Add partner portal and contextual product promotions

.env.example

@@ -232,7 +232,8 @@ DEVFEED_FARO_ENABLED=false
 DEVFEED_AI_QUOTA_PACING_ENABLED=false
 DEVFEED_AI_QUOTA_RESERVE_PERCENT=20
 
-# Image storage: credentials stay in the worker and user API; reader APIs use the public URL.
+# Image storage: credentials stay in the images worker and private APIs for avatar/ad uploads.
+# Public reader APIs and frontends use only the public URL.
 # Enable the `images` Compose profile for imgproxy and the dedicated Images worker.
 # Topic logos require public GET/HEAD CORS for card exports; see apps/aggregator/TOPIC_LOGOS.md.
 DEVFEED_IMAGE_STORAGE_ENABLED=false
@@ -270,3 +271,35 @@ DEVFEED_ARTICLE_TOPIC_PROPOSALS_ENABLED=true
 # DEVFEED_MCP_ACCESS_TOKEN_TTL_SECONDS=900
 # DEVFEED_USER_MCP_SESSION_TTL_SECONDS=2592000
 # DEVFEED_USER_MCP_SESSION_ABSOLUTE_TTL_SECONDS=7776000
+
+# Partner portal: use a separate Zitadel application/client in the same project.
+# The partner-api process reads the shared DEVFEED_OIDC_* policy settings;
+# Compose maps these dedicated client values into that process only.
+# DEVFEED_PARTNER_BASE_URL=https://partner.devfeed.tech
+# DEVFEED_PARTNER_API_URL=http://partner-api:8004
+# DEVFEED_PARTNER_PORT=3002
+# DEVFEED_PARTNER_COOKIE_SECURE=true
+# DEVFEED_PARTNER_SESSION_TTL_SECONDS=28800
+# DEVFEED_PARTNER_OIDC_CLIENT_ID=
+# DEVFEED_PARTNER_OIDC_CLIENT_SECRET=
+
+# Server-only receipt signing key shared by the public API and user API delivery code.
+# Use at least 32 random ASCII characters. Never expose this key to the reader or extensions.
+# An empty key disables delivery and collection. See packages/core/PARTNER_PROMOTIONS.md.
+DEVFEED_PARTNER_TRACKING_KEY=
+
+# Dedicated server-only key shared by web and public API for caller quota isolation.
+# Use at least 32 random ASCII characters; never reuse the receipt signing key.
+DEVFEED_PARTNER_CALLER_KEY=
+# Enable only behind an edge that overwrites this single-IP header and restricts origin access.
+# Cloudflare Tunnel deployments can use cf-connecting-ip. Leave unset for direct development.
+DEVFEED_PARTNER_CALLER_IP_HEADER=
+
+# Optional partner connector credential, injected into import workers and admin API checks.
+# Select this secret reference in the connector's authentication settings.
+DEVFEED_PARTNER_SECRET_PRODUCTS_API_TOKEN=
+# Encryption key for partner-provided import credentials. Generate a Fernet key
+# with cryptography.fernet.Fernet.generate_key(); keep it separate from the DB.
+# Inject the same key into partner-api and import workers. Missing configuration
+# disables token setup; replacing the key requires replacing saved credentials.
+DEVFEED_PARTNER_CREDENTIAL_KEY=

