You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
chore(dashboard): purge dashboard-api references from frontend codebase (#21)
The dashboard frontend talks directly to api.instanode.dev for every
operation — auth, claim, billing, team, resources, stacks. The
dashboard-api Go service is being retired. This change cleans up
documentation comments, the README architecture section, and the
ContractsPage/DeploymentsPage banners that still mentioned dashboard-api.
No runtime behavior changes: vite.config.ts and src/api/index.ts already
only point at the agent API.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copy file name to clipboardExpand all lines: README.md
+22-22Lines changed: 22 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,14 @@
1
1
# instanode.dev Dashboard
2
2
3
-
React 18 + TypeScript + Vite frontend for the customer dashboard. This is where users log in, view their provisioned resources, upgrade their plan, and manage their team. It talks exclusively to `dashboard-api/` (port 8081, NodePort 30082) — not directly to the agent-facing `api/`.
3
+
React 18 + TypeScript + Vite frontend for the customer dashboard. This is where users log in, view their provisioned resources, upgrade their plan, and manage their team. It talks directly to the agent-facing API at `api.instanode.dev`.
4
4
5
5
---
6
6
7
-
## Why Two APIs?
7
+
## Architecture
8
8
9
-
`api/` (port 8080) is designed for agents and automation: anonymous-friendly, no sessions, simple HTTP, no cookies. It intentionally has no concept of "logged-in user."
9
+
The dashboard is a single-page app that calls the agent API at `api.instanode.dev` for every operation: auth, claim, billing, team management, resource CRUD, and stacks. There is no intermediate backend — the browser holds a bearer token (`localStorage.instanode.token`) and includes it on every request.
10
10
11
-
`dashboard-api/` (port 8081) is designed for humans: it manages JWT sessions, team membership, billing state, and exposes resource management UI that proxies reads from the platform database. The two services have different auth models, different latency tolerances, and different security concerns. Keeping them separate means a bug in the human-facing session layer cannot affect agent provisioning, and vice versa.
11
+
In dev, Vite proxies `/api`, `/auth`, `/claim`, `/db`, `/cache`, `/nosql`, `/queue`, `/storage`, `/webhook`, `/.well-known` to `AGENT_API_URL` (default `http://api.instanode.dev`). In prod, the dashboard ships as a static bundle on GitHub Pages and issues cross-origin fetches directly to `https://api.instanode.dev` (set via the `VITE_API_URL` build env).
12
12
13
13
---
14
14
@@ -20,9 +20,9 @@ npm install
20
20
npm run dev # Vite dev server at http://localhost:5173
21
21
```
22
22
23
-
Requires `dashboard-api` running and reachable at `http://localhost:30082` (k8s NodePort). If you're not running k8s, start it with docker-compose:
├── ResourceCard/ # Resource summary card used in DashboardPage
@@ -59,27 +59,26 @@ src/
59
59
60
60
## Auth Flow
61
61
62
-
1. User clicks "Login with GitHub" on `LoginPage` — browser goes to `dashboard-api/auth/github`.
63
-
2. OAuth redirect returns to `dashboard-api/auth/callback`, which issues a JWT and sets a `__session` HttpOnly cookie.
64
-
3.`useAuth.ts` calls `/auth/me` on mount to hydrate session state. The JWT is kept in memory (not localStorage) to avoid XSS exposure.
65
-
4.`useAuth.ts` silently calls `/auth/refresh` every 23 hours to extend the session without prompting the user.
66
-
5. On logout, `/auth/logout` clears the cookie and the in-memory token.
62
+
1. User pastes a PAT or completes the email magic-link flow on `LoginPage`.
63
+
2. The bearer token is stored in `localStorage.instanode.token` and attached as `Authorization: Bearer <token>` on every subsequent request.
64
+
3.`useAuth.ts` calls `GET /auth/me` on mount to hydrate session state.
65
+
4. On 401, the client clears the token, stores the current path under `instanode.return_to`, and redirects to `/login`.
67
66
68
67
---
69
68
70
69
## The Claim Page (Anonymous to Account)
71
70
72
-
When an anonymous user hits a resource limit, `api/` embeds an upgrade URL in the response:
71
+
When an anonymous user hits a resource limit, the agent API embeds an upgrade URL in the response:
73
72
```
74
73
https://instanode.dev/start?t=<signed-jwt>
75
74
```
76
75
77
-
That URL hits `api/GET /start`, which validates the JWT and issues a 302 redirect to:
76
+
That URL hits `GET /start` on the agent API, which validates the JWT and issues a 302 redirect to:
78
77
```
79
78
http://localhost:5173/claim?t=<jwt>
80
79
```
81
80
82
-
`ClaimPage.tsx` picks up the `t` parameter, lets the user choose a login method, and calls `api/POST /claim` to atomically convert the anonymous session into a full account. The JWT in the claim is single-use — a second call returns 409 Conflict, preventing double-conversion.
