex;

    min-width: 0;

    flex-direction: column;

  }

  .admin-identity__names strong {

    color: var(--text-primary);

    font-size: 0.875rem;

    font-weight: 500;

    line-height: 1.25rem;

  }

  .admin-identity__names span {

    color: var(--text-dim);

    font-size: 0.75rem;

    line-height: 1rem;

  }

  .admin-paging {

    display: flex;

    align-items: center;

    justify-content: space-between;

    gap: 12px;

    padding-block-start: 4px;

  }

  .admin-paging__position {

    color: var(--text-dim);

    font-size: 0.8125rem;

    font-variant-numeric: tabular-nums;

  }

}

defmodule OpenAgentsWeb.AdminLive do

  @moduledoc """

  The operator surface: every voice call, newest first, with bounded recording

  metadata.

  The operator surface: every account, newest first, with what each has done here.

  Read-only by construction. `OpenAgents.Admin` exposes no write, so nothing here can

  ban an account, alter a conversation, or change configuration

  (`INVARIANTS.md` ADMIN-001). The only actions are paging and playback.

  Read-only by construction. `OpenAgents.Admin` exposes no write, so nothing

  here can ban an account, alter a conversation, or change configuration

  (`INVARIANTS.md` ADMIN-001). The only action is paging.

  Two presentation rules are deliberate:

  This lists accounts and activity counts, never content. Knowing that someone

  sent forty messages is an operational fact; reading them is a different

  decision with a different implementation, and there is no route to it from

  here.

    * Calls with no uploaded recording are listed with the reason. A panel that

      hid them would look like an empty history instead of an honest one.

    * Transcript *content* never appears, only whether a transcript exists. The

      operator has no recording-download route either; cross-account content

      access requires a separate decision and implementation.

  It replaced a voice-call recordings panel. Recording was off, the product no

  longer captures call audio, and an operator surface whose only view is of a

  capability that does not run is worse than no surface: it describes the

  system inaccurately to the one person who most needs an accurate picture.

  """

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Accounts

  alias OpenAgents.Admin

  alias OpenAgents.Admin.Call

  alias OpenAgents.Voice.Recordings

  @page_size 50

  @impl true

  def mount(_params, _session, socket) do

       socket

       |> assign(:page_title, "Operator · OpenAgents")

       |> assign(:offset, 0)

       |> assign(:recording_config, Recordings.config())

       |> load_page()}

    else

      {:ok, redirect(socket, to: ~p"/")}

  @impl true

  def handle_event(event, _params, socket) when event in ["next_page", "previous_page"] do

    # Re-checked per event, not only at mount: a long-lived socket outlives the

    # decision that opened it.

    if Accounts.admin?(socket.assigns.current_user) do

      do_handle_event(event, socket)

    else

    end

  end

  def do_handle_event("next_page", socket) do

    offset = socket.assigns.offset + page_size()

  defp do_handle_event("next_page", socket) do

    offset = socket.assigns.offset + @page_size

    if offset < socket.assigns.totals.calls,

    if offset < socket.assigns.total,

      do: {:noreply, socket |> assign(:offset, offset) |> load_page()},

      else: {:noreply, socket}

  end

  def do_handle_event("previous_page", socket) do

    offset = max(socket.assigns.offset - page_size(), 0)

  defp do_handle_event("previous_page", socket) do

    offset = max(socket.assigns.offset - @page_size, 0)

    {:noreply, socket |> assign(:offset, offset) |> load_page()}

  end

  defp load_page(socket) do

    socket

    |> assign(:totals, Admin.recording_totals())

    |> assign(:calls, Admin.list_calls(limit: page_size(), offset: socket.assigns.offset))

    |> assign(:total, Admin.count_accounts())

    |> assign(:accounts, Admin.list_accounts(limit: @page_size, offset: socket.assigns.offset))

  end

  @impl true

  def render(assigns) do

    ~H"""

    <Layouts.app flash={@flash} current_scope={@current_scope} title="Admin">

      <main id="admin-page" class="app-shell admin-shell">

        <%!-- The same bar every other surface renders, so moving between them

              reads as one application. The lockup carries only the way back:

              nothing in the product links here, and this is not a place to

              navigate onward from. --%>

        <section class="admin" aria-label="Voice call recordings">

          <header class="admin-heading">

            <h1>Voice calls</h1>

            <p>

              Every call across every account, newest first. Audio is captured by the

              caller's browser and stored {sealed_label(@recording_config)}; it is

              deleted {@recording_config.retention_days} days after a call ends.