.github/api-compatibility/admin-job-kinds.txt

@@ -0,0 +1,19 @@
+# Partner job kinds extend the shared AdminJobOut model. Existing requests retain
+# their original kinds: /jobs/{kind} selects only that kind, and fixed analysis,
+# notification and topic routes never return partner jobs. Partner kinds require
+# an explicit new kind in the request. The generated admin client handles both.
+# Scope exceptions to these two values and these exact response properties only.
+GET /v1/admin/jobs/ai-analysis added the new `partner-evaluation` enum value to the `items/items/kind` response property for the response status `200`
+GET /v1/admin/jobs/ai-analysis added the new `partner-pipeline` enum value to the `items/items/kind` response property for the response status `200`
+GET /v1/admin/jobs/{kind} added the new `partner-evaluation` enum value to the `items/items/kind` response property for the response status `200`
+GET /v1/admin/jobs/{kind} added the new `partner-pipeline` enum value to the `items/items/kind` response property for the response status `200`
+GET /v1/admin/jobs/{kind}/{job_id} added the new `partner-evaluation` enum value to the `kind` response property for the response status `200`
+GET /v1/admin/jobs/{kind}/{job_id} added the new `partner-pipeline` enum value to the `kind` response property for the response status `200`
+POST /v1/admin/jobs/{kind}/{job_id}/retry added the new `partner-evaluation` enum value to the `kind` response property for the response status `200`
+POST /v1/admin/jobs/{kind}/{job_id}/retry added the new `partner-pipeline` enum value to the `kind` response property for the response status `200`
+POST /v1/admin/notifications/deliveries/{identifier}/retry added the new `partner-evaluation` enum value to the `kind` response property for the response status `200`
+POST /v1/admin/notifications/deliveries/{identifier}/retry added the new `partner-pipeline` enum value to the `kind` response property for the response status `200`
+POST /v1/admin/topic-proposals/{proposal_id}/analysis added the new `partner-evaluation` enum value to the `kind` response property for the response status `202`
+POST /v1/admin/topic-proposals/{proposal_id}/analysis added the new `partner-pipeline` enum value to the `kind` response property for the response status `202`
+POST /v1/admin/topics/{topic_id}/relationships/analysis added the new `partner-evaluation` enum value to the `kind` response property for the response status `202`
+POST /v1/admin/topics/{topic_id}/relationships/analysis added the new `partner-pipeline` enum value to the `kind` response property for the response status `202`

.github/images.json

@@ -31,7 +31,9 @@
         "apps/notifications/**",
         "apps/article-enrichment-worker/**"
       ],
-      "platforms": ["linux/arm64"],
+      "platforms": [
+        "linux/arm64"
+      ],
       "smoke-script": ".github/scripts/smoke-image.sh"
     },
     {
@@ -54,7 +56,9 @@
         "apps/notifications/**",
         "apps/images-worker/**"
       ],
-      "platforms": ["linux/arm64"],
+      "platforms": [
+        "linux/arm64"
+      ],
       "smoke-script": ".github/scripts/smoke-image.sh"
     },
     {
@@ -77,15 +81,19 @@
         "apps/notifications/**",
         "apps/source-discovery-worker/**"
       ],
-      "platforms": ["linux/arm64"],
+      "platforms": [
+        "linux/arm64"
+      ],
       "smoke-script": ".github/scripts/smoke-image.sh"
     },
     {
       "id": "mcp",
       "image": "ghcr.io/abhi1693/devfeed.tech/mcp",
       "context": ".",
       "file": "apps/mcp/Dockerfile",
-      "platforms": ["linux/arm64"],
+      "platforms": [
+        "linux/arm64"
+      ],
       "smoke-script": ".github/scripts/smoke-image.sh"
     },
     {
@@ -137,6 +145,26 @@
         "linux/arm64"
       ],
       "smoke-script": ".github/scripts/smoke-image.sh"
+    },
+    {
+      "id": "partner-api",
+      "image": "ghcr.io/abhi1693/devfeed.tech/partner-api",
+      "context": ".",
+      "file": "apps/partner-api/Dockerfile",
+      "platforms": [
+        "linux/arm64"
+      ],
+      "smoke-script": ".github/scripts/smoke-image.sh"
+    },
+    {
+      "id": "partner",
+      "image": "ghcr.io/abhi1693/devfeed.tech/partner",
+      "context": ".",
+      "file": "apps/partner/Dockerfile",
+      "platforms": [
+        "linux/arm64"
+      ],
+      "smoke-script": ".github/scripts/smoke-image.sh"
     }
   ]
 }

