Merge pull request #10 from theta42/release/1.6.0

Release 1.6.0

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
+## [1.6.0] - 2026-07-27
+
+### Changed
+- **Adopted `@simpleworkjs/frontend`'s `app.messages`, `app.modal`, and `app.validate` modules**, replacing the vendored `app.util.actionMessage`/`actionConfirm` in `public/lib/js/app-base.js` and the vendored `public/lib/js/val.js` (unused by any current view here, so this is dedup/future-proofing rather than a behavior change). `app.api`/`app.auth`/`app.pubsub`/`app.socket` are untouched.
+
+## [1.5.0] - 2026-07-27
+
+### Added
+- **Web UI dashboard now lists the hosts you can reach** ("Hosts you can reach", or "All hosts" for admins) — previously the dashboard only showed usage metrics, with no way to see your actual access from the browser. Backed by a new `GET /api/user/hosts` endpoint (auth-only, not admin-gated): admins get the full inventory via `utils/access.js`'s new `allHosts()`, everyone else gets the same group-based resolution the SSH front door uses.
+- `utils/access.js`'s `accessibleHosts()` now accepts a pre-resolved `groups` array on the user object, skipping the LDAP `getGroups(dn)` round-trip — the web UI's OIDC session already has its groups claim and has no LDAP `dn` to query with.
+
+### Fixed
+- **Bumped `@simpleworkjs/ldap` to 1.0.1**, which fixes `addSshKey` throwing `ObjectClassViolationError` (LDAP `0x41`) on accounts predating the `ldapPublicKey` auxiliary objectClass. This is the code path this jump host's key-injection (`utils/key_inject.js`) uses on every first connection for a user — on affected accounts it aborted the SSH connection entirely (`key-inject-failed`).
+
 ## [1.4.0] - 2026-07-26
 
 ### Added

nodejs/package-lock.json

@@ -1,19 +1,20 @@
 {
   "name": "t42-jump-host",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-jump-host",
-      "version": "1.3.0",
+      "version": "1.5.0",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
         "@simpleworkjs/app-stack": "^1.0.0",
         "@simpleworkjs/conf": "^1.2.0",
         "@simpleworkjs/directory-schema": "^1.0.0",
-        "@simpleworkjs/ldap": "^1.0.0",
+        "@simpleworkjs/frontend": "^0.2.5",
+        "@simpleworkjs/ldap": "^1.0.1",
         "@simpleworkjs/oidc-client": "^1.0.0",
         "@simpleworkjs/orm": "^0.2.8",
         "bcrypt": "^6.0.0",
@@ -176,10 +177,19 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@simpleworkjs/frontend": {
+      "version": "0.2.5",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.2.5.tgz",
+      "integrity": "sha512-PxR7UVPv3gRpdF0WsuAZplF1vYvKsEJQevVPhz9d72U+69vP/OH3tlaAXjtO/apMHfhT1viOPw2gMVOrPSxYZw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@simpleworkjs/ldap": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@simpleworkjs/ldap/-/ldap-1.0.0.tgz",
-      "integrity": "sha512-saDmwk+KJ6kIWj9/MF37d+BM9KQisy6DsI9umyt1FWNyx6+wnEEat/1RUTwXKBd4IKJK+zPT5lC/B6gfa2CuAA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/ldap/-/ldap-1.0.1.tgz",
+      "integrity": "sha512-1jz3WQ9ghwNHz2mI+H33qw8nIQpLkoNHEy8lgdgsE/nCLK8JGU1SIKEdbsdMeXEQ0seKqyjuyXwmhdotsx6Lww==",
       "license": "MIT",
       "dependencies": {
         "ldapts": "^8.1.8"

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-jump-host",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {
@@ -20,10 +20,11 @@
   },
   "dependencies": {
     "@fortawesome/fontawesome-free": "^7.3.0",
-    "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/app-stack": "^1.0.0",
-    "@simpleworkjs/ldap": "^1.0.0",
+    "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/directory-schema": "^1.0.0",
+    "@simpleworkjs/frontend": "^0.2.5",
+    "@simpleworkjs/ldap": "^1.0.1",
     "@simpleworkjs/oidc-client": "^1.0.0",
     "@simpleworkjs/orm": "^0.2.8",
     "bcrypt": "^6.0.0",

nodejs/public/js/app.js

@@ -11,7 +11,8 @@ app.jump = (function(app){
 		var qs = $.param(query || {});
 		app.api.get('audit' + (qs ? '?' + qs : ''), cb);
 	}
-	return {metrics: metrics, sessions: sessions, audit: audit};
+	function hosts(cb){ app.api.get('user/hosts', cb); }
+	return {metrics: metrics, sessions: sessions, audit: audit, hosts: hosts};
 })(app);
 
