Merge pull request #34 from theta42/fix/bump-version-1.17.1

chore: bump package.json version to 1.17.1

CHANGELOG.md

@@ -1,9 +1,120 @@
+## v1.16.1
+- fix: remove missing DEPLOYMENT.md from Docker build context
+
+## v1.16.0
+- Added OpenBao PKI SSH Certificate Support
+- Fallback to LDAP Key injection
+
+# v1.15.0
+- feat: Rename SSO Manager to Jump in UI
+
 # Changelog
 
 All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
+## [1.14.1] - 2026-08-01
+
+### Fixed
+- **Bumped `@simpleworkjs/bao-conf` to 1.0.1** so standalone/no-OpenBao boots
+  don't crash. bao-conf 1.0.0's `init()` threw when `VAULT_TOKEN` was unset,
+  which — combined with `bin/www`'s `.catch(() => process.exit(1))` — made the
+  jump host exit at boot in any deployment without an OpenBao sidecar
+  (standalone Docker, bare metal). 1.0.1 makes `init()` fail-soft on a missing
+  token (warn + continue from `CONF_SECRETS`), matching the documented
+  contract. The theta-env stack is unaffected (it always sets a scoped
+  `VAULT_TOKEN`).
+
+## [1.14.0] - 2026-08-01
+
+### Changed
+- **Secrets now load from OpenBao at boot** via
+  [@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/), which
+  deep-merges `secret/jump-host/conf` over the file-loaded config. The jump
+  host authenticates to OpenBao with a scoped `VAULT_TOKEN` (policy
+  `jump-host` — read-only on its own path), never the root token. Because the
+  OIDC `clientSecret` is captured at require time inside `createOidcClient`
+  (during `require('../models')`), `bin/www` now runs `bao-conf.init()`
+  **before** `require('../models')`. Fail-soft: if OpenBao is unreachable,
+  boot continues from `CONF_SECRETS`. The `config/jump-secrets.js` file is now
+  an operator-edit seed artifact (gitignored); OpenBao is authoritative. See
+  theta-env's [Secrets docs](https://theta42.github.io/theta-env/secrets/).
+- Bumped package version to track the release tag.
+
+## [1.11.0] - 2026-07-30
+
+### Added
+- **`app_super_admin` (cross-app) and `app_jump_admin` groups**: super admins are full admins here same as `app_sso_admin`; jump admins get audit page/data access without other admin rights. The Audit page/API is now actually admin-gated server-side (previously the page shell rendered for any logged-in user, only its data was gated).
+- **Host list adds Last connection/Last failed connection columns** and highlights rows green (a session is live right now) or yellow (the most recent attempt failed), backed by new per-host last-success/last-fail timestamps in `models/metrics.js`. `services/ssh_server.js` now attributes grammar/TUI connect failures to the resolved host when one was found, not just aggregate counters.
+
+### Changed
+- **Dashboard's stat boxes and Top hosts/Top users cards moved to the Audit page** (audit is now the admin-facing metrics home; dashboard stays focused on "hosts I can reach"). "All hosts" renamed to "My hosts".
+
+## [1.10.2] - 2026-07-30
+
+### Changed
+- **Dashboard, Sessions, and Audit pages now match sso-manager-node/proxy's page width**, wrapping content in a standard container instead of rendering full-bleed inside the fluid shell.
+- **Audit's nav entry is now admin-gated** (`groups: ['admin']` in `utils/ui.js`), reusing the existing synthetic-admin-group nav-gating convention — the API route was already server-side admin-gated; this hides the nav link for non-admins too.
+
+## [1.10.1] - 2026-07-28
+
+### Fixed
+- **The API-token reveal modal silently didn't show after creating a token** — `submitApiToken()` called `app.modal.close()` immediately before `showToken()`'s `app.modal.open()` in the same tick, colliding with Bootstrap's hide-transition guard on the singleton modal. Same root cause as the OAuth-secret-reveal race fixed in sso-manager-node (v1.8.2) and the create-token race fixed in proxy (v1.7.0).
+
+## [1.10.0] - 2026-07-28
+
+### Added
+- **API-token UI unified with sso-manager-node/proxy**: card grid replacing the bare table, a new Edit modal (footer shows real created-by/on data), and a Description field on both the create and edit flows — the model and API already fully supported all of this, it just wasn't exposed anywhere in the dashboard.
+
+### Changed
+- `@simpleworkjs/frontend` bumped to `^0.2.6` (this app was still on `^0.2.5`).
+
+## [1.9.0] - 2026-07-28
+
+### Added
+- **"Quick Jump" copy-to-clipboard section on the dashboard** — the `uid_-_target` grammar-mode SSH command was documented in the README but nowhere in the UI. A new card gives a one-click-copy command for interactive-picker mode, and every row in "Hosts you can reach" has its own copy button for the exact grammar-mode command to that host, ready to paste and run as-is (uses the logged-in user's own uid).
+
+## [1.8.2] - 2026-07-28
+
+### Fixed
+- **Audit records for a failed upstream connection only ever said `upstream-unreachable`** — `resolveAndConnect` discarded the real error from `connectUpstream` (ECONNREFUSED, ETIMEDOUT, an ssh2 auth-failure message, etc.) and replaced it with that one generic string, so there was no way to tell a network-layer failure from an auth failure from the audit log alone. This is what blocked root-causing the "Could not reach 192.168.1.206" (emby host) report — the real error is now captured and surfaced as a new `failDetail` field on the audit record, shown as a tooltip on the fail badge in the admin audit table.
+
+## [1.8.1] - 2026-07-28
+
+### Fixed
+- **Redis had zero persistence** (`--save '' --appendonly no`, no data-dir volume) — every container rebuild/recreation silently wiped all sessions, in-flight OAuth logins, and any admin-created API token. This is why re-running `setup.sh` appeared to "break OAuth with jump": the jump-host container gets recreated, and any token or in-flight login vanished with it. Now Redis persists (AOF + periodic RDB) to `/data`, mounted as a named volume (`jump-redis-data`) in theta-env's compose file. Verified live: minted a PAT, force-recreated the container, confirmed the same PAT still authenticated afterward.
+
+## [1.8.0] - 2026-07-28
+
+### Fixed
+- **TUI-mode SSH connections (a bare `ssh user@host`, no target) could drop with "PTY allocation request failed" / "shell request failed"** — `runTuiSession` awaited two real round-trips (an audit-log write, then a directory API call) *before* attaching the session's pty/shell/exec listeners, so a client that sent those requests quickly enough got auto-rejected by ssh2 before anything was listening. `runGrammar` (the `uid_-_target` path) already had the equivalent fix; this ports it to the picker path.
+- **`formAJAX`'s loading indicator showed literal HTML**, not a spinner — same fix as sso-manager-node/proxy's companion releases.
+
+## [1.7.1] - 2026-07-28
+
+### Added
+- **Regression test**: a static check across all views/client-side scripts fails CI if any native `alert()`/`confirm()`/`prompt()` call appears — these block all further browser events on the page. This app has never had one; keeps it that way.
+
+## [1.7.0] - 2026-07-27
+
+### Added
+- **Self-service API tokens (PATs)** — `models/api_token.js` + `routes/api_token.js` (mounted at `/api-token`), Bearer-token support in `middleware/auth.js`, and a create/list/rotate/revoke card on the dashboard. Ports proxy's `jmp_<id>_<secret>` pattern; unlike proxy's, a jump-host token carries no group claims, so it authenticates as its creator for non-admin routes only (never passes `requireAdmin`). jump-host previously had no PAT support at all.
+
+## [1.6.0] - 2026-07-27
+
+### Changed
+- **Adopted `@simpleworkjs/frontend`'s `app.messages`, `app.modal`, and `app.validate` modules**, replacing the vendored `app.util.actionMessage`/`actionConfirm` in `public/lib/js/app-base.js` and the vendored `public/lib/js/val.js` (unused by any current view here, so this is dedup/future-proofing rather than a behavior change). `app.api`/`app.auth`/`app.pubsub`/`app.socket` are untouched.
+
+## [1.5.0] - 2026-07-27
+
+### Added
+- **Web UI dashboard now lists the hosts you can reach** ("Hosts you can reach", or "All hosts" for admins) — previously the dashboard only showed usage metrics, with no way to see your actual access from the browser. Backed by a new `GET /api/user/hosts` endpoint (auth-only, not admin-gated): admins get the full inventory via `utils/access.js`'s new `allHosts()`, everyone else gets the same group-based resolution the SSH front door uses.
+- `utils/access.js`'s `accessibleHosts()` now accepts a pre-resolved `groups` array on the user object, skipping the LDAP `getGroups(dn)` round-trip — the web UI's OIDC session already has its groups claim and has no LDAP `dn` to query with.
+
+### Fixed
+- **Bumped `@simpleworkjs/ldap` to 1.0.1**, which fixes `addSshKey` throwing `ObjectClassViolationError` (LDAP `0x41`) on accounts predating the `ldapPublicKey` auxiliary objectClass. This is the code path this jump host's key-injection (`utils/key_inject.js`) uses on every first connection for a user — on affected accounts it aborted the SSH connection entirely (`key-inject-failed`).
+
 ## [1.4.0] - 2026-07-26
 
 ### Added

Dockerfile

@@ -37,7 +37,7 @@ COPY nodejs/utils ./utils
 COPY nodejs/views ./views
 COPY nodejs/public ./public
 
-COPY README.md CHANGELOG.md DEPLOYMENT.md /
+COPY README.md CHANGELOG.md /
 COPY --from=gitinfo /commit.txt ./.build_commit
 
 COPY docker-entrypoint.sh /usr/local/bin/

README.md

@@ -159,6 +159,22 @@ Config layers via [@simpleworkjs/conf](https://www.npmjs.com/package/@simplework
 `conf/base.js` < `conf/<NODE_ENV>.js` < the `CONF_SECRETS` file < `app_*` env.
 See `secrets.js.example` for every key.
 
+## Secrets
+
+At boot, [@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/)
+deep-merges `secret/jump-host/conf` from **OpenBao** over the file-loaded
+config. The jump host's OIDC `clientSecret` is captured at require time
+(inside `createOidcClient` during `require('../models')`), so `bin/www` runs
+`bao-conf.init()` **before** `require('../models')`. Fail-soft: if OpenBao is
+unreachable, boot continues from `CONF_SECRETS`. The jump host authenticates to
+OpenBao with the scoped `VAULT_TOKEN` (env, policy `jump-host` — read only
+`secret/jump-host/conf`), never the root token.
+
+The `config/jump-secrets.js` file is an operator-edit seed artifact
+(gitignored); the bootstrap writes the generated API token + OAuth client
+into OpenBao, which is authoritative. For the full architecture see
+theta-env's **[Secrets docs](https://theta42.github.io/theta-env/secrets/)**.
+
 ## Development
 
 ```

docker-entrypoint.sh

@@ -12,9 +12,17 @@ if [[ -f /config/jump-secrets.js ]]; then
 	info "Loaded config from /config/jump-secrets.js"
 fi
 
-# Redis for audit/metrics/session storage (app connects to 127.0.0.1:6379).
-info "Starting redis..."
-redis-server --daemonize yes --save '' --appendonly no
+# Redis for audit/metrics/session AND api-token storage (app connects to
+# 127.0.0.1:6379). Persisted (AOF + periodic RDB) to /data, which the
+# deployment should mount as a volume -- without this, every container
+# recreation silently wiped every session, in-flight OAuth login, and any
+# admin-created API token, which is especially bad for the last one since a
+# PAT is meant to be a stable, long-lived credential, not session state.
+REDIS_DATA_DIR="${REDIS_DATA_DIR:-/data}"
+mkdir -p "$REDIS_DATA_DIR"
+info "Starting redis (AOF persisted to $REDIS_DATA_DIR)..."
+redis-server --daemonize yes --dir "$REDIS_DATA_DIR" --appendonly yes \
+	--appendfilename appendonly.aof --save 900 1 --save 300 10 --save 60 10000
 
 # Wait for redis to answer before starting the app.
 for _ in $(seq 1 20); do

nodejs/bin/www

@@ -9,32 +9,43 @@ const http = require('http');
 const conf = require('@simpleworkjs/conf');
 const { Server } = require('socket.io');
 
-require('../models');
+// @simpleworkjs/conf loads ./config/jump-secrets.js synchronously, then
+// @simpleworkjs/bao-conf deep-merges secret/jump-host/conf from OpenBao over
+// it. The OIDC clientSecret is captured at require time inside models (via
+// createOidcClient), so the fetch MUST resolve before require('../models').
+// Fail-soft: if OpenBao is unreachable, init() leaves conf as the file-loaded
+// fallback and boot continues from ./config/jump-secrets.js.
