Skip to content

Comments

Remove admin logic#42

Merged
dgellow merged 4 commits intomainfrom
session-lifecycle-fixes
Feb 14, 2026
Merged

Remove admin logic#42
dgellow merged 4 commits intomainfrom
session-lifecycle-fixes

Conversation

@dgellow
Copy link
Member

@dgellow dgellow commented Feb 14, 2026

No description provided.

Remove the admin UI and all code that only existed to support it:
adminauth package, admin handlers, admin template, admin config,
admin validation, user tracking (UpsertUser and backing storage),
and unused emailutil.Normalize.
@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello @dgellow, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request undertakes a significant refactoring by entirely removing the administrative subsystem. This includes the admin user interface, all related authorization logic, and the underlying user management capabilities within the storage layer. The change aims to simplify the application's architecture, reduce its feature set, and decrease the complexity associated with maintaining administrative roles and user tracking.

Highlights

  • Admin Logic Removal: Completely removed all admin-related functionality, including the adminauth package, AdminConfig type, and associated handlers and middleware.
  • Admin UI Deletion: Deleted the admin.html template and its corresponding Go files, effectively removing the admin user interface.
  • Configuration Simplification: Streamlined the configuration schema by eliminating the AdminConfig struct and its usage within ProxyConfig.
  • User Tracking Removal: Removed all user-specific tracking and management methods (e.g., UpsertUser, GetUser, SetUserAdmin) from the storage.Storage interface and its implementations, indicating that the system no longer persistently tracks individual user information or admin status.
  • Email Utility Simplification: Removed the emailutil.Normalize function and its tests, as it was primarily used for admin email handling.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • CLAUDE.md
    • Removed reference to the 'adminauth/' directory from the internal structure documentation.
  • config-admin-example.json
    • Removed the entire example configuration file for admin settings.
  • internal/adminauth/admin.go
    • Removed the entire file, deleting all admin authorization logic.
  • internal/adminauth/admin_test.go
    • Removed the entire file, deleting all tests for admin authorization logic.
  • internal/config/types.go
    • Removed the 'AdminConfig' struct definition.
    • Removed the 'Admin' field from the 'ProxyConfig' struct.
  • internal/config/unmarshal.go
    • Removed the import of the 'emailutil' package.
    • Removed the 'Admin' field from the 'rawProxyConfig' anonymous struct.
    • Removed the logic for normalizing admin emails during configuration unmarshalling.
  • internal/config/validation.go
    • Removed admin-related validation logic from 'validateProxyStructure'.
    • Removed the 'validateAdminStructure' function.
  • internal/emailutil/email.go
    • Removed the 'Normalize' function.
  • internal/emailutil/email_test.go
    • Removed the entire file, deleting all tests for the email normalization utility.
  • internal/mcpfront.go
    • Removed the initialization and setup of admin users in storage.
    • Removed the 'adminLogger' middleware.
    • Removed the entire block responsible for setting up and handling admin UI routes and middleware.
  • internal/server/admin_handlers.go
    • Removed the entire file, deleting all admin UI handler functions.
  • internal/server/admin_handlers_test.go
    • Removed the entire file, deleting all tests for admin UI handlers.
  • internal/server/auth_handlers.go
    • Removed the call to 'h.storage.UpsertUser' after successful user authentication.
  • internal/server/mcp_handler.go
    • Removed the 'trackUserAccess' function.
    • Removed calls to 'trackUserAccess' from 'handleSSERequest', 'handleMessageRequest', 'handleStreamablePost', and 'handleStreamableGet'.
  • internal/server/mcp_handler_test.go
    • Removed the mock implementation for 'UpsertUser' in 'mockStorage'.
  • internal/server/middleware.go
    • Removed imports for 'adminauth' and 'storage' packages.
    • Removed the 'adminMiddleware' function.
    • Removed the 'NewAdminMiddleware' factory function.
  • internal/server/templates.go
    • Removed the 'adminPageTemplateHTML' variable.
    • Removed the 'adminPageTemplate' variable.
  • internal/server/templates/admin.html
    • Removed the entire HTML template file for the admin dashboard.
  • internal/storage/firestore.go
    • Removed the 'usersCollection' constant.
    • Removed the 'UserDoc' struct definition.
    • Removed 'UpsertUser', 'GetUser', 'GetAllUsers', 'UpdateUserStatus', 'DeleteUser', 'SetUserAdmin', and 'GetActiveSessions' methods.
  • internal/storage/memory.go
    • Removed the 'users' map and 'usersMutex' fields.
    • Removed 'UpsertUser', 'GetUser', 'GetAllUsers', 'UpdateUserStatus', 'DeleteUser', 'SetUserAdmin', and 'GetActiveSessions' methods.
  • internal/storage/storage.go
    • Removed 'ErrUserNotFound' and 'ErrSessionNotFound' error variables.
    • Removed the 'UserInfo' struct definition.
    • Removed 'UpsertUser', 'GetUser', 'GetAllUsers', 'UpdateUserStatus', 'DeleteUser', 'SetUserAdmin', and 'GetActiveSessions' from the 'Storage' interface.
  • internal/storage/storage_test.go
    • Updated session tests to directly access the internal 'store.sessions' map instead of using the removed 'GetActiveSessions' method.
    • Removed the 'delete user cascades to sessions' test case, as user management functionality was removed.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request effectively removes the admin functionality from the application. The changes are comprehensive, covering the removal of the admin UI, API handlers, configuration, and the underlying user tracking and management system in the storage layer. The related adminauth package and its dependencies have been cleanly excised. The removal of user tracking simplifies the storage interface and its implementations considerably. The tests have been updated appropriately to reflect these changes, including refactoring tests that depended on removed functions. Overall, this is a clean and well-executed removal of a major feature, resulting in a simpler codebase.

Delete unused GetGrantTypes/GetResponseTypes on storage.Client. Remove
double-fetch and dead fallback path in getUserTokenIfAvailable. Extract
streamSSEResponse helper to deduplicate identical read-flush loops in
sse_proxy and streamable_proxy. Fix stale CLAUDE.md references to
removed packages and replaced fosite library.
Fix response header loss: WriteHeader was called before copying backend
response headers, silently dropping them. Swap order in both
forwardMessageToBackend and forwardStreamablePostToBackend.

Fix incomplete hop-by-hop stripping: add Keep-Alive, Transfer-Encoding,
TE, Trailer, Proxy-Authorization, Proxy-Authenticate per RFC 9110.

Fix inline server env vars: parent env was appended after custom env
(overwriting custom), and timeout re-created cmd losing all env vars.
Now sets parent env first, custom second, and creates cmd after timeout.

Fix session registration bypassing token refresh: was calling
storage.GetUserToken directly instead of getUserToken which handles
OAuth refresh, token rotation, and formatting.

Remove dead code: CSRF cookie functions, ValidateScopes,
GenerateClientSecret, ParseTokenResponse, json.Write,
ProtectedResourceMetadataURI, WithUser, Options.PanicIfInvalid.

Collapse NewServiceAuthMiddleware one-liner wrapper into the real
function. Unexport SessionCookie (only used within package).
@dgellow dgellow merged commit c694f60 into main Feb 14, 2026
2 checks passed
@dgellow dgellow deleted the session-lifecycle-fixes branch February 14, 2026 23:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant