03ff9a3813
The OIDC login flow now reads roles from the access_token (JWT) in addition to the id_token. This fixes role extraction with providers like Logto that put scopes/roles in access tokens rather than id_tokens. - Add audience and additionalScopes to OidcConfig for RFC 8707 resource indicator support and configurable extra scopes - OidcTokenExchanger decodes access_token with at+jwt-compatible processor, falls back to id_token if access_token is opaque or has no roles - syncOidcRoles preserves existing local roles when OIDC returns none - SPA includes resource and additionalScopes in authorization requests - Admin UI exposes new config fields Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Cameleer3 UI
React SPA built with @cameleer/design-system v0.1.28, TanStack Query, and Zustand.
Development
npm install
npm run dev
By default the dev server proxies /api/* to http://localhost:8081. To proxy to a remote server instead:
VITE_API_TARGET=http://192.168.50.86:30081 npm run dev
No CORS issues — Vite's proxy makes API calls server-side.
Build
npm run build
API Types
Regenerate TypeScript types from a running backend:
npm run generate-api # Requires backend running on :8081
Key Features
- Composable sidebar with accordion behavior (Applications / Starred / Admin sections)
- Context-aware cmd-k search: shows apps/routes/exchanges on operational pages, users/groups/roles on admin pages
- LIVE mode toggle: when ON, queries poll at intervals (5s-30s); when OFF, sidebar clicks trigger manual refresh
- Route control bar with state-aware buttons (start/stop/suspend/resume) and confirmation dialogs
- Event-type icons in agent timeline with severity-based coloring