+require('@simpleworkjs/bao-conf').init({ path: 'jump-host', conf }).then(() => {
+	require('../models');
 
-const app = require('../app');
-const middleware = require('../middleware/auth');
-const sshServer = require('../services/ssh_server');
+	const app = require('../app');
+	const middleware = require('../middleware/auth');
+	const sshServer = require('../services/ssh_server');
 
-const webPort = (conf.web && conf.web.port) || 3002;
-const server = http.createServer(app);
+	const webPort = (conf.web && conf.web.port) || 3002;
+	const server = http.createServer(app);
 
-// Socket.IO — the client framework (app-base.js) opens an authenticated socket.
-// We don't push anything yet, but serving /socket.io keeps the shared front-end
-// working exactly as it does in the sibling apps.
-const io = new Server(server);
-io.use(middleware.authIO);
-app.io = io;
+	// Socket.IO — the client framework (app-base.js) opens an authenticated socket.
+	// We don't push anything yet, but serving /socket.io keeps the shared front-end
+	// working exactly as it does in the sibling apps.
+	const io = new Server(server);
+	io.use(middleware.authIO);
+	app.io = io;
 
-server.listen(webPort, () => {
-	console.log(`[web] jump-host UI/API on :${server.address().port}`);
-});
+	server.listen(webPort, () => {
+		console.log(`[web] jump-host UI/API on :${server.address().port}`);
+	});
 
-sshServer.start();
+	sshServer.start();
 
-function shutdown() {
-	console.log('[jump-host] shutting down');
-	server.close();
-	process.exit(0);
-}
-process.on('SIGTERM', shutdown);
-process.on('SIGINT', shutdown);
+	function shutdown() {
+		console.log('[jump-host] shutting down');
+		server.close();
+		process.exit(0);
+	}
+	process.on('SIGTERM', shutdown);
+	process.on('SIGINT', shutdown);
+}).catch(err => {
+	console.error('boot failed:', err);
+	process.exit(1);
+});

nodejs/conf/base.js

@@ -6,7 +6,7 @@
 // values (LDAP creds, SSO API token) belong in the secrets file.
 
 module.exports = {
-	name: 'Jump Host',
+	name: 'Jump',
 	logo: '/static/img/theta42.svg',
 
 	// LDAP directory the users live in (same directory the SSO manages).
@@ -80,7 +80,12 @@ module.exports = {
 
 	auth: {
 		// OIDC group memberships that grant web UI/API admin access.
-		adminGroups: ['app_sso_admin'],
+		// app_super_admin is the cross-app super admin group (sso, proxy, jump-host).
+		adminGroups: ['app_sso_admin', 'app_super_admin'],
+		// OIDC group memberships that grant jump admin access (the audit page
+		// and its data), without granting other admin-only rights. Full admins
+		// (adminGroups/adminUsers) always have jump admin access too.
+		jumpAdminGroups: ['app_jump_admin'],
 		// Local anti-lockout admin: the first name here is bootstrapped as a
 		// redis-backed user on first boot (password from localAdminPass, or a
 		// random one printed to the log once). Lets you in even with OIDC down.

nodejs/middleware/auth.js

@@ -9,6 +9,24 @@ const { Auth } = require('../models');
 
 async function auth(req, res, next){
 	try{
+		// API-only token: `Authorization: Bearer jmp_<id>_<secret>`. Carries no
+		// group claims (see models/api_token.js), so it authenticates as its
+		// creator but never passes requireAdmin below.
+		const authz = req.header('authorization') || '';
+		if(authz.slice(0, 7).toLowerCase() === 'bearer '){
+			const t = await Auth.checkApiToken(authz.slice(7));
+			req.token = {
+				user: {username: t.created_by},
+				created_by: t.created_by,
+				groupsArray: () => [],
+				check: () => true,
+				is_valid: true,
+			};
+			req.user = req.token.user;
+			req.groups = [];
+			return next();
+		}
+
 		req.token = await Auth.checkToken(req.header('auth-token'));
 		req.user = req.token.user;
 		req.groups = typeof req.token.groupsArray === 'function' ? req.token.groupsArray() : [];
@@ -38,6 +56,25 @@ async function requireAdmin(req, res, next){
 	next(error);
 }
 
+// Jump admin = access to the audit page/data. A narrower grant than full
+// jump-host admin: full admins (isAdmin) always qualify, plus anyone in
+// conf.auth.jumpAdminGroups (e.g. a dedicated app_jump_admin LDAP group) can
+// be granted audit access without also getting other admin-only rights.
+function isJumpAdmin(req){
+	if(isAdmin(req)) return true;
+	const jumpAdminGroups = (conf.auth && conf.auth.jumpAdminGroups) || [];
+	return (req.groups || []).some(g => jumpAdminGroups.includes(g));
+}
+
+async function requireJumpAdmin(req, res, next){
+	if(isJumpAdmin(req)) return next();
+	const error = new Error('Forbidden');
+	error.name = 'Forbidden';
+	error.status = 403;
+	error.message = 'Jump admin access required.';
+	next(error);
+}
+
 // Socket.IO handshake auth (app-base.js connects with the session token).
 async function authIO(socket, next){
 	try{
@@ -51,4 +88,4 @@ async function authIO(socket, next){
 	}
 }
 
-module.exports = { auth, requireAdmin, authIO, isAdmin };
+module.exports = { auth, requireAdmin, authIO, isAdmin, isJumpAdmin, requireJumpAdmin };

nodejs/models/api_token.js

@@ -0,0 +1,83 @@
+'use strict';
+
+const Table = require('.');
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+
+// Self-service personal access token (PAT) for the jump host's own API.
+// Format:  jmp_<id>_<secret>
+//   id     — 24-char hex, stored plaintext as the record key (O(1) lookup)
+//   secret — 48-char hex, stored only as a bcrypt hash (isPrivate); shown ONCE
+//
+// Authenticated via `Authorization: Bearer jmp_...`. Mirrors proxy's
+// models/api_token.js — see that file for the fuller design notes. jump-host
+// has no per-user group snapshot the way proxy/sso do (its authz is a single
+// admin/non-admin bit off conf.auth.adminGroups/adminUsers), so a token
+// authenticates as its creator only; the auth middleware re-derives
+// admin-ness from that user's current groups, same as a live session.
+//
+// No `static _ttl`: records persist (lifetime is the optional expires_at field).
+
+const PREFIX = 'jmp_';
+const randomHex = (bytes) => crypto.randomBytes(bytes).toString('hex');
+
+class ApiToken extends Table{
+	static _key = 'id';
+	static _keyMap = {
+		'id':           {default: function(){ return randomHex(12) }, type: 'string'},
+		'secret_hash':  {isRequired: true, type: 'string', isPrivate: true},
+		'name':         {isRequired: true, type: 'string', min: 1, max: 255},
+		'description':  {default: '', type: 'string'},
+		'created_by':   {isRequired: true, type: 'string', min: 3, max: 500},
+		'created_on':   {default: function(){return (new Date).getTime()}},
+		'updated_on':   {default: function(){return (new Date).getTime()}, always: true},
+		'expires_at':   {default: 0, type: 'number'}, // epoch ms; 0 = never
+		'last_used_on': {default: 0, type: 'number'},
+		'is_valid':     {default: true, type: 'boolean'},
+	}
+
+	get isExpired() {
+		return this.expires_at > 0 && (new Date).getTime() > this.expires_at;
+	}
+
+	static async add(data){
+		const id = randomHex(12);
+		const secret = randomHex(24);
+		data.id = id;
+		data.secret_hash = await bcrypt.hash(secret, 10);
+		const token = await this.create(data);
+		token._raw_token = `${PREFIX}${id}_${secret}`;
+		return token;
+	}
+
+	async rotate(){
+		const secret = randomHex(24);
+		await this.update({ secret_hash: await bcrypt.hash(secret, 10) });
+		return `${PREFIX}${this.id}_${secret}`;
+	}
+
+	// Validate a raw `jmp_<id>_<secret>` string. Throws a generic Error on any
+	// failure so the caller (Auth.checkApiToken) can collapse every case into
+	// one 401 (no existence / wrong-secret / expired leak).
+	static async authenticate(raw){
+		const m = /^jmp_([0-9a-f]{24})_([0-9a-f]{48})$/i.exec(String(raw || ''));
+		if(!m) throw new Error('InvalidApiToken');
+		let token;
+		try{
+			token = await this.get(m[1]);
+		}catch(e){
+			throw new Error('InvalidApiToken');
+		}
+		if(!token) throw new Error('InvalidApiToken');
+		const ok = await bcrypt.compare(m[2], token.secret_hash);
+		if(!ok || !token.is_valid || token.isExpired) throw new Error('InvalidApiToken');
+		// Best-effort: stamp last use. Fire-and-forget so a Redis hiccup never
+		// fails an otherwise-valid request.
+		try{ await token.update({ last_used_on: (new Date).getTime() }); }catch(_){}
+		return token;
+	}
+}
+
+ApiToken.register();
+
+module.exports = {ApiToken};

nodejs/models/index.js

@@ -32,14 +32,17 @@ async function getRedis() {
 
 module.exports.getRedis = getRedis;
 
-// Register models (order matters: User before AuthToken's relation resolves).
+// Register models (order matters: User before AuthToken's relation resolves,
+// and before ApiToken so `require('.')`'s Table is already exporting User).
 require('./user_redis');      // User (redis-backed local + OIDC JIT)
+const { ApiToken } = require('./api_token');
+module.exports.ApiToken = ApiToken;
 
 // Shared OIDC client (authorization-code + PKCE): session models (Token,
 // AuthToken, OidcState), the Auth service, and the /login /logout /oidc/start
-// /oidc/callback router — all created on this app's Table/redis. jump-host has
-// no Bearer PATs, so checkApiToken is omitted (Auth.checkApiToken is absent).
-const oidcClient = createOidcClient({ Table });
+// /oidc/callback router — all created on this app's Table/redis. checkApiToken
+// wraps ApiToken.authenticate, same wiring as proxy's models/index.js.
+const oidcClient = createOidcClient({ Table, checkApiToken: (raw) => ApiToken.authenticate(raw) });
 module.exports.Token = oidcClient.Token;
 module.exports.AuthToken = oidcClient.AuthToken;
 module.exports.OidcState = oidcClient.OidcState;

nodejs/models/metrics.js

@@ -13,10 +13,34 @@ async function bump({ uid, hostSlug, success }) {
 	const ops = [redis.incr(`${P()}total`), redis.incr(`${P()}day_${day}`)];
 	if (!success) ops.push(redis.incr(`${P()}fail`));
 	if (uid) ops.push(redis.incr(`${P()}user_${uid}`));
-	if (hostSlug) ops.push(redis.incr(`${P()}host_${hostSlug}`));
+	if (hostSlug) {
+		ops.push(redis.incr(`${P()}host_${hostSlug}`));
+		// Last-attempt timestamp per host, split by outcome -- drives the
+		// dashboard's "Last connection"/"Last failed connection" columns and
+		// row highlighting (see lastForHosts below).
+		ops.push(redis.set(`${P()}host_last_${success ? 'success' : 'fail'}_${hostSlug}`, Date.now()));
+	}
 	await Promise.all(ops);
 }
 
+// Per-host last-success/last-fail timestamps for a given list of slugs (e.g.
+// the hosts a session can reach), for the dashboard's host list.
