[
https://issues.apache.org/jira/browse/AIRAVATA-3976?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lahiru Jayathilake updated AIRAVATA-3976:
-----------------------------------------
Labels: gsoc gsoc2026 (was: )
> SSH Signer Admin Portal & Allocation Management Dashboard
> ---------------------------------------------------------
>
> Key: AIRAVATA-3976
> URL: https://issues.apache.org/jira/browse/AIRAVATA-3976
> Project: Airavata
> Issue Type: Task
> Components: Airavata Allocation Manager, Custos Airavata Integration
> Reporter: Lahiru Jayathilake
> Priority: Major
> Labels: gsoc, gsoc2026
>
> h3. Summary
> Design and build the user-facing web interfaces for two core Custos
> components: the SSH Certificate Signer admin portal and the Allocation
> Management dashboard. This includes Figma design work (wireframes, mockups,
> design system) followed by React/TypeScript implementation. The interfaces
> serve different user roles (researchers, PIs, site administrators) and are
> backed by existing Go REST APIs.
> h3. Problem
> Custos provides backend services for SSH certificate signing and compute
> allocation management, but these services currently lack user-facing
> interfaces. Site administrators managing SSH certificates need to interact
> directly with APIs or the database. PIs and researchers have no portal to
> view their allocations, track usage, or manage their projects. Site admins
> have no dashboard to approve allocation requests or monitor system-wide
> activity.
>
> Building these interfaces is essential for making Custos usable in production
> HPC environments where non-technical users (researchers, PIs) need
> self-service access and administrators need operational visibility.
> h3. Description
> This project covers *Figma design followed by React/TypeScript
> implementation* for two connected web applications.
>
> *Part 1: SSH Signer Admin Portal*
>
> The signer service provides a Go REST API for issuing and managing
> short-lived SSH certificates. This portal gives administrators and users
> visibility into certificate operations:
>
> * {*}Dashboard{*}: At-a-glance metrics showing certificates issued (today,
> this week), active gateway clients, upcoming CA key rotations, recent
> revocations
> * {*}Client management{*}: Register new gateway clients, enable/disable
> them, configure per-client policies (max certificate TTL, allowed key types,
> source address restrictions, critical options)
> * {*}Certificate browser{*}: Search and filter issued certificates by
> tenant, principal, validity window, and revocation status. View certificate
> details including the full audit trail (who requested it, when, from where).
> * {*}CA key management{*}: View current and next CA key fingerprints,
> trigger manual CA key rotation, view rotation history
> * {*}Revocation management{*}: Revoke certificates by serial number, key ID,
> or CA fingerprint. View revocation history with reasons.
> * {*}User certificate view{*}: Authenticated users can see their own issued
> certificates, validity periods, and status
>
> *Part 2: Allocation Management Dashboard*
>
> The allocation management system tracks compute credits from multiple sources
> (ACCESS-CI, internal discretionary pools, and others in the future). The
> hierarchy is: Projects contain Awards (approved credit grants), which contain
> Allocations (resource-specific: CPU, GPU, storage). This dashboard surfaces
> that data to different roles:
>
> * {*}PI / Co-PI view{*}:
>
> * List of their projects with current allocation balances (by resource type)
> * Aggregated usage across all users in the project, broken down by user and
> resource type (CPU hours, GPU hours)
> * How much remains in each allocation
> * History of allocation changes (grants, adjustments, expirations)
> * Audit trail of user activity across the project (jobs submitted, resources
> consumed)
> * For internal awards: self-service allocation of credits from the award
> pool to specific resource types (CPU, GPU, storage)
>
> * {*}User view{*}:
>
> * Their own usage within each project, broken down by resource type
> * Overall allocation balance for the project (how much is left), but not
> per-user breakdown of other users
> * Their active SSH certificates and status
>
> * {*}Site Admin view{*}:
>
> * Everything across the entire site: all projects, all allocations, all
> usage, all users
> * Internal allocation requests pending approval, with approve/deny workflow
> * Configuration details (allocation source connections, conversion rates,
> enforcement status)
> * System health and activity overview
>
> * {*}Approval workflows{*}: Site admins can review, approve, or deny
> internal allocation requests. PIs/Co-PIs can approve member requests for
> credit transfers within their projects.
>
> * {*}Allocation lifecycle visibility{*}: Show award states (Pending, Active,
> Expired, Suspended, Depleted) and allocation states clearly, with timeline
> views of grants, adjustments, and expirations.
>
> *Design Process*
>
> # Start with Figma wireframes and mockups for both portals
> # Establish a shared design system / component library (buttons, tables,
> forms, status badges, charts)
> # Get design review and approval before moving to implementation
> # Build in React/TypeScript with a component-based architecture
> # Connect to the existing Go REST APIs
> h3. Expected Deliverables
> * Figma designs: wireframes and high-fidelity mockups for both the signer
> admin portal and allocation management dashboard, covering all role-based
> views
> * Shared design system / component library in Figma
> * React/TypeScript implementation of the SSH signer admin portal (dashboard,
> client management, certificate browser, CA management, revocation management)
> * React/TypeScript implementation of the allocation management dashboard (PI
> view, user view, site admin view, approval workflows)
> * Connected to existing Go REST APIs with proper authentication handling
> h3. Required Skills
> * UI/UX design (Figma)
> * React/TypeScript
> * REST API integration
> * Data visualization (charts, tables, timelines)
> * Responsive web design
> * Understanding of role-based access control concepts
> h3. Resources
> * {*}Custos repository{*}:
> [github.com/apache/airavata-custos|https://github.com/apache/airavata-custos]
> * {*}Signer service{*}: signer/ directory for the Go REST API that backs the
> signer admin portal. Key endpoints: /api/v1/sign, /api/v1/revoke,
> /api/v1/certificates, /api/v1/admin/rotate-ca, /api/v1/jwks, /api/v1/health
> * {*}Allocation management{*}: allocations/ directory for the allocation
> service architecture and data model
> * {*}Allocation requirements document{*}: Available in the project
> repository, covers the full data model (Projects, Awards, Allocations,
> Roles), role-based visibility rules, approval workflows, and allocation
> lifecycle states
> {*}ColdFront{*}: [https://coldfront.readthedocs.io/] (an existing open-source
> allocation management UI for HPC, useful as design reference)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