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
             const url = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             const workspaces = [
               'apps/admin-api', 'apps/aggregator', 'apps/api', 'apps/article-enrichment-worker',
-              'apps/cli', 'apps/images-worker', 'apps/mcp', 'apps/notifications',
+              'apps/cli', 'apps/images-worker', 'apps/mcp', 'apps/notifications', 'apps/partner-api',
               'apps/search-indexer', 'apps/source-discovery-worker', 'apps/user-api',
               'packages/core', 'packages/http'
             ];
@@ -178,6 +178,20 @@ jobs:
       uv-sync-args: '["--all-packages"]'
       generated-paths: '["apps/admin/openapi.json","apps/admin/src/lib/api/generated"]'
     name: Unit / Admin UI lint, tests and build
+  partner-web:
+    name: Unit / Partner portal lint, tests, build and browser checks
+    uses: abhi1693/actions/.github/workflows/node-ci.yml@afba12afb85bf40be9328c92dc53b779f18d5c6d # v1.0.1
+    with:
+      checks: '["lint", "test", "build"]'
+      scripts: '{"lint": "partner:lint", "test": "ci:partner-test", "build": "ci:partner-browser"}'
+      timeout-minutes: 20
+      runs-on: ubuntu-24.04-arm
+      node-version: "24"
+      test-results-path: |
+        reports/partner.xml
+        reports/coverage/partner/lcov.info
+      test-results-name: partner-test-results-${{ github.run_attempt }}
+      project-env: '{"NEXT_TELEMETRY_DISABLED":"1"}'
   user-web:
     uses: abhi1693/actions/.github/workflows/node-ci.yml@afba12afb85bf40be9328c92dc53b779f18d5c6d # v1.0.1
     with:
@@ -314,6 +328,7 @@ jobs:
           allow-external-refs: false
           review: false
           github-token: ""
+          err-ignore: .github/api-compatibility/admin-job-kinds.txt
           output-to-file: reports/api-compatibility/admin.breaking.txt
       - name: Check public MCP
         id: mcp_public
@@ -705,6 +720,7 @@ jobs:
       - python-unit
       - python-integration
       - admin-web
+      - partner-web
       - user-web
       - browser-budgets
       - dast
@@ -715,7 +731,7 @@ jobs:
     if: >-
       always() && !cancelled() &&
       needs.python-unit.result == 'success' && needs.python-integration.result == 'success' &&
-      needs.admin-web.result == 'success' && needs.user-web.result == 'success' &&
+      needs.admin-web.result == 'success' && needs.partner-web.result == 'success' && needs.user-web.result == 'success' &&
       ((github.event_name == 'push' && github.ref == 'refs/heads/master') ||
       (github.event_name == 'pull_request' &&
        github.event.pull_request.head.repo.full_name == github.repository &&
@@ -821,6 +837,7 @@ jobs:
     needs:
       - python-unit
       - admin-web
+      - partner-web
       - user-web
       - extensions
       - python-integration
@@ -853,6 +870,7 @@ jobs:
       - python-unit
       - coverage-report
       - admin-web
+      - partner-web
       - user-web
       - extensions
       - api-compat
@@ -889,7 +907,7 @@ jobs:
           RESULTS: ${{ toJSON(needs) }}
         run: |
           echo "$RESULTS" | jq -e --arg event "$EVENT_NAME" --arg ref_type "$REF_TYPE" --arg comment "$COVERAGE_COMMENT_REQUIRED" --arg browser_comment "$BROWSER_COMMENT_REQUIRED" --arg sonar "$SONAR_EXPECTED" '
-            ([.["python-unit"], .["admin-web"], .["user-web"], .extensions,
+            ([.["python-unit"], .["admin-web"], .["partner-web"], .["user-web"], .extensions,
               .["python-integration"], .["migration-upgrade"], .["reader-parity"],
               .["admin-browser"], .["live-browser"], .security]
              | all(.result == "success")) and

