Services Lab · Ops Console

Services Lab · Public demo

Secure Ops Console

A Next.js Backend-for-Frontend that shows how an authenticated ops UI can call a private lab API without exposing secrets, API URLs, or credentials to the browser.

How to sign inTrust boundary

Demo credentials are printed on the login guide — no account signup.

What this Next.js project does

It is not a commercial product. It is an engineering demonstration of a secure console pattern used in multi-tenant backends.

  1. Authenticates operators with a Server Action and an HttpOnly session cookie (JWE) — not localStorage tokens.
  2. Enforces RBAC in middleware so viewers cannot open operator-only pages (isolation, governance).
  3. Calls the reference API only on the server from React Server Components and Server Actions. The browser never sees LAB_API_BASE_URL.
  4. Surfaces lab capabilities — health probes, service catalogue, tenant-isolation vectors, and policy/SoD governance demos.

You will try

  • Health — live / ready probes
  • Service — capability catalogue
  • Isolation — tenant escape vectors (operator+)
  • Governance — policy + SoD demos (operator+)

You will not see

  • Database or Redis ports on the public internet
  • Raw lab API hostnames in browser DevTools
  • Java Transaction API on this public edge
  • Admin mutation tools (no public admin account)

Quick start for visitors

  1. 1
    Open the login guide

    Viewer and operator credentials are on one page.

  2. 2
    Sign in as operator (recommended)

    Username operator — unlocks Isolation and Governance. Use viewer to prove those pages are denied.

  3. 3
    Explore the console

    Health, Service, Isolation, Governance — role-gated. Admin cache mutate stays off this public edge.

Go to login guidebook