            </p>

            <div class="admin-totals">

              <.badge variant={:dim}>{@totals.calls} calls</.badge>

              <.badge variant={:info}>{@totals.recorded} with audio</.badge>

              <.badge variant={:dim}>{format_bytes(@totals.byte_size)} stored</.badge>

              <.badge :if={!@recording_config.enabled?} variant={:warning}>

                RECORDING OFF

              </.badge>

            </div>

          </header>

          <.empty :if={@calls == []} id="admin-empty" title="No voice calls yet">

            Calls appear here as soon as anyone talks with OpenAgents.

          </.empty>

          <ol :if={@calls != []} id="admin-calls" class="admin-rows">

            <li :for={call <- @calls} id={"admin-call-#{call.session_id}"}>

              <.card>

                <div class="admin-row">

    <Layouts.app flash={@flash} current_scope={@current_scope} title="Admin" wide>

      <section class="panel" aria-label="Accounts">

        <header class="panel__header">

          <h1 class="panel__title">Accounts</h1>

          <span class="admin-count">{@total} total</span>

        </header>

        <.empty :if={@accounts == []} id="admin-empty" title="No accounts yet">

          Accounts appear here after their first sign-in.

        </.empty>

        <div :if={@accounts != []} class="admin-table-scroll">

          <table id="admin-accounts" class="admin-table">

            <thead>

              <tr>

                <th scope="col">Account</th>

                <th scope="col">Joined</th>

                <th scope="col">Last seen</th>

                <th scope="col" class="admin-table__number">Messages</th>

                <th scope="col" class="admin-table__number">Issues</th>

                <th scope="col">Status</th>

              </tr>

            </thead>

            <tbody>

              <tr :for={account <- @accounts} id={"admin-account-#{account.id}"}>

                <td>

                  <div class="admin-identity">

                    <.avatar

                      src={call.github_avatar_url}

                      src={account.github_avatar_url}

                      alt=""

                      size={:sm}

                      fallback={String.first(call.github_login)}

                      fallback={String.first(account.github_login)}

                    />

                    <span>

                      <strong :if={Call.display_name(call)}>{Call.display_name(call)}</strong>

                      <span>@{call.github_login}</span>

                    <span class="admin-identity__names">

                      <strong :if={account.github_name}>{account.github_name}</strong>

                      <span>@{account.github_login}</span>

                    </span>

                  </div>

                  <div class="admin-state">

                    <.badge variant={status_variant(call.status)}>

                      {String.upcase(call.status)}

                    </.badge>

                    <.badge :if={call.termination_reason} variant={:dim}>

                      {call.termination_reason}

                    </.badge>

                    <.badge :if={call.failure_code} variant={:danger}>{call.failure_code}</.badge>

                  </div>

                  <dl class="admin-meta">

                    <div>

                      <dt>Started</dt>

                      <dd>{format_timestamp(call.started_at)}</dd>

                    </div>

                    <div>

                      <dt>Call length</dt>

                      <dd>{format_call_length(call)}</dd>

                    </div>

                    <div>

                      <dt>Model</dt>

                      <dd>{call.model_id}</dd>

                    </div>

                    <div>

                      <dt>Tokens</dt>

                      <dd>{format_count(call.total_tokens)}</dd>

                    </div>

                    <div>

                      <dt>Transcript</dt>

                      <dd>{format_count(call.transcript_item_count)} items</dd>

                    </div>

                    <div :if={call.recording}>

                      <dt>Audio</dt>

                      <dd>

                        {format_bytes(call.recording.byte_size)} · {Call.completeness(call)}

                      </dd>

                    </div>

                  </dl>

                  <p :if={is_nil(call.recording)} class="admin-absence">

                    {Call.absence_reason(call)}

                  </p>

                </div>

              </.card>

            </li>

          </ol>

          <nav :if={@totals.calls > page_size()} class="admin-pager" aria-label="Call pages">

            <.button

              id="admin-previous"

              variant={:secondary}

              size={:sm}

              disabled={@offset == 0}

              phx-click="previous_page"

