58 lines
2.1 KiB
Markdown
58 lines
2.1 KiB
Markdown
# Cloud Console
|
|
|
|
Vue 3 + Vite single-page app for the Cloud Control Plane (`apps/cloud-api`).
|
|
The primary flow is a Cloud user account: username/password login creates an
|
|
expiring, revocable `HttpOnly` session cookie, while the frontend sends the
|
|
separate CSRF cookie value on writes. The browser never stores the session
|
|
secret in JavaScript.
|
|
|
|
The login screen also offers **Use API token** for existing break-glass or
|
|
automation credentials. That token is held only in `sessionStorage`; it remains
|
|
compatible with the existing scoped `CLOUD_PUBLIC_CREDENTIALS_JSON` model.
|
|
|
|
## Prerequisites
|
|
|
|
- Node.js 20+
|
|
- A current Cloud API database migration and at least one administrator created
|
|
with `device-cloud-admin users create ...`
|
|
- HTTPS for production: `CLOUD_SESSION_COOKIE_SECURE=true` is required in a
|
|
production Cloud API. Terminate TLS at the origin serving `/console/`.
|
|
|
|
Accounts have fixed roles:
|
|
|
|
- `viewer`: task, device/host, and plugin read views
|
|
- `operator`: viewer access plus task submission APIs
|
|
- `admin`: all API scopes and the Console Users view
|
|
|
|
## Local development
|
|
|
|
```bash
|
|
cd cloud-console
|
|
cp .env.example .env.local
|
|
# Point this to the local Cloud API when it is not http://127.0.0.1:8001
|
|
npm install
|
|
npm run dev
|
|
```
|
|
|
|
For a Vite origin such as `http://127.0.0.1:5173`, configure the API with the
|
|
exact origin and disable secure cookies only in local/test mode:
|
|
|
|
```bash
|
|
export CLOUD_CONSOLE_CORS_ORIGINS="http://127.0.0.1:5173"
|
|
export CLOUD_SESSION_COOKIE_SECURE=false
|
|
```
|
|
|
|
The Console uses `credentials: include`. `401` returns to the login screen;
|
|
`403` remains an authorization error so an otherwise valid session is retained.
|
|
|
|
## Production
|
|
|
|
`npm run build` type-checks and creates `dist/`. The repository Dockerfile
|
|
already builds this bundle into `/app/console-static`; `compose.yaml` and
|
|
`compose.deploy.yaml` mount it at the same-origin `/console/` route. No CORS
|
|
configuration is required in that deployment shape.
|
|
|
|
Administrators can create users, assign roles, enable/disable accounts, reset
|
|
temporary passwords, and revoke sessions. All password inputs are cleared from
|
|
the UI after a create/reset request succeeds or fails.
|