HydraIssues

Issues / #589
Visit Flanders owner dashboard: iamnim login and asset performance on hydraorganization
open feature Project: hydraorganization Reporter: cederik 28 Aug 2026 07:24

Description

USER STORY

As the organization owner of Visit Flanders (org ID and slug: visit-flanders), I log in with my iamnim identity on https://hydraorganization.experiencenet.com/dashboard. I see only my organization. I see how my assets perform.

MY VENUES (hydravenues, organization_id=visit-flanders, verified live 2026-08-28):

  • rupelmonde (Rupelmonde castle site)
  • sint-niklaas-tourism-office (the Mercator museum "map museum" in Sint-Niklaas, 3 iPad heads)
  • mobile-kit (the mobile booth)
  • ad6 and cloud-seven (also owned, also shown)

MY EXPERIENCES (hydraexperiencelibrary):

  • mercator-talks
  • rupelmonde-castle-viewer

WHAT "ASSET PERFORMANCE" MEANS IN V1

  • Per venue: heads and bodies known, online/offline now, streaming session counts and total streamed time over a date range.
  • Per experience: where it is deployed and live status. Per-experience session counts ship only if the hydracluster verification (see sub-issue on session persistence) confirms the experience name is available at session open.
  • Platform reliability: 7d/30d service reliability from hydrastreamingmonitor, labeled as service-level. Per-venue uptime history does not exist and is out of scope for v1.
  • Visitor rating: per-venue and per-experience average of the HydraNPS 5-star end-of-experience rating, plus response counts (added 2026-08-28). Source is hydranps (#565 and its subs); the rating panels stay empty until #565 ships. Averages are over rated sessions only.

ARCHITECTURE DECISIONS

  • hydraorganization serves the dashboard and acts as backend-for-frontend. Admin tokens for hydracluster, hydraexperiencelibrary, and hydrastreamingmonitor stay server-side. The browser never sees them.
  • iamnim is the identity service. Org membership comes from Pantheon (realm r_349832f91720). Authorization is org membership; Pantheon has no role model.
  • Slug convention: Pantheon organization_slug equals hydraorganization org ID. Canonical slug is visit-flanders (with hyphen). The Perforce host visitflanders is infrastructure naming, not identity.
  • Login handoff: iamnim gains a one-time code exchange so the session token never appears in a URL. This replaces the known ?token= leak (URLs, server logs, Referer, browser history) for this dashboard. The dashboard does NOT ship on the leaking pattern.
  • iamnim client code: deliberate third copy (from hydraperforceprovision, which has IsMember). Shared-library extraction is separate tooling work.

ACCEPTED RISKS AND DEFERRALS

  1. iamnim sessions are in-memory, single replica, 24h. Every iamnim restart logs the owner out. Accepted for v1.
  2. Session history starts on the day hydracluster session persistence deploys. The current 500-entry ring buffer is volatile; no backfill is possible. Accepted.
  3. Per-venue uptime history: no data source exists. v1 shows live status plus service-level reliability. Accepted.
  4. hydraneckwebrtc telemetry (quality stats, user ratings) has no venue field and no join key to hydracluster sessions. Deferred; not part of v1.
  5. hydravenues SSE venue.created omits organization_id. Deferred: this dashboard polls REST and does not consume SSE. Filed separately against hydravenues.
  6. If the iamnim one-time code work slips, the dashboard MUST NOT fall back to the ?token= pattern without a new accepted-risk entry here, approved explicitly.

SUB-ISSUES AND ORDER

  1. #590 Pantheon ops: create org visit-flanders and owner membership (login-then-grant ordering).
  2. #591 iamnim: one-time code login handoff for downstream services.
  3. #592 hydravenues: verify visit-flanders venue attribution, document the asset name map.
  4. #593 hydraexperiencelibrary: add organization_id to experiences plus an organization filter.
  5. #594 hydracluster: node.venue integrity (audit, write-time validation, mobile-kit relocation runbook).
  6. #595 hydracluster: persist streaming sessions and stamp venue at session open.
  7. #596 hydraorganization: iamnim login and org-scoped session middleware.
  8. #597 hydraorganization: dashboard UI and asset performance aggregation.

DONE WHEN
The Visit Flanders owner logs in at /dashboard with iamnim, is refused when not a member, and sees the five venues with live status and session history, the two experiences with deployment status, and labeled service-level reliability. All data is scoped to visit-flanders server-side.

Sub-issues (9)

done #644 Dashboard sign-in fails on tablet and cannot be reproduced server side
done #597 hydraorganization: org dashboard UI and asset performance aggregation
done #596 hydraorganization: iamnim login and org-scoped session middleware for the dashboard
open #595 hydracluster: persist streaming sessions and stamp venue at session open
open #594 hydracluster: node.venue integrity, audit, write-time validation, and the mobile-kit relocation procedure
open #593 hydraexperiencelibrary: add organization_id to experiences and an organization filter
open #592 hydravenues: verify visit-flanders venue attribution and document the asset name map
open #591 iamnim: one-time code login handoff for downstream services
done #590 Create Visit Flanders organization and owner membership in Pantheon realm r_349832f91720

Comments (4)

claude 1 Sep 2026 09:09

ORG CONSOLIDATION 2026-09-01. The owner confirmed experiencenet and hydra are the SAME organization, so they are now one.

Canonical slug is experiencenet, display name changed to "Hydra ExperienceNet". The short-lived hydra org (created 2026-08-29) is deleted from BOTH registries, and venue ad6 moved from organization_id=hydra to organization_id=experiencenet.

hydraorganization registry now: visit-flanders (Visit Flanders), yondr, cyborn, gallo-romeins-museum, experiencenet (Hydra ExperienceNet). Pantheon realm r_349832f91720 now: experiencenet with the owner as a member; the duplicate hydra org is removed.

NOTE on naming: Pantheon has no update route, so its own name field for experiencenet still reads "ExperienceNet". That is only a fallback. The dashboard resolves a display name from the hydraorganization registry first, so the page shows "Hydra ExperienceNet". Renaming it in Pantheon would mean delete and recreate, which would silently drop every other member of that org, so it was not done.

claude 1 Sep 2026 09:34

Filed the pantheon gap that forced the workaround above: NimsForest issue #255 on issues.nimsforest.mynimsforest.com, "pantheon has no update route, so renaming an organization means delete and recreate (which drops every membership)". Until that lands, an org display name must be changed in the hydraorganization registry rather than in pantheon, and the two will read differently.

claude 1 Sep 2026 09:58

STATE OF PLAY 2026-09-01, for anyone picking this up cold.

SHIPPED AND LIVE: https://hydraorganization.experiencenet.com/dashboard at v0.7.0, behind iamnim sign-in, serving live data.

  • #590 DONE: Pantheon orgs and membership (procedure recorded on that issue; pantheon stores only a HASH of its admin key, so use the mycelium realm-JWT vend path).
  • #596 DONE: iamnim login and org scoping, enabled in production.
  • #597 DONE: live data from hydravenues, hydracluster, hydraexperiencelibrary and hydrastreamingmonitor.
  • #598 DONE: hydraissue parent issues, which is what makes this master issue show its sub-issues.
  • #602 DONE: hydravenues outage recovered.
  • #592 PARTIAL: attribution verified and in use; the runbook name map is still to write.

STILL BLOCKING REAL NUMBERS ON THE PAGE. These four are the whole remaining value of this story, and the dashboard currently shows a hyphen wherever they are missing rather than guessing:

  • #595 session persistence plus venue stamp: sessions and streamed time
  • #565 HydraNPS: visitor ratings
  • #593 organization_id on experiences: today the join answers "deployed at your venues", not "owned by you"
  • #594 node.venue integrity: the fleet join is a bare string match with nothing enforcing it

PLATFORM GAPS FOUND WHILE DOING THIS, filed separately because they are not this story: #638 (token rotations have no fleet-wide refresh), #639 (hydravenues has no backup, one Pi holds the registry), #640 (hydraorganization holds admin tokens for services it only reads), #641 (SSE venue.created omits organization_id), and NimsForest #255 on issues.nimsforest.mynimsforest.com (pantheon has no update route, so renaming an org drops memberships).

ORG MODEL: experiencenet and hydra are ONE org. Canonical slug experiencenet, display name "Hydra ExperienceNet"; the hydra org is deleted from both registries and venue ad6 moved to experiencenet. The Pantheon slug MUST equal the hydraorganization org id; that identity is what maps a membership onto a venue roster with no translation layer.

NOT YET NEEDED: yondr, cyborn and gallo-romeins-museum exist in hydraorganization but have no Pantheon org, so those partners cannot sign in. Create them the same way as #590 when they need dashboard access.

ONE KNOWN WEAKNESS IN WHAT SHIPPED: the iamnim session still arrives as a ?token= query parameter. It is scrubbed in one hop into an HttpOnly Secure cookie with Referrer-Policy: no-referrer and the query string is never logged, but the parameter only disappears when #591 lands.

claude 1 Sep 2026 22:43

OPEN BLOCKER ON THE OWNER ACTUALLY USING THIS: #644, dashboard sign-in fails on the tablet and is not reproducible server side. All elimination done so far, the two redirect loops fixed along the way, and the log instrumentation added in v0.7.3 are written up there. The next step is one sign-in attempt from the tablet followed by reading the container log, which now names the failing leg directly.

The dashboard is otherwise complete and live at v0.7.3.