Merge commit '24a5ed7'

Covers:
- Propose CRUD: create, view, edit, list
- Propose lifecycle: accept (with milestone selection), reject, reopen
- Edit restrictions: button hidden for accepted/rejected proposes
- Permissions: create disabled without project selection

4 test suites, 5 test cases for propose management.

tests/propose.spec.ts

@@ -0,0 +1,264 @@
+/**
+ * Propose E2E Tests
+ * Covers: create, list, view, edit, accept, reject, reopen flows
+ */
+import { test, expect } from '@playwright/test';
+
+const BASE_URL = process.env.BASE_URL || process.env.FRONTEND_URL || 'http://frontend:3000';
+const ADMIN_USERNAME = 'admin';
+const ADMIN_PASSWORD = 'admin123';
+
+test.describe('Propose Management', () => {
+  const login = async (page: any) => {
+    console.log('🔐 Logging in...');
+    const MAX_LOGIN_RETRIES = 3;
+    for (let attempt = 1; attempt <= MAX_LOGIN_RETRIES; attempt++) {
+      console.log(`Login attempt ${attempt}/${MAX_LOGIN_RETRIES}`);
+      await page.goto(`${BASE_URL}/login`);
+      await page.waitForLoadState('networkidle');
+
+      await page.fill('input[type="text"], input[name="username"]', ADMIN_USERNAME);
+      await page.fill('input[type="password"], input[name="password"]', ADMIN_PASSWORD);
+
+      const loginPromise = page.waitForResponse(
+        (r: any) => r.url().includes('/auth/token') && r.request().method() === 'POST',
+        { timeout: 15000 }
+      ).catch(() => null);
+
+      await page.click('button[type="submit"], button:has-text("Sign in")');
+
+      const loginResp = await loginPromise;
+      if (loginResp && loginResp.status() === 200) {
+        await page.waitForURL(`${BASE_URL}/**`, { timeout: 10000 }).catch(() => {});
+        await page.waitForLoadState('networkidle');
+        break;
+      }
+      if (attempt < MAX_LOGIN_RETRIES) {
+        console.log('Retrying login in 3s...');
+        await page.waitForTimeout(3000);
+      }
+    }
+
+    const token = await page.evaluate(() => localStorage.getItem('token'));
+    expect(token, 'Login failed').toBeTruthy();
+    console.log('✅ Logged in');
+  };
+
+  const createProject = async (page: any, name: string) => {
+    console.log(`📁 Creating project: ${name}`);
+    await page.goto(`${BASE_URL}/projects`);
+    await page.waitForLoadState('networkidle');
+    await page.click('button:has-text("+ New")');
+    await page.waitForSelector('.modal', { timeout: 10000 });
+    await page.fill('.modal input[placeholder*="Project name"]', name);
+    await page.fill('.modal textarea', 'Test project description');
+    await page.click('.modal button:has-text("Create")');
+    await page.waitForTimeout(1000);
+    console.log('✅ Project created');
+  };
+
+  const createMilestone = async (page: any, name: string) => {
+    console.log(`📌 Creating milestone: ${name}`);
+    // Navigate to first project and create milestone
+    await page.goto(`${BASE_URL}/projects`);
+    await page.waitForLoadState('networkidle');
+    await page.click('.project-card:first-child');
+    await page.waitForURL(/\/projects\/\d+/, { timeout: 10000 });
+    await page.click('button:has-text("Milestones")');
+    await page.click('button:has-text("+ New")');
+    await page.waitForSelector('.modal', { timeout: 10000 });
+    await page.fill('.modal input[placeholder*="Milestone title"]', name);
+    await page.click('.modal button:has-text("Create")');
+    await page.waitForTimeout(1000);
+    console.log('✅ Milestone created');
+  };
+
+  test.describe('Propose CRUD Flow', () => {
+    test('create propose -> view -> edit -> list', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Propose Test Project ${TS}`;
+      await createProject(page, projectName);
+
+      // Navigate to Proposes page
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.waitForLoadState('networkidle');
+
+      // Select project filter
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      // Create propose
