Mitchell-JohnsonandClaude Fable 5.1
47b21a6eca
Access-Control-Allow-Origin arrived twice on /api/nodes/<m>/sensors, which a browser on another origin refuses. Also: demo lists say when the token hides them. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
External demo
index.html is a stranger's page: one file, no build, no framework, served from a
different origin than Ham Lab. It knows a base URL and a read-only sensor token
(config.js, not in git) and nothing else. Each tab is one shaped query POSTed to
/api/sensors/query?full=1 on an interval; sparklines are seeded from
/api/sensors/history; the Fleet tab is one call to /api/fleet/sensors/query.
// config.js
window.HAMLAB = { base: 'http://10.0.0.234:8100', token: '<read-only sensor token>' }
Anyone who can load the page can read the token, so serve it only where that's acceptable
(it can read sensors and nothing else). Deployed on core as the hamlab-demo stack —
see Hamlet docs/docker.md. Update it with
cp examples/external-demo/index.html /home/core/apps/hamlab-demo/site/.
To link it from the Widgets tab, set "demo_url": "http://…" in the hub's config.json
and restart Ham Lab.