Skip to main content

alphaswarm-ui

The cloud-hosted, customer-facing operator dashboard. Auth-gated and multi-tenant; Auth0 (B2C) was the historic provider but the post-launcher-refactor surface is Entra-only — Auth0 has been purged from the SPA bundle.

The public marketing site is a sibling, separate repo — alphaswarm-website at alpha-swarm.ai.

Identity​

FieldValue
Service idalphaswarm-ui
Rolefrontend
Packagealphaswarm_ui/
Image (key)ui
Built from(not Dockerfile-based — typically Vercel / Cloudflare Pages SSR; AQPUI CR can also stand it up as a Deployment in a cluster)

Wire​

FieldValue
ProtocolHTTP/1.1 + WebSocket
Port80 (container) / 3000 (Next.js dev)
HealthGET /api/healthz
Public URLhttps://app.alpha-swarm.ai
IdentityMicrosoft Entra (B2B SSO via MsalEntraProvider); local dev-stub gated by ALPHASWARM_AUTH_DEV_STUB=true (hard-disabled in production builds)

Routes​

RoutePurpose
/login, /signup, /onboarding/*Provider-aware auth screens (Entra login + dev-stub)
/dashboard, /strategies, /paper-runs, /backtests, /data, /ml, /agents, /workflows, /labs, /analytics, /research, /portfolio, /settingsOperator dashboard
/api/auth/entra/login, /callback, /logout, /stepupBFF route handlers — proxy to alphaswarm-cp /auth/* (Phase 3)
/api/*Other BFF proxies (tenancy-scoped, kill-switch fan-out)

The marketing routes (/, /pricing, /docs, /legal, /about, /blog, /changelog) moved out to the alphaswarm_website repo as part of the controller-launcher refactor.

Deployment surfaces​

SurfaceWhere
Hosted (canonical)Cloudflare Pages or Vercel — pinned next >=14.2.25 for CVE-2025-29927
Cluster (option)AQPUI CR — Deployment + Service + Ingress
Identity provisioningalphaswarm_platform/terraform/modules/alphaswarm_ui_identity/

Dependencies​

Upstream (HTTP-only):

  • alphaswarm-cp (/auth/*, /manage/*) — every BFF route delegates here.
  • alphaswarm-core (/api/*) — for tenancy-scoped business calls the BFF routes proxy.

Downstream:

  • B2C and B2B users; multi-tenant via EntraTenantLink rows in the controller's database.

Operations​

  • Bundle pinning: next >=14.2.25 (CVE-2025-29927).
  • CSP: restricted to manage.alpha-swarm.ai and the controller's *.alpha-swarm.ai cell ingresses.
  • No client-side auth SDK: the SPA never reads an Entra token — only the BFF route handlers do.
  • Dev-stub: ALPHASWARM_AUTH_DEV_STUB=true writes a Local Dev User session inline; the scripts/ci/check_alphaswarm_ui_no_auth0.py guard fails on any new Auth0 reference.

See also​