58 lines
2.2 KiB
Markdown
58 lines
2.2 KiB
Markdown
# Cloud Console
|
|
|
|
Vue 3 + Vite single-page app for the Cloud Control Plane (`apps/cloud-api`).
|
|
The primary flow is a Cloud user account: username/password login creates an
|
|
expiring, revocable `HttpOnly` session cookie, while the frontend sends the
|
|
separate CSRF cookie value on writes. The browser never stores the session
|
|
secret in JavaScript.
|
|
|
|
## Prerequisites
|
|
|
|
- Node.js 20+
|
|
- A current Cloud API database migration and at least one administrator created
|
|
with `device-cloud-admin users create ...`
|
|
- HTTPS for production: `CLOUD_SESSION_COOKIE_SECURE=true` is required in a
|
|
production Cloud API. Terminate TLS at the origin serving `/console/`.
|
|
|
|
Accounts have fixed roles:
|
|
|
|
- `viewer`: task, device/host, and plugin read views
|
|
- `operator`: viewer access plus task submission APIs
|
|
- `admin`: all API scopes
|
|
|
|
Administrators can use **Users & limits** to manage accounts, restrict task
|
|
submission to explicit Host/Device targets, configure Host self-submission and
|
|
active-task limits, and inspect non-secret Cloud-proxy usage. Daily token
|
|
budgets are enforced only for Hosts reporting `AI_PLANNER_TRANSPORT=cloud`;
|
|
direct-provider Hosts are labelled **unmetered** rather than budget compliant.
|
|
The configured proxy reservation ceiling must fit within any daily budget.
|
|
|
|
## Local development
|
|
|
|
```bash
|
|
cd cloud-console
|
|
cp .env.example .env.local
|
|
# Point this to the local Cloud API when it is not http://127.0.0.1:8001
|
|
npm install
|
|
npm run dev
|
|
```
|
|
|
|
For a Vite origin such as `http://127.0.0.1:5173`, configure the API with the
|
|
exact origin and disable secure cookies only in local/test mode:
|
|
|
|
```bash
|
|
export CLOUD_CONSOLE_CORS_ORIGINS="http://127.0.0.1:5173"
|
|
export CLOUD_SESSION_COOKIE_SECURE=false
|
|
```
|
|
|
|
The Console uses `credentials: include`. `401` returns to the login screen;
|
|
`403` remains an authorization error so an otherwise valid session is retained.
|
|
|
|
## Production
|
|
|
|
`npm run build` type-checks and creates `dist/`. The repository Dockerfile
|
|
already builds this bundle into `/app/console-static` and configures the Cloud
|
|
API to serve it at the same-origin `/console/` route. No CORS configuration is
|
|
required in that deployment shape. Use `device-cloud-admin` for account
|
|
provisioning and recovery.
|