 // Shared render helpers.

nodejs/public/lib/js/app-base.js

@@ -363,7 +363,7 @@ app.auth = (function(app){
 		}
 
 		if(requiredGroups && !await memberOf(requiredGroups, user)){
-			app.util.actionMessage(
+			app.messages.action(
 				`<h1>
 					<i class="fa-solid fa-triangle-exclamation"></i>
 					<b>You do not have permission to be here.</b>
@@ -520,68 +520,15 @@ app.util = (function(app){
 		return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));
 	};
 
-	function actionMessage(message, $targetPassed, type, callback){
-		message = message || '';
-
-		let $target = $targetPassed.closest('div.card').find('.actionMessage');
-		if(!$target.length) $target = $($targetPassed.find('.actionMessage')[0]);
-
-		type = type || 'info';
-		callback = callback || function(){};
-
-		if($target.html() === message) return;
-
-		if($target.html()){
-			$target.slideUp('fast', function(){
-				$target.html('')
-				$target.removeClass (function(index, className){
-					return (className.match (/(^|\s)bg-\S+/g) || []).join(' ');
-				});
-				if(message) return actionMessage(message, $target, type, callback);
-				$target.hide()
-			})
-		}else{
-			if(type) $target.addClass('bg-' + type);
-
-			// Messages that bring their own buttons (actionConfirm) are left
-			// alone; everything else gets the standard dismiss button.
-			if(!message.includes('<button')) message = `
-				<span class="align-middle">${message}</span>
-				<button class="action-close btn btn-sm btn-outline-dark float-end">
-					<i class="fa-solid fa-xmark"></i>
-				</button>
-			`
-			$target.html(message).slideDown('fast');
-		}
-		setTimeout(callback,10)
-	}
-
-	function actionConfirm(message, $target, type, callback){
-		return new Promise((resolve, reject) =>{
-			let id = crypto.randomUUID();
-			message = `
-				<h4 class"align-middle" >
-					<i class="fa-solid fa-triangle-exclamation"></i>
-					<b>${message}</b>
-					<span class="float-end">
-						<button type="button" class="btn btn-success confirm-${id}" data-confirm="true">
-							<i class="fa-solid fa-circle-check"></i>
-							Confirm
-						</button>
-						<button type="button" class="btn btn-danger confirm-${id}">
-							<i class="fa-solid fa-circle-stop"></i>
-							Cancel
-						</button>
-					</span>
-				</h4>
-			`
-			actionMessage(message, $target, type);
-			$("body").on('click', `.confirm-${id}`, function(){
-				actionMessage('', $target, type);
-				resolve(!!$(this).data('confirm'));
-			});
-		});
-
+	// escapeHtml/actionMessage/actionConfirm moved to @simpleworkjs/frontend's
+	// app.util.escapeHtml and app.messages.action/confirm.
+	function escapeHtml(s){
+		return String(s == null ? '' : s)
+			.replace(/&/g, '&amp;')
+			.replace(/</g, '&lt;')
+			.replace(/>/g, '&gt;')
+			.replace(/"/g, '&quot;')
+			.replace(/'/g, '&#39;');
 	}
 
 	$.fn.serializeObject = function() {
@@ -640,8 +587,7 @@ app.util = (function(app){
 	return {
 		downloadFile: downloadFile,
 		getUrlParameter: getUrlParameter,
-		actionMessage: actionMessage,
-		actionConfirm,
+		escapeHtml: escapeHtml,
 	}
 })(app);
 
@@ -696,9 +642,9 @@ $( document ).ready(async function(){
 		$(this).closest('.card').slideUp('fast');
 	});
 
-	$('.actionMessage').on('click', 'button.action-close', function(event){
-		app.util.actionMessage(null, $(this));
-	});
+	// action-close click handling is wired by @simpleworkjs/frontend's
+	// app.messages.js (delegated on document, so it also covers messages
+	// rendered after this ready handler runs).
 
