Work / Nexus / Changelog / Day 8
Day 8: A Settings Page That Does Not Leak the Token
Console Settings now shows runtime config, JWT claims without the raw token, and Gateway-probed service status. Property 17 keeps the bearer string off the page.
Day 8 is a Build day: the Settings route existed. The page said “Panel implementation pending.”
The brief is three things: config display, token info, service status. I kept the fourth thing off the page on purpose. The raw JWT never belongs in a SOC console settings panel.
What shipped
Config. Gateway URL, auth provider, auth endpoint, health poll interval, whether Vite dev-bypass is on, and how many services the runtime config knows about. No passwords. No JWT secret. Those live on the Gateway.
Token info. Subject, role, issued, expires, and a kind (jwt, placeholder, opaque, missing). dev-bypass-token is labeled as a placeholder, not decoded as a JWT. Sign out is on this page when bypass is off. With Vite bypass on, logout would immediately log you back in, so the button stays hidden.
Service status. Same health probe as Overview — Gateway /api/v1/health/:id — but as a table: name, id, status, latency, last checked, URL. Offline can mean the Gateway is down, not only the upstream.
AuthContext now keeps the token in React state so Settings can read claims after login. The request interceptor still uses a ref.
Tests
Property 17: for arbitrary tokens, the summary JSON never contains the raw bearer string or a JWT-shaped prefix. Valid HS256-shaped tokens round-trip sub, role, iat, and exp. decodeJwtClaims does not throw on garbage.
Five Console tests passed (badge counts plus these).
What I am not claiming
This is not a live compose click-through tonight. Vault is still the configured provider name; login is still the Gateway local JWT. Wazuh health will stay unknown or offline until the SOC baseline is up.
Next is Day 9: use the Console to watch a live Athena session. The Settings page is there to confirm which Gateway you are pointed at before that run.