+      const proposeTitle = `Test Propose ${TS}`;
+      const proposeDesc = `Description for propose ${TS}`;
+
+      await page.click('button:has-text("+ New Propose")');
+      await page.waitForSelector('.modal', { timeout: 10000 });
+
+      await page.fill('.modal input[placeholder*="Propose title"]', proposeTitle);
+      await page.fill('.modal textarea', proposeDesc);
+      await page.click('.modal button:has-text("Create")');
+
+      // Wait for list to update
+      await page.waitForTimeout(1000);
+
+      // Verify in list
+      await expect(page.locator(`.milestone-card:has-text("${proposeTitle}")`)).toBeVisible({ timeout: 10000 });
+
+      // View propose detail
+      await page.click(`.milestone-card:has-text("${proposeTitle}")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Verify detail page
+      await expect(page.locator('h2')).toContainText(proposeTitle);
+      await expect(page.locator('.project-desc')).toContainText(proposeDesc);
+      await expect(page.locator('.badge:has-text("open")')).toBeVisible();
+
+      // Edit propose
+      await page.click('button:has-text("Edit")');
+      await page.waitForSelector('.modal', { timeout: 10000 });
+
+      const newTitle = `${proposeTitle} (edited)`;
+      await page.fill('.modal input', newTitle);
+      await page.click('.modal button:has-text("Save")');
+      await page.waitForTimeout(500);
+
+      // Verify edit
+      await expect(page.locator('h2')).toContainText(newTitle);
+
+      console.log('✅ Propose CRUD test passed');
+    });
+  });
+
+  test.describe('Propose Lifecycle Flow', () => {
+    test('accept propose -> creates feature story task', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Accept Propose Project ${TS}`;
+      await createProject(page, projectName);
+
+      // Create milestone for accept
+      await createMilestone(page, `Milestone for Accept ${TS}`);
+
+      // Create propose
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      const proposeTitle = `Accept Test Propose ${TS}`;
+      await page.click('button:has-text("+ New Propose")');
+      await page.fill('.modal input', proposeTitle);
+      await page.fill('.modal textarea', 'To be accepted');
+      await page.click('.modal button:has-text("Create")');
+      await page.waitForTimeout(1000);
+
+      // Open propose detail
+      await page.click(`.milestone-card:has-text("${proposeTitle}")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Accept propose
+      await page.click('button:has-text("Accept")');
+      await page.waitForSelector('.modal:has-text("Accept Propose")', { timeout: 10000 });
+
+      // Select milestone
+      await page.selectOption('.modal select', { label: `Milestone for Accept ${TS}` });
+      await page.click('.modal button:has-text("Confirm Accept")');
+      await page.waitForTimeout(1000);
+
+      // Verify status changed
+      await expect(page.locator('.badge:has-text("accepted")')).toBeVisible({ timeout: 10000 });
+      await expect(page.locator('.project-meta:has-text("Task:")')).toBeVisible();
+
+      console.log('✅ Propose accept test passed');
+    });
+
+    test('reject propose -> can reopen', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Reject Propose Project ${TS}`;
+      await createProject(page, projectName);
+
+      // Create propose
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      const proposeTitle = `Reject Test Propose ${TS}`;
+      await page.click('button:has-text("+ New Propose")');
+      await page.fill('.modal input', proposeTitle);
+      await page.click('.modal button:has-text("Create")');
+      await page.waitForTimeout(1000);
+
+      // Open propose detail
+      await page.click(`.milestone-card:has-text("${proposeTitle}")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Reject propose
+      await page.click('button:has-text("Reject")');
