# Cloud Console

Vue 3 + Vite single-page app for the Cloud Control Plane (`apps/cloud-api`).
The primary flow is a Cloud user account: username/password login creates an
expiring, revocable `HttpOnly` session cookie, while the frontend sends the
separate CSRF cookie value on writes. The browser never stores the session
secret in JavaScript.

## Prerequisites

- Node.js 20+
- A current Cloud API database migration and at least one administrator created
  with `device-cloud-admin users create ...`
- HTTPS for production: `CLOUD_SESSION_COOKIE_SECURE=true` is required in a
  production Cloud API. Terminate TLS at the origin serving `/console/`.

Accounts have fixed roles:

- `viewer`: task, device/host, and plugin read views
- `operator`: viewer access plus task submission APIs
- `admin`: all API scopes

Administrators can use **Users & limits** to manage accounts, restrict task
submission to explicit Host/Device targets, configure Host self-submission and
active-task limits, and inspect non-secret Cloud-proxy usage. Daily token
budgets are enforced only for Hosts reporting `AI_PLANNER_TRANSPORT=cloud`;
direct-provider Hosts are labelled **unmetered** rather than budget compliant.
The configured proxy reservation ceiling must fit within any daily budget.

## Local development

```bash
cd cloud-console
cp .env.example .env.local
# Point this to the local Cloud API when it is not http://127.0.0.1:8001
npm install
npm run dev
```

For a Vite origin such as `http://127.0.0.1:5173`, configure the API with the
exact origin and disable secure cookies only in local/test mode:

```bash
export CLOUD_CONSOLE_CORS_ORIGINS="http://127.0.0.1:5173"
export CLOUD_SESSION_COOKIE_SECURE=false
```

The Console uses `credentials: include`. `401` returns to the login screen;
`403` remains an authorization error so an otherwise valid session is retained.

## Production

`npm run build` type-checks and creates `dist/`. The repository Dockerfile
already builds this bundle into `/app/console-static` and configures the Cloud
API to serve it at the same-origin `/console/` route. No CORS configuration is
required in that deployment shape. Use `device-cloud-admin` for account
provisioning and recovery.