 	setInterval(()=>{
 		$('.momentFromNow').each((idx, el)=>{
@@ -729,11 +675,11 @@ function formAJAX(btn){
 	var method = ($form.attr('method') || 'post').toLowerCase();
 
 	if($form.validate && !$form.validate()){
-		app.util.actionMessage('Please fix the form errors.', $form, 'danger')
+		app.messages.action('Please fix the form errors.', $form, 'danger')
 		return false;
 	}
 
-	app.util.actionMessage(
+	app.messages.action(
 		`<div class="spinner-border" role="status">
 			<span class="visually-hidden">Loading...</span>
 		</div>`,
@@ -742,7 +688,7 @@ function formAJAX(btn){
 	);
 
 	app.api[method]($form.attr('action'), formData, function(error, data){
-		app.util.actionMessage(data.message, $form, error ? 'danger' : 'success'); //re-populate table
+		app.messages.action(data.message, $form, error ? 'danger' : 'success'); //re-populate table
 		$form.validateClear();
 		if(!error){
 			$form.trigger("reset");
@@ -750,7 +696,7 @@ function formAJAX(btn){
 		}else{
 			console.log('formAJAX res error', error, data)
 			if(data && data.name === 'ObjectValidateError'){
-				app.util.actionMessage('Please fix the form errors', $form, 'danger'); //re-populate table
+				app.messages.action('Please fix the form errors', $form, 'danger'); //re-populate table
 			}
 			if(data && data.keys){
 				console.log('form key errors', data.keys)

