Add V2 admin feedback and safety review

application/single_app/config.py

@@ -101,7 +101,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.278"
+VERSION = "0.261.279"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 # Opt-out for deployments where App Service Easy Auth is active but the platform

application/v2_ui/src/App.tsx

@@ -19,9 +19,12 @@ import { restorePersistedRuns } from './stores/orchestrationStore';
 import { ChatPage } from './pages/ChatPage';
 import { HomePage } from './pages/HomePage';
 import { AdminSettingsPage } from './pages/AdminSettingsPage';
+import { AdminFeedbackReviewPage } from './pages/AdminFeedbackReviewPage';
+import { AdminSafetyViolationsPage } from './pages/AdminSafetyViolationsPage';
 import { AdminActionEditorPage, AdminAgentEditorPage } from './pages/AdminGlobalEditorPages';
 import { SettingsPage } from './pages/SettingsPage';
 import { WorkspacePage } from './pages/workspace/WorkspacePage';
+import { safeSameOriginUrl } from './lib/adminOperations';
 import { PlaceholderPage } from './pages/PlaceholderPage';
 import { GroupWorkspacePage } from './pages/GroupWorkspacePage';
 import { GroupDirectoryPage } from './pages/GroupDirectoryPage';
@@ -166,12 +169,15 @@ export function App() {
      */
     useEffect(() => {
         const faviconUrl = data?.branding?.favicon_url;
-        if (!faviconUrl) {
+        const safeFaviconUrl = faviconUrl
+            ? safeSameOriginUrl(faviconUrl, window.location.origin)
+            : null;
+        if (!safeFaviconUrl) {
             return;
         }
         const link = document.querySelector<HTMLLinkElement>('link[rel="icon"]');
-        if (link && link.getAttribute('href') !== faviconUrl) {
-            link.setAttribute('href', faviconUrl);
+        if (link && link.getAttribute('href') !== safeFaviconUrl) {
+            link.setAttribute('href', safeFaviconUrl);
         }
     }, [data]);
 
@@ -213,6 +219,8 @@ export function App() {
                 <Route path="/workspace/:section/:resourceId" element={<WorkspacePage />} />
                 <Route path="/settings" element={<SettingsPage />} />
                 <Route path="/admin" element={<AdminSettingsPage />} />
+                <Route path="/admin/feedback-review" element={<AdminFeedbackReviewPage />} />
+                <Route path="/admin/safety-violations" element={<AdminSafetyViolationsPage />} />
                 {/* The global editors return here, with their section in view. */}
                 <Route path="/admin/agents" element={<AdminSettingsPage focusSection="organization-agents-section" />} />
                 <Route path="/admin/actions" element={<AdminSettingsPage focusSection="actions-config" />} />

application/v2_ui/src/components/layout/Sidebar.tsx

@@ -26,16 +26,19 @@
     Globe2,
     LogOut,
     MessageSquarePlus,
+    MessageSquareHeart,
     MessagesSquare,
     Moon,
     Settings,
+    ShieldAlert,
     ShieldCheck,
     SlidersHorizontal,
     Sparkles,
     Sun,
     Users,
 } from 'lucide-react';
 import { useUiStore } from '../../stores/uiStore';
+import { safeSameOriginUrl } from '../../lib/adminOperations';
 import { useBootstrapStore } from '../../stores/bootstrapStore';
 import { useChatStore } from '../../stores/chatStore';
 import { classicChatHref } from '../../lib/conversationUrl';
@@ -144,10 +147,26 @@
 }
 
 function UserMenu({ collapsed }: { collapsed: boolean }) {
-    const user = useBootstrapStore((state) => state.data?.user);
-    const controlCenter = useBootstrapStore((state) => state.data?.control_center);
+    const bootstrap = useBootstrapStore((state) => state.data);
+    const user = bootstrap?.user;
+    const controlCenter = bootstrap?.control_center;
     const isAdmin = Boolean(user?.is_admin);
     const canOpenControlCenter = Object.values(controlCenter ?? {}).some(Boolean);
+    const roles = user?.roles ?? [];
+    const settings = bootstrap?.settings;
+    const features = bootstrap?.features;
+    const canReviewFeedback = Boolean(features?.enable_user_feedback) && (
+        settings?.require_member_of_feedback_admin === true
+            ? roles.includes('FeedbackAdmin')
+            : roles.includes('Admin')
+    );
+    const canReviewSafety = Boolean(
+        features?.enable_content_safety || features?.enable_content_screening,
+    ) && (
+        settings?.require_member_of_safety_violation_admin === true
+            ? roles.includes('SafetyViolationAdmin')
+            : roles.includes('Admin')
+    );
     const activeConversationId = useChatStore((state) => state.activeConversationId);
     const [open, setOpen] = useState(false);
     const containerRef = useRef<HTMLDivElement>(null);
@@ -225,6 +244,16 @@
                             <Settings size={15} /> Admin Settings
                         </NavLink>
                     )}
+                    {canReviewFeedback && (
+                        <NavLink to="/admin/feedback-review" onClick={() => setOpen(false)} className={itemClass}>
+                            <MessageSquareHeart size={15} /> Feedback Review
+                        </NavLink>
+                    )}
+                    {canReviewSafety && (
+                        <NavLink to="/admin/safety-violations" onClick={() => setOpen(false)} className={itemClass}>
+                            <ShieldAlert size={15} /> Safety Violations
+                        </NavLink>
+                    )}
                     {canOpenControlCenter && (
                         <NavLink to="/control-center" onClick={() => setOpen(false)} className={itemClass}>
                             <ShieldCheck size={15} /> Control Center
@@ -457,7 +486,7 @@
                                 const label = item.to === '/public' ? publicLabels.plural : item.label;
                                 return (
                             <NavLink
-                                to={item.to}
+                                to={safeSameOriginUrl(item.to, window.location.origin) ?? '/'}
                                 onClick={item.to === '/chat' ? startNewChatOnArrival : undefined}
                                 title={collapsed ? label : item.hint}
                                 className={({ isActive }) =>