Sensor API answers other origins (token only); external demo page

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-19 08:49:59 -07:00
parent 0b0b2897cb
commit 65a9888784
4 changed files with 229 additions and 0 deletions
@@ -0,0 +1,17 @@
+# External demo
+
+`index.html` is a stranger's page: one file, no build, no framework, served from a
+different origin than Ham Lab. It knows a base URL and a read-only sensor token
+(`config.js`, not in git) and nothing else. Each tab is one shaped query POSTed to
+`/api/sensors/query?full=1` on an interval; sparklines are seeded from
+`/api/sensors/history`; the Fleet tab is one call to `/api/fleet/sensors/query`.
+
+```js
+// config.js
+window.HAMLAB = { base: 'http://10.0.0.234:8100', token: '<read-only sensor token>' }
+```
+
+Anyone who can load the page can read the token, so serve it only where that's acceptable
+(it can read sensors and nothing else). Deployed on `core` as the `hamlab-demo` stack —
+see Hamlet `docs/docker.md`. Update it with
+`cp examples/external-demo/index.html /home/core/apps/hamlab-demo/site/`.