Lahiru Jayathilake created AIRAVATA-3976:
--------------------------------------------
Summary: SSH Signer Admin Portal & Allocation Management Dashboard
Key: AIRAVATA-3976
URL: https://issues.apache.org/jira/browse/AIRAVATA-3976
Project: Airavata
Issue Type: Task
Components: Airavata Allocation Manager, Custos Airavata Integration
Reporter: Lahiru Jayathilake
h3. Summary
Design and build the user-facing web interfaces for two core Custos components:
the SSH Certificate Signer admin portal and the Allocation Management
dashboard. This includes Figma design work (wireframes, mockups, design system)
followed by React/TypeScript implementation. The interfaces serve different
user roles (researchers, PIs, site administrators) and are backed by existing
Go REST APIs.
h3. Problem
Custos provides backend services for SSH certificate signing and compute
allocation management, but these services currently lack user-facing
interfaces. Site administrators managing SSH certificates need to interact
directly with APIs or the database. PIs and researchers have no portal to view
their allocations, track usage, or manage their projects. Site admins have no
dashboard to approve allocation requests or monitor system-wide activity.
Building these interfaces is essential for making Custos usable in production
HPC environments where non-technical users (researchers, PIs) need self-service
access and administrators need operational visibility.
h3. Description
This project covers *Figma design followed by React/TypeScript implementation*
for two connected web applications.
*Part 1: SSH Signer Admin Portal*
The signer service provides a Go REST API for issuing and managing short-lived
SSH certificates. This portal gives administrators and users visibility into
certificate operations:
* {*}Dashboard{*}: At-a-glance metrics showing certificates issued (today,
this week), active gateway clients, upcoming CA key rotations, recent
revocations
* {*}Client management{*}: Register new gateway clients, enable/disable them,
configure per-client policies (max certificate TTL, allowed key types, source
address restrictions, critical options)
* {*}Certificate browser{*}: Search and filter issued certificates by tenant,
principal, validity window, and revocation status. View certificate details
including the full audit trail (who requested it, when, from where).
* {*}CA key management{*}: View current and next CA key fingerprints, trigger
manual CA key rotation, view rotation history
* {*}Revocation management{*}: Revoke certificates by serial number, key ID,
or CA fingerprint. View revocation history with reasons.
* {*}User certificate view{*}: Authenticated users can see their own issued
certificates, validity periods, and status
*Part 2: Allocation Management Dashboard*
The allocation management system tracks compute credits from multiple sources
(ACCESS-CI, internal discretionary pools, and others in the future). The
hierarchy is: Projects contain Awards (approved credit grants), which contain
Allocations (resource-specific: CPU, GPU, storage). This dashboard surfaces
that data to different roles:
* {*}PI / Co-PI view{*}:
* List of their projects with current allocation balances (by resource type)
* Aggregated usage across all users in the project, broken down by user and
resource type (CPU hours, GPU hours)
* How much remains in each allocation
* History of allocation changes (grants, adjustments, expirations)
* Audit trail of user activity across the project (jobs submitted, resources
consumed)
* For internal awards: self-service allocation of credits from the award pool
to specific resource types (CPU, GPU, storage)
* {*}User view{*}:
* Their own usage within each project, broken down by resource type
* Overall allocation balance for the project (how much is left), but not
per-user breakdown of other users
* Their active SSH certificates and status
* {*}Site Admin view{*}:
* Everything across the entire site: all projects, all allocations, all usage,
all users
* Internal allocation requests pending approval, with approve/deny workflow
* Configuration details (allocation source connections, conversion rates,
enforcement status)
* System health and activity overview
* {*}Approval workflows{*}: Site admins can review, approve, or deny internal
allocation requests. PIs/Co-PIs can approve member requests for credit
transfers within their projects.
* {*}Allocation lifecycle visibility{*}: Show award states (Pending, Active,
Expired, Suspended, Depleted) and allocation states clearly, with timeline
views of grants, adjustments, and expirations.
*Design Process*
# Start with Figma wireframes and mockups for both portals
# Establish a shared design system / component library (buttons, tables,
forms, status badges, charts)
# Get design review and approval before moving to implementation
# Build in React/TypeScript with a component-based architecture
# Connect to the existing Go REST APIs
h3. Expected Deliverables
* Figma designs: wireframes and high-fidelity mockups for both the signer
admin portal and allocation management dashboard, covering all role-based views
* Shared design system / component library in Figma
* React/TypeScript implementation of the SSH signer admin portal (dashboard,
client management, certificate browser, CA management, revocation management)
* React/TypeScript implementation of the allocation management dashboard (PI
view, user view, site admin view, approval workflows)
* Connected to existing Go REST APIs with proper authentication handling
h3. Required Skills
* UI/UX design (Figma)
* React/TypeScript
* REST API integration
* Data visualization (charts, tables, timelines)
* Responsive web design
* Understanding of role-based access control concepts
h3. Resources
* {*}Custos repository{*}:
[github.com/apache/airavata-custos|https://github.com/apache/airavata-custos]
* {*}Signer service{*}: signer/ directory for the Go REST API that backs the
signer admin portal. Key endpoints: /api/v1/sign, /api/v1/revoke,
/api/v1/certificates, /api/v1/admin/rotate-ca, /api/v1/jwks, /api/v1/health
* {*}Allocation management{*}: allocations/ directory for the allocation
service architecture and data model
* {*}Allocation requirements document{*}: Available in the project repository,
covers the full data model (Projects, Awards, Allocations, Roles), role-based
visibility rules, approval workflows, and allocation lifecycle states
{*}ColdFront{*}: [https://coldfront.readthedocs.io/] (an existing open-source
allocation management UI for HPC, useful as design reference)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
