Refactor web build process and update documentation

- Removed Node.js build artifacts from .gitignore and adjusted Makefile to reflect changes in web UI build process, now using server-rendered Go templates instead of React. - Updated README to clarify the new web UI architecture and output formats, emphasizing the removal of the Node.js build step. - Added a command to set the number of frames per render task in manager configuration, enhancing user control over rendering settings. - Improved Gitea workflow by removing unnecessary npm install step, streamlining the CI process.
2026-03-12 19:44:40 -05:00
parent d3c5ee0dba
commit 2deb47e5ad
78 changed files with 3895 additions and 12499 deletions
--- a/internal/manager/admin.go
+++ b/internal/manager/admin.go
@@ -121,37 +121,6 @@ func (s *Manager) handleDeleteRunnerAPIKey(w http.ResponseWriter, r *http.Reques
 	s.respondJSON(w, http.StatusOK, map[string]string{"message": "API key deleted"})
 }

-// handleVerifyRunner manually verifies a runner
-func (s *Manager) handleVerifyRunner(w http.ResponseWriter, r *http.Request) {
-	runnerID, err := parseID(r, "id")
-	if err != nil {
-		s.respondError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	// Check if runner exists
-	var exists bool
-	err = s.db.With(func(conn *sql.DB) error {
-		return conn.QueryRow("SELECT EXISTS(SELECT 1 FROM runners WHERE id = ?)", runnerID).Scan(&exists)
-	})
-	if err != nil || !exists {
-		s.respondError(w, http.StatusNotFound, "Runner not found")
-		return
-	}
-
-	// Mark runner as verified
-	err = s.db.With(func(conn *sql.DB) error {
-		_, err := conn.Exec("UPDATE runners SET verified = 1 WHERE id = ?", runnerID)
-		return err
-	})
-	if err != nil {
-		s.respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to verify runner: %v", err))
-		return
-	}
-
-	s.respondJSON(w, http.StatusOK, map[string]string{"message": "Runner verified"})
-}
-
 // handleDeleteRunner removes a runner
 func (s *Manager) handleDeleteRunner(w http.ResponseWriter, r *http.Request) {
 	runnerID, err := parseID(r, "id")
@@ -415,6 +384,12 @@ func (s *Manager) handleSetRegistrationEnabled(w http.ResponseWriter, r *http.Re

 // handleSetUserAdminStatus sets a user's admin status (admin only)
 func (s *Manager) handleSetUserAdminStatus(w http.ResponseWriter, r *http.Request) {
+	currentUserID, err := getUserID(r)
+	if err != nil {
+		s.respondError(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
 	targetUserID, err := parseID(r, "id")
 	if err != nil {
 		s.respondError(w, http.StatusBadRequest, err.Error())
@@ -429,6 +404,12 @@ func (s *Manager) handleSetUserAdminStatus(w http.ResponseWriter, r *http.Reques
 		return
 	}

+	// Prevent admins from revoking their own admin status.
+	if targetUserID == currentUserID && !req.IsAdmin {
+		s.respondError(w, http.StatusBadRequest, "You cannot revoke your own admin status")
+		return
+	}
+
 	if err := s.auth.SetUserAdminStatus(targetUserID, req.IsAdmin); err != nil {
 		s.respondError(w, http.StatusBadRequest, err.Error())
 		return
--- a/internal/manager/blender.go
+++ b/internal/manager/blender.go
@@ -331,8 +331,9 @@ func (s *Manager) GetBlenderArchivePath(version *BlenderVersion) (string, error)
 	// Need to download and decompress
 	log.Printf("Downloading Blender %s from %s", version.Full, version.URL)

+	// 60-minute timeout for large Blender tarballs; stream to disk via io.Copy below
 	client := &http.Client{
-		Timeout: 0, // No timeout for large downloads
+		Timeout: 60 * time.Minute,
 	}
 	resp, err := client.Get(version.URL)
 	if err != nil {
--- a/internal/manager/jobs.go
+++ b/internal/manager/jobs.go
--- a/internal/manager/manager.go
+++ b/internal/manager/manager.go
@@ -59,6 +59,7 @@ type Manager struct {
 	secrets *authpkg.Secrets
 	storage *storage.Storage
 	router  *chi.Mux
+	ui      *uiRenderer

 	// WebSocket connections
 	wsUpgrader websocket.Upgrader
@@ -125,10 +126,24 @@ type ClientConnection struct {
 type UploadSession struct {
 	SessionID string
 	UserID    int64
+	TempDir   string
 	Progress  float64
 	Status    string // "uploading", "processing", "extracting_metadata", "creating_context", "completed", "error"
+	Phase     string // "upload", "processing", "ready", "error", "action_required"
 	Message   string
 	CreatedAt time.Time
+	// Result fields set when Status is "completed" (for async processing)
+	ResultContextArchive    string
+	ResultMetadata          interface{} // *types.BlendMetadata when set
+	ResultMainBlendFile     string
+	ResultFileName          string
+	ResultFileSize          int64
+	ResultZipExtracted      bool
+	ResultExtractedFilesCnt int
+	ResultMetadataExtracted bool
+	ResultMetadataError     string   // set when Status is "completed" but metadata extraction failed
+	ErrorMessage            string   // set when Status is "error"
+	ResultBlendFiles        []string // set when Status is "select_blend" (relative paths for user to pick)
 }

 // NewManager creates a new manager server
@@ -137,6 +152,10 @@ func NewManager(db *database.DB, cfg *config.Config, auth *authpkg.Auth, storage
 	if err != nil {
 		return nil, fmt.Errorf("failed to initialize secrets: %w", err)
 	}
+	ui, err := newUIRenderer()
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize UI renderer: %w", err)
+	}

 	s := &Manager{
 		db:        db,
@@ -145,6 +164,7 @@ func NewManager(db *database.DB, cfg *config.Config, auth *authpkg.Auth, storage
 		secrets:   secrets,
 		storage:   storage,
 		router:    chi.NewRouter(),
+		ui:        ui,
 		startTime: time.Now(),
 		wsUpgrader: websocket.Upgrader{
 			CheckOrigin:     checkWebSocketOrigin,
@@ -450,6 +470,7 @@ func (w *gzipResponseWriter) WriteHeader(statusCode int) {
 func (s *Manager) setupRoutes() {
 	// Health check endpoint (unauthenticated)
 	s.router.Get("/api/health", s.handleHealthCheck)
+	s.setupUIRoutes()

 	// Public routes (with stricter rate limiting for auth endpoints)
 	s.router.Route("/api/auth", func(r chi.Router) {
@@ -477,6 +498,7 @@ func (s *Manager) setupRoutes() {
 		})
 		r.Post("/", s.handleCreateJob)
 		r.Post("/upload", s.handleUploadFileForJobCreation) // Upload before job creation
+		r.Get("/upload/status", s.handleUploadStatus)       // Poll upload processing status (session_id query param)
 		r.Get("/", s.handleListJobs)
 		r.Get("/summary", s.handleListJobsSummary)
 		r.Post("/batch", s.handleBatchGetJobs)
@@ -487,6 +509,7 @@ func (s *Manager) setupRoutes() {
 		r.Get("/{id}/files", s.handleListJobFiles)
 		r.Get("/{id}/files/count", s.handleGetJobFilesCount)
 		r.Get("/{id}/context", s.handleListContextArchive)
+		r.Get("/{id}/files/exr-zip", s.handleDownloadEXRZip)
 		r.Get("/{id}/files/{fileId}/download", s.handleDownloadJobFile)
 		r.Get("/{id}/files/{fileId}/preview-exr", s.handlePreviewEXR)
 		r.Get("/{id}/video", s.handleStreamVideo)
@@ -522,7 +545,6 @@ func (s *Manager) setupRoutes() {
 				r.Delete("/{id}", s.handleDeleteRunnerAPIKey)
 			})
 			r.Get("/", s.handleListRunnersAdmin)
-			r.Post("/{id}/verify", s.handleVerifyRunner)
 			r.Delete("/{id}", s.handleDeleteRunner)
 		})
 		r.Route("/users", func(r chi.Router) {
@@ -555,6 +577,7 @@ func (s *Manager) setupRoutes() {
 				return http.HandlerFunc(s.runnerAuthMiddleware(next.ServeHTTP))
 			})
 			r.Get("/blender/download", s.handleDownloadBlender)
+			r.Get("/jobs/{jobId}/status", s.handleGetJobStatusForRunner)
 			r.Get("/jobs/{jobId}/files", s.handleGetJobFilesForRunner)
 			r.Get("/jobs/{jobId}/metadata", s.handleGetJobMetadataForRunner)
 			r.Get("/files/{jobId}/{fileName}", s.handleDownloadFileForRunner)
@@ -564,8 +587,8 @@ func (s *Manager) setupRoutes() {
 	// Blender versions API (public, for job submission page)
 	s.router.Get("/api/blender/versions", s.handleGetBlenderVersions)

-	// Serve static files (embedded React app with SPA fallback)
-	s.router.Handle("/*", web.SPAHandler())
+	// Static assets for server-rendered UI.
+	s.router.Handle("/assets/*", web.StaticHandler())
 }

 // ServeHTTP implements http.Handler
--- a/internal/manager/renderer.go
+++ b/internal/manager/renderer.go
@@ -0,0 +1,104 @@
+package api
+
+import (
+	"fmt"
+	"html/template"
+	"net/http"
+	"strings"
+	"time"
+
+	authpkg "jiggablend/internal/auth"
+	"jiggablend/web"
+)
+
+type uiRenderer struct {
+	templates *template.Template
+}
+
+type pageData struct {
+	Title           string
+	CurrentPath     string
+	ContentTemplate string
+	PageScript      string
+	User            *authpkg.Session
+	Error           string
+	Notice          string
+	Data            interface{}
+}
+
+func newUIRenderer() (*uiRenderer, error) {
+	tpl, err := template.New("base").Funcs(template.FuncMap{
+		"formatTime": func(t time.Time) string {
+			if t.IsZero() {
+				return "-"
+			}
+			return t.Local().Format("2006-01-02 15:04:05")
+		},
+		"statusClass": func(status string) string {
+			switch status {
+			case "completed":
+				return "status-completed"
+			case "running":
+				return "status-running"
+			case "failed":
+				return "status-failed"
+			case "cancelled":
+				return "status-cancelled"
+			case "online":
+				return "status-online"
+			case "offline":
+				return "status-offline"
+			case "busy":
+				return "status-busy"
+			default:
+				return "status-pending"
+			}
+		},
+		"progressInt": func(v float64) int {
+			if v < 0 {
+				return 0
+			}
+			if v > 100 {
+				return 100
+			}
+			return int(v)
+		},
+		"derefInt": func(v *int) string {
+			if v == nil {
+				return ""
+			}
+			return fmt.Sprintf("%d", *v)
+		},
+		"derefString": func(v *string) string {
+			if v == nil {
+				return ""
+			}
+			return *v
+		},
+		"hasSuffixFold": func(value, suffix string) bool {
+			return strings.HasSuffix(strings.ToLower(value), strings.ToLower(suffix))
+		},
+	}).ParseFS(
+		web.GetTemplateFS(),
+		"templates/*.html",
+		"templates/partials/*.html",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("parse templates: %w", err)
+	}
+	return &uiRenderer{templates: tpl}, nil
+}
+
+func (r *uiRenderer) render(w http.ResponseWriter, data pageData) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := r.templates.ExecuteTemplate(w, "base", data); err != nil {
+		http.Error(w, "template render error", http.StatusInternalServerError)
+	}
+}
+
+func (r *uiRenderer) renderTemplate(w http.ResponseWriter, templateName string, data interface{}) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := r.templates.ExecuteTemplate(w, templateName, data); err != nil {
+		http.Error(w, "template render error", http.StatusInternalServerError)
+	}
+}
--- a/internal/manager/renderer_test.go
+++ b/internal/manager/renderer_test.go
@@ -0,0 +1,13 @@
+package api
+
+import "testing"
+
+func TestNewUIRendererParsesTemplates(t *testing.T) {
+	renderer, err := newUIRenderer()
+	if err != nil {
+		t.Fatalf("newUIRenderer returned error: %v", err)
+	}
+	if renderer == nil || renderer.templates == nil {
+		t.Fatalf("renderer/templates should not be nil")
+	}
+}
--- a/internal/manager/runners.go
+++ b/internal/manager/runners.go
@@ -275,7 +275,8 @@ type NextJobTaskInfo struct {
 	TaskID   int64                `json:"task_id"`
 	JobID    int64                `json:"job_id"`
 	JobName  string               `json:"job_name"`
-	Frame    int                  `json:"frame"`
+	Frame    int                  `json:"frame"`     // frame start (inclusive)
+	FrameEnd int                  `json:"frame_end"` // frame end (inclusive); same as Frame for single-frame
 	TaskType string               `json:"task_type"`
 	Metadata *types.BlendMetadata `json:"metadata,omitempty"`
 }
@@ -376,6 +377,7 @@ func (s *Manager) handleNextJob(w http.ResponseWriter, r *http.Request) {
 		TaskID        int64
 		JobID         int64
 		Frame         int
+		FrameEnd      sql.NullInt64
 		TaskType      string
 		JobName       string
 		JobUserID     int64
@@ -385,7 +387,7 @@ func (s *Manager) handleNextJob(w http.ResponseWriter, r *http.Request) {

 	err = s.db.With(func(conn *sql.DB) error {
 		rows, err := conn.Query(
-			`SELECT t.id, t.job_id, t.frame, t.task_type, 
+			`SELECT t.id, t.job_id, t.frame, t.frame_end, t.task_type, 
 			        j.name as job_name, j.user_id, j.blend_metadata,
 			        t.condition
 			 FROM tasks t
@@ -403,7 +405,7 @@ func (s *Manager) handleNextJob(w http.ResponseWriter, r *http.Request) {
 		for rows.Next() {
 			var task taskCandidate
 			var condition sql.NullString
-			err := rows.Scan(&task.TaskID, &task.JobID, &task.Frame, &task.TaskType,
+			err := rows.Scan(&task.TaskID, &task.JobID, &task.Frame, &task.FrameEnd, &task.TaskType,
 				&task.JobName, &task.JobUserID, &task.BlendMetadata, &condition)
 			if err != nil {
 				continue
@@ -549,6 +551,11 @@ func (s *Manager) handleNextJob(w http.ResponseWriter, r *http.Request) {
 	// Update job status
 	s.updateJobStatusFromTasks(selectedTask.JobID)

+	// Frame end for response: use task range or single frame (NULL frame_end)
+	frameEnd := selectedTask.Frame
+	if selectedTask.FrameEnd.Valid {
+		frameEnd = int(selectedTask.FrameEnd.Int64)
+	}
 	// Build response
 	response := NextJobResponse{
 		JobToken: jobToken,
@@ -558,6 +565,7 @@ func (s *Manager) handleNextJob(w http.ResponseWriter, r *http.Request) {
 			JobID:    selectedTask.JobID,
 			JobName:  selectedTask.JobName,
 			Frame:    selectedTask.Frame,
+			FrameEnd: frameEnd,
 			TaskType: selectedTask.TaskType,
 			Metadata: metadata,
 		},
@@ -1959,6 +1967,12 @@ func (s *Manager) updateJobStatusFromTasks(jobID int64) {
 		return
 	}

+	// Cancellation is terminal from the user's perspective.
+	// Do not allow asynchronous task updates to revive cancelled jobs.
+	if currentStatus == string(types.JobStatusCancelled) {
+		return
+	}
+
 	// Count total tasks and completed tasks
 	var totalTasks, completedTasks int
 	err = s.db.With(func(conn *sql.DB) error {
--- a/internal/manager/ui.go
+++ b/internal/manager/ui.go
@@ -0,0 +1,556 @@
+package api
+
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	authpkg "jiggablend/internal/auth"
+
+	"github.com/go-chi/chi/v5"
+)
+
+type uiJobSummary struct {
+	ID           int64
+	Name         string
+	Status       string
+	Progress     float64
+	FrameStart   *int
+	FrameEnd     *int
+	OutputFormat *string
+	CreatedAt    time.Time
+}
+
+type uiTaskSummary struct {
+	ID          int64
+	TaskType    string
+	Status      string
+	Frame       int
+	FrameEnd    *int
+	CurrentStep string
+	RetryCount  int
+	Error       string
+	StartedAt   *time.Time
+	CompletedAt *time.Time
+}
+
+type uiFileSummary struct {
+	ID        int64
+	FileName  string
+	FileType  string
+	FileSize  int64
+	CreatedAt time.Time
+}
+
+func (s *Manager) setupUIRoutes() {
+	s.router.Get("/", s.handleUIRoot)
+	s.router.Get("/login", s.handleUILoginPage)
+	s.router.Post("/logout", s.handleUILogout)
+
+	s.router.Group(func(r chi.Router) {
+		r.Use(func(next http.Handler) http.Handler {
+			return http.HandlerFunc(s.auth.Middleware(next.ServeHTTP))
+		})
+		r.Get("/jobs", s.handleUIJobsPage)
+		r.Get("/jobs/new", s.handleUINewJobPage)
+		r.Get("/jobs/{id}", s.handleUIJobDetailPage)
+
+		r.Get("/ui/fragments/jobs", s.handleUIJobsFragment)
