Orbit Dash
Your authorization control center. Orbit Dash is the server-rendered management interface where operators manage tenants, users, roles, permissions, and OAuth2 clients. Zero client-side JavaScript frameworks — just Bootstrap 5, HTMX, and your browser.
Key Capabilities
Server-Side Rendering
Every page is rendered on the server as complete HTML. HTMX handles dynamic interactions (modals, inline edits, live search) without a client-side framework.
Permission-Gated UI
Navigation tabs and actions render only if your session holds the required permission. No hidden routes, no client-side checks — the server decides.
OAuth2 Consent (CAS)
Orbit Dash doubles as the Central Authentication Service for Orbit's OAuth2 clients. It authenticates users, displays consent prompts, and signs consent payloads with Ed25519.
SDK-Only API Access
Orbit Dash never calls orbit-service directly. Every API interaction goes through @wrift/orbit-sdk, ensuring type safety and consistent error handling.
Route Structure
All tenant-scoped routes live under /t/:slug/. The middleware validates your session,
confirms membership in the target tenant, and attaches the user context and effective permissions.
| Route | Permission | Description |
|---|---|---|
/login | — | Sign in form |
/tenants | Session required | Tenant selection (card grid) |
/t/:slug/users | users.read | User management |
/t/:slug/roles | roles.read | Role management |
/t/:slug/permissions | permissions.read | Permission list (read-only) |
/t/:slug/api-keys | api-keys.read | API key management |
/t/:slug/audit | audit.read | Audit log viewer |
/t/:slug/sub-tenants | tenants.read | Sub-tenant management |
/t/:slug/feature-flags | feature-flags.read | Feature flag overrides |
/t/:slug/oauth2-clients | oauth2.read | OAuth2 client management |
/t/:slug/ca-overview | domains.read | Fleet-wide certificate expiry view across all domains |
/t/:slug/certificates | certificates.read | Tenant-wide certificate order roll-up across all domains, filterable by status |
/t/:slug/domains | domains.read | Domain inventory, CNAME verification, TLS expiry probes |
/t/:slug/domains/:hostname/certificates | certificates.read | Certificate order history, on-demand issuance and renewal for a domain |
/t/:slug/issuers | issuers.read | ACME/internal-CA issuer management, root CA download |
/t/:slug/activity | jobs.read | Read-only cert-module job queue (verify/probe/issue), filterable by status |
/t/:slug/secrets | secrets.read | Secret metadata, version history, escrow toggle. Values are never displayed, only leased by machine clients |
/t/:slug/access | Session required | Shows this session's effective permissions against every nav tab's gate |
System Tenant
When signed in to the system tenant, additional routes are available for global management:
all tenants, global feature flags, permission modules, and OAuth2 signing key rotation.
Session Model
- HttpOnly, SameSite=Strict cookie. No JWT, no client-side token storage.
- Two-step login: pre-tenant session (10-min TTL) → tenant selection → tenant-scoped session.
- If
auth.me()fails or times out, the middleware redirects to/login.