Dashboard: Security Overview

Route: /security/overview (SecurityOverview.tsx)

What this screen is

A page header plus a single card that dumps the raw JSON response from GET /security/overview via syntax highlighting. There is no API-key list, no create/rotate/revoke UI, and no RBAC-matrix visualization on this screen — use the CLI (hoziron-cli auth) or the API (reference/api/auth.md, reference/api/security.md) for those.

What it actually shows

GET /security/overview is a console-surface-internal route (hoziron-console/src/routes.rs, distinct from the main API's GET /security/status) that calls the same platform.security_status() the API surface does. The JSON rendered is the same shape reference/api/security.md documents:

{
  "audit_enabled": true,
  "audit_entries": 1247,
  "auth_mode": "api-key",
  "tls_enabled": true
}

auth_mode is "none", "api-key", or "oidc".

RBAC in the console: display-only, not enforcement

The console's Shell.tsx / NavFooter.tsx fetch the current identity's role and display it as plain text next to the user's identity (e.g. viewer · Hoziron). There is no conditional rendering anywhere in the frontend keyed on role — no nav item, button, or route is hidden or disabled based on the caller's role. Enforcement is entirely server-side: a lower-privileged user sees every screen and control, and gets a 403 from the API when they try an action their role doesn't permit. The console does not pre-emptively hide what a viewer can't do — see reference/api/security.md for the actual role/permission matrix this maps to.

Related: