mirror of https://github.com/hanzoai/kms.git synced 2026-10-17 11:18:16 +00:00

Files

T

History

zeekay 5cab2f1f5a The console signs in on hanzo.ai, carrying hanzo-kms's own request

Signed out, the console no longer draws "Sign in with hanzo.id". It has
the SDK mint hanzo-kms's PKCE request (its callback, an S256 challenge,
no nonce) and replaces the page with hanzo.ai/login plus that query.
hanzo.ai finishes it and the callback lands on the page that was asked
for.

Discovery is read from api.hanzo.ai and the token, revoke and logout
calls stay on this origin's /v1/iam, so nothing calls hanzo.id. Sign-out
ends the session here with the SDK's end(), which @hanzo/iam 0.21.31
has. The Status page stops printing the issuer.

2026-10-16 18:37:41 -07:00

public

fix: the favicon is the Hanzo mark, not a red tile with a drawn H

2026-08-24 14:22:20 -07:00

src

The console signs in on hanzo.ai, carrying hanzo-kms's own request

2026-10-16 18:37:41 -07:00

.gitignore

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

index.html

The console signs in with Hanzo IAM and manages secrets over cloud's /v1/kms

2026-09-15 11:33:56 -07:00

package.json

The console signs in on hanzo.ai, carrying hanzo-kms's own request

2026-10-16 18:37:41 -07:00

pnpm-lock.yaml

The console signs in on hanzo.ai, carrying hanzo-kms's own request

2026-10-16 18:37:41 -07:00

postcss.config.js

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

README.md

The console signs in with Hanzo IAM and manages secrets over cloud's /v1/kms

2026-09-15 11:33:56 -07:00

tsconfig.json

The console signs in with Hanzo IAM and manages secrets over cloud's /v1/kms

2026-09-15 11:33:56 -07:00

vite.config.ts

The console signs in with Hanzo IAM and manages secrets over cloud's /v1/kms

2026-09-15 11:33:56 -07:00

README.md

Hanzo KMS console

The app at kms.hanzo.ai. It signs in with Hanzo IAM and manages the signed-in organization's secrets over the KMS API that cloud serves on the same host.

Vite, React 19, TypeScript, Tailwind v4
@hanzo/iam/browser for sign-in: authorization code with PKCE against the issuer GET /v1/kms/config names, as the <brand>-kms client
@tanstack/react-query for fetch state, wouter for routes

API it calls

Method	Path	Page
GET	`/v1/kms/config`	before sign-in
GET	`/v1/kms/health`	Status
GET	`/v1/kms/secrets?path=&env=`	Secrets
GET, DELETE	`/v1/kms/secrets/{path}/{name}?env=`	Secrets
POST	`/v1/kms/secrets`	Secrets

The org is never in a URL: cloud reads it from the token.

Commands

pnpm install
pnpm dev         # http://localhost:5173, proxies /v1 to a local cloud on :8000
pnpm test        # node:test over src/lib/kms.ts
pnpm build       # typecheck, then dist/

Shipping

hanzo.yml declares the site: the forge runs .hanzo/workflows/cicd.yml, which builds dist/ and publishes it to the Sites plane as kms. The ingress serves it on kms.hanzo.ai and sends /v1 to cloud.