.github/workflows/performance.yml

@@ -27,15 +27,14 @@ jobs:
         id: changes
         run: node scripts/ci/api-performance-changes.mjs
   measure:
-    name: ${{ matrix.revision }} sample ${{ matrix.repeat }}
+    name: Runner pair ${{ matrix.repeat }}
     needs: select
     if: github.event_name == 'pull_request' && needs.select.outputs.needed == 'true'
     runs-on: ubuntu-24.04-arm
-    timeout-minutes: 10
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
-        revision: [base, head]
         repeat: [0, 1, 2]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -44,7 +43,6 @@ jobs:
           path: candidate
           persist-credentials: false
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        if: matrix.revision == 'base'
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: baseline
@@ -59,45 +57,29 @@ jobs:
           cache-dependency-glob: |
             candidate/uv.lock
             baseline/uv.lock
-          cache-suffix: performance-${{ matrix.revision }}
+          cache-suffix: performance-pair
       - name: Install the candidate harness
         run: sh candidate/scripts/ci/python-bootstrap.sh candidate --editable --all-packages --group loadtest
       - name: Install the baseline application
-        if: matrix.revision == 'base'
         run: sh candidate/scripts/ci/python-bootstrap.sh baseline --editable --all-packages
-      - name: Run one isolated sample
+      - name: Run one runner pair
         env:
-          APP_ROOT: ${{ matrix.revision == 'base' && 'baseline' || 'candidate' }}
-          SAMPLE: ${{ matrix.revision }}-${{ matrix.repeat }}
-        run: |
-          destination="reports/performance/$SAMPLE"
-          mkdir -p "$destination"
-          set +e
-          candidate/.venv/bin/python candidate/scripts/load-test.py \
-            --app-root "$APP_ROOT" --app-python "$APP_ROOT/.venv/bin/python" \
-            --users 16 --spawn-rate 4 --seconds 60 --rows 1000 \
-            --output "$destination" > "$destination/runner.log" 2>&1
-          result=$?
-          printf '%s\n' "$result" > "$destination/exit-code.txt"
-          exit "$result"
+          PAIR_REPEAT: ${{ matrix.repeat }}
+        run: python3 candidate/scripts/ci/api-performance-pair.py --repeat "$PAIR_REPEAT"
       - name: Preserve incomplete samples
         if: always()
         env:
-          SAMPLE: ${{ matrix.revision }}-${{ matrix.repeat }}
-        run: |
-          mkdir -p "reports/performance/$SAMPLE"
-          if [ ! -f "reports/performance/$SAMPLE/exit-code.txt" ]; then
-            echo incomplete > "reports/performance/$SAMPLE/exit-code.txt"
-          fi
+          PAIR_REPEAT: ${{ matrix.repeat }}
+        run: python3 candidate/scripts/ci/api-performance-pair.py --repeat "$PAIR_REPEAT" --preserve-only
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
-          name: perf-sample-${{ matrix.revision }}-${{ matrix.repeat }}-${{ github.run_attempt }}
+          name: perf-sample-pair-${{ matrix.repeat }}-${{ github.run_attempt }}
           path: reports/performance/
           if-no-files-found: error
           retention-days: 30
   compare:
-    name: Compare six independent samples
+    name: Compare six samples from three runners
     needs: [select, measure]
     if: always() && !cancelled() && github.event_name == 'pull_request'
     runs-on: ubuntu-24.04

.gitleaksignore

@@ -13,6 +13,6 @@ aefa7143e2d3420c702e54dd1906279f9b9c50ec:docs/development.md:generic-api-key:147
 # Public RFC 6455 example WebSocket nonce in the historical transport test.
 6f7042198d7a22e1fca9a6e100ed9571853adf8c:infra/codex/transport.test.cjs:generic-api-key:38
 
-# Disposable partner-placement signing keys used only by historical test fixtures.
+# Reviewed disposable fixture literals, replaced by generated test values.
 9463cbb56414fc4f83ee6f183873bc39de323d2e:tests/test_partner_placement_api.py:generic-api-key:25
 9463cbb56414fc4f83ee6f183873bc39de323d2e:tests/test_partner_placements_integration.py:generic-api-key:44

.pre-commit-config.yaml

@@ -18,10 +18,10 @@ repos:
       - id: check-yaml
         args: [--allow-multiple-documents]
       - id: end-of-file-fixer
-        exclude: ^apps/admin/src/lib/api/generated/
+        exclude: ^apps/(admin|partner)/src/lib/api/generated/
       - id: trailing-whitespace
         args: [--markdown-linebreak-ext=md]
-        exclude: ^apps/admin/src/lib/api/generated/
+        exclude: ^apps/(admin|partner)/src/lib/api/generated/
 
   - repo: local
     hooks:
@@ -42,7 +42,7 @@ repos:
         entry: node node_modules/prettier/bin/prettier.cjs --write
         language: system
         files: \.(ts|tsx|js|jsx|mjs|cjs|mts|cts)$
-        exclude: (^|/)next-env\.d\.ts$|^apps/admin/src/lib/api/generated/
+        exclude: (^|/)next-env\.d\.ts$|^apps/(admin|partner)/src/lib/api/generated/
         require_serial: true
       - id: project-checks
         name: Affected project lint, types and unit tests

.prettierignore

@@ -14,3 +14,5 @@ reports/
 **/next-env.d.ts
 apps/admin/openapi.json
 apps/admin/src/lib/api/generated/
+apps/partner/openapi.json
+apps/partner/src/lib/api/generated/

CHANGELOG.md

@@ -107,6 +107,23 @@ Application releases and Alembic schema revisions are separate identifiers.
 