            >

              <.icon name="arrow-left" /> NEWER

            </.button>

            <span>{page_label(@offset, @calls, @totals.calls)}</span>

            <.button

              id="admin-next"

              variant={:secondary}

              size={:sm}

              disabled={@offset + page_size() >= @totals.calls}

              phx-click="next_page"

            >

              OLDER

            </.button>

          </nav>

        </section>

      </main>

                </td>

                <td>{date(account.joined_at)}</td>

                <td>{date(account.last_authenticated_at)}</td>

                <td class="admin-table__number">{account.message_count}</td>

                <td class="admin-table__number">{account.issue_count}</td>

                <td>

                  <.badge variant={status_variant(account.status)}>

                    {String.upcase(account.status)}

                  </.badge>

                </td>

              </tr>

            </tbody>

          </table>

        </div>

        <footer :if={@total > page_size()} class="admin-paging">

          <.button

            id="previous-page"

            variant={:secondary}

            size={:sm}

            phx-click="previous_page"

            disabled={@offset == 0}

          >

            Previous

          </.button>

          <span class="admin-paging__position">

            {@offset + 1}–{min(@offset + page_size(), @total)} of {@total}

          </span>

          <.button

            id="next-page"

            variant={:secondary}

            size={:sm}

            phx-click="next_page"

            disabled={@offset + page_size() >= @total}

          >

            Next

          </.button>

        </footer>

      </section>

    </Layouts.app>

    """

  end

  # The panel is paged rather than streamed: an operator scanning recent calls

  # wants a bounded page and the recording projection remains metadata-only.

  defp page_size, do: 25

  defp page_label(offset, calls, total) do

    "#{offset + 1}–#{offset + length(calls)} of #{total}"

  end

  defp sealed_label(%{sealed?: true}), do: "encrypted"

  defp sealed_label(%{sealed?: false}), do: "unencrypted"

  defp status_variant("ended"), do: :dim

  defp status_variant("failed"), do: :danger

  defp status_variant(_active), do: :success

  # `@page_size` inside ~H would be an assign lookup, not this attribute.

  defp page_size, do: @page_size

  # The browser's own duration claim when it uploaded one, otherwise the durable

  # session clock. Labeled the same either way, because neither is a measurement

  # of the audio itself.

  defp format_call_length(%Call{recording: %{client_duration_ms: ms}}) when is_integer(ms),

    do: format_duration_ms(ms)

  # A date, not a timestamp. An operator scanning a list wants to know roughly

  # when, and to-the-second precision in a column invites arithmetic nobody

  # asked for.

  defp date(nil), do: "—"

  defp date(%DateTime{} = at), do: at |> DateTime.to_date() |> Date.to_iso8601()

  defp format_call_length(%Call{started_at: started, ended_at: ended})

       when not is_nil(started) and not is_nil(ended),

       do: started |> DateTime.diff(ended, :millisecond) |> abs() |> format_duration_ms()

  defp date(%NaiveDateTime{} = at),

    do: at |> NaiveDateTime.to_date() |> Date.to_iso8601()

  defp format_call_length(%Call{}), do: "—"

  defp format_duration_ms(ms) when is_integer(ms) and ms >= 0 do

    total_seconds = div(ms, 1_000)

    minutes = div(total_seconds, 60)

    seconds = rem(total_seconds, 60)

    "#{minutes}:#{String.pad_leading(Integer.to_string(seconds), 2, "0")}"

  end

  defp format_timestamp(nil), do: "—"

  defp format_timestamp(%DateTime{} = at) do

    at

    |> DateTime.truncate(:second)

    |> Calendar.strftime("%Y-%m-%d %H:%M:%S UTC")

  end

  defp format_bytes(bytes) when is_integer(bytes) and bytes < 1_024, do: "#{bytes} B"

  defp format_bytes(bytes) when is_integer(bytes) and bytes < 1_048_576,

    do: "#{Float.round(bytes / 1_024, 1)} KB"

  defp format_bytes(bytes) when is_integer(bytes),

    do: "#{Float.round(bytes / 1_048_576, 1)} MB"

  defp format_bytes(_bytes), do: "0 B"

  defp format_count(count) when is_integer(count) do

    count

    |> Integer.to_string()

    |> String.reverse()

    |> String.replace(~r/(\d{3})(?=\d)/, "\\1,")

    |> String.reverse()

  end

  defp status_variant("active"), do: :success

  defp status_variant("banned"), do: :danger

  defp status_variant(_status), do: :default

end

  `/admin` is the only surface that reads across accounts for one person, so the

  gate matters more than the layout: who reaches it, who is told nothing, and

  what the page is allowed to show once it renders.

