feat(jira): admin account replaces per-user tokens for all Jira/Tempo ops

- Single admin Jira account stored in system_configs (jira.admin_email, jira.admin_api_token)
- Admin Tempo token in system_configs (tempo.admin_token)
- get_admin_jira_client() + has_admin_jira_configured() replace per-user auth in all lifecycle hooks
- lookup_user_jira_account_id() auto-discovers each user's Atlassian accountId by email on login
- auto_log_test_worklog() now uses admin Tempo token and logs both red+blue team time
- Settings > Jira: admin credentials fields + test buttons moved to admin Jira tab
- Profile section simplified: jira_account_id shown read-only (auto-detected)

backend/app/services/jira_service.py

@@ -188,10 +188,110 @@ def get_user_jira_client(user: User, db: Session):
 
 
 def has_jira_configured(user: User, db: Session) -> bool:
-    """Return True if *user* has everything needed to call Jira."""
+    """Return True if *user* has everything needed to call Jira (legacy per-user check)."""
     return bool(get_jira_url(db) and _effective_jira_email(user) and user.jira_api_token)
 
 
+# ---------------------------------------------------------------------------
+# Admin Jira client (single account for all lifecycle hooks)
+# ---------------------------------------------------------------------------
+
+
+def get_admin_jira_email(db: Session) -> Optional[str]:
+    """Return the admin Jira email from system_configs."""
+    return _read_system_config(db, "jira.admin_email") or None
+
+
+def get_admin_jira_api_token(db: Session) -> Optional[str]:
+    """Return the admin Jira API token from system_configs."""
+    return _read_system_config(db, "jira.admin_api_token") or None
+
+
+def has_admin_jira_configured(db: Session) -> bool:
+    """Return True if the global Jira admin account is fully configured."""
+    return bool(
+        is_jira_enabled(db)
+        and get_jira_url(db)
+        and get_admin_jira_email(db)
+        and get_admin_jira_api_token(db)
+    )
+
+
+def get_admin_jira_client(db: Session):
+    """Return a Jira client authenticated with the global admin credentials.
+
+    All Aegis-to-Jira operations (issue creation, comments, transitions)
+    go through this single account.  Users do not need personal Jira tokens.
+    """
+    jira_url = get_jira_url(db)
+    if not jira_url:
+        raise InvalidOperationError("Jira URL is not configured.")
+
+    admin_email = get_admin_jira_email(db)
+    admin_token = get_admin_jira_api_token(db)
+    if not admin_email or not admin_token:
+        raise InvalidOperationError(
+            "Admin Jira credentials not configured. "
+            "Set them in System Settings → Jira Configuration → Admin Account."
+        )
+
+    from atlassian import Jira
+
+    return Jira(
+        url=jira_url.rstrip("/"),
+        username=admin_email,
+        password=admin_token,
+        cloud=True,
+    )
+
+
+def lookup_user_jira_account_id(db: Session, user: User) -> bool:
+    """Lookup *user*'s Atlassian account ID by email using the admin Jira client.
+
+    Updates ``user.jira_account_id`` in-place when found or changed.
+    Returns ``True`` when the value was updated, ``False`` otherwise.
+    Non-fatal — all errors are logged at DEBUG level and swallowed.
+    """
+    if not has_admin_jira_configured(db):
+        return False
+
+    email = getattr(user, "email", None)
+    if not email:
+        return False
+
+    try:
+        jira = get_admin_jira_client(db)
+        results = jira.user_find_by_user_string(query=email, maxResults=10)
+
+        account_id: Optional[str] = None
+        for u in results or []:
+            if isinstance(u, dict) and u.get("emailAddress", "").lower() == email.lower():
+                account_id = u.get("accountId")
+                break
+
+        if not account_id:
+            logger.debug("No Jira user found for email %s", email)
+            return False
+
+        current = getattr(user, "jira_account_id", None)
+        if account_id != current:
+            user.jira_account_id = account_id
+            db.flush()
+            logger.info(
+                "Auto-updated jira_account_id for %s: %s", user.username, account_id
+            )
+            return True
+
+        return False
+    except Exception as exc:
+        logger.debug(
+            "Could not lookup Jira account_id for %s: %s",
+            getattr(user, "username", "?"),
+            exc,
+        )
+        return False
+
+
 # ---------------------------------------------------------------------------
 # Ticket content builders (inspired by the pentest-to-Jira script)
 # ---------------------------------------------------------------------------
@@ -403,7 +503,7 @@ def auto_create_campaign_issue(
     Called once right after a campaign is committed to the database.
     The created ticket is stored as a JiraLink with entity_type=campaign.
     """
-    if not has_jira_configured(actor, db):
+    if not has_admin_jira_configured(db):
         return None
 
     project_key = get_jira_project_key(db)
@@ -417,7 +517,7 @@ def auto_create_campaign_issue(
     parent_ticket = get_jira_parent_ticket(db)
 
     try:
-        jira = get_user_jira_client(actor, db)
+        jira = get_admin_jira_client(db)
 
         fields: dict = {
             "project": {"key": project_key},
@@ -487,7 +587,7 @@ def auto_create_test_issue(
             instead of the system-configured parent (e.g. OFS-9107).
             Use this to nest test tickets under a campaign ticket.
     """
-    if not has_jira_configured(actor, db):
+    if not has_admin_jira_configured(db):
         return None
 
     project_key = get_jira_project_key(db)
@@ -502,7 +602,7 @@ def auto_create_test_issue(
     mitre_id = technique.mitre_id if technique else "N/A"
 
     try:
-        jira = get_user_jira_client(actor, db)
+        jira = get_admin_jira_client(db)
 
         # All tests — whether inside a campaign or standalone — are created
         # as Task.  Campaign tests use the campaign Jira key as parent
@@ -574,7 +674,7 @@ def push_test_event(
     Completely non-fatal — any Jira error is logged and swallowed so it
     never blocks the test workflow.
     """
-    if not has_jira_configured(actor, db):
+    if not has_admin_jira_configured(db):
         return
 
     link = (
@@ -589,7 +689,7 @@ def push_test_event(
         return
 
     try:
-        jira = get_user_jira_client(actor, db)
+        jira = get_admin_jira_client(db)
         comment = _build_state_comment(test, new_state, actor, extra)
         jira.issue_add_comment(link.jira_issue_key, comment)
 
@@ -650,7 +750,7 @@ def push_hold_event(
 
     Non-fatal — any Jira error is logged and swallowed.
     """
-    if not has_jira_configured(actor, db):
+    if not has_admin_jira_configured(db):
         return
 
     link = (
@@ -665,7 +765,7 @@ def push_hold_event(
         return
 
     try:
-        jira = get_user_jira_client(actor, db)
+        jira = get_admin_jira_client(db)
         ts = datetime.utcnow().strftime("%Y-%m-%d %H:%M UTC")
 
         if resuming:

backend/app/services/tempo_service.py

@@ -45,17 +45,50 @@ from app.models.user import User
 # Assign logger = logging.getLogger(__name__)
 logger = logging.getLogger(__name__)
 
-# Only red team execution time goes to Tempo.
-# Blue team evaluation time is tracked internally (worklogs table) for SLA
-# purposes but is NOT forwarded to Tempo — blue team has no Jira access.
-_TEMPO_ACTIVITY_TYPES = {"red_team_execution"}
-
-
 def has_tempo_configured(user) -> bool:
-    """Return True if *user* has a personal Tempo API token stored."""
+    """Return True if *user* has a personal Tempo API token stored (legacy)."""
     return bool(getattr(user, "tempo_api_token", None))
 
 
+def get_admin_tempo_token(db=None) -> Optional[str]:
+    """Return the admin Tempo API token from system_configs or env-var fallback."""
+    if db is not None:
+        try:
+            from app.models.system_config import SystemConfig
+            row = db.query(SystemConfig).filter(
+                SystemConfig.key == "tempo.admin_token"
+            ).first()
+            if row and row.value:
+                return row.value
+        except Exception:  # nosec B110
+            pass
+    return getattr(settings, "TEMPO_API_TOKEN", None) or None
+
+
+def has_admin_tempo_configured(db=None) -> bool:
+    """Return True if the admin Tempo token is configured."""
+    return bool(get_admin_tempo_token(db))
+
+
+def get_admin_tempo_client(db=None):
+    """Return a Tempo API v4 client authenticated with the admin token."""
+    token = get_admin_tempo_token(db)
+    if not token:
+        raise InvalidOperationError(
+            "Admin Tempo token not configured. "
+            "Set it in System Settings → Jira Configuration."
+        )
+    try:
+        from tempoapiclient import client_v4 as tempo_client
+        base_url = _get_tempo_base_url(db)
+        return tempo_client.Tempo(auth_token=token, base_url=base_url)
+    except ImportError:
+        raise InvalidOperationError(
+            "tempo-api-python-client is not installed. "
+            "Run: pip install tempo-api-python-client"
+        )
+
+
 _TEMPO_DEFAULT_BASE_URL = "https://api.tempo.io/4"
 _TEMPO_EU_BASE_URL = "https://api.eu.tempo.io/4"
 
