Sprint 3 — admin quick-actions, order status, and Entra sign-in scaffold

.github/workflows/AdminWebpage-Deploy-WF.yml

@@ -26,6 +26,13 @@ env:
   APP_SERVICE_NAME: WA-DeliveryBot-Admin-dev
   BOTNET_API_URL: https://ewu-deliverybotsystem-api.mangocoast-332176b0.westus2.azurecontainerapps.io
   SIMULATOR_API_URL: https://deliverybot-robot-simulator.mangocoast-332176b0.westus2.azurecontainerapps.io
+  ORDER_SERVICE_URL: https://deliverybot-order-service.mangocoast-332176b0.westus2.azurecontainerapps.io
+  # Entra ID staff sign-in (issue #54). Blank → auth disabled (app runs open).
+  # Fill these in from the app registration to switch sign-in on, then push.
+  # Client/tenant/group IDs are not secrets (a public SPA exposes them anyway).
+  ENTRA_CLIENT_ID: "b5a029c3-d046-4005-9497-23ba18df70b2"
+  ENTRA_TENANT_ID: "37321907-14a5-4390-987d-ec0c66c655cd"
+  ENTRA_ADMIN_GROUP_ID: "14fcd995-e89f-4020-b5ff-4a9b48a5824e"
 
 jobs:
   build-and-deploy:
@@ -64,6 +71,10 @@ jobs:
         env:
           VITE_BOTNET_API_URL: ${{ env.BOTNET_API_URL }}
           VITE_SIMULATOR_API_URL: ${{ env.SIMULATOR_API_URL }}
+          VITE_ORDER_SERVICE_URL: ${{ env.ORDER_SERVICE_URL }}
+          VITE_ENTRA_CLIENT_ID: ${{ env.ENTRA_CLIENT_ID }}
+          VITE_ENTRA_TENANT_ID: ${{ env.ENTRA_TENANT_ID }}
+          VITE_ENTRA_ADMIN_GROUP_ID: ${{ env.ENTRA_ADMIN_GROUP_ID }}
         run: npm run build
 
       # ── 3. Deploy the build to the App Service ─────────────────────────────

OrderService/OrderService/Controllers/OrdersController.cs

@@ -34,11 +34,14 @@ public async Task<IActionResult> GetOrder(Guid id)
         return order is null ? NotFound() : Ok(order);
     }
 
-    // GET /api/orders?customerId=xxx — returns full order history for a customer
+    // GET /api/orders — returns all orders (admin view, issue #53)
+    // GET /api/orders?customerId=xxx — returns full order history for one customer
     [HttpGet]
-    public async Task<IActionResult> GetOrderHistory([FromQuery] string customerId)
+    public async Task<IActionResult> GetOrders([FromQuery] string? customerId)
     {
-        var orders = await _orderService.GetOrderHistoryAsync(customerId);
+        var orders = string.IsNullOrWhiteSpace(customerId)
+            ? await _orderService.GetAllOrdersAsync()
+            : await _orderService.GetOrderHistoryAsync(customerId);
         return Ok(orders);
     }
 }

OrderService/OrderService/Program.cs

@@ -32,6 +32,19 @@
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddSwaggerGen();
 
+// ── CORS ─────────────────────────────────────────────────────────────────────
+// Allow the Admin & Maintenance App (issue #18, Orders view #53) to call this
+// API from the browser.
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy("AdminApp", policy =>
+        policy.WithOrigins(
+                  "https://wa-deliverybot-admin-dev.azurewebsites.net", // deployed admin app
+                  "http://localhost:5173")                              // local Vite dev server
+              .AllowAnyHeader()
+              .AllowAnyMethod());
+});
+
 var app = builder.Build();
 
 // ── Auto-migrate on startup ────────────────────────────────────────────────────
@@ -56,6 +69,7 @@
 app.UseSwaggerUI();
 
 app.UseHttpsRedirection();
+app.UseCors("AdminApp");
 app.MapControllers();
 
 app.Run();

OrderService/OrderService/Services/IOrderService.cs

@@ -9,6 +9,7 @@ public interface IOrderService
     Task<OrderResponseDto> PlaceOrderAsync(PlaceOrderDto dto);
     Task<OrderResponseDto?> GetOrderAsync(Guid id);
     Task<IEnumerable<OrderResponseDto>> GetOrderHistoryAsync(string customerId);
+    Task<IEnumerable<OrderResponseDto>> GetAllOrdersAsync();
 
     // Advances order status in response to a bot event from the simulator (#41).
     Task ApplyStatusEventAsync(RobotEventEnvelope evt, CancellationToken ct = default);

OrderService/OrderService/Services/OrderService.cs

@@ -89,6 +89,17 @@ public async Task<IEnumerable<OrderResponseDto>> GetOrderHistoryAsync(string cus
         return orders.Select(ToResponseDto);
     }
 
+    // Returns every order, newest first. Backs the admin Orders view (issue #53).
+    public async Task<IEnumerable<OrderResponseDto>> GetAllOrdersAsync()
+    {
+        var orders = await _db.Orders
+            .Include(o => o.Items)
+            .OrderByDescending(o => o.CreatedAt)
+            .ToListAsync();
+
+        return orders.Select(ToResponseDto);
+    }
+
     public async Task ApplyStatusEventAsync(RobotEventEnvelope evt, CancellationToken ct = default)
     {
         // Never react to events we published ourselves (RobotOrderAssignment).

admin-webapp/.env.example

@@ -10,3 +10,14 @@ VITE_BOTNET_API_URL=https://ewu-deliverybotsystem-api.mangocoast-332176b0.westus
 # When unset, simulator sync is silently disabled and the admin app operates
 # against BotNet alone — useful before the simulator is deployed locally.
 VITE_SIMULATOR_API_URL=https://deliverybot-robot-simulator.mangocoast-332176b0.westus2.azurecontainerapps.io
+
+# Base URL of the Order Service (issue #22). Backs the Orders tab (issue #53).
+# When unset, the Orders view falls back to mock data.
+VITE_ORDER_SERVICE_URL=https://deliverybot-order-service.mangocoast-332176b0.westus2.azurecontainerapps.io
+
+# Entra ID staff sign-in (issue #54). Leave blank to run with auth disabled.
+# Fill from the "DeliveryBot Admin App" registration to enable sign-in.
+VITE_ENTRA_CLIENT_ID=b5a029c3-d046-4005-9497-23ba18df70b2
+VITE_ENTRA_TENANT_ID=37321907-14a5-4390-987d-ec0c66c655cd
+# Object ID of the DeliveryBot-Admin security group (gates who can sign in).
+VITE_ENTRA_ADMIN_GROUP_ID=14fcd995-e89f-4020-b5ff-4a9b48a5824e