  It lists accounts and activity counts. It does not list content, and the

  assertions below hold that line: knowing someone sent forty messages is an

  operational fact, reading them is a different decision entirely.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Phoenix.LiveViewTest

  alias OpenAgents.Conversations

  alias OpenAgents.Voice

  alias OpenAgents.Voice.Config

  alias OpenAgents.Voice.Recordings

  @webm "audio/webm;codecs=opus"

  describe "access" do

    test "the operator reaches the panel", %{conn: conn} do

      {:ok, _view, html} = live(conn, ~p"/admin")

      assert html =~ "Voice calls"

      assert html =~ "Accounts"

    end

    test "an ordinary authenticated account is redirected and told nothing", %{conn: conn} do

  end

  describe "the panel" do

    test "lists recording metadata without exposing a playback route", %{conn: conn} do

      caller = github_user("admin-recorded-caller")

      session = recorded_call(caller)

    test "lists every account with when it joined and what it has done", %{conn: conn} do

      subject = github_user("admin-listed-account")

      {:ok, conversation} = Conversations.ensure_conversation(subject)

      conn = log_in_admin_user(conn, "admin-listener")

      {:ok, _records} =

        Conversations.create_turn(conversation, "a message the operator must not read")

      conn = log_in_admin_user(conn, "admin-lister")

      {:ok, view, html} = live(conn, ~p"/admin")

      assert html =~ "@#{caller.github_login}"

      assert has_element?(view, "#admin-call-#{session.id}")

      refute has_element?(view, "audio")

      refute html =~ "/admin/recordings/"

      assert html =~ "Complete upload"

      assert html =~ "@#{subject.github_login}"

      assert has_element?(view, "#admin-account-#{subject.id}")

      assert has_element?(view, "#admin-accounts")

    end

    test "lists calls with no audio and says why, instead of hiding them", %{conn: conn} do

      caller = github_user("admin-silent-caller")

      {:ok, conversation} = Conversations.ensure_conversation(caller)

      {:ok, session} = Voice.admit_session(conversation, enabled_config())

      {:ok, _ended} = Voice.end_session(session, session.generation, "user_ended")

    test "counts activity without exposing any of its content", %{conn: conn} do

      subject = github_user("admin-content-account")

      {:ok, conversation} = Conversations.ensure_conversation(subject)

      {:ok, _records} = Conversations.create_turn(conversation, "the private text of a message")

      conn = log_in_admin_user(conn, "admin-silent-listener")

      {:ok, view, html} = live(conn, ~p"/admin")

      conn = log_in_admin_user(conn, "admin-content-reader")

      {:ok, _view, html} = live(conn, ~p"/admin")

      assert has_element?(view, "#admin-call-#{session.id}")

      assert html =~ "No audio uploaded"

      refute has_element?(view, "#admin-audio-#{session.id}")

      refute html =~ "the private text of a message"

    end

    test "renders transcript counts but never transcript content", %{conn: conn} do

      caller = github_user("admin-transcript-caller")

      session = recorded_call(caller)

      {:ok, session} = Voice.attach_provider(session, session.generation, "rtc_admin_transcript")

      {:ok, session, _event, :created} =

        Voice.record_provider_event(

          session,

          session.generation,

          %OpenAgents.Voice.ProviderEvent{

            kind: :session_ready,

            provider_event_id: "evt-admin-ready",

            payload: %{}

          }

        )

      {:ok, _session, _event, :created} =

        Voice.record_provider_event(

          session,

          session.generation,

          %OpenAgents.Voice.ProviderEvent{

            kind: :user_transcript_final,

            provider_event_id: "evt-admin-user",

            payload: %{

              "item_id" => "item-admin-user",

              "response_id" => nil,

              "content" => "my private banking password is hunter2"

            }

          }

        )

      conn = log_in_admin_user(conn, "admin-transcript-listener")