nodejs/public/lib/js/val.js

@@ -1,201 +0,0 @@
-( function( $ ) {
-	var settings = {
-		rule: {
-			eq: function(value, options){
-				var compare = $('[name=' + options + ']').val();
-	 
-				if ( value != compare ) {
-					return "Miss-match";
-				}
-			}
-		},
-	};
-
-	$.fn.validate = function(event) {
-		// let	thisSettings = $.extend(true, settings, settingsObj);
-		let hasErrors = false;
-
-		if(this.is('[validate]')) return this.validateField(event);
-
-		if(!this.attr('isValid')){
-			console.log('adding reset event')
-			this.on('reset', function(){
-				$(this).attr('isValid', false);
-				$(this).validateClear();
-			})
-		}
-
-		this.find('[validate]').each(function(){
-			if(!$(this).validateField()) hasErrors = true;
-		});
-		
-		this.attr('isValid', !hasErrors);
-
-		if(hasErrors && event) event.preventDefault();
-
-		return !hasErrors;
-	};
-
-	$.fn.validateClear = function(){
-		$(this).find('input').each(function(){
-			$(this).removeClass('is-invalid');
-			$(this).removeClass('is-valid');
-		})
-	}
-
-	$.fn.validateField = function(){
-		var attr = this.attr('validate').split(':'); //array of params
-		var	rule = attr[0];
-		var	options = attr[1];
-		var	value = this.val(); //link to input value
-		var message;
-
-		if(this.prop('disabled')) return true;
-
-
-		//checks if field is required, and length 
-		if(!isNaN(options) && value.length < options){
-			message = `Must be ${options} characters`;
-		}
-
-		//checks if empty to stop processing 
-		if(!isNaN(options) && value.length === 0) {
-		}else if(rule in settings.rule){
-			message = settings.rule[rule].apply(this, [value, options]);
-		}
-
-		this.validateMessage(message)
-		return !message;
-	}
-
-	$.fn.validateMessage = function(message){
-		if(message && message !== true){
-			this.closest('.form-group').find('b.invalid-feedback').html(message);
-			this.addClass('is-invalid');
-		}else{
-			this.removeClass('is-invalid');
-			this.addClass('is-valid');
-		}
-		return this;
-	};
-
-	jQuery.extend({
-		validateSettings: function( settingsObj ) {
-			$.extend( true, settings, settingsObj );
-		},
-
-		validateInit: function( ettingsObj ) {
-			$( '[action]' ).on( 'submit', function ( event, settingsObj ){
-				$( this ).validate( settingsObj, event );
-			});
-		}
-	});
-
-}( jQuery ));
-
-// Host / target validation, mirrored from the backend (utils/hostname_validate.js):
-// a bare hostname or IPv4 address, no protocol / "/" / ":" / whitespace. The
-// incoming host may be a wildcard ("*.example.com"); the target may not.
-(function(){
-	var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
-	// Either one bare label (Docker service names, /etc/hosts entries) or a
-	// dotted hostname with an alphabetic TLD.
-	var HOSTNAME = /^(?=.{1,253}$)(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}|[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)$/i;
-	var FORBIDDEN = /[\s/:]/;
-
-	function isIPv4( value ) {
-		var parts = value.split( '.' );
-		if ( parts.length !== 4 ) return false;
-		return parts.every( function( p ) {
-			return /^(0|[1-9]\d{0,2})$/.test( p ) && Number( p ) <= 255;
-		});
-	}
-
-	// Incoming-host pattern: labels may be normal, "*" (one fragment), or "**"
-	// (any number of fragments, incl. a bare "**" global catch-all).
-	function isHostPattern( value ) {
-		if ( value.length > 253 ) return false;
-		return value.split( '.' ).every( function( l ) {
-			return l === '*' || l === '**' || LABEL.test( l );
-		});
-	}
-
-	function forbidden( value ) {
-		return FORBIDDEN.test( value ) || value.includes( '://' );
-	}
-
-	// Incoming host: IPv4 or a wildcard host pattern.
-	function checkHost( value ) {
-		if ( typeof value !== 'string' || value.length === 0 ) return "Required";
-		if ( forbidden( value ) ) return 'No protocol, "/", or ":"';
-		if ( isIPv4( value ) || isHostPattern( value ) ) return;
-		return "Enter a valid host or wildcard (*, **)";
-	}
-
-	// Downstream target: IPv4 or a strict hostname, no wildcard.
-	function checkTarget( value ) {
-		if ( typeof value !== 'string' || value.length === 0 ) return "Required";
-		if ( forbidden( value ) ) return 'No protocol, "/", or ":"';
-		if ( isIPv4( value ) || HOSTNAME.test( value ) ) return;
-		return "Enter a valid hostname or IP";
-	}
-
-	$.validateSettings({
-		rule:{
-			ip: function( value ) {
-				value = value.split( '.' );
-
-				if ( value.length != 4 ) {
-					return "Malformed IP";
-				}
-
-				$.each( value, function( key, value ) {
-					if( value > 255 || value < 0 ) {
-						return "Malformed IP";
-					}
-				});
-			},
-
-			// Incoming host name — hostname, IPv4, or wildcard pattern (*, **).
-			host: function( value ) {
-				return checkHost( value );
-			},
-
-			// Downstream target — hostname or IPv4, no wildcard.
-			target: function( value ) {
-				return checkTarget( value );
-			},
-
-			// Back-compat alias (no wildcard).
-			hostname: function( value ) {
-				return checkTarget( value );
-			},
-
-			user: function( value ) {
-				var reg = /^[a-z0-9\_\-\@\.]{1,32}$/;
-				if ( reg.test( value ) === false ) {
-					return "Invalid";
-				}
-			},
-
-			// Mirrors utils/password_policy.js: >= 8 chars, and either 12+ chars
-			// or at least 3 of {lowercase, uppercase, number, symbol}.
-			password: function( value ) {
-				if ( typeof value !== 'string' || value.length < 8 ) {
-					return "Password must be at least 8 characters";
-				}
-				if ( value.length >= 12 ) return;
-
-				var classes = 0;
-				if ( /[a-z]/.test( value ) ) classes++;
-				if ( /[A-Z]/.test( value ) ) classes++;
-				if ( /[0-9]/.test( value ) ) classes++;
-				if ( /[^A-Za-z0-9]/.test( value ) ) classes++;
-
-				if ( classes < 3 ) {
-					return "Use 3 of: lowercase, uppercase, number, symbol (or 12+ chars)";
-				}
-			}
-		}
-	});
-})();

nodejs/routes/render.js

@@ -21,7 +21,7 @@ const values = {
 // as the sibling apps), and the app's own JS/CSS/img from public/.
 mountStaticModules(router, {
 	root: path.join(__dirname, '..'),
-	deps: ['bootstrap', 'mustache', 'jquery', '@fortawesome', 'moment', 'jq-repeat'],
+	deps: ['bootstrap', 'mustache', 'jquery', '@fortawesome', 'moment', 'jq-repeat', '@simpleworkjs/frontend'],
 });
 