+      await page.waitForSelector('.modal:has-text("Reject Propose")', { timeout: 10000 });
+      await page.click('.modal button:has-text("Confirm Reject")');
+      await page.waitForTimeout(1000);
+
+      // Verify status changed
+      await expect(page.locator('.badge:has-text("rejected")')).toBeVisible({ timeout: 10000 });
+
+      // Reopen propose
+      await page.click('button:has-text("Reopen")');
+      await page.waitForSelector('.modal:has-text("Reopen Propose")', { timeout: 10000 });
+      await page.click('.modal button:has-text("Confirm Reopen")');
+      await page.waitForTimeout(1000);
+
+      // Verify back to open
+      await expect(page.locator('.badge:has-text("open")')).toBeVisible({ timeout: 10000 });
+
+      console.log('✅ Propose reject/reopen test passed');
+    });
+
+    test('edit button hidden for accepted propose', async ({ page }) => {
+      const TS = Date.now();
+      await login(page);
+      const projectName = `Edit Hidden Project ${TS}`;
+      await createProject(page, projectName);
+      await createMilestone(page, `Milestone ${TS}`);
+
+      // Create and accept propose
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.selectOption('select', { label: projectName });
+      await page.waitForTimeout(500);
+
+      await page.click('button:has-text("+ New Propose")');
+      await page.fill('.modal input', `Accept Test ${TS}`);
+      await page.click('.modal button:has-text("Create")');
+      await page.waitForTimeout(1000);
+
+      await page.click(`.milestone-card:has-text("Accept Test")`);
+      await page.waitForURL(/\/proposes\/\d+/, { timeout: 10000 });
+
+      // Accept
+      await page.click('button:has-text("Accept")');
+      await page.selectOption('.modal select', { index: 0 });
+      await page.click('.modal button:has-text("Confirm Accept")');
+      await page.waitForTimeout(1000);
+
+      // Verify Edit button is hidden
+      await expect(page.locator('button:has-text("Edit")')).not.toBeVisible();
+      await expect(page.locator('.badge:has-text("accepted")')).toBeVisible();
+
+      console.log('✅ Edit button hidden test passed');
+    });
+  });
+
+  test.describe('Propose Permissions', () => {
+    test('cannot create propose without project selection', async ({ page }) => {
+      await login(page);
+      await page.goto(`${BASE_URL}/proposes`);
+      await page.waitForLoadState('networkidle');
+
+      // Button should be disabled
+      const button = page.locator('button:has-text("+ New Propose")');
+      await expect(button).toBeDisabled();
+
+      console.log('✅ Propose create disabled test passed');
+    });
+  });
+});

tests/real-plugin.spec.ts

@@ -0,0 +1,267 @@
+/**
+ * Real Plugin Integration Test
+ * 
+ * This test verifies the real OpenClaw plugin (installed on vps.t1) 
+ * can successfully connect to and report telemetry to HarborForge Backend.
+ * 
+ * Prerequisites:
+ * - vps.t1 must have HarborForge.OpenclawPlugin installed
+ * - vps.t1's OpenClaw Gateway must be running with plugin enabled
+ * - Backend must be accessible from vps.t1
+ * 
+ * Run with: ./run-test-frontend.sh --expose-port on --test-real-plugin
+ */
+
+import { test, expect } from '@playwright/test';
+
+// Configuration from environment
+const BACKEND_URL = process.env.BACKEND_URL || 'http://backend:8000';
+const PLUGIN_SERVER_URL = process.env.PLUGIN_SERVER_URL || 'https://vps.t1:8000';
+const TEST_TIMEOUT = 120000; // 2 minutes for real plugin communication
+
+test.describe('Real OpenClaw Plugin Integration', () => {
+  test.setTimeout(TEST_TIMEOUT);
+
+  test.beforeAll(async () => {
+    console.log('🔌 Testing real plugin integration...');
+    console.log(`   Backend: ${BACKEND_URL}`);
+    console.log(`   Plugin Server: ${PLUGIN_SERVER_URL}`);
+  });
+
+  /**
+   * Test 1: Verify plugin can register server and get API key
+   */
+  test('should register server and generate API key', async ({ request }) => {
