Per-user layout lives in the new app_user.prefs JSON column, read via
/v1/auth/me and written via PUT /v1/auth/me/prefs/workbench. The
workbench gets an in-place edit mode (gear -> drag to reorder, x to
remove, tray to add back, reset/done). Reset stores empty prefs so
registry changes still apply; ids of modules the user can't currently
see are kept on save.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Checkpoint before workbench facade redesign: list defaults, API key quota, toast portal, topology canvas editor toolbar with More menu, and trusted-proxy client IP for sessions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Persist only business events and mutating/failed HTTP calls, and default the audit UI to a business view with an explicit HTTP filter.
Co-authored-by: Cursor <cursoragent@cursor.com>
Filter add/layout/remove keeps MCP payloads small; tokens default MCP scopes and edit them in a modal with a compact help tip.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add capability RBAC, Alembic bootstrap, optional worker schedulers, and close public docs by default so lab installs stay usable without shared signing keys.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gate netx Web/API/WebCRT with JWT and per-user API tokens, bootstrap an admin with forced password change, and expose users/audit/API-key management under a System section. MCP can reuse data/auth/mcp_token without extra env for local labs.
Co-authored-by: Cursor <cursoragent@cursor.com>
