dashboard: hide "Run scripted demo" card by default

Author: Seryiza

CLAUDE.md

@@ -45,7 +45,7 @@ Use `bun run dev` alone to (re)start. It already stops any running instance firs
 
 - `DISABLE_POLLING=1` — disable all workers (useful for tests or when running standalone service scripts).
 - `POLL_INTERVAL_MS` — override poll interval. Default 1000ms. Standalone scripts still use their own 60000ms default.
-- `DEMO_MODE` — default-on. Controls the Dashboard's "Run demo now" endpoint (`POST /demo/run-scenario`). Only `DEMO_MODE=off` disables (returns 403).
+- `DEMO_MODE` — default-off. Set to `on` to render the Dashboard's "Run scripted demo" card and enable `POST /demo/run-scenario`. Anything else (unset, empty, `off`, `1`, `true`) hides the card and returns 403 from the endpoint.
 
 ## US Core demographic extension runtime note
 

README.md

@@ -94,7 +94,7 @@ Most deployments only need a `.env` file. Defaults work for local demo.
 | `BILLING_APP` / `BILLING_FAC` | — | Receiving app/facility (MSH-5/6) in outbound BAR |
 | `DISABLE_POLLING` | unset | Set to `1` to disable all workers |
 | `POLL_INTERVAL_MS` | `1000` | Worker poll interval |
-| `DEMO_MODE` | on | Set to `off` to disable `/demo/run-scenario` |
+| `DEMO_MODE` | unset | Set to `on` to show the Dashboard's "Run scripted demo" card and enable `/demo/run-scenario` |
 
 **Production checklist:**
 - Change `AIDBOX_CLIENT_SECRET` + `BOX_ADMIN_PASSWORD` in `docker-compose.yaml`.

src/api/demo-scenario.ts

@@ -160,10 +160,10 @@ export async function runDemoScenario(
 export function isDemoEnabled(
   env: NodeJS.ProcessEnv = process.env,
 ): boolean {
-  // Default-on: unset, empty, or any non-"off" value enables the endpoint.
-  // Only DEMO_MODE=off disables. Matches the plan's env-flag semantics so
-  // the demo ships as part of the default-dev experience.
-  return env.DEMO_MODE !== "off";
+  // Default-off: the scripted-demo card is hidden unless DEMO_MODE=on.
+  // The endpoint is gated on the same flag so a hidden card can't be
+  // poked by hand-crafted POSTs.
+  return env.DEMO_MODE === "on";
 }
 
 export async function handleRunDemoScenario(): Promise<Response> {

src/ui/pages/dashboard.ts

@@ -222,32 +222,28 @@ function renderHero(): string {
 }
 
 function renderDemoConductor(demoEnabled: boolean): string {
+  if (!demoEnabled) {return "";}
+
   const steps = DEMO_STEPS.map((s, i) => {
     const arrow = i < DEMO_STEPS.length - 1 ? `<div class="flex-[0_1_24px]">${arrowSvg()}</div>` : "";
     return renderDemoStep(s, i) + arrow;
   }).join("");
 