+async function lastForHosts(slugs) {
+	const redis = await getRedis();
+	const result = {};
+	await Promise.all((slugs || []).map(async (slug) => {
+		const [lastSuccess, lastFail] = await Promise.all([
+			redis.get(`${P()}host_last_success_${slug}`),
+			redis.get(`${P()}host_last_fail_${slug}`),
+		]);
+		result[slug] = {
+			lastConnected: lastSuccess ? Number(lastSuccess) : null,
+			lastFailed: lastFail ? Number(lastFail) : null,
+		};
+	}));
+	return result;
+}
+
 async function summary() {
 	const redis = await getRedis();
 	const [total, fail] = await Promise.all([
@@ -37,4 +61,4 @@ async function summary() {
 	};
 }
 
-module.exports = { bump, summary };
+module.exports = { bump, summary, lastForHosts };

nodejs/package-lock.json

@@ -1,19 +1,21 @@
 {
   "name": "t42-jump-host",
-  "version": "1.3.0",
+  "version": "1.17.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-jump-host",
-      "version": "1.3.0",
+      "version": "1.17.0",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@simpleworkjs/app-stack": "^1.0.0",
+        "@simpleworkjs/bao-conf": "^1.0.0",
         "@simpleworkjs/conf": "^1.2.0",
         "@simpleworkjs/directory-schema": "^1.0.0",
-        "@simpleworkjs/ldap": "^1.0.0",
+        "@simpleworkjs/frontend": "^0.2.6",
+        "@simpleworkjs/ldap": "^1.0.1",
         "@simpleworkjs/oidc-client": "^1.0.0",
         "@simpleworkjs/orm": "^0.2.8",
         "bcrypt": "^6.0.0",
@@ -155,6 +157,18 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@simpleworkjs/bao-conf": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/bao-conf/-/bao-conf-1.0.1.tgz",
+      "integrity": "sha512-mcay5NQ/w9ShpIAolMP/3f9TfXSLE+d5jrA4dTPOUHDjTkdsP7pe4hMmQUmwnniR59U1bGoRIVdXjvDbX3I5nw==",
+      "license": "MIT",
+      "dependencies": {
+        "extend": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@simpleworkjs/conf": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz",
@@ -176,10 +190,19 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@simpleworkjs/frontend": {
+      "version": "0.2.6",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.2.6.tgz",
+      "integrity": "sha512-2uqvEjxyZ2LE+sfhP6rJcEMmqdViazJ3ZkitWJXInPMWF6DiEZuP5MYqBqJvfDko63CCHEt1/ChFQd7Ry85Pzg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@simpleworkjs/ldap": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@simpleworkjs/ldap/-/ldap-1.0.0.tgz",
-      "integrity": "sha512-saDmwk+KJ6kIWj9/MF37d+BM9KQisy6DsI9umyt1FWNyx6+wnEEat/1RUTwXKBd4IKJK+zPT5lC/B6gfa2CuAA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/ldap/-/ldap-1.0.1.tgz",
+      "integrity": "sha512-1jz3WQ9ghwNHz2mI+H33qw8nIQpLkoNHEy8lgdgsE/nCLK8JGU1SIKEdbsdMeXEQ0seKqyjuyXwmhdotsx6Lww==",
       "license": "MIT",
       "dependencies": {
         "ldapts": "^8.1.8"

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-jump-host",
-  "version": "1.4.0",
+  "version": "1.17.1",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {
@@ -20,10 +20,12 @@
   },
   "dependencies": {
     "@fortawesome/fontawesome-free": "^7.3.0",
-    "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/app-stack": "^1.0.0",
-    "@simpleworkjs/ldap": "^1.0.0",
+    "@simpleworkjs/bao-conf": "^1.0.0",
+    "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/directory-schema": "^1.0.0",
+    "@simpleworkjs/frontend": "^0.2.6",
+    "@simpleworkjs/ldap": "^1.0.1",
     "@simpleworkjs/oidc-client": "^1.0.0",
     "@simpleworkjs/orm": "^0.2.8",
     "bcrypt": "^6.0.0",

nodejs/public/css/styles.css

@@ -7,6 +7,12 @@ body {
 	display: flex;
 	flex-direction: column;
 	min-height: 100vh;
+	/* Height of the fixed navbar (plus the update banner, while shown --
+	   see top.ejs's showUpdateBanner/dismissUpdateBanner). Lets an in-page
+	   sticky element offset itself below both fixed elements via
+	   `top: var(--sw-content-offset)` instead of colliding with them at the
+	   viewport's true top:0. */
+	--sw-content-offset: 4.5rem;
 }
 
 #spa-shell {

nodejs/public/js/app.js

@@ -11,11 +11,23 @@ app.jump = (function(app){
 		var qs = $.param(query || {});
 		app.api.get('audit' + (qs ? '?' + qs : ''), cb);
 	}
-	return {metrics: metrics, sessions: sessions, audit: audit};
+	function hosts(cb){ app.api.get('user/hosts', cb); }
+	return {metrics: metrics, sessions: sessions, audit: audit, hosts: hosts};
+})(app);
+
+// Self-service API token (PAT) management.
+app.apiToken = (function(app){
+	function list(cb){ app.api.get('api-token/', cb); }
+	function add(args, cb){ app.api.post('api-token/', args, cb); }
+	function update(args, cb){ app.api.put('api-token/' + args.id, args, cb); }
+	function remove(id, cb){ app.api.delete('api-token/' + id, cb); }
+	function rotate(id, cb){ app.api.post('api-token/' + id + '/rotate', {}, cb); }
+	return {list: list, add: add, update: update, remove: remove, rotate: rotate};
 })(app);
 
 // Shared render helpers.
 app.jump.fmtTime = function(ts){ return ts ? moment(Number(ts)).format('YYYY-MM-DD HH:mm:ss') : '—'; };
 app.jump.esc = function(s){ return $('<div>').text(s == null ? '' : String(s)).html(); };
-app.jump.result = function(e){ return e.success ? '<span class="badge bg-success">ok</span>'
-	: '<span class="badge bg-danger">' + app.jump.esc(e.failReason || 'fail') + '</span>'; };
+app.jump.result = function(e){ if (e.success) return '<span class="badge bg-success">ok</span>';
+	var title = e.failDetail ? ' title="' + app.jump.esc(e.failDetail) + '"' : '';
+	return '<span class="badge bg-danger"' + title + '>' + app.jump.esc(e.failReason || 'fail') + '</span>'; };

nodejs/public/lib/js/app-base.js

@@ -363,7 +363,7 @@ app.auth = (function(app){
 		}
 
 		if(requiredGroups && !await memberOf(requiredGroups, user)){
-			app.util.actionMessage(
+			app.messages.action(
 				`<h1>
 					<i class="fa-solid fa-triangle-exclamation"></i>
 					<b>You do not have permission to be here.</b>
@@ -520,68 +520,15 @@ app.util = (function(app){
 		return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));
 	};
 
-	function actionMessage(message, $targetPassed, type, callback){
-		message = message || '';
-
-		let $target = $targetPassed.closest('div.card').find('.actionMessage');
-		if(!$target.length) $target = $($targetPassed.find('.actionMessage')[0]);
-
-		type = type || 'info';
-		callback = callback || function(){};
-
-		if($target.html() === message) return;
-
-		if($target.html()){
-			$target.slideUp('fast', function(){
-				$target.html('')
-				$target.removeClass (function(index, className){
-					return (className.match (/(^|\s)bg-\S+/g) || []).join(' ');
-				});
-				if(message) return actionMessage(message, $target, type, callback);
-				$target.hide()
-			})
-		}else{
-			if(type) $target.addClass('bg-' + type);
-
-			// Messages that bring their own buttons (actionConfirm) are left
-			// alone; everything else gets the standard dismiss button.
-			if(!message.includes('<button')) message = `
-				<span class="align-middle">${message}</span>
-				<button class="action-close btn btn-sm btn-outline-dark float-end">
-					<i class="fa-solid fa-xmark"></i>
-				</button>
-			`
-			$target.html(message).slideDown('fast');
-		}
-		setTimeout(callback,10)
-	}
-
-	function actionConfirm(message, $target, type, callback){
-		return new Promise((resolve, reject) =>{
-			let id = crypto.randomUUID();
-			message = `
-				<h4 class"align-middle" >
-					<i class="fa-solid fa-triangle-exclamation"></i>
-					<b>${message}</b>
-					<span class="float-end">
-						<button type="button" class="btn btn-success confirm-${id}" data-confirm="true">
-							<i class="fa-solid fa-circle-check"></i>
-							Confirm
-						</button>
-						<button type="button" class="btn btn-danger confirm-${id}">
-							<i class="fa-solid fa-circle-stop"></i>
-							Cancel
-						</button>
-					</span>
-				</h4>
-			`
-			actionMessage(message, $target, type);
-			$("body").on('click', `.confirm-${id}`, function(){
-				actionMessage('', $target, type);
-				resolve(!!$(this).data('confirm'));
-			});
-		});
-
+	// escapeHtml/actionMessage/actionConfirm moved to @simpleworkjs/frontend's
+	// app.util.escapeHtml and app.messages.action/confirm.
+	function escapeHtml(s){
+		return String(s == null ? '' : s)
+			.replace(/&/g, '&amp;')
+			.replace(/</g, '&lt;')
+			.replace(/>/g, '&gt;')
+			.replace(/"/g, '&quot;')
+			.replace(/'/g, '&#39;');
 	}
 
 	$.fn.serializeObject = function() {
@@ -637,11 +584,31 @@ app.util = (function(app){
 		document.body.removeChild(element);
 	}
 
+	// Scroll a just-added/-edited element into view and flash its
+	// background, so the user's eye lands on the row that changed instead of
+	// it silently appearing/updating somewhere off-screen. Takes a jQuery
+	// object or a raw DOM node (e.g. jq-repeat's `item.__jq_$el`).
+	function revealItem(el){
+		var node = el && el.jquery ? el[0] : el;
+		if (!node) return;
+		if (typeof node.scrollIntoView === 'function') {
+			node.scrollIntoView({behavior: 'smooth', block: 'center'});
+		}
+		var prevTransition = node.style.transition;
+		var prevBg = node.style.backgroundColor;
+		node.style.transition = 'background-color 1.5s ease';
+		node.style.backgroundColor = 'var(--bs-success-bg-subtle, #d1e7dd)';
+		setTimeout(function(){
+			node.style.backgroundColor = prevBg;
+			setTimeout(function(){ node.style.transition = prevTransition; }, 1500);
+		}, 300);
+	}
+
 	return {
 		downloadFile: downloadFile,
 		getUrlParameter: getUrlParameter,
-		actionMessage: actionMessage,
-		actionConfirm,
+		escapeHtml: escapeHtml,
+		revealItem: revealItem,
 	}
 })(app);
 
@@ -696,9 +663,9 @@ $( document ).ready(async function(){
 		$(this).closest('.card').slideUp('fast');
 	});
 
-	$('.actionMessage').on('click', 'button.action-close', function(event){
-		app.util.actionMessage(null, $(this));
-	});
+	// action-close click handling is wired by @simpleworkjs/frontend's
+	// app.messages.js (delegated on document, so it also covers messages
+	// rendered after this ready handler runs).
 
 	setInterval(()=>{
 		$('.momentFromNow').each((idx, el)=>{
@@ -729,20 +696,17 @@ function formAJAX(btn){
 	var method = ($form.attr('method') || 'post').toLowerCase();
 
 	if($form.validate && !$form.validate()){
-		app.util.actionMessage('Please fix the form errors.', $form, 'danger')
+		app.messages.action('Please fix the form errors.', $form, 'danger')
 		return false;
 	}
 
-	app.util.actionMessage(
-		`<div class="spinner-border" role="status">
-			<span class="visually-hidden">Loading...</span>
-		</div>`,
-		$form,
-		'info'
-	);
+	// Plain text: app.messages.action HTML-escapes its message (by design,
+	// see @simpleworkjs/frontend), so raw markup like a spinner <div> would
+	// render literally instead of as an element.
+	app.messages.action('Saving…', $form, 'info');
 
 	app.api[method]($form.attr('action'), formData, function(error, data){
-		app.util.actionMessage(data.message, $form, error ? 'danger' : 'success'); //re-populate table
+		app.messages.action(data.message, $form, error ? 'danger' : 'success'); //re-populate table
 		$form.validateClear();
 		if(!error){
 			$form.trigger("reset");
@@ -750,7 +714,7 @@ function formAJAX(btn){
 		}else{
 			console.log('formAJAX res error', error, data)
 			if(data && data.name === 'ObjectValidateError'){
-				app.util.actionMessage('Please fix the form errors', $form, 'danger'); //re-populate table
+				app.messages.action('Please fix the form errors', $form, 'danger'); //re-populate table
 			}
 			if(data && data.keys){
 				console.log('form key errors', data.keys)

nodejs/public/lib/js/val.js

@@ -1,201 +0,0 @@
-( function( $ ) {
-	var settings = {
-		rule: {
-			eq: function(value, options){
-				var compare = $('[name=' + options + ']').val();
-	 
-				if ( value != compare ) {
-					return "Miss-match";
-				}
-			}
-		},
-	};
-
-	$.fn.validate = function(event) {
-		// let	thisSettings = $.extend(true, settings, settingsObj);
-		let hasErrors = false;
-
-		if(this.is('[validate]')) return this.validateField(event);
-
-		if(!this.attr('isValid')){
-			console.log('adding reset event')
-			this.on('reset', function(){
-				$(this).attr('isValid', false);
-				$(this).validateClear();
-			})
-		}
-
-		this.find('[validate]').each(function(){
-			if(!$(this).validateField()) hasErrors = true;
-		});
-		
-		this.attr('isValid', !hasErrors);
-
-		if(hasErrors && event) event.preventDefault();
-
-		return !hasErrors;
-	};
-
-	$.fn.validateClear = function(){
-		$(this).find('input').each(function(){
-			$(this).removeClass('is-invalid');
-			$(this).removeClass('is-valid');
-		})
-	}
-
-	$.fn.validateField = function(){
-		var attr = this.attr('validate').split(':'); //array of params
-		var	rule = attr[0];
-		var	options = attr[1];
-		var	value = this.val(); //link to input value
-		var message;
-
-		if(this.prop('disabled')) return true;
-
-
-		//checks if field is required, and length 
-		if(!isNaN(options) && value.length < options){
-			message = `Must be ${options} characters`;
-		}
-
-		//checks if empty to stop processing 
-		if(!isNaN(options) && value.length === 0) {
-		}else if(rule in settings.rule){
-			message = settings.rule[rule].apply(this, [value, options]);
-		}
-
-		this.validateMessage(message)
-		return !message;
-	}
-
-	$.fn.validateMessage = function(message){
-		if(message && message !== true){
-			this.closest('.form-group').find('b.invalid-feedback').html(message);
-			this.addClass('is-invalid');
-		}else{
-			this.removeClass('is-invalid');
-			this.addClass('is-valid');
-		}
-		return this;
-	};
-
-	jQuery.extend({
-		validateSettings: function( settingsObj ) {
-			$.extend( true, settings, settingsObj );
-		},
-
-		validateInit: function( ettingsObj ) {
-			$( '[action]' ).on( 'submit', function ( event, settingsObj ){
-				$( this ).validate( settingsObj, event );
-			});
-		}
-	});
-
-}( jQuery ));
-
-// Host / target validation, mirrored from the backend (utils/hostname_validate.js):
-// a bare hostname or IPv4 address, no protocol / "/" / ":" / whitespace. The
-// incoming host may be a wildcard ("*.example.com"); the target may not.
-(function(){
-	var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
-	// Either one bare label (Docker service names, /etc/hosts entries) or a
-	// dotted hostname with an alphabetic TLD.
-	var HOSTNAME = /^(?=.{1,253}$)(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}|[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)$/i;
-	var FORBIDDEN = /[\s/:]/;
-
-	function isIPv4( value ) {
-		var parts = value.split( '.' );
-		if ( parts.length !== 4 ) return false;
-		return parts.every( function( p ) {
-			return /^(0|[1-9]\d{0,2})$/.test( p ) && Number( p ) <= 255;
-		});
-	}
-
-	// Incoming-host pattern: labels may be normal, "*" (one fragment), or "**"
-	// (any number of fragments, incl. a bare "**" global catch-all).
-	function isHostPattern( value ) {
-		if ( value.length > 253 ) return false;
-		return value.split( '.' ).every( function( l ) {
-			return l === '*' || l === '**' || LABEL.test( l );
-		});
-	}
-
-	function forbidden( value ) {
-		return FORBIDDEN.test( value ) || value.includes( '://' );
-	}
-
-	// Incoming host: IPv4 or a wildcard host pattern.
-	function checkHost( value ) {
-		if ( typeof value !== 'string' || value.length === 0 ) return "Required";
-		if ( forbidden( value ) ) return 'No protocol, "/", or ":"';
-		if ( isIPv4( value ) || isHostPattern( value ) ) return;
-		return "Enter a valid host or wildcard (*, **)";
-	}
-
-	// Downstream target: IPv4 or a strict hostname, no wildcard.
-	function checkTarget( value ) {
-		if ( typeof value !== 'string' || value.length === 0 ) return "Required";
-		if ( forbidden( value ) ) return 'No protocol, "/", or ":"';
-		if ( isIPv4( value ) || HOSTNAME.test( value ) ) return;
-		return "Enter a valid hostname or IP";
-	}
-
-	$.validateSettings({
-		rule:{
-			ip: function( value ) {
-				value = value.split( '.' );
-
-				if ( value.length != 4 ) {
-					return "Malformed IP";
-				}
-
-				$.each( value, function( key, value ) {
-					if( value > 255 || value < 0 ) {
-						return "Malformed IP";
-					}
-				});
-			},
-
-			// Incoming host name — hostname, IPv4, or wildcard pattern (*, **).
-			host: function( value ) {
-				return checkHost( value );
-			},
-
-			// Downstream target — hostname or IPv4, no wildcard.
-			target: function( value ) {
-				return checkTarget( value );
-			},
-
-			// Back-compat alias (no wildcard).
-			hostname: function( value ) {
-				return checkTarget( value );
-			},
-
-			user: function( value ) {
-				var reg = /^[a-z0-9\_\-\@\.]{1,32}$/;
-				if ( reg.test( value ) === false ) {
-					return "Invalid";
-				}
-			},
-
-			// Mirrors utils/password_policy.js: >= 8 chars, and either 12+ chars
-			// or at least 3 of {lowercase, uppercase, number, symbol}.
-			password: function( value ) {
-				if ( typeof value !== 'string' || value.length < 8 ) {
-					return "Password must be at least 8 characters";
-				}
-				if ( value.length >= 12 ) return;
-
-				var classes = 0;
-				if ( /[a-z]/.test( value ) ) classes++;
-				if ( /[A-Z]/.test( value ) ) classes++;
-				if ( /[0-9]/.test( value ) ) classes++;
-				if ( /[^A-Za-z0-9]/.test( value ) ) classes++;
-
-				if ( classes < 3 ) {
-					return "Use 3 of: lowercase, uppercase, number, symbol (or 12+ chars)";
-				}
-			}
-		}
-	});
-})();

nodejs/routes/api.js

@@ -9,7 +9,11 @@ router.use('/auth', require('../models').authRouter);
 // Who am I — needs a valid session but no admin gate (drives the login state).
 router.use('/user', middleware.auth, require('./user'));
 
-// Jump-host data — admin only (audit log, active sessions, metrics).
-router.use('/', middleware.auth, middleware.requireAdmin, require('./jump'));
+// Self-service API token (PAT) management — any authenticated user, no
+// admin gate (see routes/api_token.js for why a token can't reach admin routes).
+router.use('/api-token', middleware.auth, require('./api_token'));
+
+// Jump-host data — jump admin only (audit log, active sessions, metrics).
+router.use('/', middleware.auth, middleware.requireJumpAdmin, require('./jump'));
 
 module.exports = router;

nodejs/routes/api_token.js

@@ -0,0 +1,120 @@
+'use strict';
+
+// Self-service API token (PAT) management. Every endpoint is owner-scoped: a
+// user only sees / mutates tokens where created_by === req.user.username.
+// Mirrors proxy's routes/api_token.js. Mounted under middleware.auth only
+// (no requireAdmin) — any authenticated user may mint one, but the token
+// itself carries no group claims (see models/api_token.js), so it can only
+// reach non-admin routes (e.g. GET /api/user/hosts), never the admin-gated
+// ones under routes/jump.js.
+
+const router = require('express').Router();
+const {ApiToken} = require('../models');
+
+function forbidden(){
+	let error = new Error('Forbidden');
+	error.name = 'Forbidden';
+	error.message = 'You do not own this API token.';
+	error.status = 403;
+	return error;
+}
+
+// Resolve a token the caller owns. Missing or not-yours both raise 403 (no
+// existence leak; ids are unguessable random hex anyway).
+async function getOwned(req, id){
+	let token;
+	try{
+		token = await ApiToken.get(id);
+	}catch(e){
+		throw forbidden();
+	}
+	if(!token || token.created_by !== req.user.username) throw forbidden();
+	return token;
+}
+
+router.get('/', async function(req, res, next){
+	try{
+		return res.json({results: await ApiToken.listDetail({created_by: req.user.username})});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.post('/', async function(req, res, next){
+	try{
+		const days = req.body.expires_in_days !== '' && req.body.expires_in_days !== undefined
+			? Number(req.body.expires_in_days) : 0;
+
+		const token = await ApiToken.add({
+			name: req.body.name,
+			description: req.body.description || '',
+			created_by: req.user.username,
+			expires_at: days > 0 ? (new Date).getTime() + days * 86400000 : 0,
+		});
+
+		return res.json({
+			results: token,
+			token: token._raw_token,
+			message: `API token '${token.name}' created. Save it now — it will not be shown again.`,
+		});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.get('/:id', async function(req, res, next){
+	try{
+		return res.json({results: await getOwned(req, req.params.id)});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.put('/:id', async function(req, res, next){
+	try{
+		const token = await getOwned(req, req.params.id);
+
+		const update = {};
+		for(const k of ['name', 'description']){
+			if(req.body[k] !== undefined) update[k] = req.body[k];
+		}
+		if(req.body.expires_in_days !== undefined && req.body.expires_in_days !== ''){
+			const days = Number(req.body.expires_in_days);
+			update.expires_at = days > 0 ? (new Date).getTime() + days * 86400000 : 0;
+		}else if(req.body.expires_at !== undefined){
+			update.expires_at = Number(req.body.expires_at) || 0;
+		}
+
+		return res.json({
+			results: await token.update(update),
+			message: `API token '${token.name}' updated.`,
+		});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.delete('/:id', async function(req, res, next){
+	try{
+		const token = await getOwned(req, req.params.id);
+		await token.remove();
+		return res.json({id: req.params.id, message: `API token '${token.name}' revoked.`});
+	}catch(error){
+		next(error);
+	}
+});
+
+router.post('/:id/rotate', async function(req, res, next){
+	try{
+		const token = await getOwned(req, req.params.id);
+		const raw = await token.rotate();
+		return res.json({
+			token: raw,
+			message: `API token '${token.name}' rotated. Save it — it will not be shown again.`,
+		});
+	}catch(error){
+		next(error);
+	}
+});
+
+module.exports = router;

nodejs/routes/render.js

@@ -14,6 +14,10 @@ const values = {
 	titleIcon: conf.environment !== 'production' ? '<i class="fa-brands fa-dev"></i>' : '',
 	name: conf.name,
 	logo: conf.logo,
+	// The SSH front door's port -- the dashboard's "quick jump" copy buttons
+	// need this to build a real, working `ssh ...` command (the web UI and
+	// SSH front door share a hostname but not a port).
+	sshPort: (conf.ssh && conf.ssh.listenPort) || 22,
 	...buildInfo,
 };
 
@@ -21,7 +25,7 @@ const values = {
 // as the sibling apps), and the app's own JS/CSS/img from public/.
 mountStaticModules(router, {
 	root: path.join(__dirname, '..'),
-	deps: ['bootstrap', 'mustache', 'jquery', '@fortawesome', 'moment', 'jq-repeat'],
+	deps: ['bootstrap', 'mustache', 'jquery', '@fortawesome', 'moment', 'jq-repeat', '@simpleworkjs/frontend'],
 });
 
 // Liveness probe — no auth.

nodejs/routes/user.js

@@ -4,14 +4,43 @@
 // browser who it is and whether it's an admin (drives login state + nav).
 
 const router = require('express').Router();
-const { isAdmin } = require('../middleware/auth');
+const { isAdmin, isJumpAdmin } = require('../middleware/auth');
+const access = require('../utils/access');
+const metrics = require('../models/metrics');
+const registry = require('../services/session_registry');
 
 router.get('/me', (req, res) => {
 	res.json({
 		username: req.user && req.user.username,
 		groups: req.groups || [],
 		isAdmin: isAdmin(req),
+		isJumpAdmin: isJumpAdmin(req),
 	});
 });
 
+// The hosts this session can SSH to — every host for an admin, otherwise the
+// same group-based resolution the SSH front door uses (accessibleHosts),
+// fed the OIDC session's already-known groups instead of an LDAP lookup.
+router.get('/hosts', async (req, res, next) => {
+	try {
+		const hosts = isAdmin(req)
+			? await access.allHosts()
+			: await access.accessibleHosts({ uid: req.user && req.user.username, groups: req.groups || [] });
+
+		// Enrich with connection state for the dashboard's host list: whether a
+		// session is live right now (active bridges, session_registry), plus the
+		// last successful/failed connection times (models/metrics).
+		const connectedSlugs = new Set(registry.list().map((s) => s.slug));
+		const last = await metrics.lastForHosts(hosts.map((h) => h.slug));
+		const enriched = hosts.map((h) => ({
+			...h,
+			connected: connectedSlugs.has(h.slug),
+			lastConnected: (last[h.slug] && last[h.slug].lastConnected) || null,
+			lastFailed: (last[h.slug] && last[h.slug].lastFailed) || null,
+		}));
+
+		res.json({ results: enriched });
+	} catch (err) { next(err); }
+});
+
 module.exports = router;

nodejs/services/bridge.js

@@ -23,7 +23,7 @@ function counter(onBytes) {
 // Connect the upstream ssh2.Client, retrying once after a short pause if the
 // first attempt fails auth (SSSD/AuthorizedKeysCommand cache lag right after a
 // first-time key injection).
-function connectUpstream({ host, port, username, privateKey, onHostKey, uid, justInjected }) {
+function connectUpstream({ host, port, username, privateKey, cert, onHostKey, uid, justInjected, expectedHostKeyFp }) {
 	return new Promise((resolve, reject) => {
 		let attempted = false;
 		const dial = (allowRetry) => {
@@ -42,12 +42,16 @@ function connectUpstream({ host, port, username, privateKey, onHostKey, uid, jus
 				})
 				.connect({
 					host, port, username, privateKey,
+					certificates: cert ? [cert] : undefined,
 					readyTimeout: (conf.ssh && conf.ssh.connectTimeoutMs) || 10000,
 					keepaliveInterval: 15000,
 					hostVerifier: (key) => {
 						const fp = 'SHA256:' + crypto.createHash('sha256').update(key).digest('base64').replace(/=+$/, '');
 						if (onHostKey) onHostKey(fp);
-						return true; // v1: trust-on-use, fingerprint audited. Pinning = follow-up.
+						if (expectedHostKeyFp && expectedHostKeyFp !== fp) {
+							return false;
+						}
+						return true; // v1: trust-on-use if not pinned, fingerprint audited.
 					},
 				});
 		};

nodejs/services/ssh_server.js

@@ -129,22 +129,41 @@ async function resolveAndConnect(state, record, { onHostKey } = {}) {
 	await record.patch({ targetSlug: host ? host.slug : 'raw-ip', targetAddr: endpoint.address, targetPort: endpoint.port });
 
 	let justInjected = false;
-	try { justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine); }
-	catch (_) { throw fail('key-inject-failed'); }
+	let cert;
+	const usePki = conf.ssh && conf.ssh.pki && conf.ssh.pki.enabled;
+
+	try {
+		if (usePki) {
+			const { getSignedCert } = require('../utils/vault_cert');
+			cert = await getSignedCert(JUMP_KEYS.publicLine, state.uid);
+		} else {
+			justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine);
+		}
+	} catch (err) {
+		const failType = usePki ? 'pki-cert-failed' : 'key-inject-failed';
+		throw fail(failType, err.message, host ? host.slug : undefined);
+	}
 
 	let upstream;
 	try {
 		upstream = await connectUpstream({
 			host: endpoint.address, port: endpoint.port,
-			username: state.uid, privateKey: JUMP_KEYS.clientKey,
+			username: state.uid, privateKey: JUMP_KEYS.clientKey, cert,
 			uid: state.uid, justInjected, onHostKey,
+			expectedHostKeyFp: host && host.metadata && host.metadata.sshHostKeyFp,
 		});
-	} catch (_) { throw fail('upstream-unreachable'); }
+	} catch (err) { throw fail('upstream-unreachable', err.message, host ? host.slug : undefined); }
 
 	return { upstream, host, endpoint };
 }
 
-function fail(reason) { const e = new Error(reason); e.reason = reason; return e; }
+// detail carries the real underlying error message (e.g. ECONNREFUSED,
+// ETIMEDOUT, an ssh2 auth-failure string) so audit records aren't reduced to
+// just the generic reason code -- without it, a network-layer failure and an
+// SSH auth failure both looked identical in the audit log. hostSlug (when the
+// target was already resolved to a known host) lets callers attribute the
+// failure to that host for per-host "last failed connection" tracking.
+function fail(reason, detail, hostSlug) { const e = new Error(reason); e.reason = reason; e.detail = detail; e.hostSlug = hostSlug; return e; }
 
 async function runGrammar(session, client, state) {
 	// Register session listeners IMMEDIATELY — before any async work.
@@ -174,25 +193,47 @@ async function runGrammar(session, client, state) {
 	} catch (err) {
 		const reason = err.reason || 'error';
 		rejectUp(new Error(reasonMessage(reason)));
-		await record.finish({ success: false, failReason: reason });
-		await metrics.bump({ uid: state.uid, success: false });
+		await record.finish({ success: false, failReason: reason, failDetail: err.detail });
+		await metrics.bump({ uid: state.uid, hostSlug: err.hostSlug, success: false });
 	}
 }
 
 async function runTuiSession(session, client, state) {
+	// Register session listeners IMMEDIATELY, before any await — same fix,
+	// same reason, as runGrammar above. The client sends pty-req and shell
+	// requests right after opening the session; awaiting audit.create() and
+	// accessibleHosts() first (both real round-trips: Redis, then the
+	// directory API) left a window where those requests could arrive before
+	// runTui had attached any listener for them, and ssh2 auto-rejects an
+	// unlistened channel request with CHANNEL_FAILURE — surfacing to the
+	// client as "PTY allocation request failed" / "shell request failed",
+	// with the connection then just sitting there (nothing left to drive it).
+	let resolveHosts, rejectHosts;
+	const hostsPromise = new Promise((res, rej) => { resolveHosts = res; rejectHosts = rej; });
+	// A silent catch so a rejection isn't "unhandled" if the client never
+	// sends a shell request at all (exec-only) — runTui's own .catch() below
+	// still runs independently when it does.
+	hostsPromise.catch(() => {});
+	const tuiPromise = runTui(session, state.uid, hostsPromise);
+
 	const record = await audit.create({ uid: state.uid, authMethod: state.authMethod, clientIp: state.clientIp, mode: 'tui' });
 
-	const finishFail = async (reason) => {
-		await record.finish({ success: false, failReason: reason });
-		await metrics.bump({ uid: state.uid, success: false });
+	const finishFail = async (reason, detail, hostSlug) => {
+		await record.finish({ success: false, failReason: reason, failDetail: detail });
+		await metrics.bump({ uid: state.uid, hostSlug, success: false });
 		try { client.end(); } catch (_) {}
 	};
 
 	let hosts;
-	try { hosts = await accessibleHosts(state.user); }
-	catch (_) { return finishFail('directory-unreachable'); }
+	try {
+		hosts = await accessibleHosts(state.user);
+		resolveHosts(hosts);
+	} catch (_) {
+		rejectHosts(new Error('directory-unreachable'));
+		return finishFail('directory-unreachable');
+	}
 
-	const tui = await runTui(session, state.uid, hosts);
+	const tui = await tuiPromise;
 	if (!tui.host) return finishFail('cancelled');
 	state.target = tui.host.slug;
 
@@ -200,19 +241,32 @@ async function runTuiSession(session, client, state) {
 	await record.patch({ targetSlug: tui.host.slug, targetAddr: endpoint.address, targetPort: endpoint.port });
 
 	let justInjected = false;
-	try { justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine); }
-	catch (_) { return finishFail('key-inject-failed'); }
+	let cert;
+	const usePki = conf.ssh && conf.ssh.pki && conf.ssh.pki.enabled;
+
+	try {
+		if (usePki) {
+			const { getSignedCert } = require('../utils/vault_cert');
+			cert = await getSignedCert(JUMP_KEYS.publicLine, state.uid);
+		} else {
+			justInjected = await ensureKeyInjected(state.user, JUMP_KEYS.publicLine);
+		}
+	} catch (err) {
+		const failType = usePki ? 'pki-cert-failed' : 'key-inject-failed';
+		return finishFail(failType, err.message, tui.host.slug);
+	}
 
 	let upstream;
 	try {
 		upstream = await connectUpstream({
 			host: endpoint.address, port: endpoint.port,
-			username: state.uid, privateKey: JUMP_KEYS.clientKey,
+			username: state.uid, privateKey: JUMP_KEYS.clientKey, cert,
 			uid: state.uid, justInjected, onHostKey: (fp) => record.patch({ hostKeyFp: fp }),
+			expectedHostKeyFp: tui.host && tui.host.metadata && tui.host.metadata.sshHostKeyFp,
 		});
-	} catch (_) {
+	} catch (err) {
 		try { tui.channel.write(`\r\n  Could not reach ${endpoint.address}.\r\n`); tui.channel.close(); } catch (_) {}
-		return finishFail('upstream-unreachable');
+		return finishFail('upstream-unreachable', err.message, tui.host.slug);
 	}
 
 	registry.add(record.id, { uid: state.uid, target: endpoint.address, slug: tui.host.slug });
@@ -253,7 +307,10 @@ function reasonMessage(reason) {
 
 // Run the TUI picker over a shell channel; returns { host, channel, ptyInfo }.
 // host is null if the user quit. exec/subsystem in picker mode are rejected.
-function runTui(session, uid, hosts) {
+// Takes a Promise for the accessible-hosts list (not the resolved list)
+// so the caller can register these listeners before that lookup completes
+// — see the comment in runTuiSession for why that ordering matters.
+function runTui(session, uid, hostsPromise) {
 	return new Promise((resolve) => {
 		let ptyInfo = null;
 		let settled = false;
@@ -262,9 +319,14 @@ function runTui(session, uid, hosts) {
 		session.on('pty', (accept, _reject, info) => { ptyInfo = info; accept && accept(); });
 		session.on('shell', (accept) => {
 			const channel = accept();
-			pickHost(channel, uid, hosts).then((host) => {
-				if (!host) { try { channel.write('\r\n  Bye.\r\n'); channel.close(); } catch (_) {} }
-				finish({ host, channel, ptyInfo });
+			hostsPromise.then((hosts) => {
+				pickHost(channel, uid, hosts).then((host) => {
+					if (!host) { try { channel.write('\r\n  Bye.\r\n'); channel.close(); } catch (_) {} }
+					finish({ host, channel, ptyInfo });
+				});
+			}).catch(() => {
+				try { channel.write('\r\n  Could not reach the directory.\r\n'); channel.close(); } catch (_) {}
+				finish({ host: null });
 			});
 		});
 		session.on('exec', (accept) => {

nodejs/services/tui_picker.js

@@ -9,10 +9,29 @@ const ESC = '\x1b';
 const CLEAR = `${ESC}[2J${ESC}[H`;
 const HIDE_CUR = `${ESC}[?25l`;
 const SHOW_CUR = `${ESC}[?25h`;
-const INV = `${ESC}[7m`;
+
+// Basic styles
 const RST = `${ESC}[0m`;
-const DIM = `${ESC}[2m`;
 const BOLD = `${ESC}[1m`;
+const DIM = `${ESC}[2m`;
+
+// Colors (30-37: standard, 90-97: bright)
+const RED = `${ESC}[31m`;
+const BRIGHT_RED = `${ESC}[91m`;
+const CYAN = `${ESC}[36m`;
+const BRIGHT_CYAN = `${ESC}[96m`;
+const GREEN = `${ESC}[32m`;
+const BRIGHT_GREEN = `${ESC}[92m`;
+const YELLOW = `${ESC}[33m`;
+const BRIGHT_YELLOW = `${ESC}[93m`;
+const MAGENTA = `${ESC}[35m`;
+const BRIGHT_MAGENTA = `${ESC}[95m`;
+const BLUE = `${ESC}[34m`;
+const BRIGHT_BLUE = `${ESC}[94m`;
+
+// Inverted selection with color
+const INV_GREEN = `${ESC}[42m${ESC}[30m`;  // Green bg, black text
+const INV = `${ESC}[7m`;
 
 function pickHost(channel, uid, hosts) {
 	return new Promise((resolve) => {
@@ -35,18 +54,43 @@ function pickHost(channel, uid, hosts) {
 			const list = visible();
 			if (selected >= list.length) selected = Math.max(0, list.length - 1);
 			let out = CLEAR + HIDE_CUR;
-			out += `${BOLD}  Theta42 Jump — hosts for ${uid}${RST}\r\n`;
-			out += `${DIM}  ↑/↓ move · Enter connect · type to filter · q quit${RST}\r\n\r\n`;
+
+			// Header with gradient-style color
+			out += `\r\n  ${BOLD}${BRIGHT_CYAN}╔════════════════════════════════════════════════════════╗${RST}\r\n`;
+			out += `  ${BOLD}${BRIGHT_CYAN}║${RST}  ${BOLD}${BRIGHT_MAGENTA}Theta42 Jump${RST} ${DIM}·${RST} ${BRIGHT_GREEN}hosts for ${uid}${RST}                      ${BOLD}${BRIGHT_CYAN}║${RST}\r\n`;
+			out += `  ${BOLD}${BRIGHT_CYAN}╚════════════════════════════════════════════════════════╝${RST}\r\n`;
+			out += `\r\n`;
+			out += `  ${DIM}↑/↓ move · Enter connect · type to filter · q quit${RST}\r\n`;
+			out += `\r\n`;
+
 			if (!list.length) {
-				out += `  ${DIM}(no match for "${filter}")${RST}\r\n`;
+				out += `  ${YELLOW}⚠${RST}  ${DIM}(no match for "${filter}")${RST}\r\n`;
 			} else {
 				list.forEach((h, i) => {
 					const ip = (h.metadata && h.metadata.ip) || (h.metadata && h.metadata.address) || '';
-					const row = `  ${h.name}  ${DIM}(${h.slug})${RST}${ip ? `  ${ip}` : ''}`;
-					out += (i === selected ? `${INV}> ${h.name}  (${h.slug})${ip ? `  ${ip}` : ''}${RST}` : row) + '\r\n';
+					const isProd = h.metadata && h.metadata.isProduction;
+					const envBadge = isProd ? `${BOLD}${RED}PROD${RST} ` : `${DIM}DEV${RST}  `;
+
+					if (i === selected) {
+						// Selected row with green inverse background
+						const selRow = `${INV_GREEN}  ${h.name}  ${DIM}(${h.slug})${RST}${ip ? `  ${CYAN}${ip}${RST}` : ''}  ${envBadge}  ${BOLD}${BRIGHT_GREEN}◄ SELECTED ►${RST}${INV_GREEN}${RST}`;
+						out += selRow + '\r\n';
+					} else {
+						// Normal row with subtle coloring
+						const nameColor = i % 2 === 0 ? BRIGHT_CYAN : CYAN;
+						out += `  ${nameColor}${h.name}${RST}  ${DIM}(${h.slug})${RST}${ip ? `  ${BLUE}${ip}${RST}` : ''}  ${envBadge}\r\n`;
+					}
 				});
 			}
-			if (filter) out += `\r\n  ${DIM}filter:${RST} ${filter}`;
+
+			if (filter) {
+				out += `\r\n  ${DIM}filter: ${BRIGHT_YELLOW}${filter}${RST}`;
+			}
+
+			// Footer
+			out += `\r\n\r\n  ${DIM}────────────────────────────────────────────────────────${RST}\r\n`;
+			out += `  ${DIM}Press${RST} ${BOLD}1-9${RST} ${DIM}to quick-select · ${BOLD}q${RST} ${DIM}to quit${RST}\r\n`;
+
 			channel.write(out);
 		};
 

nodejs/test/integration/ssh_bridge.test.js

@@ -156,6 +156,29 @@ test('shell bridges and echoes', async () => {
 	assert.match(out, /echo:ping/);
 });
 
+test('connectUpstream rejects with a specific, non-generic error when the target refuses the connection', async () => {
+	// Regression coverage for ssh_server.js's resolveAndConnect: it used to
+	// discard this error entirely (catch (_) { throw fail('upstream-unreachable') }),
+	// so the audit log recorded the same generic reason for a refused port, a
+	// timeout, or a bad key alike. Now the real message is threaded through as
+	// failDetail, so this must stay meaningful.
+	// Bind a server just to reserve a free port, then close it immediately so
+	// nothing is listening there — guarantees ECONNREFUSED rather than relying
+	// on a hardcoded port number that might be in use.
+	const closedPort = await new Promise((resolve) => {
+		const probe = require('net').createServer();
+		probe.listen(0, '127.0.0.1', () => { const p = probe.address().port; probe.close(() => resolve(p)); });
+	});
+	await assert.rejects(
+		connectUpstream({ host: '127.0.0.1', port: closedPort, username: 'test', privateKey: jumpKey, uid: 'test', justInjected: false }),
+		(err) => {
+			assert.ok(err.message && err.message.length > 0);
+			assert.notStrictEqual(err.message, 'upstream-unreachable');
+			return true;
+		},
+	);
+});
+
 test('sftp subsystem bytes pass through', async () => {
 	const { conn, ready } = connectJump();
 	await ready;

nodejs/test/unit/access.test.js

@@ -2,45 +2,39 @@
 
 const { test } = require('node:test');
 const assert = require('node:assert');
-const { accessibleHosts, clearCache } = require('../../utils/access');
+const { accessibleHosts, allHosts, clearCache } = require('../../utils/access');
 
 function stubLdap(groups) {
 	return { getGroups: async () => groups };
 }
 
-function stubFetch(byGroup) {
+function stubFetch(byUid) {
 	return async (url) => {
-		const cn = decodeURIComponent(url.split('group=')[1]);
-		return { ok: true, json: async () => ({ results: byGroup[cn] || [] }) };
+		const uid = url.split('/access/')[1];
+		return { ok: true, json: async () => ({ results: byUid[uid] || [] }) };
 	};
 }
 
-test('unions hosts across groups, dedupes, drops non-hosts', async () => {
+test('drops non-hosts from access projection', async () => {
 	clearCache();
 	const user = { uid: 'alice', dn: 'uid=alice,ou=people,dc=x' };
 	const fetchImpl = stubFetch({
-		host_web01_access: [
+		alice: [
 			{ id: '1', kind: 'host', slug: 'host_web01' },
+			{ id: '2', kind: 'host', slug: 'host_db' },
 			{ id: '9', kind: 'service', slug: 'app_gitea' }, // dropped: not a host
 		],
-		host_db_access: [
-			{ id: '1', kind: 'host', slug: 'host_web01' }, // dupe by id
-			{ id: '2', kind: 'host', slug: 'host_db' },
-		],
 	});
-	const hosts = await accessibleHosts(user, { fetchImpl, ldap: stubLdap(['host_web01_access', 'host_db_access']) });
+	const hosts = await accessibleHosts(user, { fetchImpl });
 	assert.deepStrictEqual(hosts.map((h) => h.id).sort(), ['1', '2']);
 });
 
-test('a failing group query does not sink the rest', async () => {
+test('a failing access query returns empty list without throwing', async () => {
 	clearCache();
 	const user = { uid: 'bob', dn: 'uid=bob,ou=people,dc=x' };
-	const fetchImpl = async (url) => {
-		if (url.includes('bad')) return { ok: false, status: 500 };
-		return { ok: true, json: async () => ({ results: [{ id: '3', kind: 'host', slug: 'host_ok' }] }) };
-	};
-	const hosts = await accessibleHosts(user, { fetchImpl, ldap: stubLdap(['bad_access', 'good_access']) });
-	assert.deepStrictEqual(hosts.map((h) => h.id), ['3']);
+	const fetchImpl = async () => ({ ok: false, status: 500 });
+	const hosts = await accessibleHosts(user, { fetchImpl });
+	assert.deepStrictEqual(hosts, []);
 });
 
 test('caches per uid', async () => {
@@ -48,22 +42,42 @@ test('caches per uid', async () => {
 	let calls = 0;
 	const user = { uid: 'cara', dn: 'd' };
 	const fetchImpl = async () => { calls++; return { ok: true, json: async () => ({ results: [] }) }; };
-	const ldap = { getGroups: async () => ['g1'] };
-	await accessibleHosts(user, { fetchImpl, ldap });
-	await accessibleHosts(user, { fetchImpl, ldap });
+	await accessibleHosts(user, { fetchImpl });
+	await accessibleHosts(user, { fetchImpl });
 	assert.strictEqual(calls, 1);
 });
 
-test('a bare-array response (envelope drift) is treated as a failed group, not silently []', async () => {
+test('does not depend on user.groups or ldap.getGroups', async () => {
+	clearCache();
+	const user = { uid: 'erin' }; // no dn, no groups
+	const fetchImpl = stubFetch({
+		erin: [{ id: '5', kind: 'host', slug: 'host_web01' }],
+	});
+	const hosts = await accessibleHosts(user, { fetchImpl });
+	assert.deepStrictEqual(hosts.map((h) => h.id), ['5']);
+});
+
+test('allHosts fetches the whole host inventory with no group filter', async () => {
+	const fetchImpl = async (url) => {
+		assert.ok(!url.includes('group='), 'must not filter by group');
+		assert.ok(url.includes('kind=host'));
+		return { ok: true, json: async () => ({ results: [
+			{ id: '1', kind: 'host', slug: 'host_a' },
+			{ id: '2', kind: 'host', slug: 'host_b' },
+		] }) };
+	};
+	const hosts = await allHosts({ fetchImpl });
+	assert.deepStrictEqual(hosts.map((h) => h.id).sort(), ['1', '2']);
+});
+
+test('a bare-array response (envelope drift) returns empty list', async () => {
 	clearCache();
 	const user = { uid: 'dave', dn: 'd' };
 	// drift shape: a bare array instead of { results: [...] }. The shared client
-	// throws DirectoryEnvelopeViolation; access.js must catch + continue, so a
-	// good group alongside still yields its hosts.
-	const fetchImpl = async (url) => {
-		if (url.includes('drift')) return { ok: true, json: async () => [{ id: '7', kind: 'host' }] };
-		return { ok: true, json: async () => ({ results: [{ id: '8', kind: 'host' }] }) };
+	// throws DirectoryEnvelopeViolation; access.js must catch + continue.
+	const fetchImpl = async () => {
+		return { ok: true, json: async () => [{ id: '7', kind: 'host' }] };
 	};
-	const hosts = await accessibleHosts(user, { fetchImpl, ldap: stubLdap(['drift_access', 'good_access']) });
-	assert.deepStrictEqual(hosts.map((h) => h.id), ['8']);
+	const hosts = await accessibleHosts(user, { fetchImpl });
+	assert.deepStrictEqual(hosts, []);
 });

nodejs/test/unit/no_native_dialogs.test.js

@@ -0,0 +1,43 @@
+'use strict';
+
+// Regression guard: native alert()/confirm()/prompt() calls block all further
+// browser events on the page (found live, mid browser-automation testing, on
+// sso-manager-node's equivalent secret-rotate flow) and are visually
+// inconsistent with the rest of the UI. This app has no such call sites;
+// keep it that way.
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+
+const ROOTS = ['views', 'public/js', 'public/lib/js'].map((d) => path.join(__dirname, '..', '..', d));
+
+const NATIVE_DIALOG_RE = /(^|[^.\w$])(alert|confirm|prompt)\s*\(/g;
+
+function walk(dir) {
+	let files = [];
+	if (!fs.existsSync(dir)) return files;
+	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+		const full = path.join(dir, entry.name);
+		if (entry.isDirectory()) files = files.concat(walk(full));
+		else if (/\.(ejs|js)$/.test(entry.name)) files.push(full);
+	}
+	return files;
+}
+
+test('no view or client-side script calls native alert()/confirm()/prompt()', () => {
+	const offenders = [];
+	for (const root of ROOTS) {
+		for (const file of walk(root)) {
+			const src = fs.readFileSync(file, 'utf8');
+			let m;
+			NATIVE_DIALOG_RE.lastIndex = 0;
+			while ((m = NATIVE_DIALOG_RE.exec(src))) {
+				const line = src.slice(0, m.index).split('\n').length;
+				offenders.push(`${path.relative(path.join(__dirname, '..', '..'), file)}:${line} — ${m[2]}(`);
+			}
+		}
+	}
+	assert.deepStrictEqual(offenders, []);
+});

nodejs/utils/access.js

@@ -8,22 +8,18 @@
 const conf = require('@simpleworkjs/conf');
 
 if (conf.standalone && conf.standalone.enabled) {
-	// Standalone mode: use the ORM-backed host inventory.
+	// Standalone mode: use the ORM-backed host inventory. Every host is
+	// accessible to every user, so allHosts and accessibleHosts coincide.
 	const { accessibleHosts } = require('./hosts_file');
-	module.exports = { accessibleHosts, clearCache: () => {} };
+	module.exports = { accessibleHosts, allHosts: () => accessibleHosts(), clearCache: () => {} };
 } else {
 	// Production mode: LDAP groups + SSO API (unchanged).
 
 	// Which directory hosts may a user reach, and how do we dial them?
 	//
-	// v1 resolution (see directory_spec.md §9.2 in sso-manager-node): the SSO's
-	// /api/discovery/me only answers for the API token's own user, and /graph
-	// omits ResourceGroup links — so we combine the user's LDAP groups (queried
-	// directly) with per-group resource lookups:
-	//
-	//   1. LDAP: groups the user's DN is a member of
-	//   2. SSO:  GET /api/discovery/resources?group=<cn>  per group (ApiToken)
-	//   3. union, keep kind === 'host'
+	// We use the SSO's machine-aware /api/discovery/access/:uid endpoint,
+	// which evaluates the user's groups server-side and returns their complete
+	// access projection in one call.
 	//
 	// Results are cached per-uid for a short TTL — the TUI picker and the
 	// username-grammar path share the cache. Dependency-injected fetch/ldap for
@@ -48,29 +44,25 @@ if (conf.standalone && conf.standalone.enabled) {
 		return directoryClient({ fetchImpl }).getResourcesByGroup(group);
 	}
 
-	async function accessibleHosts(user, { fetchImpl = fetch, ldap = userLdap } = {}) {
+	// Every host in the inventory, unfiltered — for admins (the web UI's own
+	// account is already gated by requireAdmin before this is ever called).
+	async function allHosts({ fetchImpl = fetch } = {}) {
+		const resources = await directoryClient({ fetchImpl }).getResourcesByGroup(undefined, { kind: 'host' });
+		return resources.filter(r => r.kind === 'host');
+	}
+
+	async function accessibleHosts(user, { fetchImpl = fetch } = {}) {
 		const hit = cache.get(user.uid);
 		if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.hosts;
 
-		const groups = await ldap.getGroups(user.dn);
-
-		const seen = new Map();
-		for (const cn of groups) {
-			let resources;
-			try {
-				resources = await fetchResourcesByGroup(cn, { fetchImpl });
-			} catch (error) {
-				// One bad group must not hide the rest; the SSO being down
-				// surfaces as an empty list + log line, not a crash.
-				console.error(`[access] ${error.message}`);
-				continue;
-			}
-			for (const r of resources) {
-				if (r.kind === 'host' && !seen.has(r.id)) seen.set(r.id, r);
-			}
+		let resources = [];
+		try {
+			resources = await directoryClient({ fetchImpl }).getAccess(user.uid);
+		} catch (error) {
+			console.error(`[access] ${error.message}`);
 		}
 
-		const hosts = [...seen.values()];
+		const hosts = resources.filter(r => r.kind === 'host');
 		cache.set(user.uid, { at: Date.now(), hosts });
 		return hosts;
 	}
@@ -80,5 +72,5 @@ if (conf.standalone && conf.standalone.enabled) {
 		else cache.clear();
 	}
 
-	module.exports = { accessibleHosts, clearCache, fetchResourcesByGroup };
+	module.exports = { accessibleHosts, allHosts, clearCache, fetchResourcesByGroup };
 }

nodejs/utils/ui.js

@@ -37,6 +37,6 @@ module.exports = {
 	nav: [
 		{href: '/dashboard', icon: 'fa-solid fa-gauge-high', label: 'Dashboard', groups: []},
 		{href: '/sessions', icon: 'fa-solid fa-plug-circle-bolt', label: 'Sessions', groups: []},
-		{href: '/audit', icon: 'fa-solid fa-clipboard-list', label: 'Audit', groups: []},
+		{href: '/audit', icon: 'fa-solid fa-clipboard-list', label: 'Audit', groups: ['admin', 'app_jump_admin']},
 	],
 };

nodejs/utils/vault_cert.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const conf = require('@simpleworkjs/conf');
+
+/**
+ * Requests a signed SSH certificate from the SSO Manager's OpenBao/Vault proxy.
+ *
+ * @param {string} publicKey - The jump host's public key (e.g. 'ssh-rsa AAAAB3...')
+ * @param {string} targetUid - The username the cert should be valid for
+ * @returns {Promise<string>} - The signed SSH certificate
+ */
+async function getSignedCert(publicKey, targetUid) {
+	const sso = conf.sso || {};
+	const pkiConfig = conf.ssh?.pki || {};
+	
+	const vaultRole = pkiConfig.role || 'jump-host-role';
+	const endpoint = `${sso.url}/api/vault/ssh/sign/${vaultRole}`;
+
+	const response = await fetch(endpoint, {
+		method: 'POST',
+		headers: {
+			'Authorization': `Bearer ${sso.apiToken}`,
+			'Content-Type': 'application/json'
+		},
+		body: JSON.stringify({
+			public_key: publicKey,
+			valid_principals: targetUid
+		})
+	});
+
+	if (!response.ok) {
+		const errText = await response.text().catch(() => '');
+		throw new Error(`Failed to sign SSH cert (status ${response.status}): ${errText}`);
+	}
+
+	const data = await response.json();
+	if (!data.data || !data.data.signed_key) {
+		throw new Error('Vault response missing signed_key');
+	}
+
+	return data.data.signed_key;
+}
+
+module.exports = { getSignedCert };

nodejs/views/audit.ejs

@@ -1,5 +1,46 @@
 <%- include('top') %>
-<script type="text/javascript">app.auth.forceLogin();</script>
+<script type="text/javascript">app.auth.forceLogin(['admin', 'app_jump_admin']);</script>
+
+<div class="container mt-4">
+<div class="row g-3 mb-4">
+	<div class="col-6 col-md-3">
+		<div class="card shadow-sm text-center"><div class="card-body">
+			<div class="display-6" id="stat-active">–</div>
+			<div class="text-muted small text-uppercase">Active sessions</div>
+		</div></div>
+	</div>
+	<div class="col-6 col-md-3">
+		<div class="card shadow-sm text-center"><div class="card-body">
+			<div class="display-6" id="stat-total">–</div>
+			<div class="text-muted small text-uppercase">Total connections</div>
+		</div></div>
+	</div>
+	<div class="col-6 col-md-3">
+		<div class="card shadow-sm text-center"><div class="card-body">
+			<div class="display-6 text-danger" id="stat-fail">–</div>
+			<div class="text-muted small text-uppercase">Failed</div>
+		</div></div>
+	</div>
+	<div class="col-6 col-md-3">
+		<div class="card shadow-sm text-center"><div class="card-body">
+			<div class="display-6" id="stat-users">–</div>
+			<div class="text-muted small text-uppercase">Users seen</div>
+		</div></div>
+	</div>
+</div>
+
+<div class="row g-3 mb-4">
+	<div class="col-md-6">
+		<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-server me-1"></i> Top hosts</div>
+			<table class="table table-sm mb-0"><tbody id="top-hosts"></tbody></table>
+		</div>
+	</div>
+	<div class="col-md-6">
+		<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-user me-1"></i> Top users</div>
+			<table class="table table-sm mb-0"><tbody id="top-users"></tbody></table>
+		</div>
+	</div>
+</div>
 
 <div class="card shadow-sm">
 	<div class="card-header"><i class="fa-solid fa-clipboard-list me-1"></i> Audit log</div>
@@ -29,8 +70,28 @@
 		<button class="btn btn-sm btn-outline-secondary" id="next" onclick="changePage(1)">next &rarr;</button>
 	</div>
 </div>
+</div>
 
 <script type="text/javascript">
+	function rows(sel, list){
+		var $b = $(sel).empty();
+		if(!list || !list.length){ $b.append('<tr><td class="text-muted">No data.</td></tr>'); return; }
+		list.forEach(function(x){
+			$b.append('<tr><td>' + app.jump.esc(x.name) + '</td><td class="text-end">' + x.count + '</td></tr>');
+		});
+	}
+	function loadMetrics(){
+		app.jump.metrics(function(error, data){
+			if(error || !data) return;
+			$('#stat-active').text(data.active);
+			$('#stat-total').text(data.total);
+			$('#stat-fail').text(data.fail);
+			$('#stat-users').text((data.topUsers || []).length);
+			rows('#top-hosts', data.topHosts);
+			rows('#top-users', data.topUsers);
+		});
+	}
+
 	var page = 0;
 	function filters(){ return {page: page, uid: $('#f-uid').val(), target: $('#f-target').val(), status: $('#f-status').val()}; }
 	function applyFilters(){ page = 0; load(); }
@@ -57,6 +118,9 @@
 			$('#next').prop('disabled', (page + 1) * size >= total);
 		});
 	}
-	$(document).ready(load);
+	$(document).ready(function(){
+		loadMetrics();
+		load();
+	});
 </script>
 <%- include('bottom') %>

nodejs/views/dashboard.ejs

@@ -1,64 +1,282 @@
 <%- include('top') %>
 <script type="text/javascript">app.auth.forceLogin();</script>
 
+<div class="container mt-4">
 <div class="row g-3 mb-4">
-	<div class="col-6 col-md-3">
-		<div class="card shadow-sm text-center"><div class="card-body">
-			<div class="display-6" id="stat-active">–</div>
-			<div class="text-muted small text-uppercase">Active sessions</div>
-		</div></div>
+	<div class="col-12">
+		<div class="card shadow-sm">
+			<div class="card-header"><i class="fa-solid fa-terminal me-1"></i> Quick Jump</div>
+			<div class="card-body">
+				<p class="text-muted small mb-2">
+					Skip the picker: <code>ssh &lt;your-username&gt;_-_&lt;host-slug&gt;@&lt;this-jump-host&gt;</code>
+					connects straight to a host. Or just <code>ssh &lt;your-username&gt;@&lt;this-jump-host&gt;</code>
+					for the interactive picker.
+				</p>
+				<div class="input-group">
+					<input type="text" class="form-control font-monospace" id="quick-jump-cmd" readonly>
+					<button class="btn btn-outline-secondary" onclick="copyFieldValue('#quick-jump-cmd')" title="Copy">
+						<i class="fa-solid fa-copy"></i>
+					</button>
+				</div>
+			</div>
+		</div>
 	</div>
-	<div class="col-6 col-md-3">
-		<div class="card shadow-sm text-center"><div class="card-body">
-			<div class="display-6" id="stat-total">–</div>
-			<div class="text-muted small text-uppercase">Total connections</div>
-		</div></div>
-	</div>
-	<div class="col-6 col-md-3">
-		<div class="card shadow-sm text-center"><div class="card-body">
-			<div class="display-6 text-danger" id="stat-fail">–</div>
-			<div class="text-muted small text-uppercase">Failed</div>
-		</div></div>
-	</div>
-	<div class="col-6 col-md-3">
-		<div class="card shadow-sm text-center"><div class="card-body">
-			<div class="display-6" id="stat-users">–</div>
-			<div class="text-muted small text-uppercase">Users seen</div>
-		</div></div>
+</div>
+
+<div class="row g-3 mb-4">
+	<div class="col-12">
+		<div class="card shadow-sm">
+			<div class="card-header"><i class="fa-solid fa-network-wired me-1"></i> <span id="my-hosts-title">Hosts you can reach</span></div>
+			<div class="table-responsive">
+				<table class="table table-sm mb-0">
+					<thead><tr><th>Host</th><th>Slug</th><th class="text-end">Address</th><th>Last connection</th><th>Last failed connection</th><th></th></tr></thead>
+					<tbody id="my-hosts"></tbody>
+				</table>
+			</div>
+		</div>
 	</div>
 </div>
 
 <div class="row g-3">
-	<div class="col-md-6">
-		<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-server me-1"></i> Top hosts</div>
-			<table class="table table-sm mb-0"><tbody id="top-hosts"></tbody></table>
-		</div>
-	</div>
-	<div class="col-md-6">
-		<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-user me-1"></i> Top users</div>
-			<table class="table table-sm mb-0"><tbody id="top-users"></tbody></table>
+	<div class="col-12">
+		<div class="card shadow-sm">
+			<div class="card-header d-flex justify-content-between align-items-center">
+				<span><i class="fa-solid fa-key me-1"></i> API Tokens</span>
+				<button class="btn btn-sm btn-primary" onclick="createApiToken()"><i class="fa-solid fa-plus"></i> New token</button>
+			</div>
+			<div class="card-header actionMessage" style="display:none"></div>
+			<p class="text-muted small px-3 pt-3 mb-0">
+				Personal access tokens authenticate as you against this jump host's own API
+				(e.g. <code>GET /api/user/hosts</code>) — not for SSH login. A token carries
+				no group claims, so it can't reach admin-only endpoints.
+			</p>
+			<div class="card-body">
+				<p id="api-tokens-empty" class="text-muted mb-0" style="display:none">No API tokens.</p>
+				<div id="api-tokens">
+					<div jq-repeat="apiTokenCard" jq-index-key="id" id="apitoken-card-{{id}}" class="card shadow-sm mb-3">
+						<div class="card-header">
+							<h6 class="mb-0"><i class="fa-solid fa-key"></i> {{name}}</h6>
+							<small class="text-muted font-monospace">{{id_short}}</small>
+						</div>
+						<div class="card-header actionMessage" style="display:none"></div>
+						<div class="card-body">
+							{{#description}}<p>{{description}}</p>{{/description}}
+							<dl class="row mb-0 small">
+								<dt class="col-sm-3">Token ID</dt>
+								<dd class="col-sm-9"><code>{{id_short}}</code></dd>
+								<dt class="col-sm-3">Created</dt>
+								<dd class="col-sm-9">{{{created_display}}}</dd>
+								<dt class="col-sm-3">Last used</dt>
+								<dd class="col-sm-9">{{{last_used_display}}}</dd>
+								<dt class="col-sm-3">Expires</dt>
+								<dd class="col-sm-9">{{{expires_display}}}</dd>
+							</dl>
+						</div>
+						<div class="card-footer">
+							<button type="button" onclick="editToken('{{id}}')" class="btn btn-primary btn-sm"><i class="fa-solid fa-pen-to-square"></i> Edit</button>
+							<button type="button" onclick="rotateApiToken('{{id}}', this)" class="btn btn-warning btn-sm"><i class="fa-solid fa-arrows-rotate"></i> Rotate</button>
+							<button type="button" onclick="revokeApiToken('{{id}}', this)" class="btn btn-danger btn-sm float-end"><i class="fa-solid fa-trash"></i> Revoke</button>
+						</div>
+					</div>
+				</div>
+			</div>
 		</div>
 	</div>
 </div>
+</div>
 
 <script type="text/javascript">
-	function rows(sel, list){
-		var $b = $(sel).empty();
-		if(!list || !list.length){ $b.append('<tr><td class="text-muted">No data.</td></tr>'); return; }
-		list.forEach(function(x){
-			$b.append('<tr><td>' + app.jump.esc(x.name) + '</td><td class="text-end">' + x.count + '</td></tr>');
+	// The web UI and the SSH front door share a hostname, just not a port.
