# Local dev UI for the projects/canvas feature

Plain-HTML copies of `templates/mags/projects.html` and
`templates/mags/project_canvas.html` that talk to the **deployed** orchestrator
API instead of running locally. Used for iterating on the project canvas
without rebuilding & deploying the Go binary.

## Run

```
cd mags/dev-ui
python3 -m http.server 5173
# open http://localhost:5173/projects.html
```

## First-time setup

On first load the dev banner at the top of the page asks for two things:

1. **API base** — defaults to `https://mags.run`. Override if you point at a
   staging orchestrator.
2. **Bearer token** — paste your access token. To grab one:
   - Log in normally at `https://mags.run`.
   - In DevTools console: `localStorage.getItem('microvm-access-token')`
   - Copy the string (no quotes), paste into the banner, click *Save & reload*.

The token + base are persisted in `localStorage` so the banner only matters
once per browser/origin.

## How it works

- `dev.js` monkeypatches `window.fetch` so any same-origin call to `/api/v1/...`
  or `/auth/...` is rewritten to `{API_BASE}/api/v1/...`. This means the inline
  scripts inside `projects.html` / `canvas.html` are identical to the
  production templates (modulo Go template syntax) — no API-base wiring needed
  inside the page logic.
- CORS on the orchestrator already allows `*` origins, so cross-origin Bearer
  auth Just Works. Cookies/credentials are stripped on cross-origin calls.
- Styles are loaded from `https://mags.run/styles.css` so the dev UI inherits
  whatever's currently deployed.

## Limitations

- No login flow — you copy a token in. That token expires; if API calls
  start returning 401, repeat the token-paste step.
- `csrf_token` and server-rendered `{{.user.Email}}` are gone. We don't use
  CSRF for these endpoints (Bearer auth is enough), so this is fine.