-  const button = demoEnabled
-    ? `
-      <button
-        type="button"
-        class="btn btn-primary text-[15px] py-3 px-5 justify-center"
-        :disabled="running"
-        x-on:click="run()"
-      >
-        <template x-if="!running">
-          <span class="inline-flex items-center gap-1.5">${renderIcon("play", "sm")}<span x-text="done ? 'Demo sent ✓' : 'Run demo now'"></span></span>
-        </template>
-        <template x-if="running">
-          <span class="inline-flex items-center gap-1.5"><span class="spinner"></span><span>Firing step <span x-text="Math.min(currentIndex + 1, ${DEMO_STEPS.length})"></span>/${DEMO_STEPS.length}…</span></span>
-        </template>
-      </button>
-    `
-    : `
-      <button type="button" class="btn btn-primary text-[15px] py-3 px-5 justify-center opacity-60 cursor-not-allowed" disabled>
-        ${renderIcon("play", "sm")} Disabled (DEMO_MODE=off)
-      </button>
-    `;
+  const button = `
+    <button
+      type="button"
+      class="btn btn-primary text-[15px] py-3 px-5 justify-center"
+      :disabled="running"
+      x-on:click="run()"
+    >
+      <template x-if="!running">
+        <span class="inline-flex items-center gap-1.5">${renderIcon("play", "sm")}<span x-text="done ? 'Demo sent ✓' : 'Run demo now'"></span></span>
+      </template>
+      <template x-if="running">
+        <span class="inline-flex items-center gap-1.5"><span class="spinner"></span><span>Firing step <span x-text="Math.min(currentIndex + 1, ${DEMO_STEPS.length})"></span>/${DEMO_STEPS.length}…</span></span>
+      </template>
+    </button>
+  `;
 
   // Alpine state: `currentIndex` drives both the stepper's active-state
   // highlight and the button's "Firing step N/4" label. Server fires

test/unit/api/demo-scenario.test.ts

@@ -220,33 +220,34 @@ describe("runDemoScenario", () => {
 });
 
 describe("isDemoEnabled", () => {
-  test("default-on when env var is unset", () => {
-    expect(isDemoEnabled({})).toBe(true);
+  test("default-off when env var is unset", () => {
+    expect(isDemoEnabled({})).toBe(false);
   });
 
-  test("enabled for empty string", () => {
-    expect(isDemoEnabled({ DEMO_MODE: "" })).toBe(true);
+  test("disabled for empty string", () => {
+    expect(isDemoEnabled({ DEMO_MODE: "" })).toBe(false);
   });
 
-  test("enabled for any non-'off' value", () => {
+  test("enabled only for literal 'on'", () => {
     expect(isDemoEnabled({ DEMO_MODE: "on" })).toBe(true);
-    expect(isDemoEnabled({ DEMO_MODE: "1" })).toBe(true);
-    expect(isDemoEnabled({ DEMO_MODE: "staging" })).toBe(true);
   });
 
-  test("disabled only for literal 'off'", () => {
+  test("disabled for other truthy-looking values", () => {
+    expect(isDemoEnabled({ DEMO_MODE: "1" })).toBe(false);
+    expect(isDemoEnabled({ DEMO_MODE: "true" })).toBe(false);
     expect(isDemoEnabled({ DEMO_MODE: "off" })).toBe(false);
   });
 
-  test("case-sensitive — 'OFF' is NOT treated as off", () => {
+  test("case-sensitive — 'ON' is NOT treated as on", () => {
     // Documented tradeoff: matches the `DISABLE_POLLING=1` exact-string
     // convention elsewhere. If we ever want case-insensitive, normalize here.
-    expect(isDemoEnabled({ DEMO_MODE: "OFF" })).toBe(true);
+    expect(isDemoEnabled({ DEMO_MODE: "ON" })).toBe(false);
   });
 });
 
 describe("handleRunDemoScenario", () => {
-  test("returns 202 and fires the scenario when enabled", async () => {
+  test("returns 202 and fires the scenario when DEMO_MODE=on", async () => {
+    process.env.DEMO_MODE = "on";
     const res = await handleRunDemoScenario();
     expect(res.status).toBe(202);
     // Fire-and-forget — we can't easily await the scenario, but at least one
@@ -255,8 +256,7 @@ describe("handleRunDemoScenario", () => {
     expect(sendCalls.length).toBeGreaterThanOrEqual(1);
   });
 
-  test("returns 403 when DEMO_MODE=off", async () => {
-    process.env.DEMO_MODE = "off";
+  test("returns 403 when DEMO_MODE is unset", async () => {
     const res = await handleRunDemoScenario();
     expect(res.status).toBe(403);
     expect(await res.text()).toContain("disabled");