      {:ok, _view, html} = live(conn, ~p"/admin")

    test "carries no recording surface at all", %{conn: conn} do

      conn = log_in_admin_user(conn, "admin-no-recording")

      {:ok, view, html} = live(conn, ~p"/admin")

      assert html =~ "1 items"

      refute html =~ "hunter2"

      # The product does not capture call audio, and an operator panel whose

      # only view is of a capability that does not run describes the system

      # inaccurately to the person who most needs an accurate picture.

      refute has_element?(view, "audio")

      refute html =~ "/admin/recordings/"

      refute html =~ "Voice calls"

      refute html =~ "RECORDING"

    end

    test "renders no composed instructions, tool catalog, or provider call identity",

    test "an account with no activity is listed with zeroes rather than dropped",

         %{conn: conn} do

      caller = github_user("admin-secrets-caller")

      session = recorded_call(caller)

      {:ok, attached} = Voice.attach_provider(session, session.generation, "rtc_admin_secret")

      quiet = github_user("admin-quiet-account")

      conn = log_in_admin_user(conn, "admin-secrets-listener")

      {:ok, _view, html} = live(conn, ~p"/admin")

      conn = log_in_admin_user(conn, "admin-quiet-reader")

      {:ok, view, _html} = live(conn, ~p"/admin")

      refute html =~ attached.provider_session_id

      refute html =~ attached.instruction_digest

      refute html =~ "sarah.realtime_tool_catalog"

      assert has_element?(view, "#admin-account-#{quiet.id}")

    end

    test "states the retention window, because listenable forever is a different promise",

    test "renders no composed instructions, tool catalog, or provider call identity",

         %{conn: conn} do

      conn = log_in_admin_user(conn, "admin-retention-listener")

      conn = log_in_admin_user(conn, "admin-no-internals")

      {:ok, _view, html} = live(conn, ~p"/admin")

      assert html =~ "#{Recordings.config().retention_days} days after a call ends"

    end

    test "the browser policy admits same-origin audio without loosening anything", %{conn: conn} do

      conn = log_in_admin_user(conn, "admin-csp-operator")

      response = get(conn, ~p"/admin")

      [policy] = get_resp_header(response, "content-security-policy")

      # No `media-src` directive, so audio falls back to `default-src 'self'`.

      # Asserted rather than assumed: a later directive added for another reason

      # would silently break playback.

      assert policy =~ "default-src 'self'"

      refute policy =~ "media-src"

    end

    test "shows an empty state before anyone has called", %{conn: conn} do

      conn = log_in_admin_user(conn, "admin-empty-listener")

      {:ok, view, _html} = live(conn, ~p"/admin")

      assert has_element?(view, "#admin-empty")

      refute html =~ "system_prompt"

      refute html =~ "tool_catalog"

      refute html =~ "gpt-realtime"

    end

    test "renders the shared command bar with only the way back", %{conn: conn} do

      conn = log_in_admin_user(conn, "admin-chrome-operator")

    test "the shell supplies the chrome; the panel builds none of its own", %{conn: conn} do

      conn = log_in_admin_user(conn, "admin-chrome")

      {:ok, view, _html} = live(conn, ~p"/admin")

      refute has_element?(view, "header.command-bar")

      assert has_element?(view, ~s(#sidebar a.sidebar-row__hit[href="/chat"]))

      assert has_element?(view, "#account-bar-trigger")

      # Nothing navigates onward from here, and nothing in the product links in.

      refute has_element?(view, "#open-leaderboard")

      assert has_element?(view, "#sidebar")

    end

  end

  defp recorded_call(user) do

    {:ok, conversation} = Conversations.ensure_conversation(user)

    {:ok, session} = Voice.admit_session(conversation, enabled_config())

    {:ok, _chunk} = Recordings.append_chunk(session, session.generation, 1, "opus-bytes", @webm)

    {:ok, _recording} = Recordings.finalize(session, session.generation, "complete", 3_000)

    session

  end

  defp enabled_config do

    Config.build!(

      enabled: true,

      architecture: :openai_realtime,

      provider: "openai",

      model: "gpt-realtime-2.1",

      voice: "marin",

      reasoning_effort: "low",

      maximum_session_seconds: 3_000

    )

  end

end