Add MFE admin API, routes, sidebar menu and audit events

Illya Klymovrequested to merge
feature/mfe-static-4-admin-api into feature/mfe-static-3-overrides

What does this MR do and why?

Part 4 of the registry-direct MFE series: the admin backend for runtime version management — JSON endpoints only, UI arrives in part 5.

  • GET /admin/mfe/apps: every baked app merged with its override row and the resolver verdict — {name, baked_version, override_version, served_version, served_source, served_reason} — plus the configured registry_url for the browser to query the registry itself.
  • POST /admin/mfe/activate ({name, version, sha}): records the admin-chosen version with the registry version-manifest checksum and the running GitLab MAJOR.MINOR; rejects apps that are not baked (422) and model-invalid payloads (422). The server never contacts the registry — the admin browser fetches version lists via CORS in part 5; the recorded sha is enforced by the runtime loader in part 6a.
  • DELETE /admin/mfe/reset ({name}): removes the override (idempotent), serving returns to baked.
  • Every action 404s unless Gitlab::Mfe.enabled? (config + feature flag). Sidebar menu renders under the same gate. Activate/reset emit instance-scope audit events.

How to verify

bin/rspec spec/requests/admin/mfe_controller_spec.rb spec/lib/sidebars/admin/menus/mfe_menu_spec.rb spec/helpers/admin/mfe_helper_spec.rb

Stack

# Scope MR
1 Config section + instance kill switch !246732 (merged)
2 Vendor pin file + registry manifest schema + verified bake task !246736 (closed)
3 Version overrides table + resolver !246753 (closed)
4 Admin API + routes + sidebar this MR
5 Admin UI (Vue) !246764 (closed)
6a Runtime loader: gon contract, manifest verification + SRI, baked fallback, CSP connect-src !246775 (closed)
6b Duo Chat consumer behind mfe_duo_chat !246778 (closed)
7 Developer mode (local dev server + HMR) !246833 (closed)

Related

Related to #605798.

Edited by Illya Klymov

Merge request reports