feat: Phase 25 - Admin Panel + Query Suggestions + Anomaly Detection

- Admin auth: file-based JWT auth (no DB dependency), login/logout/session
- Admin API: /admin/login, /admin/logout, /admin/users, /admin/validate
- Admin dashboard: health status, anomaly list, user management
- Query suggestions: based on historical patterns and document content
- Suggestions API: /suggestions, /suggestions/related
- Anomaly detection: cost spikes, latency spikes, rapid queries, routing imbalances
- Health metrics: system status, avg cost, avg latency, error rate
- Anomaly API: /anomalies, /health/metrics
- Frontend: query suggestions in dashboard, admin link in all sidebars

Author: DeryFerd

PROGRESS.md

@@ -1,8 +1,8 @@
 # Cost-Aware Agentic RAG - Progress
 
-## Current Status: Phase 22 In Progress 🔄
+## Current Status: Phase 25 Complete ✅
 
-**Last Updated**: June 15, 2026
+**Last Updated**: June 16, 2026
 
 ---
 
@@ -137,6 +137,17 @@ caa3f98 feat: expand data to 7 companies, 2075 chunks
 - **Conversation API** — GET /conversation/context, POST /conversation/session, GET /conversation/sessions, DELETE /conversation/session/{id}
 - **Frontend export buttons** — CSV and Analytics PDF export in dashboard header
 
+### ✅ Phase 25: Admin Panel + Query Suggestions + Anomaly Detection
+- **Admin auth** — File-based JWT auth (no DB dependency), login/logout/session management
+- **Admin API** — POST /admin/login, /admin/logout, GET /admin/users, POST /admin/users, DELETE /admin/users/{id}, GET /admin/validate
+- **Admin dashboard** — Health status, anomaly list, user management, query suggestions
+- **Query suggestions** — Based on historical patterns and document content
+- **Suggestions API** — GET /suggestions, GET /suggestions/related
+- **Anomaly detection** — Cost spikes, latency spikes, rapid queries, routing imbalances
+- **Health metrics** — System status, avg cost, avg latency, error rate
+- **Anomaly API** — GET /anomalies, GET /health/metrics
+- **Frontend** — Query suggestions in dashboard, Admin link in all sidebars
+
 ---
 
 ## API Endpoints
@@ -169,17 +180,28 @@ GET  /conversation/context - Get conversation context
 POST /conversation/session - Create/switch session
 GET  /conversation/sessions - List all sessions
 DELETE /conversation/session/{id} - Delete session
+GET  /suggestions         - Get query suggestions
+GET  /suggestions/related - Get related queries
+GET  /anomalies           - Detect anomalies
+GET  /health/metrics      - System health metrics
+POST /admin/login         - Admin login
+POST /admin/logout        - Admin logout
+GET  /admin/users         - List users
+POST /admin/users         - Create user
+DELETE /admin/users/{id}  - Delete user
+GET  /admin/validate      - Validate session
 ```
 
 ---
 
 ## Frontend Pages
 
