feat(cloud): remove static credentials and add host console

cloud-console/src/api.ts

@@ -7,9 +7,6 @@ import type {
   TaskAttempt,
   TaskListResponse,
   TaskStatus,
-  UserCreatePayload,
-  UserListResponse,
-  UserUpdatePayload,
 } from "./types";
 
 const configuredBaseUrl = import.meta.env.VITE_CLOUD_API_BASE_URL as
@@ -21,7 +18,6 @@ export const API_BASE_URL = (configuredBaseUrl || window.location.origin).replac
   "",
 );
 
-const TOKEN_STORAGE_KEY = "cloudConsole.bearerToken";
 const CSRF_COOKIE_NAME = "amcp_csrf";
 
 export const AUTH_INVALID_EVENT = "cloud-console:auth-invalid";
@@ -35,47 +31,19 @@ export class CloudApiError extends Error {
   }
 }
 
-export function getStoredToken(): string | null {
-  try {
-    return sessionStorage.getItem(TOKEN_STORAGE_KEY);
-  } catch {
-    return null;
-  }
-}
-
-export function storeToken(token: string): void {
-  sessionStorage.setItem(TOKEN_STORAGE_KEY, token);
-}
-
-export function clearStoredToken(): void {
-  sessionStorage.removeItem(TOKEN_STORAGE_KEY);
-}
-
-export function hasTokenMode(): boolean {
-  return getStoredToken() !== null;
-}
-
 interface RequestInitLike {
   method?: string;
   body?: string | null;
   headers?: Record<string, string>;
-  allowAnonymous?: boolean;
-  sessionOnly?: boolean;
 }
 
 async function request<T>(path: string, init: RequestInitLike = {}): Promise<T> {
-  const token = init.sessionOnly ? null : getStoredToken();
-  if (!init.allowAnonymous && !token && !init.sessionOnly) {
-    // Session mode is permitted, so a missing token is not itself an error.
-  }
   const method = init.method || "GET";
   const headers: Record<string, string> = {
     Accept: "application/json",
     ...init.headers,
   };
-  if (token) {
-    headers.Authorization = `Bearer ${token}`;
-  } else if (["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
     const csrfToken = getCookie(CSRF_COOKIE_NAME);
     if (csrfToken) headers["X-CSRF-Token"] = csrfToken;
   }
@@ -89,7 +57,6 @@ async function request<T>(path: string, init: RequestInitLike = {}): Promise<T>
     credentials: "include",
   });
   if (response.status === 401) {
-    if (token) clearStoredToken();
     window.dispatchEvent(new CustomEvent(AUTH_INVALID_EVENT));
     throw new CloudApiError(401, await responseDetail(response, "authentication expired"));
   }
@@ -127,17 +94,15 @@ export function login(username: string, password: string): Promise<CloudUser> {
   return request<CloudUser>("/v1/auth/login", {
     method: "POST",
     body: JSON.stringify({ username, password }),
-    allowAnonymous: true,
-    sessionOnly: true,
   });
 }
 
 export function getCurrentUser(): Promise<CloudUser> {
-  return request<CloudUser>("/v1/auth/me", { sessionOnly: true });
+  return request<CloudUser>("/v1/auth/me");
 }
 
 export function logout(): Promise<void> {
-  return request<void>("/v1/auth/logout", { method: "POST", sessionOnly: true });
+  return request<void>("/v1/auth/logout", { method: "POST" });
 }
 
 export function changePassword(
@@ -150,7 +115,6 @@ export function changePassword(
       current_password: currentPassword,
       new_password: newPassword,
     }),
-    sessionOnly: true,
   });
 }
 
@@ -189,41 +153,3 @@ export function registerPlugin(payload: PluginRegistrationPayload): Promise<Plug
     body: JSON.stringify(payload),
   });
 }
-
-export function listUsers(options?: {
-  limit?: number;
-  offset?: number;
-}): Promise<UserListResponse> {
-  const params = new URLSearchParams({
-    limit: String(options?.limit ?? 50),
-    offset: String(options?.offset ?? 0),
-  });
-  return request<UserListResponse>(`/v1/users?${params.toString()}`);
-}
-
-export function createUser(payload: UserCreatePayload): Promise<CloudUser> {
-  return request<CloudUser>("/v1/users", {
-    method: "POST",
-    body: JSON.stringify(payload),
-  });
-}
-
-export function updateUser(userId: string, payload: UserUpdatePayload): Promise<CloudUser> {
-  return request<CloudUser>(`/v1/users/${encodeURIComponent(userId)}`, {
-    method: "PATCH",
-    body: JSON.stringify(payload),
-  });
-}
-
-export function resetUserPassword(userId: string, password: string): Promise<CloudUser> {
-  return request<CloudUser>(`/v1/users/${encodeURIComponent(userId)}/password`, {
-    method: "POST",
-    body: JSON.stringify({ password }),
-  });
-}
-
-export function revokeUserSessions(userId: string): Promise<void> {
-  return request<void>(`/v1/users/${encodeURIComponent(userId)}/sessions`, {
-    method: "DELETE",
-  });
-}