Merge pull request #212 from aojea/substrate

feat: implement OIDC PKCE redirect flow and deploy local Dex sandbox

Author: aojea

.github/k8s/sam-console-template.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sam-console-${ENV_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  ports:
+    - port: 8081
+      targetPort: 8081
+      protocol: TCP
+      name: http
+  selector:
+    app: sam-console-${ENV_NAME}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sam-console-${ENV_NAME}
+  namespace: ${NAMESPACE}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sam-console-${ENV_NAME}
+  template:
+    metadata:
+      labels:
+        app: sam-console-${ENV_NAME}
+    spec:
+      containers:
+      - name: sam-console
+        image: ${IMAGE_PREFIX}sam-console:${TAG}
+        imagePullPolicy: IfNotPresent
+        args:
+        - "--hub=http://sam-control-plane-${ENV_NAME}:8080"
+        - "--bind-addr=:8081"
+        - "--static-dir=/app/public"
+        - "--admin-token=$(SAM_ADMIN_TOKEN)"
+        env:
+        - name: SAM_ADMIN_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: sam-admin-token
+              key: token
+        ports:
+        - containerPort: 8081
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+          limits:
+            cpu: 100m
+            memory: 128Mi

Dockerfile.sam-console

@@ -0,0 +1,17 @@
+FROM golang:1.26.4-alpine AS builder
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 go build -o /bin/sam-console ./cmd/sam-console
+
+FROM gcr.io/distroless/static-debian12
+
+WORKDIR /app
+COPY --from=builder /bin/sam-console /usr/local/bin/sam-console
+COPY cmd/sam-console/public /app/public
+
+EXPOSE 8081
+ENTRYPOINT ["/usr/local/bin/sam-console"]

Makefile

@@ -31,6 +31,7 @@ build: $(OUT_DIR)/libinterceptor.so
 	go build -v -o "$(OUT_DIR)/mcp-client" ./cmd/mcp-client
 	go build -v -o "$(OUT_DIR)/nano-init" ./cmd/nano-init
 	go build -v -o "$(OUT_DIR)/sam-box" ./cmd/sam-box
+	go build -v -o "$(OUT_DIR)/sam-console" ./cmd/sam-console
 
 
 .PHONY: mobile-ffi-host mobile-ffi-android mobile-ffi-android-x86_64 mobile-ffi-ios mobile-ffi mobile-app-apk mobile-app-apk-emulator
@@ -182,6 +183,9 @@ docker-build-nano-init:
 docker-build-sam-box:
 	docker build --load -t sam-box:local -f Dockerfile.sam-box .
 
-docker-build: docker-build-control-plane docker-build-router docker-build-node docker-build-mock-oidc docker-build-e2e-runtime docker-build-nano-init docker-build-sam-box
+docker-build-sam-console:
+	docker build --load -t sam-console:local -f Dockerfile.sam-console .
 
-.PHONY: docker-build-control-plane docker-build-router docker-build-node docker-build-mock-oidc docker-build-e2e-runtime docker-build-nano-init docker-build-sam-box docker-build
+docker-build: docker-build-control-plane docker-build-router docker-build-node docker-build-mock-oidc docker-build-e2e-runtime docker-build-nano-init docker-build-sam-box docker-build-sam-console
+
+.PHONY: docker-build-control-plane docker-build-router docker-build-node docker-build-mock-oidc docker-build-e2e-runtime docker-build-nano-init docker-build-sam-box docker-build-sam-console docker-build

cmd/sam-console/main.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/google/sam/internal/console"
+)
+
+func main() {
+	var (
+		hubURL     = flag.String("hub", "http://localhost:8080", "URL of the SAM control plane")
+		adminToken = flag.String("admin-token", "", "Admin token for control plane authentication")
+		bindAddr   = flag.String("bind-addr", ":8081", "Address to bind the console server")
+		staticDir  = flag.String("static-dir", "public", "Directory containing static frontend files")
+	)
+	flag.Parse()
+
+	if *adminToken == "" {
+		log.Fatal("Admin token is required (via --admin-token)")
+	}
+
+	srv, err := console.NewServer(console.Config{
+		HubURL:     *hubURL,
+		AdminToken: *adminToken,
+		StaticDir:  *staticDir,
+	})
+	if err != nil {
+		log.Fatalf("Failed to initialize console server: %v", err)
+	}
+
+	httpSrv := &http.Server{
+		Addr:    *bindAddr,
+		Handler: srv.Handler(),
+	}
+
+	go func() {
+		log.Printf("SAM Console listening on %s", *bindAddr)
+		if err := httpSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatalf("Console server error: %v", err)
+		}
+	}()
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	<-ctx.Done()
+	log.Println("Shutting down console server...")
+
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := httpSrv.Shutdown(shutdownCtx); err != nil {
+		log.Fatalf("Server shutdown failed: %v", err)
+	}
+}