 ```
-/ (Dashboard)            - Chat with streaming + feedback buttons
+/ (Dashboard)            - Chat with streaming + feedback + suggestions
 /upload                  - Upload PDF documents
 /analytics               - Charts and metrics (real API)
-/comparison              - Model comparison dashboard (NEW)
+/comparison              - Model comparison dashboard
+/admin                   - Admin panel (auth, users, health, anomalies)
 /documents               - SEC filing browser (real API)
 ```
 
@@ -250,9 +272,10 @@ cost-aware-agentic-rag/
 │       ├── analytics/page.tsx    # Analytics (real API)
 │       └── documents/page.tsx    # Documents (real API)
 ├── web/templates/                    # HTML templates (Jinja2)
-│   ├── app.html                      # Dashboard (chat + feedback buttons)
+│   ├── app.html                      # Dashboard (chat + feedback + suggestions)
 │   ├── upload.html                   # Document upload page
-│   ├── comparison.html               # NEW: Model comparison dashboard
+│   ├── comparison.html               # Model comparison dashboard
+│   ├── admin.html                    # NEW: Admin panel
 │   ├── documents.html                # Document browser
 │   └── analytics.html                # Analytics dashboard
 ├── src/

api/main.py

@@ -46,6 +46,17 @@
 from src.ml.feedback import store_feedback, get_feedback_stats, get_recent_feedback
 from src.ml.cost_analytics import CostAnalytics
 from src.ml.export import QueryExporter
+from src.ml.suggestions import QuerySuggestion
+from src.ml.anomaly import AnomalyDetector
+from src.database.admin_auth import (
+    authenticate_user,
+    create_session,
+    validate_session,
+    logout_session,
+    list_users,
+    create_user,
+    delete_user,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -631,6 +642,93 @@ def delete_session(session_id: str):
     return {"status": "deleted"}
 
 
+# ── Query Suggestion Endpoints ──────────────────────────────────────
+@app.get("/suggestions")
+def get_suggestions(limit: int = 5):
+    """Get query suggestions."""
+    suggestion_engine = QuerySuggestion()
+    return {"suggestions": suggestion_engine.get_suggestions(limit=limit)}
+
+
+@app.get("/suggestions/related")
+def get_related_queries(query: str, limit: int = 3):
+    """Get queries related to the input query."""
+    suggestion_engine = QuerySuggestion()
+    return {"related": suggestion_engine.get_related_queries(query, limit=limit)}
+
+
+# ── Anomaly Detection Endpoints ─────────────────────────────────────
+@app.get("/anomalies")
+def detect_anomalies(window_hours: int = 24):
+    """Detect anomalies in recent data."""
+    detector = AnomalyDetector()
+    return detector.detect_anomalies(window_hours=window_hours)
+
+
+@app.get("/health/metrics")
+def health_metrics():
+    """Get system health metrics."""
+    detector = AnomalyDetector()
+    return detector.get_health_metrics()
+
+
+# ── Admin Auth Endpoints ────────────────────────────────────────────
+@app.post("/admin/login")
+def admin_login(username: str, password: str):
+    """Admin login."""
+    user = authenticate_user(username, password)
+    if not user:
+        raise HTTPException(status_code=401, detail="Invalid credentials")
+    token = create_session(user["username"])
+    return {"token": token, "user": user}
+
+
+@app.post("/admin/logout")
+def admin_logout(token: str):
+    """Admin logout."""
+    if logout_session(token):
+        return {"status": "logged_out"}
+    raise HTTPException(status_code=401, detail="Invalid token")
+
+
+@app.get("/admin/users")
+def admin_list_users():
+    """List all users (admin only)."""
+    return {"users": list_users()}
+
+
+@app.post("/admin/users")
+def admin_create_user(username: str, password: str, role: str = "user"):
+    """Create a new user (admin only)."""
+    result = create_user(username, password, role)
+    if "error" in result:
+        raise HTTPException(status_code=400, detail=result["error"])
+    return result
+
+
+@app.delete("/admin/users/{username}")
+def admin_delete_user(username: str):
+    """Delete a user (admin only)."""
+    if delete_user(username):
+        return {"status": "deleted"}
+    raise HTTPException(status_code=404, detail="User not found")
+
+
+@app.get("/admin/validate")
+def admin_validate(token: str):
+    """Validate admin session."""
+    user = validate_session(token)
+    if user:
+        return {"valid": True, "user": user}
+    return {"valid": False}