 // Liveness probe — no auth.

nodejs/routes/user.js

@@ -5,6 +5,7 @@
 
 const router = require('express').Router();
 const { isAdmin } = require('../middleware/auth');
+const access = require('../utils/access');
 
 router.get('/me', (req, res) => {
 	res.json({
@@ -14,4 +15,16 @@ router.get('/me', (req, res) => {
 	});
 });
 
+// The hosts this session can SSH to — every host for an admin, otherwise the
+// same group-based resolution the SSH front door uses (accessibleHosts),
+// fed the OIDC session's already-known groups instead of an LDAP lookup.
+router.get('/hosts', async (req, res, next) => {
+	try {
+		const hosts = isAdmin(req)
+			? await access.allHosts()
+			: await access.accessibleHosts({ uid: req.user && req.user.username, groups: req.groups || [] });
+		res.json({ results: hosts });
+	} catch (err) { next(err); }
+});
+
 module.exports = router;

nodejs/test/unit/access.test.js

@@ -2,7 +2,7 @@
 
 const { test } = require('node:test');
 const assert = require('node:assert');
-const { accessibleHosts, clearCache } = require('../../utils/access');
+const { accessibleHosts, allHosts, clearCache } = require('../../utils/access');
 
 function stubLdap(groups) {
 	return { getGroups: async () => groups };
@@ -54,6 +54,32 @@ test('caches per uid', async () => {
 	assert.strictEqual(calls, 1);
 });
 
+test('accepts pre-resolved groups (web UI/OIDC session) without calling ldap.getGroups', async () => {
+	clearCache();
+	let ldapCalled = false;
+	const user = { uid: 'erin', groups: ['host_web01_access'] };
+	const fetchImpl = stubFetch({
+		host_web01_access: [{ id: '5', kind: 'host', slug: 'host_web01' }],
+	});
+	const ldap = { getGroups: async () => { ldapCalled = true; return []; } };
+	const hosts = await accessibleHosts(user, { fetchImpl, ldap });
+	assert.deepStrictEqual(hosts.map((h) => h.id), ['5']);
+	assert.strictEqual(ldapCalled, false);
+});
+
+test('allHosts fetches the whole host inventory with no group filter', async () => {
+	const fetchImpl = async (url) => {
+		assert.ok(!url.includes('group='), 'must not filter by group');
+		assert.ok(url.includes('kind=host'));
+		return { ok: true, json: async () => ({ results: [
+			{ id: '1', kind: 'host', slug: 'host_a' },
+			{ id: '2', kind: 'host', slug: 'host_b' },
+		] }) };
+	};
+	const hosts = await allHosts({ fetchImpl });
+	assert.deepStrictEqual(hosts.map((h) => h.id).sort(), ['1', '2']);
+});
+
 test('a bare-array response (envelope drift) is treated as a failed group, not silently []', async () => {
 	clearCache();
 	const user = { uid: 'dave', dn: 'd' };

nodejs/utils/access.js

@@ -8,9 +8,10 @@
 const conf = require('@simpleworkjs/conf');
 
 if (conf.standalone && conf.standalone.enabled) {
-	// Standalone mode: use the ORM-backed host inventory.
+	// Standalone mode: use the ORM-backed host inventory. Every host is
+	// accessible to every user, so allHosts and accessibleHosts coincide.
 	const { accessibleHosts } = require('./hosts_file');
-	module.exports = { accessibleHosts, clearCache: () => {} };
+	module.exports = { accessibleHosts, allHosts: () => accessibleHosts(), clearCache: () => {} };
 } else {
 	// Production mode: LDAP groups + SSO API (unchanged).
 