 - Label the user list's activity timestamp as Last active, reflecting authenticated activity rather than only sign-ins.
 
+### Enhancements
+
+- Set a separate sync interval for each partner without interrupting running syncs.
+- Browse partner products in a searchable table with dedicated detail pages and related listings, jobs, and evaluations.
+- Sync partner products independently so a failed product can retry without repeating successful work.
+- Connect launch platform partnerships to sync developer products automatically, check product capabilities, and privately evaluate article relevance.
+- Browse partnership pipeline jobs and evaluations in dedicated pages with related records, matching evidence, and worker logs.
+- Manage partners in dedicated list, create, edit, and detail pages, with related products and sync job logs.
+- Combine matching products from multiple launch platforms while retaining each listing, attribution, and shared product exclusions.
+
+### Fixes
+
+- Search partner products, pipeline jobs, and evaluations using literal text, including punctuation.
+- Recover partner syncs after repeated failures so corrected upstream products can be discovered.
+- Refresh article matching after retrying product checks while an earlier evaluation is still active.
+- Sort products by name or update time in a partner's related objects.
+
 ## 0.0.48 — 2026-10-02
 
 ### Fixes

Dockerfile

@@ -16,6 +16,7 @@ COPY packages/http/pyproject.toml packages/http/pyproject.toml
 COPY apps/api/pyproject.toml apps/api/pyproject.toml
 COPY apps/mcp/pyproject.toml apps/mcp/pyproject.toml
 COPY apps/admin-api/pyproject.toml apps/admin-api/pyproject.toml
+COPY apps/partner-api/pyproject.toml apps/partner-api/pyproject.toml
 COPY apps/user-api/pyproject.toml apps/user-api/pyproject.toml
 COPY apps/aggregator/pyproject.toml apps/aggregator/pyproject.toml
 COPY apps/notifications/pyproject.toml apps/notifications/pyproject.toml

README.md

@@ -103,3 +103,11 @@ or [join the discussion](https://github.com/abhi1693/devfeed.tech/discussions).
 
 Contributions to the reading experience, feed compatibility, accessibility, and
 documentation are welcome. Start with [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Partner portal
+
+The standalone partner portal and API expose membership-scoped product/ad analytics,
+and partnership tiers. Superusers manage accounts in the admin application. See [portal setup and access model](apps/partner/README.md).
+
+Configure product API endpoints, mappings, pagination and authentication in the admin app.
+See [partner API connectors](packages/core/PARTNER_CONNECTORS.md) for setup and supported contracts.

apps/admin-api/Dockerfile

@@ -15,6 +15,7 @@ COPY packages/http/pyproject.toml packages/http/pyproject.toml
 COPY apps/api/pyproject.toml apps/api/pyproject.toml
 COPY apps/mcp/pyproject.toml apps/mcp/pyproject.toml
 COPY apps/admin-api/pyproject.toml apps/admin-api/pyproject.toml
+COPY apps/partner-api/pyproject.toml apps/partner-api/pyproject.toml
 COPY apps/user-api/pyproject.toml apps/user-api/pyproject.toml
 COPY apps/aggregator/pyproject.toml apps/aggregator/pyproject.toml
 COPY apps/notifications/pyproject.toml apps/notifications/pyproject.toml

apps/admin-api/pyproject.toml

@@ -4,7 +4,7 @@ version = "0.0.52"
 description = "Isolated DevFeed administration and OIDC service"
 requires-python = ">=3.12"
 dependencies = [
-    "devfeed-core", "devfeed-http[identity]", "fastapi>=0.142.2,<1", "uvicorn[standard]>=0.34,<1",
+    "devfeed-core", "devfeed-http[identity,uploads]", "fastapi>=0.142.2,<1", "uvicorn[standard]>=0.34,<1",
     "websockets>=15,<18", "rq>=2.8,<3",
 ]