Add admin dashboard job lead review

Author: michaelmwu

apps/admin_dashboard/src/main.tsx

@@ -27,6 +27,7 @@
 import httpx
 import uvicorn
 from fastapi import FastAPI, Query, Request
+from fastapi.encoders import jsonable_encoder
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse, Response
 from fastapi.staticfiles import StaticFiles
 from pydantic import ValidationError
@@ -55,6 +56,11 @@
 )
 from five08.clients.espo import EspoAPIError, EspoClient
 from five08.logging import configure_observability
+from five08.job_leads import (
+    JobLeadStatus,
+    list_job_leads,
+    review_job_lead,
+)
 from five08.queue import (
     EnqueuedJob,
     JobRecord,
@@ -118,6 +124,9 @@
     DashboardGigApplicationCreateRequest,
     DashboardGigApplicationStatusRequest,
     DashboardGigStatusRequest,
+    DashboardJobLeadPostRequest,
+    DashboardJobLeadReviewRequest,
+    DashboardJobLeadSyncRequest,
     DashboardOnboardingEmailDraftRequest,
     DashboardOnboardingEmailSendRequest,
     DashboardOnboardingStatusRequest,
@@ -1029,6 +1038,48 @@ async def _sync_discord_gig_thread_status(
     return cast(dict[str, Any], payload)
 
 
+async def _post_job_lead_to_discord(
+    request: Request,
+    *,
+    lead_id: str,
+    reviewer_discord_user_id: str,
+    channel_id: str | None = None,
+    tags: str | None = None,
+) -> tuple[dict[str, Any], int]:
+    """Ask the Discord bot to create a jobs forum thread for an approved lead."""
+    base_url = settings.discord_bot_internal_base_url.strip()
+    if not base_url:
+        return {"error": "bot_endpoint_not_configured"}, 503
+
+    api_secret = str(settings.api_shared_secret or "").strip()
+    if not api_secret:
+        return {"error": "api_secret_not_configured"}, 503
+
+    try:
+        response = await _http_client_from_app(request.app).post(
+            f"{base_url.rstrip('/')}/internal/jobs/job-leads/post",
+            headers={"X-API-Secret": api_secret},
+            json={
+                "lead_id": lead_id,
+                "reviewer_discord_user_id": reviewer_discord_user_id,
+                "channel_id": channel_id,
+                "tags": tags,
+            },
+            timeout=15.0,
+        )
+    except httpx.HTTPError as exc:
+        logger.warning("Failed posting job lead %s to Discord: %s", lead_id, exc)
+        return {"error": "bot_request_failed"}, 502
+
+    try:
+        payload = response.json()
+    except ValueError:
+        payload = {}
+    if not isinstance(payload, dict):
+        payload = {}
+    return cast(dict[str, Any], payload), response.status_code
+
+
 MAX_SESSION_COOKIE_CANDIDATES = 5
 
 
@@ -3972,6 +4023,198 @@ async def dashboard_gig_detail_handler(
     return JSONResponse(gigs[0])
 