+		r.Get("/ui/fragments/jobs/{id}/tasks", s.handleUIJobTasksFragment)
+		r.Get("/ui/fragments/jobs/{id}/files", s.handleUIJobFilesFragment)
+	})
+
+	s.router.Group(func(r chi.Router) {
+		r.Use(func(next http.Handler) http.Handler {
+			return http.HandlerFunc(s.auth.AdminMiddleware(next.ServeHTTP))
+		})
+		r.Get("/admin", s.handleUIAdminPage)
+		r.Get("/ui/fragments/admin/runners", s.handleUIAdminRunnersFragment)
+		r.Get("/ui/fragments/admin/users", s.handleUIAdminUsersFragment)
+		r.Get("/ui/fragments/admin/apikeys", s.handleUIAdminAPIKeysFragment)
+	})
+}
+
+func (s *Manager) sessionFromRequest(r *http.Request) (*authpkg.Session, bool) {
+	cookie, err := r.Cookie("session_id")
+	if err != nil {
+		return nil, false
+	}
+	return s.auth.GetSession(cookie.Value)
+}
+
+func (s *Manager) handleUIRoot(w http.ResponseWriter, r *http.Request) {
+	if _, ok := s.sessionFromRequest(r); ok {
+		http.Redirect(w, r, "/jobs", http.StatusFound)
+		return
+	}
+	http.Redirect(w, r, "/login", http.StatusFound)
+}
+
+func (s *Manager) handleUILoginPage(w http.ResponseWriter, r *http.Request) {
+	if _, ok := s.sessionFromRequest(r); ok {
+		http.Redirect(w, r, "/jobs", http.StatusFound)
+		return
+	}
+
+	s.ui.render(w, pageData{
+		Title:           "Login",
+		CurrentPath:     "/login",
+		ContentTemplate: "page_login",
+		PageScript:      "/assets/login.js",
+		Data: map[string]interface{}{
+			"google_enabled":  s.auth.IsGoogleOAuthConfigured(),
+			"discord_enabled": s.auth.IsDiscordOAuthConfigured(),
+			"local_enabled":   s.auth.IsLocalLoginEnabled(),
+			"error":           r.URL.Query().Get("error"),
+		},
+	})
+}
+
+func (s *Manager) handleUILogout(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("session_id")
+	if err == nil {
+		s.auth.DeleteSession(cookie.Value)
+	}
+	expired := &http.Cookie{
+		Name:     "session_id",
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	}
+	if s.cfg.IsProductionMode() {
+		expired.Secure = true
+	}
+	http.SetCookie(w, expired)
+	http.Redirect(w, r, "/login", http.StatusFound)
+}
+
+func (s *Manager) handleUIJobsPage(w http.ResponseWriter, r *http.Request) {
+	user, _ := s.sessionFromRequest(r)
+	s.ui.render(w, pageData{
+		Title:           "Jobs",
+		CurrentPath:     "/jobs",
+		ContentTemplate: "page_jobs",
+		PageScript:      "/assets/jobs.js",
+		User:            user,
+	})
+}
+
+func (s *Manager) handleUINewJobPage(w http.ResponseWriter, r *http.Request) {
+	user, _ := s.sessionFromRequest(r)
+	s.ui.render(w, pageData{
+		Title:           "New Job",
+		CurrentPath:     "/jobs/new",
+		ContentTemplate: "page_jobs_new",
+		PageScript:      "/assets/job_new.js",
+		User:            user,
+	})
+}
+
+func (s *Manager) handleUIJobDetailPage(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusFound)
+		return
+	}
+	isAdmin := authpkg.IsAdmin(r.Context())
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	job, err := s.getUIJob(jobID, userID, isAdmin)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	user, _ := s.sessionFromRequest(r)
+	s.ui.render(w, pageData{
+		Title:           fmt.Sprintf("Job %d", jobID),
+		CurrentPath:     "/jobs",
+		ContentTemplate: "page_job_show",
+		PageScript:      "/assets/job_show.js",
+		User:            user,
+		Data:            map[string]interface{}{"job": job},
+	})
+}
+
+func (s *Manager) handleUIAdminPage(w http.ResponseWriter, r *http.Request) {
+	user, _ := s.sessionFromRequest(r)
+	regEnabled, _ := s.auth.IsRegistrationEnabled()
+	s.ui.render(w, pageData{
+		Title:           "Admin",
+		CurrentPath:     "/admin",
