mirror of https://github.com/hanzoai/kms.git synced 2026-10-17 11:18:16 +00:00

Files

T

zeekayandHanzo Dev 3d53f3709a fix(kms-ui): truthful labels for validator key slots

The Keys page labeled the two validator slots "BLS public key" and "Corona
public key". Those names do not describe the cryptography: the "BLS" slot is
secp256k1 signed via CGGMP21 threshold ECDSA (not bls12-381), and the "Corona"
slot is ed25519 signed via FROST (not post-quantum, not the Corona R-LWE
lattice protocol). Relabel to state the actual scheme so operators are not
misled into a bls12-381/PQ assumption.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-25 17:52:27 -07:00

public

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

src

fix(kms-ui): truthful labels for validator key slots

2026-07-25 17:52:27 -07:00

.gitignore

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

index.html

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

package.json

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

pnpm-lock.yaml

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

postcss.config.js

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

README.md

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

tsconfig.json

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

vite.config.ts

purge: rip remaining Infisical residue — docs, env examples, repo boilerplate

2026-06-07 14:23:12 -07:00

README.md

@hanzo/kms-frontend

Hanzo KMS admin SPA.

Vite + React 19 + TypeScript + Tailwind v4
@hanzo/brand for brand tokens
@tanstack/react-query for fetch state
wouter with hash routing for deep links

Talks to /v1/kms/* on the kmsd HTTP server. No backend coupling beyond that.

Layout

src/
  components/
    AdminShell.tsx     — sidebar + topbar + content chrome
    CollectionCRUD.tsx — flat-collection table primitive
    Button.tsx         — buttons + inputs + cards + badges
  lib/
    api.ts             — typed fetch wrapper + auth helpers
    cn.ts              — clsx classname join
  pages/
    Login.tsx          — POST /v1/kms/auth/login
    Secrets.tsx        — bespoke path-tree browser
    Keys.tsx           — flat CollectionCRUD over GET /v1/kms/keys
    Audit.tsx          — GET /v1/kms/audit/stats
    Status.tsx         — GET /v1/kms/health + /v1/kms/status
    EndpointGap.tsx    — honest stub for unbacked admin pages
  App.tsx              — router + AdminShell wiring
  main.tsx             — entrypoint

Decisions

No tree listing for secrets. The canonical surface is path-addressed CRUD only. The "tree view" is a session-local history of paths the operator has opened. Persisted to localStorage so reloads don't lose context.
Hash routing. kmsd serves the SPA from / and ingress is path-stripped at root. Hash routing keeps deep links resilient to proxy reconfiguration.
Token in localStorage. /v1/kms/auth/login exchanges clientId/clientSecret for an IAM access token. The token sits in localStorage.KMS_TOKEN and is sent as Authorization: Bearer … on every request.
Pages with no backing endpoints (projects, workspaces, identities, integrations, certificates) render a single EndpointGap component that lists the routes the backend will need.

Commands

pnpm install
pnpm dev                       # http://localhost:5173 — proxies /v1/kms to :8443
pnpm build                     # → dist/, picked up by kmsd via KMS_FRONTEND_DIR
pnpm preview
pnpm typecheck

The image build copies dist/ to /app/frontend and kmsd serves it from KMS_FRONTEND_DIR. API paths are SPA-fallthrough-protected by kmsd's mux.