@@ -166,93 +199,56 @@ def get_tempo_client():
     )
 
 
-# Define function auto_log_test_worklog
 def auto_log_test_worklog(
-    # Entry: db
     db: Session,
-    # Entry: test
     test: Test,
-    # Entry: user
     user: User,
-    # Entry: activity_type
     activity_type: str,
     duration_seconds: Optional[int] = None,
 ) -> Optional[dict]:
     """Log time to Tempo for the given test if conditions are met.
 
-    ``duration_seconds``, when provided, is used as-is so the Tempo entry
-    matches the Aegis worklog exactly.  When omitted, the duration is computed
-    from the test's phase start timestamp to ``updated_at`` (or now).
+    Uses the admin Tempo token (preferred) so regular users need no personal
+    token.  Falls back to the user's personal token when no admin token is set.
+    Both ``red_team_execution`` and ``blue_team_evaluation`` are logged.
 
-    Only ``red_team_execution`` activities are forwarded to Tempo.
-    ``blue_team_evaluation`` is tracked internally but not sent.
+    ``duration_seconds``, when provided, is used as-is.  When omitted, the
+    duration is computed from the test's phase start timestamp.
 
     Returns the Tempo worklog response dict, or ``None`` if skipped.
     Completely non-fatal — errors are logged and swallowed.
     """
-    # Only whitelisted activity types go to Tempo
-    if activity_type not in _TEMPO_ACTIVITY_TYPES:
-        logger.debug(
-            "Skipping Tempo sync for activity_type=%s (not in whitelist)", activity_type
-        )
+    # Only recognised activity types
+    if activity_type not in ("red_team_execution", "blue_team_evaluation"):
+        logger.debug("Skipping Tempo sync for activity_type=%s", activity_type)
         return None
 
     # Global kill-switch
     if not settings.TEMPO_ENABLED:
-        # Return None
         return None
 
     # Compute duration from test timestamps when not supplied by the caller
     if duration_seconds is None:
         from datetime import datetime as _dt
-        started = getattr(test, "red_started_at", None)
+        if activity_type == "blue_team_evaluation":
+            started = getattr(test, "blue_work_started_at", None) or getattr(test, "blue_started_at", None)
+        else:
+            started = getattr(test, "red_started_at", None)
         if started is None:
-            logger.debug("No red_started_at on test %s; skipping Tempo worklog", test.id)
+            logger.debug("No start timestamp on test %s for %s; skipping Tempo worklog", test.id, activity_type)
             return None
         ended = getattr(test, "updated_at", None) or _dt.utcnow()
         duration_seconds = max(int((ended - started).total_seconds()), 0)
 
     if duration_seconds <= 0:
-        logger.debug(
-            "Skipping Tempo sync for test %s: duration=%ds", test.id, duration_seconds
-        )
+        logger.debug("Skipping Tempo sync for test %s: duration=%ds", test.id, duration_seconds)
         return None
 
-    # Tempo requires whole minutes. Always round UP to the nearest minute
-    # and enforce a minimum of 60 seconds (1 minute).
-    #   2 seconds         → 60 s  (1 min, minimum)
-    #   3 min 20 s (200s) → 240 s (4 min, ceiling)
-    #   5 min 0 s  (300s) → 300 s (5 min, exact)
+    # Round UP to the nearest whole minute; enforce ≥ 60 s
     import math
     duration_seconds = max(60, math.ceil(duration_seconds / 60) * 60)
 
-    # Per-user token required
-    if not has_tempo_configured(user):
-        logger.debug(
-            "User %s has no Tempo token; skipping worklog for test %s",
-            getattr(user, "username", user), test.id,
-        )
-        return None
-
-    # Need a Jira link with a numeric issue ID
-    link = (
-        db.query(JiraLink)
-        # Chain .filter() call
-        .filter(
-            JiraLink.entity_id == test.id,
-            JiraLink.entity_type == JiraLinkEntityType.test,
-        )
-        # Chain .first() call
-        .first()
-    )
-
-    # Check: not link or not link.jira_issue_id
-    if not link or not link.jira_issue_id:
-        # Log debug: "No Jira link for test %s, skipping Tempo worklog"
-        logger.debug("No Jira link for test %s, skipping Tempo worklog", test.id)
-        # Return None
-        return None
-
+    # user.jira_account_id is required for Tempo worklog attribution
     jira_account_id = (getattr(user, "jira_account_id", "") or "").strip()
     if not jira_account_id:
         logger.debug(
@@ -261,37 +257,64 @@ def auto_log_test_worklog(
         )
         return None
 
-    # Attempt the following; catch errors below
-    try:
-        # Use the phase start timestamp as the worklog date so it matches when
-        # work actually happened (not the submission timestamp).
-        if activity_type == "blue_team_evaluation":
-            work_date = (
-                (test.blue_work_started_at or test.blue_started_at or test.created_at)
-                .strftime("%Y-%m-%d")
-            )
-            description = f"[Aegis] Blue Team evaluation: {test.name}"
-        else:
-            work_date = (
-                (test.red_started_at or getattr(test, "updated_at", None) or test.created_at)
-                .strftime("%Y-%m-%d")
-            )
-            description = f"[Aegis] Red Team execution: {test.name}"
-        result = log_worklog(
-            user=user,
-            jira_issue_id=int(link.jira_issue_id),
-            author_account_id=jira_account_id,
-            date=work_date,
-            time_spent_seconds=duration_seconds,
-            description=description,
-            db=db,
+    # Need a Jira link with a numeric issue ID
+    link = (
+        db.query(JiraLink)
+        .filter(
+            JiraLink.entity_id == test.id,
+            JiraLink.entity_type == JiraLinkEntityType.test,
         )
+        .first()
+    )
+    if not link or not link.jira_issue_id:
+        logger.debug("No Jira link for test %s, skipping Tempo worklog", test.id)
+        return None
+
+    # Use the phase start timestamp for the worklog date
+    if activity_type == "blue_team_evaluation":
+        work_date = (
+            (test.blue_work_started_at or test.blue_started_at or test.created_at)
+            .strftime("%Y-%m-%d")
+        )
+        description = f"[Aegis] Blue Team evaluation: {test.name}"
+    else:
+        work_date = (
+            (test.red_started_at or getattr(test, "updated_at", None) or test.created_at)
+            .strftime("%Y-%m-%d")
+        )
+        description = f"[Aegis] Red Team execution: {test.name}"
+
+    try:
+        # Admin token preferred; fall back to user's personal token for legacy setups
+        admin_token = get_admin_tempo_token(db)
+        if admin_token:
+            from tempoapiclient import client_v4 as tempo_client
+            base_url = _get_tempo_base_url(db)
+            tempo = tempo_client.Tempo(auth_token=admin_token, base_url=base_url)
+        elif has_tempo_configured(user):
+            tempo = get_user_tempo_client(user, db=db)
+        else:
+            logger.debug(
+                "No Tempo credentials available; skipping worklog for test %s", test.id
+            )
+            return None
+
+        try:
+            result = tempo.create_worklog(
+                accountId=jira_account_id,
+                issueId=int(link.jira_issue_id),
+                dateFrom=work_date,
+                timeSpentSeconds=duration_seconds,
+                description=description,
+            )
+        except BaseException as exc:
+            raise RuntimeError(f"Tempo API error: {exc}") from exc
+
         logger.info(
             "Tempo worklog created for test %s by user %s: %ds on %s",
             test.id, getattr(user, "username", user), duration_seconds, work_date,
         )
         return result
-    # Handle Exception
     except Exception as e:
         logger.warning(
             "Tempo worklog failed for test %s (user %s): %s",