+		ContentTemplate: "page_admin",
+		PageScript:      "/assets/admin.js",
+		User:            user,
+		Data: map[string]interface{}{
+			"registration_enabled": regEnabled,
+		},
+	})
+}
+
+func (s *Manager) handleUIJobsFragment(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	jobs, err := s.listUIJobSummaries(userID, 50, 0)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	s.ui.renderTemplate(w, "partial_jobs_table", map[string]interface{}{"jobs": jobs})
+}
+
+func (s *Manager) handleUIJobTasksFragment(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	isAdmin := authpkg.IsAdmin(r.Context())
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		http.Error(w, "invalid job id", http.StatusBadRequest)
+		return
+	}
+
+	if _, err := s.getUIJob(jobID, userID, isAdmin); err != nil {
+		http.Error(w, "job not found", http.StatusNotFound)
+		return
+	}
+
+	tasks, err := s.listUITasks(jobID)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	s.ui.renderTemplate(w, "partial_job_tasks", map[string]interface{}{
+		"job_id": jobID,
+		"tasks":  tasks,
+	})
+}
+
+func (s *Manager) handleUIJobFilesFragment(w http.ResponseWriter, r *http.Request) {
+	userID, err := getUserID(r)
+	if err != nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	isAdmin := authpkg.IsAdmin(r.Context())
+	jobID, err := parseID(r, "id")
+	if err != nil {
+		http.Error(w, "invalid job id", http.StatusBadRequest)
+		return
+	}
+
+	if _, err := s.getUIJob(jobID, userID, isAdmin); err != nil {
+		http.Error(w, "job not found", http.StatusNotFound)
+		return
+	}
+
+	files, err := s.listUIFiles(jobID, 100)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	outputFiles := make([]uiFileSummary, 0, len(files))
+	adminInputFiles := make([]uiFileSummary, 0)
+	for _, file := range files {
+		if strings.EqualFold(file.FileType, "output") {
+			outputFiles = append(outputFiles, file)
+			continue
+		}
+		if isAdmin {
+			adminInputFiles = append(adminInputFiles, file)
+		}
+	}
+
+	s.ui.renderTemplate(w, "partial_job_files", map[string]interface{}{
+		"job_id":            jobID,
+		"files":             outputFiles,
+		"is_admin":          isAdmin,
+		"admin_input_files": adminInputFiles,
+	})
+}
+
+func (s *Manager) handleUIAdminRunnersFragment(w http.ResponseWriter, r *http.Request) {
+	var rows *sql.Rows
+	err := s.db.With(func(conn *sql.DB) error {
+		var qErr error
+		rows, qErr = conn.Query(`SELECT id, name, hostname, status, last_heartbeat, priority, created_at FROM runners ORDER BY created_at DESC`)
+		return qErr
+	})
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	defer rows.Close()
+
+	type runner struct {
+		ID            int64
+		Name          string
+		Hostname      string
+		Status        string
+		LastHeartbeat time.Time
+		Priority      int
+		CreatedAt     time.Time
+	}
+	all := make([]runner, 0)
+	for rows.Next() {
+		var item runner
+		if scanErr := rows.Scan(&item.ID, &item.Name, &item.Hostname, &item.Status, &item.LastHeartbeat, &item.Priority, &item.CreatedAt); scanErr != nil {
+			http.Error(w, scanErr.Error(), http.StatusInternalServerError)
+			return
+		}
+		all = append(all, item)
+	}
+	s.ui.renderTemplate(w, "partial_admin_runners", map[string]interface{}{"runners": all})
+}
+
+func (s *Manager) handleUIAdminUsersFragment(w http.ResponseWriter, r *http.Request) {
+	currentUserID, _ := getUserID(r)
+	firstUserID, _ := s.auth.GetFirstUserID()
+	var rows *sql.Rows
+	err := s.db.With(func(conn *sql.DB) error {
+		var qErr error
+		rows, qErr = conn.Query(`SELECT id, email, name, oauth_provider, is_admin, created_at FROM users ORDER BY created_at DESC`)