+	var SSH_PORT = <%- JSON.stringify(sshPort) %>;
+	function sshCommand(target){
+		var uid = app.auth.user && app.auth.user.username;
+		if(!uid) return '';
+		var portFlag = SSH_PORT === 22 ? '' : ' -p ' + SSH_PORT;
+		return 'ssh ' + uid + (target ? '_-_' + target : '') + '@' + location.hostname + portFlag;
+	}
+	function copyFieldValue(sel){
+		var $el = $(sel);
+		var text = $el.val();
+		if(!text) return;
+		navigator.clipboard.writeText(text).then(function(){
+			app.messages.toast('Copied to clipboard', 'success');
+		}, function(){
+			app.messages.toast('Could not copy — select and copy manually', 'danger');
 		});
 	}
-	$(document).ready(function(){
-		app.jump.metrics(function(error, data){
-			if(error || !data) return;
-			$('#stat-active').text(data.active);
-			$('#stat-total').text(data.total);
-			$('#stat-fail').text(data.fail);
-			$('#stat-users').text((data.topUsers || []).length);
-			rows('#top-hosts', data.topHosts);
-			rows('#top-users', data.topUsers);
+
+	function hostRows(sel, hosts){
+		var $b = $(sel).empty();
+		if(!hosts || !hosts.length){ $b.append('<tr><td class="text-muted">No hosts reachable.</td></tr>'); return; }
+		hosts.forEach(function(h){
+			var addr = (h.metadata && (h.metadata.ip || h.metadata.address)) || '';
+			var rowId = 'host-cmd-' + h.slug.replace(/[^a-zA-Z0-9_-]/g, '');
+			// Green: a session to this host is live right now. Yellow: the most
+			// recent attempt to this host failed (and none is currently live).
+			var rowClass = h.connected ? 'table-success'
+				: (h.lastFailed && (!h.lastConnected || h.lastFailed > h.lastConnected)) ? 'table-warning'
+				: '';
+			$b.append('<tr class="' + rowClass + '"><td>' + app.jump.esc(h.displayName || h.name || h.slug) + '</td>'
+				+ '<td class="text-muted small">' + app.jump.esc(h.slug) + '</td>'
+				+ '<td class="text-end text-muted small">' + app.jump.esc(addr) + '</td>'
+				+ '<td class="small">' + (h.lastConnected ? app.jump.fmtTime(h.lastConnected) : '—') + '</td>'
+				+ '<td class="small">' + (h.lastFailed ? app.jump.fmtTime(h.lastFailed) : '—') + '</td>'
+				+ '<td class="text-end">'
+				+   '<input type="hidden" id="' + rowId + '" value="' + app.jump.esc(sshCommand(h.slug)) + '">'
+				+   '<button class="btn btn-sm btn-outline-secondary" onclick="copyFieldValue(\'#' + rowId + '\')" title="Copy quick-jump command"><i class="fa-solid fa-copy"></i></button>'
+				+ '</td></tr>');
 		});
+	}
+	// expires_at/created_on/last_used_on come back as redis-hash strings for
+	// some fields and real numbers for others depending on the model's field
+	// type -- fmtTime already handles both via moment(ms, 'x').
+	function fmtExpiry(token){
+		var exp = Number(token.expires_at);
+		if(!exp) return '<span class="badge text-bg-secondary">never</span>';
+		if(Date.now() > exp) return '<span class="badge text-bg-danger">expired</span>';
+		return '<span class="badge text-bg-warning">' + moment(exp).fromNow() + '</span>';
+	}
+
+	var tokensById = {};
+	function processToken(token){
+		tokensById[token.id] = token;
+		token.id_short = token.id.slice(0, 12) + '…';
+		token.expires_display = fmtExpiry(token);
+		token.created_display = app.jump.fmtTime(token.created_on);
+		token.last_used_display = token.last_used_on ? app.jump.fmtTime(token.last_used_on) : 'Never';
+		return token;
+	}
+
+	function loadApiTokens(){
+		app.apiToken.list(function(error, data){
+			var tokens = (!error && data && data.results) || [];
+			$.scope.apiTokenCard.empty();
+			tokens.forEach(function(t){ $.scope.apiTokenCard.push(processToken(t)); });
+			$('#api-tokens-empty').toggle(tokens.length === 0);
+		});
+	}
+
+	// Shared "reveal secret once" display -- also used by proxy/sso-manager-node.
+	function showToken(title, token){
+		app.modal.open({title: title, bodyHtml:
+			'<p class="text-danger"><i class="fa-solid fa-triangle-exclamation"></i> Save this token now — it will <strong>not</strong> be shown again.</p>'
+			+ '<div class="input-group"><input type="text" class="form-control font-monospace" id="revealed-token" readonly value="' + app.jump.esc(token) + '">'
+			// Reuses the same copy-to-clipboard helper as the Quick Jump card
+			// above (toast feedback -- FontAwesome replaces <i> icons with
+			// inline <svg>, so a checkmark-flash-the-icon approach silently
+			// no-ops; the toast doesn't have that problem).
+			+   '<button class="btn btn-outline-secondary" onclick="copyFieldValue(\'#revealed-token\')" title="Copy"><i class="fa-solid fa-copy"></i></button></div>'
+			+ '<p class="mt-3 mb-0 text-muted small">Use it as a bearer token:<br><code>Authorization: Bearer ' + app.jump.esc(token) + '</code></p>'
+		});
+	}
+
+	function createApiToken(){
+		var $body = app.modal.open({title: 'New API Token', bodyHtml:
+			'<div class="mb-3">'
+			+   '<label class="form-label">Name</label>'
+			+   '<input type="text" class="form-control" id="new-token-name" placeholder="e.g. laptop-cron">'
+			+ '</div>'
+			+ '<div class="mb-3">'
+			+   '<label class="form-label">Description</label>'
+			+   '<input type="text" class="form-control" id="new-token-description" placeholder="optional">'
+			+ '</div>'
+			+ '<div class="mb-3">'
+			+   '<label class="form-label">Expires in (days, blank = never)</label>'
+			+   '<input type="number" class="form-control" id="new-token-days" min="1">'
+			+ '</div>',
+			footer: {buttonsHtml: app.modal.footerButtons({onSave: 'submitApiToken()', saveLabel: 'Create'})},
+		});
+		$body.find('#new-token-name').focus();
+	}
+
+	function submitApiToken(){
+		var name = $('#new-token-name').val().trim();
+		if(!name) return app.messages.action('Name is required', app.modal.body(), 'danger');
+		app.apiToken.add({
+			name: name,
+			description: $('#new-token-description').val(),
+			expires_in_days: $('#new-token-days').val(),
+		}, function(error, data){
+			if(error) return app.messages.action((data && data.message) || 'Failed to create token', app.modal.body(), 'danger');
+			// Deliberately no app.modal.close() here -- app.modal is a
+			// singleton, and close() immediately followed by open() (inside
+			// showToken) in the same tick collides with Bootstrap's
+			// hide-transition guard, so the reveal modal silently never
+			// shows. open() alone already overwrites the (already-visible)
+			// modal's content in place.
+			showToken('API Token Created', data.token);
+			loadApiTokens();
+		});
+	}
+
+	function editToken(id){
+		var t = tokensById[id]; if(!t) return;
+		app.modal.open({
+			title: 'Edit Token',
+			bodyHtml:
+				'<input type="hidden" id="edit-token-id" value="' + app.jump.esc(id) + '">'
+				+ '<div class="mb-3">'
+				+   '<label class="form-label">Name</label>'
+				+   '<input type="text" class="form-control" id="edit-token-name" value="' + app.jump.esc(t.name || '') + '">'
+				+ '</div>'
+				+ '<div class="mb-3">'
+				+   '<label class="form-label">Description</label>'
+				+   '<input type="text" class="form-control" id="edit-token-description" value="' + app.jump.esc(t.description || '') + '">'
+				+ '</div>'
+				+ '<div class="mb-3">'
+				+   '<label class="form-label">Expires in (days, blank = keep as-is, 0 = never)</label>'
+				+   '<input type="number" class="form-control" id="edit-token-days" min="0">'
+				+ '</div>',
+			footer: {
+				metaHtml: 'Created by ' + app.jump.esc(t.created_by || '—') + ' on ' + app.jump.fmtTime(t.created_on),
+				buttonsHtml: app.modal.footerButtons({onSave: 'saveEditToken()', saveLabel: 'Save'}),
+			},
+		});
+	}
+
+	function saveEditToken(){
+		var payload = {
+			id: $('#edit-token-id').val(),
+			name: $('#edit-token-name').val(),
+			description: $('#edit-token-description').val(),
+			expires_in_days: $('#edit-token-days').val(),
+		};
+		app.apiToken.update(payload, function(error, data){
+			if(error) return app.messages.action((data && data.message) || 'Failed to update token', app.modal.body(), 'danger');
+			app.modal.close();
+			loadApiTokens();
+		});
+	}
+
+	async function revokeApiToken(id, btn){
+		var $card = $(btn).closest('.card');
+		var ok = await app.messages.confirm('Revoke this API token? It stops working immediately.', $card, 'danger');
+		if(!ok) return;
+		app.apiToken.remove(id, function(error, data){
+			if(error) return app.messages.action((data && data.message) || 'Failed to revoke token', $card, 'danger');
+			loadApiTokens();
+		});
+	}
+	async function rotateApiToken(id, btn){
+		var $card = $(btn).closest('.card');
+		var ok = await app.messages.confirm('Rotate this API token? The old token stops working immediately.', $card, 'warning');
+		if(!ok) return;
+		app.apiToken.rotate(id, function(error, data){
+			if(error) return app.messages.action((data && data.message) || 'Failed to rotate token', $card, 'danger');
+			showToken('API Token Rotated', data.token);
+			loadApiTokens();
+		});
+	}
+
+	$(document).ready(async function(){
+		await app.auth.loadUser();
+		if(app.auth.isAdmin()) $('#my-hosts-title').text('My hosts');
+		$('#quick-jump-cmd').val(sshCommand());
+		app.jump.hosts(function(error, data){
+			if(error) return hostRows('#my-hosts', []);
+			hostRows('#my-hosts', data && data.results);
+		});
+		loadApiTokens();
 	});
 </script>
 <%- include('bottom') %>

nodejs/views/login.ejs

@@ -90,7 +90,7 @@
 				<hr />
 				<div class="d-grid">
 					<a href="/api/auth/oidc/start" class="btn btn-outline-primary">
-						<i class="fa-solid fa-id-badge"></i> Log in with SSO
+						<i class="fa-solid fa-id-badge"></i> Log in with Jump
 					</a>
 				</div>
 				<% } %>

nodejs/views/sessions.ejs

@@ -1,6 +1,7 @@
 <%- include('top') %>
 <script type="text/javascript">app.auth.forceLogin();</script>
 
+<div class="container mt-4">
 <div class="card shadow-sm">
 	<div class="card-header d-flex justify-content-between align-items-center">
 		<span><i class="fa-solid fa-plug-circle-bolt me-1"></i> Active sessions</span>
@@ -13,6 +14,7 @@
 		</table>
 	</div>
 </div>
+</div>
 
 <script type="text/javascript">
 	function loadSessions(){

nodejs/views/top.ejs

@@ -21,9 +21,11 @@
 		<script type="text/javascript" src="/static-modules/@fortawesome/fontawesome-free/js/all.min.js"></script>
 		<script type="text/javascript" src='/static-modules/mustache/mustache.min.js'></script>
 		<script type="text/javascript" src='/static-modules/jq-repeat/dist/js/jq-repeat.js'></script>
-		<script type="text/javascript" src='/static/lib/js/val.js'></script>
 		<script type="text/javascript" src="/static-modules/moment/moment.js"></script>
 		<script type="text/javascript" src="/static/lib/js/app-base.js"></script>
+		<script type="text/javascript" src="/static-modules/@simpleworkjs/frontend/lib/app.messages.js"></script>
+		<script type="text/javascript" src="/static-modules/@simpleworkjs/frontend/lib/app.modal.js"></script>
+		<script type="text/javascript" src="/static-modules/@simpleworkjs/frontend/lib/app.validate.js"></script>
 		<script type="text/javascript" src="/static/js/app.js"></script>
 	</head>
 	<body>
@@ -80,16 +82,24 @@
 		</div>
 
 		<script type="text/javascript">
+			// --sw-content-offset tracks the same height as #spa-shell's margin-top
+			// (fixed navbar, plus the update banner while it's shown), so any
+			// in-page sticky element (e.g. a sticky search/sort bar) can offset
+			// itself below both fixed elements via `top: var(--sw-content-offset)`
+			// instead of colliding with them at the viewport's true top:0.
 			function showUpdateBanner(){
 				let $nav = $('nav.fixed-top');
 				let $banner = $('#update-banner');
 				$banner.css('top', $nav.outerHeight() + 'px').show();
-				$('#spa-shell').css('margin-top', ($nav.outerHeight() + $banner.outerHeight()) + 'px');
+				let offset = $nav.outerHeight() + $banner.outerHeight();
+				$('#spa-shell').css('margin-top', offset + 'px');
+				document.documentElement.style.setProperty('--sw-content-offset', offset + 'px');
 			}
 
 			function dismissUpdateBanner(){
 				$('#update-banner').hide();
 				$('#spa-shell').css('margin-top', '');
+				document.documentElement.style.setProperty('--sw-content-offset', $('nav.fixed-top').outerHeight() + 'px');
 				sessionStorage.setItem('update-banner-dismissed', '1');
 			}