Merge pull request #267 from aojea/ui_fixes

UI fixes

Author: aojea

.github/workflows/ui.yml

@@ -0,0 +1,62 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: console-ui
+
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: "1.26"
+
+jobs:
+  console_ui_smoke:
+    runs-on: ubuntu-latest
+    name: Console UI smoke test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: false
+
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: tests/ui/package-lock.json
+
+      - name: Run console UI smoke test
+        run: make ui-test
+
+      - name: Upload Playwright report
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: playwright-report-${{ github.run_id }}
+          path: tests/ui/playwright-report

.gitignore

@@ -38,6 +38,11 @@ bin/
 /sam-box
 /sam-router
 /sam-console
+
+# Playwright console UI tests
+node_modules/
+tests/ui/playwright-report/
+tests/ui/test-results/
 /sam-control-plane
 /mcp-client
 /nano-init

Makefile

@@ -142,6 +142,11 @@ test-python-e2e: build docker-build
 e2e-test: build docker-build
 	bats -j 10 --verbose-run $(if $(WHAT),--filter "$(WHAT)") tests/e2e/
 
+.PHONY: ui-test
+ui-test: build
+	chmod +x ./tests/ui/run.sh
+	./tests/ui/run.sh $(if $(WHAT),--grep "$(WHAT)")
+
 test-e2e: build docker-build
 	@command -v bats >/dev/null 2>&1 || { \
 		echo "bats not found; attempting install"; \

cmd/sam-console/public/app.js

@@ -360,13 +360,11 @@ function updateUIForRole(role, userId) {
     if (ownerInput) {
         const group = ownerInput.closest('.input-group');
         if (group) {
-            if (role === 'admin') {
-                group.style.display = 'flex';
-                ownerInput.required = true;
-            } else {
-                group.style.display = 'none';
-                ownerInput.required = false;
-                ownerInput.value = userId; // Scoped to user implicitly
+            // Only admins may set an owner; for everyone else the server infers it
+            // from the session, so the field is hidden and left empty.
+            group.style.display = role === 'admin' ? 'flex' : 'none';
+            if (role !== 'admin') {
+                ownerInput.value = '';
             }
         }
     }
@@ -467,23 +465,26 @@ function renderBootstrapTokensTable(tokens) {
 
 window.generateBootstrapToken = async function() {
     const role = document.getElementById('token-role').value;
-    const owner_id = document.getElementById('token-owner').value;
+    const owner_id = document.getElementById('token-owner').value.trim();
     const max_usages = parseInt(document.getElementById('token-usages').value, 10);
     const ttl_hours = parseInt(document.getElementById('token-ttl').value, 10) || 24;
     const description = document.getElementById('token-desc').value;
 
     const payload = {
         role,
-        owner_id,
         max_usages,
         ttl_hours,
         description
     };
+    // Omitted entirely so the server falls back to the authenticated session.
+    if (owner_id) {
+        payload.owner_id = owner_id;
+    }
 
     try {
         const res = await actionRequest('api/user/bootstrap-tokens', 'POST', payload);
         if (res && res.token) {
-            alert('Bootstrap Token Generated Successfully!\n\nToken: ' + res.token + '\n\nCopy this token now. It will not be shown again.');
+            showGeneratedToken(res);
             document.getElementById('form-generate-token').reset();
             loadData();
         }
@@ -492,6 +493,36 @@ window.generateBootstrapToken = async function() {
     }
 };
 
+function showGeneratedToken(res) {
+    const panel = document.getElementById('token-result');
+    const input = document.getElementById('token-result-value');
+    input.value = res.token;
+    document.getElementById('token-result-owner').textContent = res.owner_id || 'you';
+    document.getElementById('token-result-cmd').textContent =
+        'sam-node join --bootstrap-token ' + res.token + ' <control-plane-url>';
+    panel.hidden = false;
+    input.focus();
+    input.select();
+}
+
+window.copyGeneratedToken = async function() {
+    const input = document.getElementById('token-result-value');
+    const btn = document.getElementById('token-copy-btn');
+    input.select();
+    try {
+        // Only available on secure origins; execCommand covers plain-HTTP deployments.
+        if (navigator.clipboard && window.isSecureContext) {
+            await navigator.clipboard.writeText(input.value);
+        } else if (!document.execCommand('copy')) {
+            throw new Error('copy command rejected');
+        }
+        btn.textContent = 'Copied';
+    } catch (err) {
+        btn.textContent = 'Press Ctrl+C';
+    }
+    setTimeout(() => { btn.textContent = 'Copy'; }, 2000);
+};
+
 function writeVarint(value) {
     const bytes = [];
     while (value > 127) {