+
+
+@app.get("/app/admin", response_class=HTMLResponse)
+def admin_page(request: Request) -> HTMLResponse:
+    """Admin dashboard page."""
+    return templates.TemplateResponse(request, "admin.html")
+
+
 def _build_context(results: list, max_chars: int = 2000) -> str:
     """Build context string from retrieval results."""
     from src.agents.graph import _build_context_from_tools

src/database/admin_auth.py

@@ -0,0 +1,147 @@
+"""Simplified admin authentication (file-based, no DB dependency)."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import secrets
+from datetime import datetime, timedelta
+
+from src.config import settings
+
+ADMIN_DIR = settings.data_dir / "admin"
+ADMIN_DIR.mkdir(parents=True, exist_ok=True)
+
+USERS_FILE = ADMIN_DIR / "users.json"
+SESSIONS_FILE = ADMIN_DIR / "sessions.json"
+
+
+def _hash_password(password: str) -> str:
+    return hashlib.sha256(password.encode()).hexdigest()
+
+
+def _load_users() -> dict:
+    if USERS_FILE.exists():
+        return json.loads(USERS_FILE.read_text(encoding="utf-8"))
+    return {}
+
+
+def _save_users(users: dict) -> None:
+    USERS_FILE.write_text(json.dumps(users, indent=2), encoding="utf-8")
+
+
+def _load_sessions() -> dict:
+    if SESSIONS_FILE.exists():
+        return json.loads(SESSIONS_FILE.read_text(encoding="utf-8"))
+    return {}
+
+
+def _save_sessions(sessions: dict) -> None:
+    SESSIONS_FILE.write_text(json.dumps(sessions, indent=2), encoding="utf-8")
+
+
+def init_admin() -> None:
+    """Create default admin user if no users exist."""
+    users = _load_users()
+    if not users:
+        users["admin"] = {
+            "username": "admin",
+            "password_hash": _hash_password("admin123"),
+            "role": "admin",
+            "created_at": datetime.now().isoformat(),
+            "is_active": True,
+        }
+        _save_users(users)
+
+
+def authenticate_user(username: str, password: str) -> dict | None:
+    """Authenticate user credentials."""
+    users = _load_users()
+    user = users.get(username)
+    if not user:
+        return None
+    if user["password_hash"] != _hash_password(password):
+        return None
+    if not user.get("is_active", True):
+        return None
+    return {"username": user["username"], "role": user["role"]}
+
+
+def create_session(username: str) -> str:
+    """Create a session token for authenticated user."""
+    token = secrets.token_hex(32)
+    sessions = _load_sessions()
+    sessions[token] = {
+        "username": username,
+        "created_at": datetime.now().isoformat(),
+        "expires_at": (datetime.now() + timedelta(hours=24)).isoformat(),
+    }
+    _save_sessions(sessions)
+    return token
+
+
+def validate_session(token: str) -> dict | None:
+    """Validate session token and return user info."""
+    sessions = _load_sessions()
+    session = sessions.get(token)
+    if not session:
+        return None
+    if datetime.fromisoformat(session["expires_at"]) < datetime.now():
+        del sessions[token]
+        _save_sessions(sessions)
+        return None
+    return {"username": session["username"], "role": "admin"}
+
+
+def logout_session(token: str) -> bool:
+    """Logout (delete) a session."""
+    sessions = _load_sessions()
+    if token in sessions:
+        del sessions[token]
+        _save_sessions(sessions)
+        return True
+    return False
+
+
+def list_users() -> list[dict]:
+    """List all users."""
+    users = _load_users()
+    return [
+        {
+            "username": u["username"],
+            "role": u["role"],
+            "created_at": u["created_at"],
+            "is_active": u.get("is_active", True),
+        }
+        for u in users.values()
+    ]
+
+
+def create_user(username: str, password: str, role: str = "user") -> dict:
+    """Create a new user."""
+    users = _load_users()
+    if username in users:
+        return {"error": "User already exists"}
+    users[username] = {
+        "username": username,
+        "password_hash": _hash_password(password),
+        "role": role,
+        "created_at": datetime.now().isoformat(),
+        "is_active": True,
+    }
+    _save_users(users)
+    return {"username": username, "role": role}
+
+
+def delete_user(username: str) -> bool:
+    """Delete a user."""
+    users = _load_users()
+    if username in users:
+        del users[username]
+        _save_users(users)
+        return True
+    return False
+
+
+# Initialize on import
+init_admin()