mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
9b7352ae4a
Two changes that are really one: stop owning things that are already owned. AUTH. Deleted ui/src/auth.ts — a local PKCE implementation with its own token storage, its own refresh, its own state handling and its own idea of what signing out means. @hanzo/iam/browser is that, for every Hanzo app: configureIam + startLogin + handleCallback + getSession + getUser + logout. There is now no auth code in this repo to review, drift, or get wrong, and when IAM's end-session behaviour improves every app gets it without a line changing here. Verified against production IAM: hanzo.id reflects https://aml.hanzo.ai on discovery, token and userinfo, so the flow works from the console's origin. CONFIGURATION. Dropped config.json and the SPA_* env with it. The console derives its API from the host it is served on — aml.hanzo.ai can only ever talk to api.hanzo.ai — and reads its brand, issuer and IAM clientId from that API's /v1/aml/config, which now carries client_id because that route already answers 'which identity does this surface have'. So there is no setting that points authenticated requests somewhere, which is the setting worth attacking; the same image is every brand's; and nothing writes the served root, which is what lets the container run read-only and unprivileged. The derivation is deliberate about what it refuses: an address literal has three labels and no parent domain, so 127.0.0.1 would have become api.0.0.1. Every host shape is asserted — brand hosts, a bare domain, localhost, IPv4, IPv6. Also here, from the same review: one replay per tenant on /v1/aml/rules/test, because an empty sample opens every retained record and a handful at once occupies the engine that still has to answer ingest; and the CI smoke now asserts the invariants that replaced the old ones — no config.json is served, and the bundle names no clientId. CSP unchanged and re-proven: 7 routes, zero violations, zero console errors, still no 'unsafe-inline'. Go build/vet/gofmt clean, 18 packages green, api race-clean. Co-authored-by: Hanzo Dev <[email protected]>