+		return qErr
+	})
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	defer rows.Close()
+
+	type user struct {
+		ID            int64
+		Email         string
+		Name          string
+		OAuthProvider string
+		IsAdmin       bool
+		IsFirstUser   bool
+		CreatedAt     time.Time
+	}
+	all := make([]user, 0)
+	for rows.Next() {
+		var item user
+		if scanErr := rows.Scan(&item.ID, &item.Email, &item.Name, &item.OAuthProvider, &item.IsAdmin, &item.CreatedAt); scanErr != nil {
+			http.Error(w, scanErr.Error(), http.StatusInternalServerError)
+			return
+		}
+		item.IsFirstUser = item.ID == firstUserID
+		all = append(all, item)
+	}
+	s.ui.renderTemplate(w, "partial_admin_users", map[string]interface{}{
+		"users":           all,
+		"current_user_id": currentUserID,
+	})
+}
+
+func (s *Manager) handleUIAdminAPIKeysFragment(w http.ResponseWriter, r *http.Request) {
+	keys, err := s.secrets.ListRunnerAPIKeys()
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	type item struct {
+		ID        int64
+		Name      string
+		Scope     string
+		Key       string
+		IsActive  bool
+		CreatedAt time.Time
+	}
+	out := make([]item, 0, len(keys))
+	for _, key := range keys {
+		out = append(out, item{
+			ID:        key.ID,
+			Name:      key.Name,
+			Scope:     key.Scope,
+			Key:       key.Key,
+			IsActive:  key.IsActive,
+			CreatedAt: key.CreatedAt,
+		})
+	}
+	s.ui.renderTemplate(w, "partial_admin_apikeys", map[string]interface{}{"keys": out})
+}
+
+func (s *Manager) listUIJobSummaries(userID int64, limit int, offset int) ([]uiJobSummary, error) {
+	rows := &sql.Rows{}
+	err := s.db.With(func(conn *sql.DB) error {
+		var qErr error
+		rows, qErr = conn.Query(
+			`SELECT id, name, status, progress, frame_start, frame_end, output_format, created_at
+			 FROM jobs WHERE user_id = ? ORDER BY created_at DESC LIMIT ? OFFSET ?`,
+			userID, limit, offset,
+		)
+		return qErr
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := make([]uiJobSummary, 0)
+	for rows.Next() {
+		var item uiJobSummary
+		var frameStart, frameEnd sql.NullInt64
+		var outputFormat sql.NullString
+		if scanErr := rows.Scan(&item.ID, &item.Name, &item.Status, &item.Progress, &frameStart, &frameEnd, &outputFormat, &item.CreatedAt); scanErr != nil {
+			return nil, scanErr
+		}
+		if frameStart.Valid {
+			v := int(frameStart.Int64)
+			item.FrameStart = &v
+		}
+		if frameEnd.Valid {
+			v := int(frameEnd.Int64)
+			item.FrameEnd = &v
+		}
+		if outputFormat.Valid {
+			item.OutputFormat = &outputFormat.String
+		}
+		out = append(out, item)
+	}
+	return out, nil
+}
+
+func (s *Manager) getUIJob(jobID int64, userID int64, isAdmin bool) (uiJobSummary, error) {
+	var item uiJobSummary
+	var frameStart, frameEnd sql.NullInt64
+	var outputFormat sql.NullString
+
+	err := s.db.With(func(conn *sql.DB) error {
+		if isAdmin {
+			return conn.QueryRow(
+				`SELECT id, name, status, progress, frame_start, frame_end, output_format, created_at
+				 FROM jobs WHERE id = ?`,
+				jobID,
+			).Scan(&item.ID, &item.Name, &item.Status, &item.Progress, &frameStart, &frameEnd, &outputFormat, &item.CreatedAt)
+		}
+		return conn.QueryRow(
+			`SELECT id, name, status, progress, frame_start, frame_end, output_format, created_at
+			 FROM jobs WHERE id = ? AND user_id = ?`,
+			jobID, userID,
+		).Scan(&item.ID, &item.Name, &item.Status, &item.Progress, &frameStart, &frameEnd, &outputFormat, &item.CreatedAt)
+	})
+	if err != nil {
+		return uiJobSummary{}, err
+	}
+	if frameStart.Valid {
+		v := int(frameStart.Int64)
+		item.FrameStart = &v
+	}
+	if frameEnd.Valid {