81
+
`ClaimPage.tsx` picks up the `t` parameter, lets the user choose a login method, and calls `POST /claim` on the agent API to atomically convert the anonymous session into a full account. The JWT in the claim is single-use — a second call returns 409 Conflict, preventing double-conversion.
107 tests covering auth guards, the upgrade journey, and resource interactions.
89
88
90
89
```bash
91
-
# Requires: Vite dev server running (npm run dev) + k8s API at localhost:30080
90
+
# Requires: Vite dev server running (npm run dev) + agent API at localhost:30080
92
91
E2E_API_URL=http://localhost:30080 npx playwright test --project=chromium
93
92
94
93
# Run a single spec
@@ -106,13 +105,14 @@ npx playwright test --headed --project=chromium
106
105
107
106
| Variable | Purpose | Default |
108
107
|---|---|---|
109
-
|`VITE_API_URL`| dashboard-api base URL |`http://localhost:30082`|
108
+
|`AGENT_API_URL`| Upstream the Vite dev proxy points at |`http://api.instanode.dev`|
109
+
|`VITE_API_URL`| Build-time override for the production bundle |`https://api.instanode.dev`|
110
110
|`VITE_NO_PROXY`| Disables Vite proxy (set to `1` in E2E) | unset |
111
111
|`E2E_API_URL`| Agent API base URL used by Playwright tests |`http://localhost:30080`|
112
112
113
113
---
114
114
115
115
## Known Gaps
116
116
117
-
-**RotateCredentials**: the UI calls `POST /api/v1/resources/:id/rotate` on dashboard-api, which proxies to `api/`. Rotation is implemented for Postgres, Redis, and MongoDB.
118
-
-**Razorpay Checkout**: the "Upgrade to Pro" button opens `instanode.dev/pricing` when checkout is not configured. A real `POST /api/v1/billing/checkout`endpoint in dashboard-api returns a Razorpay short URL when keys are configured.
117
+
-**RotateCredentials**: the UI calls `POST /api/v1/resources/:id/rotate-credentials` on the agent API. Rotation is implemented for Postgres, Redis, and MongoDB.
118
+
-**Razorpay Checkout**: the "Upgrade to Pro" button calls `POST /api/v1/billing/checkout`on the agent API and redirects to the returned Razorpay short URL. When Razorpay isn't configured (503), the button falls back to `instanode.dev/pricing`.
<strong>Trial vs. immediate Hobby.</strong><code>plans.yaml</code> declares <code>trial_days: 14</code>; <code>auth.go:151</code> assigns <code>hobby</code> with no trial fields. Brief journey 1 assumes a trial. <strong>Lock:</strong> add <code>teams.trial_ends_at</code> + worker, OR drop trial language from copy.
162
162
</ContractBanner>
163
163
<ContractBannerkind="warning"badge="#2">
164
-
<strong>"Deployments" vs "Stacks".</strong> Brief uses "Deployments"; proto + dashboard-api use "Stacks". <strong>Lock:</strong> dashboard URL is <code>/deployments</code> (user language), API stays <code>/stacks</code> (existing).
164
+
<strong>"Deployments" vs "Stacks".</strong> Brief uses "Deployments"; the API uses "Stacks". <strong>Lock:</strong> dashboard URL is <code>/deployments</code> (user language), API stays <code>/stacks</code> (existing).
165
165
</ContractBanner>
166
166
<ContractBannerkind="warning"badge="#3">
167
167
<strong>Multi-env scoping.</strong> Resource shape includes <code>env</code> but list endpoint has no <code>?env=</code> filter. <strong>Lock:</strong> add server-side filter param + <code>teams.default_env</code> in PATCH body.
@@ -174,7 +174,7 @@ data: {}`}</>}
174
174
</ContractBanner>
175
175
</div>
176
176
177
-
<SectionHlabel="DELEGATED"badgeBg="var(--blue)"title="3 surfaces · routes to agent api"sub="not in dashboard-api · already documented in /flows"/>
177
+
<SectionHlabel="DELEGATED"badgeBg="var(--blue)"title="3 surfaces · routes to agent api"sub="anonymous / cross-origin paths · already documented in /flows"/>
Copy file name to clipboardExpand all lines: src/pages/DeployDetailPage.tsx
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -85,7 +85,7 @@ export function DeployDetailPage() {
85
85
</ROBanner>
86
86
87
87
<ContractBannerkind="blocked"badge="🔒 blocked">
88
-
<strong>Redeploy / Rollback / Stop are missing from dashboard-api.</strong><code>POST /api/v1/stacks/:slug/redeploy</code>currently routes to the agent API directly. Rollback and Stop don't exist anywhere yet.
88
+
<strong>Redeploy / Rollback / Stop are partially wired.</strong><code>POST /api/v1/stacks/:slug/redeploy</code> routes to the agent API. Rollback and Stop don't exist on the agent API yet.
0 commit comments