cmd/sam-console/public/index.html

@@ -262,8 +262,9 @@ <h3>Generate Bootstrap Token</h3>
                                 </select>
                             </div>
                             <div class="input-group" style="display: flex; flex-direction: column; gap: 4px;">
-                                <label for="token-owner" style="font-size: 0.85rem; color: var(--text-secondary);">Owner ID</label>
-                                <input type="text" id="token-owner" placeholder="e.g. system:serviceaccount:sam-kind:node-a-sa" style="background: rgba(0,0,0,0.2); border: 1px solid var(--border-color); color: var(--text-primary); border-radius: 4px; padding: 8px;" required>
+                                <label for="token-owner" style="font-size: 0.85rem; color: var(--text-secondary);">Owner ID <span style="opacity: 0.7;">(optional)</span></label>
+                                <input type="text" id="token-owner" placeholder="Leave blank to use your own identity" style="background: rgba(0,0,0,0.2); border: 1px solid var(--border-color); color: var(--text-primary); border-radius: 4px; padding: 8px;">
+                                <small id="token-owner-hint" style="font-size: 0.75rem; color: var(--text-secondary); opacity: 0.8;">Admins only: issue this token on behalf of another user. The user must have logged in at least once.</small>
                             </div>
                             <div class="input-group" style="display: flex; flex-direction: column; gap: 4px;">
                                 <label for="token-usages" style="font-size: 0.85rem; color: var(--text-secondary);">Max Usages</label>
@@ -279,6 +280,19 @@ <h3>Generate Bootstrap Token</h3>
                             </div>
                             <button type="submit" class="btn btn-primary" style="margin-top: 12px; max-width: 200px;">Generate Token</button>
                         </form>
+                        <div id="token-result" hidden style="margin-top: 1.5rem; max-width: 500px; border: 1px solid var(--border-color); border-radius: 6px; padding: 1rem; background: rgba(0,0,0,0.2);">
+                            <div style="font-size: 0.85rem; color: var(--text-secondary); margin-bottom: 8px;">
+                                Token generated for owner <code id="token-result-owner"></code>. Copy it now &mdash; it is not stored and will not be shown again.
+                            </div>
+                            <div style="display: flex; gap: 8px; align-items: center;">
+                                <input type="text" id="token-result-value" readonly onfocus="this.select();"
+                                       style="flex: 1; font-family: monospace; background: rgba(0,0,0,0.35); border: 1px solid var(--border-color); color: var(--text-primary); border-radius: 4px; padding: 8px;">
+                                <button type="button" class="btn" id="token-copy-btn" onclick="copyGeneratedToken();">Copy</button>
+                            </div>
+                            <div style="font-size: 0.75rem; color: var(--text-secondary); margin-top: 8px;">
+                                Join a node with: <code id="token-result-cmd"></code>
+                            </div>
+                        </div>
                     </div>
                     <div class="card">
                         <h3>Active Tokens</h3>

hack/lint.sh

@@ -22,3 +22,15 @@ REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 cd $REPO_ROOT
 docker run --rm -v $(pwd):/app -w /app golangci/golangci-lint:v2.11.4 golangci-lint run -v
+
+# golangci-lint has no deadcode linter (removed upstream in v1.49) and its
+# replacement, "unused", ignores exported identifiers. This catches exported
+# code that is unreachable from every binary and test.
+# mobile/ is exported to Android over cgo/FFI and development/examples/ is sample code.
+DEADCODE_EXCLUDES='^(mobile/|development/examples/)'
+deadcode_report=$(go run golang.org/x/tools/cmd/deadcode@v0.40.0 -test ./... | grep -Ev "${DEADCODE_EXCLUDES}" || true)
+if [[ -n "${deadcode_report}" ]]; then
+  echo "Dead code detected (unreachable from any binary or test):"
+  echo "${deadcode_report}"
+  exit 1
+fi

internal/controlplane/server.go

@@ -1210,6 +1210,7 @@ func (s *Server) HandleEnroll(w http.ResponseWriter, r *http.Request) {
 			PublicKey:      req.PublicKey,
 			Biscuit:        biscuitBytes,
 			Role:           tokenRecord.Role,
+			OwnerID:        tokenRecord.OwnerID,
 			EnrollmentType: "BOOTSTRAP",
 			Labels:         req.Labels,
 			EnrolledAt:     time.Now(),
@@ -1557,6 +1558,7 @@ func (s *Server) HandleAdminEnrollmentAction(w http.ResponseWriter, r *http.Requ
 			PublicKey:      enrollReq.PublicKey,
 			Biscuit:        biscuitBytes,
 			Role:           tokenRecord.Role,
+			OwnerID:        tokenRecord.OwnerID,
 			EnrollmentType: "BOOTSTRAP",
 			Labels:         enrollReq.Labels,
 			EnrolledAt:     time.Now(),
@@ -1796,6 +1798,7 @@ func (s *Server) HandleUserBootstrapTokens(w http.ResponseWriter, r *http.Reques
 
 	var req struct {
 		Role        string `json:"role"`
+		OwnerID     string `json:"owner_id"`
 		TTLHours    int    `json:"ttl_hours"`
 		MaxUsages   int    `json:"max_usages"`
 		Description string `json:"description"`
@@ -1817,6 +1820,12 @@ func (s *Server) HandleUserBootstrapTokens(w http.ResponseWriter, r *http.Reques
 		return
 	}
 