+		v := int(frameEnd.Int64)
+		item.FrameEnd = &v
+	}
+	if outputFormat.Valid {
+		item.OutputFormat = &outputFormat.String
+	}
+	return item, nil
+}
+
+func (s *Manager) listUITasks(jobID int64) ([]uiTaskSummary, error) {
+	var rows *sql.Rows
+	err := s.db.With(func(conn *sql.DB) error {
+		var qErr error
+		rows, qErr = conn.Query(
+			`SELECT id, task_type, status, frame, frame_end, current_step, retry_count, error_message, started_at, completed_at
+			 FROM tasks WHERE job_id = ? ORDER BY id ASC`,
+			jobID,
+		)
+		return qErr
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := make([]uiTaskSummary, 0)
+	for rows.Next() {
+		var item uiTaskSummary
+		var frameEnd sql.NullInt64
+		var currentStep sql.NullString
+		var errMsg sql.NullString
+		var startedAt, completedAt sql.NullTime
+		if scanErr := rows.Scan(
+			&item.ID, &item.TaskType, &item.Status, &item.Frame, &frameEnd,
+			&currentStep, &item.RetryCount, &errMsg, &startedAt, &completedAt,
+		); scanErr != nil {
+			return nil, scanErr
+		}
+		if frameEnd.Valid {
+			v := int(frameEnd.Int64)
+			item.FrameEnd = &v
+		}
+		if currentStep.Valid {
+			item.CurrentStep = currentStep.String
+		}
+		if errMsg.Valid {
+			item.Error = errMsg.String
+		}
+		if startedAt.Valid {
+			item.StartedAt = &startedAt.Time
+		}
+		if completedAt.Valid {
+			item.CompletedAt = &completedAt.Time
+		}
+		out = append(out, item)
+	}
+	return out, nil
+}
+
+func (s *Manager) listUIFiles(jobID int64, limit int) ([]uiFileSummary, error) {
+	var rows *sql.Rows
+	err := s.db.With(func(conn *sql.DB) error {
+		var qErr error
+		rows, qErr = conn.Query(
+			`SELECT id, file_name, file_type, file_size, created_at
+			 FROM job_files WHERE job_id = ? ORDER BY created_at DESC LIMIT ?`,
+			jobID, limit,
+		)
+		return qErr
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	out := make([]uiFileSummary, 0)
+	for rows.Next() {
+		var item uiFileSummary
+		if scanErr := rows.Scan(&item.ID, &item.FileName, &item.FileType, &item.FileSize, &item.CreatedAt); scanErr != nil {
+			return nil, scanErr
+		}
+		out = append(out, item)
+	}
+	return out, nil
+}
+
+func parseBoolForm(r *http.Request, key string) bool {
+	v := strings.TrimSpace(strings.ToLower(r.FormValue(key)))
+	return v == "1" || v == "true" || v == "on" || v == "yes"
+}
+
+func parseIntQuery(r *http.Request, key string, fallback int) int {
+	raw := strings.TrimSpace(r.URL.Query().Get(key))
+	if raw == "" {
+		return fallback
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 0 {
+		return fallback
+	}
+	return v
+}
--- a/internal/manager/ui_test.go
+++ b/internal/manager/ui_test.go
@@ -0,0 +1,37 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+func TestParseBoolForm(t *testing.T) {
+	req := httptest.NewRequest("POST", "/?flag=true", nil)
+	req.ParseForm()
+	req.Form.Set("enabled", "true")
+	if !parseBoolForm(req, "enabled") {
+		t.Fatalf("expected true for enabled=true")
+	}
+
+	req.Form.Set("enabled", "no")
+	if parseBoolForm(req, "enabled") {
+		t.Fatalf("expected false for enabled=no")
+	}
+}
+
+func TestParseIntQuery(t *testing.T) {
+	req := httptest.NewRequest("GET", "/?limit=42", nil)
+	if got := parseIntQuery(req, "limit", 10); got != 42 {
+		t.Fatalf("expected 42, got %d", got)
+	}
+
+	req = httptest.NewRequest("GET", "/?limit=-1", nil)
+	if got := parseIntQuery(req, "limit", 10); got != 10 {
+		t.Fatalf("expected fallback 10, got %d", got)
+	}
+
+	req = httptest.NewRequest("GET", "/?limit=abc", nil)
+	if got := parseIntQuery(req, "limit", 10); got != 10 {
+		t.Fatalf("expected fallback 10, got %d", got)
+	}
+}