[Bpoe]

Summary

• Add a dependency-free admin SPA at /admin/ using vanilla HTML, CSS, and JavaScript to list, search, create, update, delete, and copy links through the existing /api/v1/links endpoints.
• Serve static files before endpoint routing and redirect /admin to /admin/ using default-file middleware. Unknown /admin/* paths return 404 instead of resolving redirect aliases.
• Preserve X-Api-Key protection on the management API. The page is public static content; the key stays in page memory, is cleared from the input on connection, and is forgotten on refresh/disconnect. Disconnect cancels pending requests and clears rendered link data.
• Add integration tests for static assets, routing, reserved paths, and authentication, plus dependency-free Node behavior tests for CRUD, search/copy, validation, expired keys, disconnect races, stale list responses, concurrent mutations, reopened editors, and exact alias preservation. CI runs both test suites.

Design and deployment

• No npm packages, frontend framework, build tool, extra runtime dependency, backend API changes, or database migration.
• Static assets are included in normal Web SDK publish output for portable releases and container images.
• /admin and paths beneath it are reserved for the UI. Production access should use HTTPS.
• Node 22+ is used only to run UI behavior tests, not to build or run the application.

Validation

• Release solution build: passed with zero warnings/errors.
• All 48 .NET integration tests passed with the existing 96% line/branch coverage gate; measured coverage: 99.03% lines, 100% branches.
• All 12 UI behavior tests passed; JavaScript syntax check passed. UI tests use a small DOM adapter rather than a real browser.
• Portable publish succeeded. A temporary Production instance served /admin, /admin/, and the JS/CSS assets successfully; both HTTP deployment tests passed against that instance, including the complete link lifecycle.

Scope

Analytics, click metrics, accounts, new management endpoints, frameworks, and a separate frontend build pipeline are omitted.

[Copilot]

🟡 Changes recommended

Save and Delete can race to recreate a deleted link, with additional unresolved issues affecting alias preservation, list and editor consistency, and text contrast.

5 open issues

• Prevent concurrent save and delete mutations for the same link · New
• Ignore stale list responses after newer mutations · New
• Prevent stale mutation completion from closing a new editor · New
• Preserve existing code aliases during edit saves · New
• Increase muted-text contrast to meet WCAG AA · New

1 file not reviewed

• src/prod/Indirection/wwwroot/admin/styles.css: Generated file

What changed in this PR

Adds a dependency-free admin UI at /admin/ for managing redirects through the existing API, while retaining API-key protection.

Changes:

• Adds link listing, search, creation, editing, deletion, and copying, with an in-memory API key.
• Serves static assets before endpoint routing and reserves admin paths.
• Adds integration and UI behavior tests, CI execution, and usage documentation.

File	Description
src/​test/​Indirection.Tests/​AdminUiTests.cs	Tests static assets, reserved routes, and API authentication.
src/​test/​admin-ui/​app.test.cjs	Tests UI operations, validation, authentication failures, and disconnect races.
src/​prod/​Indirection/​wwwroot/​admin/​styles.css	Adds responsive styling for the admin interface.
src/​prod/​Indirection/​wwwroot/​admin/​index.html	Defines login, link listing, and editor views.
src/​prod/​Indirection/​wwwroot/​admin/​app.js	Implements API access, link management, and session handling.
src/​prod/​Indirection/​Program.cs	Enables static-file serving and reserves admin routes.
README.md	Documents UI usage, security behavior, and testing.
.github/​workflows/​ci.yml	Runs UI behavior tests in CI.

_{Review effort: Balanced}