Merge branch 'feat/UI-enhancments' into 'main'

*

!pyproject.toml

!uv.lock

!README.md

!src/portal_service/

!portal-gui/

**/__pycache__

portal-gui/node_modules

portal-gui/dist

portal-gui/.env*.local

APP_VERSION=dev

POSTGRESQL_SETTINGS__URL="postgresql+asyncpg://portal:portal@localhost:5432/portal"

POSTGRESQL_SETTINGS__CREATE_SCHEMA_ON_STARTUP=true

# Login through Keycloak. Set AUTH__SECURITY_MODE="none" to skip it.

AUTH__SECURITY_MODE="jwt"

OIDC__ISSUER="http://<keycloak-host>/realms/oop"

OIDC__CLIENT_ID="oop-portal"

OIDC__CLIENT_SECRET="change-me"

# The GUI dev server's address, which proxies /api here, so the login cookies

# belong to the address the browser is on. Keycloak's client must accept it.

OIDC__REDIRECT_URI="http://localhost:3000/api/auth/callback"

# OEG, which the GUI reaches through the portal at /api/oeg/* with the user's token.

OEG__BASE_URL="http://localhost:8080"

# The AI2 agent's chat endpoint, which the GUI reaches through the portal at /api/ai2/chat.

AI2__CHAT_URL="http://localhost:9013/groq-mcp"

# API products and their scopes.

API_PRODUCTS__FILE="api-products.example.json"

# Python

.venv/

.cache/

*.egg-info/

__pycache__/

.coverage

*.py[cod]

# Local environment

.env

.env.*

!.env.example

workflow:

  rules:

    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS

      when: never

    - if: $CI_COMMIT_BRANCH

stages:

  - backend

  - frontend

variables:

  UV_CACHE_DIR: "$CI_PROJECT_DIR/.cache/uv"

.backend:

  stage: backend

  image: python:3.12-slim

  needs: []

  cache:

    paths:

      - .cache/uv

  before_script:

    - cd "$CI_PROJECT_DIR/${BACKEND_DIR:-.}"

    - pip install uv

    - export UV_SYSTEM_CERTS=1

    - uv sync --locked --extra dev

    - . .venv/bin/activate

  rules:

    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH == "develop"

    - changes:

        - src/**/*

        - tests/**/*

        - pyproject.toml

        - uv.lock

        - .gitlab-ci.yml

.frontend:

  stage: frontend

  image: node:22-slim

  needs: []

  cache:

    key:

      files:

        - portal-gui/package-lock.json

    paths:

      - portal-gui/.npm/

  before_script:

    - cd "$CI_PROJECT_DIR/portal-gui"

    - npm ci --cache .npm --prefer-offline --no-audit --no-fund

  rules:

    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH == "develop"

    - changes:

        - portal-gui/**/*

        - .gitlab-ci.yml

backend:format:

  extends: .backend

  script:

    - ruff format --check src/ tests/

backend:lint:

  extends: .backend

  script:

    - ruff check src/ tests/

backend:type:

  extends: .backend

  script:

    - mypy src/ tests/

backend:architecture:

  extends: .backend

  script:

    - lint-imports

backend:test:

  extends: .backend

  needs: [backend:format, backend:lint, backend:type, backend:architecture]

  variables:

    DOCKER_HOST: tcp://docker:2375

    DOCKER_TLS_CERTDIR: ""

  services:

    - docker:dind

  script:

    - pytest --cov=src/portal_service --cov-branch --cov-report=term-missing

  coverage: '/TOTAL.+ ([0-9]{1,3}(?:\.[0-9]+)?%)/'

gui:format:

  extends: .frontend

  script:

    - npm run format:check

gui:lint:

  extends: .frontend

  script:

    - npm run lint

gui:typecheck:

  extends: .frontend

  script:

    - npm run typecheck

gui:build:

  extends: .frontend

  needs: [gui:format, gui:lint, gui:typecheck]

  script:

    - npm run build

default_install_hook_types: [pre-commit, pre-push]

default_stages: [pre-commit]

repos:

- repo: https://github.com/pre-commit/pre-commit-hooks

  rev: v6.0.0

  hooks:

    - id: check-yaml

      exclude: ^deployment/templates/

    - id: check-toml

    - id: end-of-file-fixer

      stages: [pre-commit]

    - id: trailing-whitespace

      stages: [pre-commit]

      args: [--markdown-linebreak-ext=md]

- repo: https://github.com/astral-sh/ruff-pre-commit

  rev: v0.15.6

  hooks:

    - id: ruff-check

      args: [--fix, --cache-dir, .cache/ruff]

    - id: ruff-format

      args: [--cache-dir, .cache/ruff]

- repo: https://github.com/pre-commit/mirrors-mypy

  rev: v1.19.1

  hooks:

    - id: mypy

      files: ^(src|tests)/

      args: [--strict, --ignore-missing-imports, --cache-dir, .cache/mypy]

      additional_dependencies: [

        "fastapi[standard]>=0.115.0",

        "httpx>=0.28.0",

        "pydantic-settings>=2.9.1",

        "PyJWT[crypto]>=2.10.1",

        "pytest>=8.0.0",

        "pytest-asyncio>=0.25.0",

        "sqlalchemy>=2.0.48",

        "structlog>=25.0.0",

      ]

# portal-gui: run through its own node_modules, so hooks and CI use the same versions.

- repo: local

  hooks:

    - id: gui-prettier

      name: prettier (portal-gui)

      language: system

      entry: bash -c 'cd portal-gui && npx --no-install prettier --write --ignore-unknown "${@#portal-gui/}"' --

      files: ^portal-gui/

    - id: gui-eslint

      name: eslint (portal-gui)

      language: system

      entry: bash -c 'cd portal-gui && npx --no-install eslint --fix --no-warn-ignored "${@#portal-gui/}"' --

      files: ^portal-gui/.*\.(ts|tsx)$

    - id: gui-typecheck

      name: typecheck (portal-gui)

      language: system

      entry: npm --prefix portal-gui run typecheck

      files: ^portal-gui/

      pass_filenames: false

      stages: [pre-push]