From e561ae7fd819a33b9410934abed4b3c76448a921 Mon Sep 17 00:00:00 2001 From: whit3rabbit Date: Fri, 27 Mar 2026 15:08:39 -0500 Subject: [PATCH 1/4] feat(admin-ui): replace localStorage+prompt with sessionStorage+login form Stops the admin token from persisting across browser sessions (XSS exfiltration window reduced) and replaces the phishable window.prompt with a proper password-masked login form. Token is validated against GET /admin/api/metrics before being stored; invalid tokens show an inline error message. URL query param token cleanup removed since that path no longer exists. Co-Authored-By: Claude Sonnet 4.6 --- crates/proxy/admin-ui/index.html | 55 +++++++++++++++++++++++++------- 1 file changed, 44 insertions(+), 11 deletions(-) diff --git a/crates/proxy/admin-ui/index.html b/crates/proxy/admin-ui/index.html index 58ca2db..a6e4d7c 100644 --- a/crates/proxy/admin-ui/index.html +++ b/crates/proxy/admin-ui/index.html @@ -52,9 +52,27 @@ input:focus,select:focus{outline:none;border-color:#4a9eff} .error{color:#f85149} .empty{text-align:center;padding:40px;color:#8b949e} .pagination{display:flex;gap:8px;margin-top:12px;align-items:center} +/* Login overlay */ +.login-overlay{position:fixed;top:0;left:0;width:100%;height:100%;background:#0d1117;display:flex;align-items:center;justify-content:center;z-index:1000} +.login-card{background:#161b22;border:1px solid #30363d;border-radius:8px;padding:32px;width:320px} +.login-title{font-size:18px;font-weight:600;margin-bottom:24px;text-align:center;color:#c9d1d9} +.login-card input[type="password"]{width:100%;padding:8px 12px;margin-bottom:12px;font-size:14px;background:#0d1117;border:1px solid #30363d;color:#c9d1d9;border-radius:4px} +.login-card input[type="password"]:focus{outline:none;border-color:#4a9eff} +.login-card .btn{width:100%;padding:10px;font-size:14px} +.login-error{color:#f85149;font-size:12px;margin-top:8px;min-height:16px} +
Dashboard
Request Log
@@ -122,18 +140,33 @@ input:focus,select:focus{outline:none;border-color:#4a9eff} (function() { 'use strict'; - var TOKEN = localStorage.getItem('admin_token'); + var TOKEN = sessionStorage.getItem('admin_token'); if (!TOKEN) { - TOKEN = prompt('Enter admin token:'); - if (TOKEN) { - localStorage.setItem('admin_token', TOKEN); - } - } - if (!TOKEN) { document.body.textContent = 'No token provided'; return; } - - // Clean URL just in case it was used previously - if (window.location.search.indexOf('token=') !== -1) { - window.history.replaceState({}, '', window.location.pathname); + // Show login overlay, hide main UI until authenticated. + document.getElementById('login-overlay').style.display = 'flex'; + document.querySelector('.nav').style.display = 'none'; + document.querySelectorAll('.tab').forEach(function(t) { t.style.display = 'none'; }); + + document.getElementById('login-form').addEventListener('submit', function(e) { + e.preventDefault(); + var candidate = document.getElementById('login-token').value.trim(); + var errEl = document.getElementById('login-error'); + if (!candidate) { errEl.textContent = 'Token is required.'; return; } + errEl.textContent = ''; + // Validate by hitting a known admin endpoint. + fetch('/admin/api/metrics', {headers: {'Authorization': 'Bearer ' + candidate}}) + .then(function(r) { + if (r.ok) { + sessionStorage.setItem('admin_token', candidate); + window.location.reload(); + } else { + errEl.textContent = 'Invalid token.'; + } + }) + .catch(function() { errEl.textContent = 'Request failed. Is the server running?'; }); + }); + document.getElementById('login-token').focus(); + return; } var API = '/admin/api'; From 85423b115dd7498c423bf4e85159b1472f4bb0c6 Mon Sep 17 00:00:00 2001 From: whit3rabbit Date: Fri, 27 Mar 2026 15:22:35 -0500 Subject: [PATCH 2/4] feat: split token columns and add feed pause/filter controls Split the single Tokens column into In/Out columns (7-column grid). Add pause button and status filter (2xx/4xx/5xx) to the live feed. Co-Authored-By: Claude Sonnet 4.6 --- crates/proxy/admin-ui/index.html | 506 ++++++++++++++++++++++++++++++- 1 file changed, 493 insertions(+), 13 deletions(-) diff --git a/crates/proxy/admin-ui/index.html b/crates/proxy/admin-ui/index.html index a6e4d7c..04137d5 100644 --- a/crates/proxy/admin-ui/index.html +++ b/crates/proxy/admin-ui/index.html @@ -27,10 +27,16 @@ a{color:#4a9eff;text-decoration:none} .card-body{margin-top:8px;color:#8b949e;font-size:12px} .section-label{color:#8b949e;font-size:11px;text-transform:uppercase;margin-bottom:8px;letter-spacing:0.5px} .feed{background:#161b22;border:1px solid #30363d;border-radius:6px;overflow:hidden;max-height:400px;overflow-y:auto} -.feed-header,.feed-row{display:grid;grid-template-columns:150px 60px 90px 100px 70px 70px;padding:6px 12px;font-size:12px} +.feed-header,.feed-row{display:grid;grid-template-columns:140px 50px 80px 1fr 65px 55px 55px;padding:6px 12px;font-size:12px} .feed-header{background:#1c2128;color:#8b949e;border-bottom:1px solid #30363d;position:sticky;top:0} -.feed-row{border-bottom:1px solid #21262d} +.feed-row{border-bottom:1px solid #21262d;cursor:pointer} .feed-row:last-child{border-bottom:none} +.feed-row:hover{background:#1c2128} +.feed-detail{padding:12px 16px;background:#0d1117;border-bottom:1px solid #21262d;font-size:12px;display:grid;grid-template-columns:120px 1fr;gap:4px 12px} +.feed-detail .label{color:#8b949e} +.feed-detail .val{color:#c9d1d9;font-family:monospace;word-break:break-all} +.feed-detail .error-msg{color:#f85149;grid-column:1/-1;margin-top:4px;padding:6px;background:rgba(248,81,73,0.1);border-radius:4px} +.streaming-badge{font-size:9px;padding:1px 4px;border-radius:2px;background:rgba(74,158,255,0.2);color:#4a9eff;margin-left:4px} .status-2xx{color:#3fb950}.status-4xx{color:#d29922}.status-5xx{color:#f85149} .form-group{margin-bottom:16px;padding:12px;background:#161b22;border:1px solid #30363d;border-radius:6px} .form-label{font-weight:600;margin-bottom:4px} @@ -60,6 +66,18 @@ input:focus,select:focus{outline:none;border-color:#4a9eff} .login-card input[type="password"]:focus{outline:none;border-color:#4a9eff} .login-card .btn{width:100%;padding:10px;font-size:14px} .login-error{color:#f85149;font-size:12px;margin-top:8px;min-height:16px} +/* Keys tab */ +.keys-grid{width:100%;border-collapse:collapse;font-size:12px} +.keys-grid th,.keys-grid td{padding:8px 10px;text-align:left;border-bottom:1px solid #21262d} +.keys-grid th{background:#1c2128;color:#8b949e;font-size:10px;text-transform:uppercase;letter-spacing:0.5px;position:sticky;top:0} +.keys-grid tr:hover td{background:#161b22} +.badge-active{background:rgba(63,185,80,0.2);color:#3fb950;font-size:10px;padding:2px 6px;border-radius:3px} +.badge-revoked{background:rgba(248,81,73,0.2);color:#f85149;font-size:10px;padding:2px 6px;border-radius:3px} +.badge-expired{background:rgba(210,153,34,0.2);color:#d29922;font-size:10px;padding:2px 6px;border-radius:3px} +.btn-danger{background:#da3633;border-color:#f85149;color:white} +.btn-sm{padding:3px 8px;font-size:11px;border-radius:4px} +.key-result{background:#0d1117;border:1px solid #3fb950;border-radius:6px;padding:12px;margin-bottom:12px;font-family:monospace;font-size:12px;word-break:break-all} +.key-result-label{color:#3fb950;font-size:11px;margin-bottom:4px;font-weight:600} @@ -78,6 +96,8 @@ input:focus,select:focus{outline:none;border-color:#4a9eff}
Request Log
Settings
Backends
+
Keys
+
Models
Disconnected
@@ -90,9 +110,15 @@ input:focus,select:focus{outline:none;border-color:#4a9eff}
Total Requests
0
-
Live Request Feed
+
+
Live Request Feed
+
+ + +
+
-
Time
Status
Backend
Model
Latency
Tokens
+
Time
Status
Backend
Model
Latency
In
Out
@@ -106,7 +132,7 @@ input:focus,select:focus{outline:none;border-color:#4a9eff}
-
Time
Status
Backend
Model
Latency
Tokens
+
Time
Status
Backend
Model
Latency
In
Out
+
+
+
Virtual API Keys
+ +
+ +
+
+
Loading...
+
+
+
+ +
+
+
Model Routing
+ +
+ +
+
+
+
Loading...
+
+
+
+