 
+async def dashboard_job_leads_handler(
+    request: Request,
+    status: str | None = Query(default="pending"),
+    limit: int = Query(default=50, ge=1, le=50),
+) -> JSONResponse:
+    """Return sourced job leads for dashboard review."""
+    _session, error_response = await _dashboard_session_or_error(
+        request,
+        required_permission=DASHBOARD_PERMISSION_GIGS_READ,
+    )
+    if error_response is not None:
+        return error_response
+
+    normalized_status: JobLeadStatus | None
+    if status is None or status.strip().casefold() in {"", "all", "any"}:
+        normalized_status = None
+    else:
+        try:
+            normalized_status = JobLeadStatus(status.strip().casefold())
+        except ValueError:
+            return JSONResponse({"error": "invalid_status"}, status_code=400)
+
+    leads = await asyncio.to_thread(
+        list_job_leads,
+        settings,
+        status=normalized_status,
+        limit=limit,
+    )
+    return JSONResponse(jsonable_encoder(leads))
+
+
+async def dashboard_review_job_lead_handler(
+    request: Request,
+    lead_id: str,
+) -> JSONResponse:
+    """Approve or reject one sourced job lead from the dashboard."""
+    session, error_response = await _dashboard_session_or_error(
+        request,
+        required_permission=DASHBOARD_PERMISSION_GIGS_WRITE,
+    )
+    if error_response is not None:
+        return error_response
+    assert session is not None
+
+    csrf_error = _dashboard_same_origin_post_or_error(request)
+    if csrf_error is not None:
+        return csrf_error
+
+    try:
+        body = await request.json()
+        payload = DashboardJobLeadReviewRequest.model_validate(body)
+    except Exception:
+        return JSONResponse({"error": "invalid_payload"}, status_code=400)
+
+    reviewer = _session_discord_actor_id(session) or session.subject
+    try:
+        lead = await asyncio.to_thread(
+            review_job_lead,
+            settings,
+            lead_id=lead_id,
+            status=payload.status,
+            reviewer_discord_user_id=reviewer,
+        )
+    except ValueError:
+        return JSONResponse({"error": "invalid_status"}, status_code=400)
+
+    if lead is None:
+        return JSONResponse({"error": "job_lead_not_found"}, status_code=404)
+    return JSONResponse(jsonable_encoder(lead))
+
+
+async def dashboard_post_job_lead_handler(
+    request: Request,
+    lead_id: str,
+) -> JSONResponse:
+    """Post one approved sourced job lead to the registered Discord jobs forum."""
+    session, error_response = await _dashboard_session_or_error(
+        request,
+        required_permission=DASHBOARD_PERMISSION_GIGS_WRITE,
+    )
+    if error_response is not None:
+        return error_response
+    assert session is not None
+
+    csrf_error = _dashboard_same_origin_post_or_error(request)
+    if csrf_error is not None:
+        return csrf_error
+
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
+    try:
+        payload = DashboardJobLeadPostRequest.model_validate(body or {})
+    except Exception:
+        return JSONResponse({"error": "invalid_payload"}, status_code=400)
+
+    reviewer = _session_discord_actor_id(session) or session.subject
+    result, status_code = await _post_job_lead_to_discord(
+        request,
+        lead_id=lead_id,
+        reviewer_discord_user_id=reviewer,
+        channel_id=payload.channel_id,
+        tags=payload.tags,
+    )
+    if status_code >= 400:
+        return JSONResponse(result, status_code=status_code)
+
+    actor_provider, actor_subject = _session_audit_actor(session)
+    await _write_auth_audit_event(
+        action="job_leads.post",
+        result=AuditResult.SUCCESS,
+        actor_subject=actor_subject,
+        actor_display_name=session.display_name,
+        actor_provider=actor_provider,
+        resource_type="job_lead",
+        resource_id=str(result.get("lead_id") or lead_id),
+        metadata={
+            "lead_id": result.get("lead_id") or lead_id,
+            "guild_id": result.get("guild_id"),
+            "channel_id": result.get("channel_id"),
+            "thread_id": result.get("thread_id"),
+        },
+    )
+    return JSONResponse(result)
+
+
+async def dashboard_sync_job_leads_handler(request: Request) -> JSONResponse:
+    """Enqueue a sourced job lead scrape from the dashboard."""
+    session, error_response = await _dashboard_session_or_error(
+        request,
+        required_permission=DASHBOARD_PERMISSION_GIGS_WRITE,
+    )
+    if error_response is not None:
+        return error_response
+    assert session is not None
+
+    csrf_error = _dashboard_same_origin_post_or_error(request)
+    if csrf_error is not None:
+        return csrf_error
+
+    try:
+        body = await request.json()
+    except Exception:
+        body = {}
+    try:
+        payload = DashboardJobLeadSyncRequest.model_validate(body or {})
+    except Exception:
+        return JSONResponse({"error": "invalid_payload"}, status_code=400)
+
+    normalized_source = payload.source.strip() or "hackernews_who_is_hiring"
+    now = datetime.now(tz=timezone.utc)
+    job = await asyncio.to_thread(
+        enqueue_job,
+        queue=request.app.state.queue,
+        fn=JOB_FUNCTIONS["scrape_job_leads_job"],
+        args=(),
+        settings=settings,
+        kwargs={"source": normalized_source, "story_id": payload.story_id},
+        idempotency_key=(
+            f"job-leads:{normalized_source}:{payload.story_id or 'latest'}:"
+            f"{now.strftime('%Y%m%d%H%M')}"
+        ),
+    )
+    actor_provider, actor_subject = _session_audit_actor(session)
+    await _write_auth_audit_event(
+        action="job_leads.sync",
+        result=AuditResult.SUCCESS,
+        actor_subject=actor_subject,
+        actor_display_name=session.display_name,
+        actor_provider=actor_provider,
+        resource_type="job_lead_source",
+        resource_id=normalized_source,
+        metadata={
+            "source": normalized_source,
+            "story_id": payload.story_id,
+            "job_id": job.id,
+            "created": job.created,
+        },
+    )
+    return JSONResponse(
+        {
+            "status": "queued",
+            "source": normalized_source,
+            "story_id": payload.story_id,
+            "job_id": job.id,
+            "created": job.created,
+        },
+        status_code=202,
+    )
+
+
 async def dashboard_notifications_handler(
     request: Request,
     limit: int = Query(default=20, ge=1, le=50),