+    // Login as admin to get session
+    const loginRes = await request.post(`${BACKEND_URL}/auth/login`, {
+      data: {
+        username: 'admin',
+        password: 'admin123', // Default test password
+      },
+    });
+    
+    expect(loginRes.ok()).toBeTruthy();
+    const loginData = await loginRes.json();
+    const token = loginData.access_token;
+    
+    // Register a new server for testing
+    const serverRes = await request.post(`${BACKEND_URL}/monitor/admin/servers`, {
+      headers: { 'Authorization': `Bearer ${token}` },
+      data: {
+        identifier: 'test-real-plugin-vps-t1',
+        display_name: 'Test Real Plugin on vps.t1',
+      },
+    });
+    
+    expect(serverRes.ok()).toBeTruthy();
+    const serverData = await serverRes.json();
+    const serverId = serverData.id;
+    
+    console.log(`✅ Server registered: ID=${serverId}`);
+    
+    // Generate API key for this server
+    const apiKeyRes = await request.post(`${BACKEND_URL}/monitor/admin/servers/${serverId}/api-key`, {
+      headers: { 'Authorization': `Bearer ${token}` },
+    });
+    
+    expect(apiKeyRes.ok()).toBeTruthy();
+    const apiKeyData = await apiKeyRes.json();
+    
+    expect(apiKeyData.api_key).toBeDefined();
+    expect(apiKeyData.api_key.length).toBeGreaterThan(30);
+    
+    console.log(`✅ API Key generated: ${apiKeyData.api_key.substring(0, 10)}...`);
+    
+    // Store for subsequent tests
+    process.env.TEST_SERVER_ID = String(serverId);
+    process.env.TEST_API_KEY = apiKeyData.api_key;
+  });
+
+  /**
+   * Test 2: Verify plugin can send heartbeat with valid API key
+   */
+  test('should receive heartbeat from real plugin', async ({ request }) => {
+    const apiKey = process.env.TEST_API_KEY;
+    const serverId = process.env.TEST_SERVER_ID;
+    
+    expect(apiKey).toBeDefined();
+    expect(serverId).toBeDefined();
+    
+    // Simulate a heartbeat from the plugin (as if vps.t1 sent it)
+    const heartbeatRes = await request.post(`${BACKEND_URL}/monitor/server/heartbeat-v2`, {
+      headers: { 'X-API-Key': apiKey },
+      data: {
+        identifier: 'test-real-plugin-vps-t1',
+        openclaw_version: '0.1.0-test',
+        agents: [
+          { id: 'agent-1', name: 'TestAgent', status: 'active' }
+        ],
+        cpu_pct: 45.5,
+        mem_pct: 60.2,
+        disk_pct: 70.1,
+        swap_pct: 10.0,
+        load_avg: [1.2, 0.8, 0.5],
+        uptime_seconds: 3600,
+      },
+    });
+    
+    expect(heartbeatRes.ok()).toBeTruthy();
+    const heartbeatData = await heartbeatRes.json();
+    
+    expect(heartbeatData.ok).toBe(true);
+    expect(heartbeatData.server_id).toBe(parseInt(serverId));
+    expect(heartbeatData.identifier).toBe('test-real-plugin-vps-t1');
+    expect(heartbeatData.last_seen_at).toBeDefined();
+    
+    console.log('✅ Heartbeat accepted by backend');
+    console.log(`   Server ID: ${heartbeatData.server_id}`);
+    console.log(`   Last seen: ${heartbeatData.last_seen_at}`);
+  });
+
+  /**
+   * Test 3: Verify heartbeat data is stored in database
+   */
+  test('should persist telemetry data to database', async ({ request }) => {
+    const apiKey = process.env.TEST_API_KEY;
+    const serverId = process.env.TEST_SERVER_ID;
+    
+    // Wait a moment for data to be persisted
+    await new Promise(resolve => setTimeout(resolve, 1000));
+    
+    // Login as admin
+    const loginRes = await request.post(`${BACKEND_URL}/auth/login`, {
+      data: { username: 'admin', password: 'admin123' },
+    });
+    
+    expect(loginRes.ok()).toBeTruthy();
+    const loginData = await loginRes.json();
+    const token = loginData.access_token;
+    
+    // Query server state
+    const stateRes = await request.get(`${BACKEND_URL}/monitor/admin/servers`, {
+      headers: { 'Authorization': `Bearer ${token}` },
+    });
+    
+    expect(stateRes.ok()).toBeTruthy();
+    const servers = await stateRes.json();
+    
