feat(cloud): remove static credentials and add host console

2026-07-13 19:45:53 +08:00
parent efeb3eb926
commit c162c2501b
61 changed files with 3118 additions and 1221 deletions
@@ -0,0 +1,49 @@
+## Why
+
+The Cloud deployment currently requires operators to hand-maintain public API,
+Host, and enrollment bearer tokens in Compose environment variables. Cloud
+operator accounts now provide the human authentication boundary, while a Host
+Agent can establish its own durable identity by registering directly with the
+trusted control plane. Retaining both models makes deployment error-prone and
+leaves secrets in configuration without serving the intended workflow.
+
+## What Changes
+
+- **BREAKING** Remove configured public, static Host, and enrollment bearer
+  credentials from the Cloud Control Plane configuration and deployment
+  examples.
+- Authorize human Cloud API access exclusively through persistent Cloud user
+  sessions; remove the Console's bearer-token path and user-directory UI.
+  Interactive `device-cloud-admin` commands remain the account provisioning and
+  recovery surface.
+- Enable a fresh Host Agent to register directly with the trusted Cloud API
+  without a pre-shared enrollment token, then use its persisted, cloud-bound
+  secret for all later Host operations.
+- Bake the packaged Console static directory into the production image rather
+  than repeating it in Compose, and remove Compose entries whose values merely
+  duplicate application defaults or have no runtime effect.
+- Update deployment documentation and tests to describe and enforce the
+  tokenless production flow.
+
+## Capabilities
+
+### New Capabilities
+- `cloud-operator-authentication`: Cloud operator sign-in, CLI account
+  provisioning, and a token-free Console experience.
+- `credentialless-host-bootstrap`: Direct Host registration and durable
+  post-registration identity without static deployment credentials.
+
+### Modified Capabilities
+- `platform-sdk`: Replace configured bearer credentials as the production
+  authorization prerequisite with Cloud user-session authorization.
+- `host-agent-protocol`: Add unauthenticated first registration while retaining
+  host-bound authentication for every subsequent Host operation.
+
+## Impact
+
+Affected areas include the Cloud control configuration and authentication
+composition, public and internal Cloud routers, Host Agent configuration and
+enrollment client, Console UI, Docker/Compose deployment assets, tests, and
+`docs/CLOUD_DEPLOYMENT.md`. Existing deployments using the removed static token
+variables must create an administrator and re-enroll Hosts through the new
+flow before upgrading.