Vue 3 + Vite single-page app for the Cloud Control Plane (apps/cloud-api). The primary flow is a Cloud user account: username/password login creates an expiring, revocable HttpOnly session cookie, while the frontend sends the separate CSRF cookie value on writes. The browser never stores the session secret in JavaScript.

The login screen also offers Use API token for existing break-glass or automation credentials. That token is held only in sessionStorage; it remains compatible with the existing scoped CLOUD_PUBLIC_CREDENTIALS_JSON model.

Prerequisites

Node.js 20+
A current Cloud API database migration and at least one administrator created with device-cloud-admin users create ...
HTTPS for production: CLOUD_SESSION_COOKIE_SECURE=true is required in a production Cloud API. Terminate TLS at the origin serving /console/.

Accounts have fixed roles:

viewer: task, device/host, and plugin read views
operator: viewer access plus task submission APIs
admin: all API scopes and the Console Users view

Local development

cd cloud-console
cp .env.example .env.local
# Point this to the local Cloud API when it is not http://127.0.0.1:8001
npm install
npm run dev

For a Vite origin such as http://127.0.0.1:5173, configure the API with the exact origin and disable secure cookies only in local/test mode:

export CLOUD_CONSOLE_CORS_ORIGINS="http://127.0.0.1:5173"
export CLOUD_SESSION_COOKIE_SECURE=false

The Console uses credentials: include. 401 returns to the login screen; 403 remains an authorization error so an otherwise valid session is retained.

Production

npm run build type-checks and creates dist/. The repository Dockerfile already builds this bundle into /app/console-static; compose.yaml and compose.deploy.yaml mount it at the same-origin /console/ route. No CORS configuration is required in that deployment shape.

Administrators can create users, assign roles, enable/disable accounts, reset temporary passwords, and revoke sessions. All password inputs are cleared from the UI after a create/reset request succeeds or fails.