apps/api/src/five08/backend/api.py

@@ -44,6 +44,9 @@ class BackendRouteSurface(Protocol):
     dashboard_gig_detail_handler: RouteHandler
     dashboard_gigs_handler: RouteHandler
     dashboard_handler: RouteHandler
+    dashboard_job_leads_handler: RouteHandler
+    dashboard_post_job_lead_handler: RouteHandler
+    dashboard_review_job_lead_handler: RouteHandler
     dashboard_job_detail_handler: RouteHandler
     dashboard_jobs_handler: RouteHandler
     dashboard_me_handler: RouteHandler
@@ -64,6 +67,7 @@ class BackendRouteSurface(Protocol):
     dashboard_sync_newsletters_handler: RouteHandler
     dashboard_sync_people_handler: RouteHandler
     dashboard_sync_projects_handler: RouteHandler
+    dashboard_sync_job_leads_handler: RouteHandler
     dashboard_update_configuration_handler: RouteHandler
     dashboard_update_gig_application_status_handler: RouteHandler
     dashboard_update_gig_status_handler: RouteHandler
@@ -120,6 +124,9 @@ def register_routes(app: FastAPI, api: BackendRouteSurface) -> None:
     dashboard_gig_detail_handler = api.dashboard_gig_detail_handler
     dashboard_gigs_handler = api.dashboard_gigs_handler
     dashboard_handler = api.dashboard_handler
+    dashboard_job_leads_handler = api.dashboard_job_leads_handler
+    dashboard_post_job_lead_handler = api.dashboard_post_job_lead_handler
+    dashboard_review_job_lead_handler = api.dashboard_review_job_lead_handler
     dashboard_job_detail_handler = api.dashboard_job_detail_handler
     dashboard_jobs_handler = api.dashboard_jobs_handler
     dashboard_me_handler = api.dashboard_me_handler
@@ -150,6 +157,7 @@ def register_routes(app: FastAPI, api: BackendRouteSurface) -> None:
     dashboard_sync_newsletters_handler = api.dashboard_sync_newsletters_handler
     dashboard_sync_people_handler = api.dashboard_sync_people_handler
     dashboard_sync_projects_handler = api.dashboard_sync_projects_handler
+    dashboard_sync_job_leads_handler = api.dashboard_sync_job_leads_handler
     dashboard_update_configuration_handler = api.dashboard_update_configuration_handler
     dashboard_update_gig_application_status_handler = (
         api.dashboard_update_gig_application_status_handler
@@ -227,6 +235,26 @@ def register_routes(app: FastAPI, api: BackendRouteSurface) -> None:
         dashboard_gig_detail_handler,
         methods=["GET"],
     )
+    app.add_api_route(
+        "/dashboard/api/gig-leads",
+        dashboard_job_leads_handler,
+        methods=["GET"],
+    )
+    app.add_api_route(
+        "/dashboard/api/gig-leads/sync",
+        dashboard_sync_job_leads_handler,
+        methods=["POST"],
+    )
+    app.add_api_route(
+        "/dashboard/api/gig-leads/{lead_id}/review",
+        dashboard_review_job_lead_handler,
+        methods=["POST"],
+    )
+    app.add_api_route(
+        "/dashboard/api/gig-leads/{lead_id}/post",
+        dashboard_post_job_lead_handler,
+        methods=["POST"],
+    )
     app.add_api_route(
         "/dashboard/api/notifications",
         dashboard_notifications_handler,

apps/api/src/five08/backend/routes.py

@@ -77,6 +77,26 @@ class DashboardGigStatusRequest(BaseModel):
     status: str
 
 
+class DashboardJobLeadReviewRequest(BaseModel):
+    """Payload for reviewing one sourced dashboard job lead."""
+
+    status: Literal["approved", "rejected"]
+
+
+class DashboardJobLeadPostRequest(BaseModel):
+    """Payload for posting one approved sourced job lead to Discord."""
+
+    channel_id: str | None = None
+    tags: str | None = None
+
+
+class DashboardJobLeadSyncRequest(BaseModel):
+    """Payload for enqueuing a sourced job lead scrape."""
+
+    source: str = "hackernews_who_is_hiring"
+    story_id: int | None = Field(default=None, ge=1)
+
+
 class DashboardProjectStatusRequest(BaseModel):
     """Payload for updating one ERPNext Project status."""
 

apps/api/src/five08/backend/schemas.py

@@ -1,11 +1,11 @@
 {
   "index.html": {
-    "file": "assets/index-DJVNsvDL.js",
+    "file": "assets/index-mTDqJ4Z1.js",
     "name": "index",
     "src": "index.html",
     "isEntry": true,
     "css": [
-      "assets/index-O0VUJuOk.css"
+      "assets/index-BQDfJvUA.css"
     ]
   }
 }

apps/api/src/five08/backend/static/dashboard/.vite/manifest.json

@@ -4,8 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>508 Operations Dashboard</title>
-    <script type="module" crossorigin src="/dashboard/assets/index-DJVNsvDL.js"></script>
-    <link rel="stylesheet" crossorigin href="/dashboard/assets/index-O0VUJuOk.css">
+    <script type="module" crossorigin src="/dashboard/assets/index-mTDqJ4Z1.js"></script>
+    <link rel="stylesheet" crossorigin href="/dashboard/assets/index-BQDfJvUA.css">
   </head>
   <body>
     <div id="root"></div>