@@ -48,11 +49,21 @@ if (conf.standalone && conf.standalone.enabled) {
 		return directoryClient({ fetchImpl }).getResourcesByGroup(group);
 	}
 
+	// Every host in the inventory, unfiltered — for admins (the web UI's own
+	// account is already gated by requireAdmin before this is ever called).
+	async function allHosts({ fetchImpl = fetch } = {}) {
+		const resources = await directoryClient({ fetchImpl }).getResourcesByGroup(undefined, { kind: 'host' });
+		return resources.filter(r => r.kind === 'host');
+	}
+
 	async function accessibleHosts(user, { fetchImpl = fetch, ldap = userLdap } = {}) {
 		const hit = cache.get(user.uid);
 		if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.hosts;
 
-		const groups = await ldap.getGroups(user.dn);
+		// The SSH path passes an LDAP user ({dn, uid, ...}) with no .groups, so we
+		// look them up; the web UI already has the session's OIDC groups claim
+		// and passes it directly, skipping a redundant LDAP round-trip.
+		const groups = user.groups || await ldap.getGroups(user.dn);
 
 		const seen = new Map();
 		for (const cn of groups) {
@@ -80,5 +91,5 @@ if (conf.standalone && conf.standalone.enabled) {
 		else cache.clear();
 	}
 
-	module.exports = { accessibleHosts, clearCache, fetchResourcesByGroup };
+	module.exports = { accessibleHosts, allHosts, clearCache, fetchResourcesByGroup };
 }

nodejs/views/dashboard.ejs

@@ -28,6 +28,15 @@
 	</div>
 </div>
 
+<div class="row g-3 mb-4">
+	<div class="col-12">
+		<div class="card shadow-sm">
+			<div class="card-header"><i class="fa-solid fa-network-wired me-1"></i> <span id="my-hosts-title">Hosts you can reach</span></div>
+			<table class="table table-sm mb-0"><tbody id="my-hosts"></tbody></table>
+		</div>
+	</div>
+</div>
+
 <div class="row g-3">
 	<div class="col-md-6">
 		<div class="card shadow-sm"><div class="card-header"><i class="fa-solid fa-server me-1"></i> Top hosts</div>
@@ -49,7 +58,17 @@
 			$b.append('<tr><td>' + app.jump.esc(x.name) + '</td><td class="text-end">' + x.count + '</td></tr>');
 		});
 	}
-	$(document).ready(function(){
+	function hostRows(sel, hosts){
+		var $b = $(sel).empty();
+		if(!hosts || !hosts.length){ $b.append('<tr><td class="text-muted">No hosts reachable.</td></tr>'); return; }
+		hosts.forEach(function(h){
+			var addr = (h.metadata && (h.metadata.ip || h.metadata.address)) || '';
+			$b.append('<tr><td>' + app.jump.esc(h.displayName || h.name || h.slug) + '</td>'
+				+ '<td class="text-muted small">' + app.jump.esc(h.slug) + '</td>'
+				+ '<td class="text-end text-muted small">' + app.jump.esc(addr) + '</td></tr>');
+		});
+	}
+	$(document).ready(async function(){
 		app.jump.metrics(function(error, data){
 			if(error || !data) return;
 			$('#stat-active').text(data.active);
@@ -59,6 +78,12 @@
 			rows('#top-hosts', data.topHosts);
 			rows('#top-users', data.topUsers);
 		});
+		await app.auth.loadUser();
+		if(app.auth.isAdmin()) $('#my-hosts-title').text('All hosts');
+		app.jump.hosts(function(error, data){
+			if(error) return hostRows('#my-hosts', []);
+			hostRows('#my-hosts', data && data.results);
+		});
 	});
 </script>
 <%- include('bottom') %>

nodejs/views/top.ejs

@@ -21,9 +21,11 @@
 		<script type="text/javascript" src="/static-modules/@fortawesome/fontawesome-free/js/all.min.js"></script>
 		<script type="text/javascript" src='/static-modules/mustache/mustache.min.js'></script>
 		<script type="text/javascript" src='/static-modules/jq-repeat/dist/js/jq-repeat.js'></script>
-		<script type="text/javascript" src='/static/lib/js/val.js'></script>
 		<script type="text/javascript" src="/static-modules/moment/moment.js"></script>
 		<script type="text/javascript" src="/static/lib/js/app-base.js"></script>
+		<script type="text/javascript" src="/static-modules/@simpleworkjs/frontend/lib/app.messages.js"></script>
+		<script type="text/javascript" src="/static-modules/@simpleworkjs/frontend/lib/app.modal.js"></script>
+		<script type="text/javascript" src="/static-modules/@simpleworkjs/frontend/lib/app.validate.js"></script>
 		<script type="text/javascript" src="/static/js/app.js"></script>
 	</head>
 	<body>