+	ownerID, status, err := s.resolveTokenOwner(r.Context(), user, req.OwnerID)
+	if err != nil {
+		http.Error(w, err.Error(), status)
+		return
+	}
+
 	if req.TTLHours <= 0 {
 		req.TTLHours = 24
 	}
@@ -1836,7 +1845,7 @@ func (s *Server) HandleUserBootstrapTokens(w http.ResponseWriter, r *http.Reques
 		ID:          tokenID,
 		TokenHash:   tokenID,
 		Role:        req.Role,
-		OwnerID:     user.ID,
+		OwnerID:     ownerID,
 		MaxUsages:   req.MaxUsages,
 		UsagesCount: 0,
 		Description: req.Description,
@@ -1856,10 +1865,31 @@ func (s *Server) HandleUserBootstrapTokens(w http.ResponseWriter, r *http.Reques
 		"id":         tokenRecord.ID,
 		"token":      tokenVal,
 		"role":       tokenRecord.Role,
+		"owner_id":   tokenRecord.OwnerID,
 		"expires_at": tokenRecord.ExpiresAt.Format(time.RFC3339),
 	})
 }
 
+// resolveTokenOwner determines which user a bootstrap token is issued on behalf of.
+// The owner defaults to the caller; only admins may override it, and only with a
+// user that already exists. Returns the owner plus an HTTP status to use on error.
+func (s *Server) resolveTokenOwner(ctx context.Context, caller *storage.User, requested string) (string, int, error) {
+	requested = strings.TrimSpace(requested)
+	if requested == "" || requested == caller.ID {
+		return caller.ID, 0, nil
+	}
+	if caller.Role != "admin" {
+		return "", http.StatusForbidden, errors.New("forbidden: only admins may issue tokens on behalf of another user")
+	}
+	if _, err := s.store.GetUser(ctx, requested); err != nil {
+		if err == storage.ErrNotFound {
+			return "", http.StatusBadRequest, fmt.Errorf("unknown owner_id %q: the user must have logged in at least once", requested)
+		}
+		return "", http.StatusInternalServerError, errors.New("failed to look up owner")
+	}
+	return requested, 0, nil
+}
+
 func (s *Server) HandleUserRevoke(w http.ResponseWriter, r *http.Request) {
 	user, err := s.authenticateUser(r)
 	if err != nil {

internal/controlplane/server_test.go

@@ -1386,3 +1386,78 @@ func TestAuthDenialPaths(t *testing.T) {
 		}
 	})
 }
+
+// TestBootstrapTokenOwnerPropagatesToNode ensures a node enrolled with a user-owned
+// bootstrap token is attributed to that user, which is what makes the console's
+// per-user node listing work.
+func TestBootstrapTokenOwnerPropagatesToNode(t *testing.T) {
+	issuer, mintToken := startCustomMockOIDC(t)
+	srv, store, baseURL := setupTestServer(t, issuer)
+	defer func() {
+		_ = srv.Close()
+		_ = store.Close()
+	}()
+	srv.config.AutoApproveEnrollment = true
+
+	ctx := context.Background()
+	client := &http.Client{Timeout: 5 * time.Second}
+
+	const ownerSub = "owner-sub-id"
+	userJWT := mintToken(map[string]interface{}{"sub": ownerSub, "email": "owner@example.com"})
+
+	req, _ := http.NewRequest(http.MethodPost, baseURL+"/user/bootstrap-tokens",
+		bytes.NewBufferString(`{"role":"`+api.RoleNode+`","max_usages":1}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+userJWT)
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("failed to create bootstrap token: %v", err)
+	}
+	if resp.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		t.Fatalf("unexpected status creating token: %s (%s)", resp.Status, body)
+	}
+	var tokenDetails struct {
+		Token   string `json:"token"`
+		OwnerID string `json:"owner_id"`
+	}
+	_ = json.NewDecoder(resp.Body).Decode(&tokenDetails)
+	_ = resp.Body.Close()
+
+	if tokenDetails.OwnerID != ownerSub {
+		t.Fatalf("token owner = %q, want %q", tokenDetails.OwnerID, ownerSub)
+	}
+
+	privNode, pubNode, err := crypto.GenerateKeyPair(crypto.Ed25519, -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pID, _ := peer.IDFromPrivateKey(privNode)
+	pubBytes, _ := crypto.MarshalPublicKey(pubNode)
+
+	enrollData, _ := proto.Marshal(&api.BootstrapEnrollRequest{
+		BootstrapToken: tokenDetails.Token,
+		PeerId:         pID.String(),
+		PublicKey:      pubBytes,
+		RequestedRole:  api.RoleNode,
+	})
+	resp, err = client.Post(baseURL+"/enroll", "application/x-protobuf", bytes.NewBuffer(enrollData))
+	if err != nil {
+		t.Fatalf("failed to enroll: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		t.Fatalf("unexpected enroll status: %s (%s)", resp.Status, body)
+	}
+	_ = resp.Body.Close()
+
+	enrolled, err := store.GetNode(ctx, pID.String())
+	if err != nil {
+		t.Fatalf("failed to load enrolled node: %v", err)
+	}
+	if enrolled.OwnerID != ownerSub {
+		t.Errorf("enrolled node owner = %q, want %q", enrolled.OwnerID, ownerSub)
+	}
+}