mirror of https://github.com/hanzoai/kms.git synced 2026-10-17 11:18:16 +00:00

Files

T

zooqueenandHanzo Dev 81e27efff6 The console signs in with Hanzo IAM and manages secrets over cloud's /v1/kms

The console now calls the KMS API cloud serves on kms.hanzo.ai: the org
comes from the token, a listing shows every secret by path and
environment, and a value is opened, replaced or deleted one secret at a
time. Sign-in is authorization code with PKCE through @hanzo/iam against
the issuer /v1/kms/config names, as the <brand>-kms client.

Pages with no API behind them (keys, audit, projects, certificates) are
gone. kmsd no longer serves the console; it ships as a static site.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-15 11:33:56 -07:00

1.2 KiB

Raw Permalink Blame History

Hanzo KMS console

The app at kms.hanzo.ai. It signs in with Hanzo IAM and manages the signed-in organization's secrets over the KMS API that cloud serves on the same host.

Vite, React 19, TypeScript, Tailwind v4
@hanzo/iam/browser for sign-in: authorization code with PKCE against the issuer GET /v1/kms/config names, as the <brand>-kms client
@tanstack/react-query for fetch state, wouter for routes

API it calls

Method	Path	Page
GET	`/v1/kms/config`	before sign-in
GET	`/v1/kms/health`	Status
GET	`/v1/kms/secrets?path=&env=`	Secrets
GET, DELETE	`/v1/kms/secrets/{path}/{name}?env=`	Secrets
POST	`/v1/kms/secrets`	Secrets

The org is never in a URL: cloud reads it from the token.

Commands

pnpm install
pnpm dev         # http://localhost:5173, proxies /v1 to a local cloud on :8000
pnpm test        # node:test over src/lib/kms.ts
pnpm build       # typecheck, then dist/

Shipping

hanzo.yml declares the site: the forge runs .hanzo/workflows/cicd.yml, which builds dist/ and publishes it to the Sites plane as kms. The ingress serves it on kms.hanzo.ai and sends /v1 to cloud.

1.2 KiB Raw Permalink Blame History

Hanzo KMS console

API it calls

Commands

Shipping

1.2 KiB

Raw Permalink Blame History