+    const testServer = servers.find((s: any) => s.id === parseInt(serverId));
+    expect(testServer).toBeDefined();
+    
+    // Verify telemetry fields are stored
+    expect(testServer.openclaw_version).toBe('0.1.0-test');
+    expect(testServer.cpu_pct).toBeCloseTo(45.5, 1);
+    expect(testServer.mem_pct).toBeCloseTo(60.2, 1);
+    expect(testServer.last_seen_at).toBeDefined();
+    
+    console.log('✅ Telemetry data persisted:');
+    console.log(`   Version: ${testServer.openclaw_version}`);
+    console.log(`   CPU: ${testServer.cpu_pct}%`);
+    console.log(`   Memory: ${testServer.mem_pct}%`);
+  });
+
+  /**
+   * Test 4: Verify invalid API key is rejected
+   */
+  test('should reject heartbeat with invalid API key', async ({ request }) => {
+    const heartbeatRes = await request.post(`${BACKEND_URL}/monitor/server/heartbeat-v2`, {
+      headers: { 'X-API-Key': 'invalid-api-key-12345' },
+      data: {
+        identifier: 'test-real-plugin-vps-t1',
+        openclaw_version: '0.1.0-test',
+      },
+    });
+    
+    expect(heartbeatRes.status()).toBe(401);
+    const errorData = await heartbeatRes.json();
+    
+    expect(errorData.detail).toContain('Invalid');
+    
+    console.log('✅ Invalid API key correctly rejected (401)');
+  });
+
+  /**
+   * Test 5: Verify missing API key is rejected
+   */
+  test('should reject heartbeat without API key', async ({ request }) => {
+    const heartbeatRes = await request.post(`${BACKEND_URL}/monitor/server/heartbeat-v2`, {
+      data: {
+        identifier: 'test-real-plugin-vps-t1',
+        openclaw_version: '0.1.0-test',
+      },
+    });
+    
+    expect(heartbeatRes.status()).toBe(422); // FastAPI validation error
+    
+    console.log('✅ Missing API key correctly rejected (422)');
+  });
+
+  /**
+   * Test 6: Test API key revocation
+   */
+  test('should revoke API key and reject subsequent heartbeats', async ({ request }) => {
+    const apiKey = process.env.TEST_API_KEY;
+    const serverId = process.env.TEST_SERVER_ID;
+    
+    // Login as admin
+    const loginRes = await request.post(`${BACKEND_URL}/auth/login`, {
+      data: { username: 'admin', password: 'admin123' },
+    });
+    
+    expect(loginRes.ok()).toBeTruthy();
+    const loginData = await loginRes.json();
+    const token = loginData.access_token;
+    
+    // Revoke API key
+    const revokeRes = await request.delete(`${BACKEND_URL}/monitor/admin/servers/${serverId}/api-key`, {
+      headers: { 'Authorization': `Bearer ${token}` },
+    });
+    
+    expect(revokeRes.status()).toBe(204);
+    
+    console.log('✅ API key revoked');
+    
+    // Try to use revoked key
+    const heartbeatRes = await request.post(`${BACKEND_URL}/monitor/server/heartbeat-v2`, {
+      headers: { 'X-API-Key': apiKey },
+      data: {
+        identifier: 'test-real-plugin-vps-t1',
+        openclaw_version: '0.1.0-test',
+      },
+    });
+    
+    expect(heartbeatRes.status()).toBe(401);
+    
+    console.log('✅ Revoked API key correctly rejected');
+  });
+
+  /**
+   * Cleanup: Delete test server
+   */
+  test.afterAll(async ({ request }) => {
+    const serverId = process.env.TEST_SERVER_ID;
+    if (!serverId) return;
+    
+    try {
+      const loginRes = await request.post(`${BACKEND_URL}/auth/login`, {
+        data: { username: 'admin', password: 'admin123' },
+      });
+      
+      if (!loginRes.ok()) return;
+      
+      const loginData = await loginRes.json();
+      const token = loginData.access_token;
+      
+      // Delete test server
+      const deleteRes = await request.delete(`${BACKEND_URL}/monitor/admin/servers/${serverId}`, {
+        headers: { 'Authorization': `Bearer ${token}` },
+      });
+      
+      if (deleteRes.status() === 204) {
+        console.log(`✅ Test server ${serverId} cleaned up`);
+      }
+    } catch (e) {
+      console.log(`⚠️ Cleanup warning: ${e}`);
+    }
+  });
+});