A portal session names a person, not whoever enrolled

Remote access used to collapse every portal session onto the account that
performed the enrolment. That was the only thing it could do while nothing
here knew who was at the other end, and it is why letting a second person
in meant handing them the first one's account.

`user.portal_sub` is where a portal identity meets a local one: set for the
enrolling superuser at enrolment, and for each person a superuser admits
afterwards through Settings -> Remote access -> Add remote user. The code
they type comes from the newcomer's own portal account, and it is redeemed
against the hub with this installation's tunnel credential rather than with
a portal session, so being let in is not itself the power to let others in.
The account created is never a superuser, which closes the same door from
this side.

A proxy token now resolves through that mapping and nowhere else. An
identity nobody mapped resolves to no user rather than falling back on the
enroller, so deleting the local row under Admin -> Users is the whole of
the revocation: it bites on a credential already in flight, and it does not
wait on the portal being reachable to be told. Telling the portal is best
effort for exactly that reason.

The cost is stated where it lands, in DEPLOY.md: an installation enrolled
before this has no mapping, so its owner reconnects once with a fresh code.
Panels and the health summary still act as the enrolling account - neither
of them is a person, and neither gained a way to name one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

frontend/src/client/schemas.gen.ts

@@ -2214,6 +2214,20 @@ export const RegisteredClientsSchema = {
     title: 'RegisteredClients'
 } as const;
 
+export const RemoteUserBodySchema = {
+    properties: {
+        code: {
+            type: 'string',
+            maxLength: 32,
+            minLength: 1,
+            title: 'Code'
+        }
+    },
+    type: 'object',
+    required: ['code'],
+    title: 'RemoteUserBody'
+} as const;
+
 export const RuleSchema = {
     properties: {
         events: {
@@ -2799,6 +2813,17 @@ export const UserPublicSchema = {
             format: 'uuid',
             title: 'Id'
         },
+        portal_sub: {
+            anyOf: [
+                {
+                    type: 'string'
+                },
+                {
+                    type: 'null'
+                }
+            ],
+            title: 'Portal Sub'
+        },
         created_at: {
             anyOf: [
                 {

frontend/src/client/sdk.gen.ts

@@ -3,7 +3,7 @@
 import type { CancelablePromise } from './core/CancelablePromise';
 import { OpenAPI } from './core/OpenAPI';
 import { request as __request } from './core/request';
-import type { AlertsReadAlertsConfigResponse, AlertsSaveAlertsConfigData, AlertsSaveAlertsConfigResponse, AlertsTestChannelData, AlertsTestChannelResponse, ArtifactsPutArtifactData, ArtifactsPutArtifactResponse, ArtifactsGetArtifactData, ArtifactsGetArtifactResponse, CloudReadStatusResponse, CloudEnrollData, CloudEnrollResponse, CloudDisconnectResponse, DashboardsReadDashboardsResponse, DashboardsReadDashboardData, DashboardsReadDashboardResponse, DashboardsCreateDashboardData, DashboardsCreateDashboardResponse, DashboardsSaveDashboardData, DashboardsSaveDashboardResponse, DashboardsDeleteDashboardData, DashboardsDeleteDashboardResponse, DashboardsPublishDashboardData, DashboardsPublishDashboardResponse, DashboardsDiscardDashboardDraftData, DashboardsDiscardDashboardDraftResponse, DashboardsRenameDashboardData, DashboardsRenameDashboardResponse, FlowsReadFlowsResponse, FlowsReadNodeTypesResponse, FlowsReadGraphResponse, FlowsReadLibraryResponse, FlowsDeleteSharedNodeData, FlowsDeleteSharedNodeResponse, FlowsReadFlowData, FlowsReadFlowResponse, FlowsSaveFlowData, FlowsSaveFlowResponse, FlowsDeleteFlowData, FlowsDeleteFlowResponse, FlowsPublishFlowData, FlowsPublishFlowResponse, FlowsDiscardDraftData, FlowsDiscardDraftResponse, FlowsRenameFlowData, FlowsRenameFlowResponse, FlowsReadNodeSourceData, FlowsReadNodeSourceResponse, FlowsSaveNodeSourceData, FlowsSaveNodeSourceResponse, FlowsShareNodeData, FlowsShareNodeResponse, FlowsUnshareNodeData, FlowsUnshareNodeResponse, FlowsStartFlowData, FlowsStartFlowResponse, FlowsStopFlowData, FlowsStopFlowResponse, FlowsPauseFlowData, FlowsPauseFlowResponse, FlowsResumeFlowData, FlowsResumeFlowResponse, FlowsStepFlowData, FlowsStepFlowResponse, FlowsValidateFlowData, FlowsValidateFlowResponse, FlowsRunFlowData, FlowsRunFlowResponse, FlowsTriggerNodeData, FlowsTriggerNodeResponse, FlowsCancelNodeData, FlowsCancelNodeResponse, FlowsReadFlowStateData, FlowsReadFlowStateResponse, FlowsReadMessageHistoryData, FlowsReadMessageHistoryResponse, LoginLoginAccessTokenData, LoginLoginAccessTokenResponse, LoginTestTokenResponse, LoginRecoverPasswordData, LoginRecoverPasswordResponse, LoginResetPasswordData, LoginResetPasswordResponse, LoginRecoverPasswordHtmlContentData, LoginRecoverPasswordHtmlContentResponse, MessagesReadMessagesResponse, MessagesPublishMessageData, MessagesPublishMessageResponse, MessagesReadMessageHistoryData, MessagesReadMessageHistoryResponse, ModulesReadModulesResponse, ModulesApplyModulesData, ModulesApplyModulesResponse, OauthRegisterClientData, OauthRegisterClientResponse, OauthAuthorizeValidateData, OauthAuthorizeValidateResponse, OauthAuthorizeData, OauthAuthorizeResponse, OauthTokenData, OauthTokenResponse, OauthReadClientsResponse, OauthRevokeClientData, OauthRevokeClientResponse, ObservabilityReadSummaryResponse, ObservabilityReadTimeseriesData, ObservabilityReadTimeseriesResponse, ObservabilityReadFlowRollupsData, ObservabilityReadFlowRollupsResponse, ObservabilityReadRunsData, ObservabilityReadRunsResponse, ObservabilityReadEventsData, ObservabilityReadEventsResponse, ObservabilityReadDeadLettersData, ObservabilityReadDeadLettersResponse, PanelsReadPanelsResponse, PanelsSavePanelsData, PanelsSavePanelsResponse, PanelsStartPairingResponse, PanelsPollPairingData, PanelsPollPairingResponse, PanelsPendingDeviceData, PanelsPendingDeviceResponse, PanelsApprovePairingData, PanelsApprovePairingResponse, PanelsReadPanelData, PanelsReadPanelResponse, PrivateCreateUserData, PrivateCreateUserResponse, RunsCreateRunData, RunsCreateRunResponse, RunsCreateSweepData, RunsCreateSweepResponse, RunsReadRunsData, RunsReadRunsResponse, RunsReadRunData, RunsReadRunResponse, RunsCancelRunData, RunsCancelRunResponse, RunsReadMetricsData, RunsReadMetricsResponse, RunsCompareMetricData, RunsCompareMetricResponse, SecretsReadSecretsResponse, SecretsSaveSecretData, SecretsSaveSecretResponse, SecretsDeleteSecretData, SecretsDeleteSecretResponse, UsersReadUsersData, UsersReadUsersResponse, UsersCreateUserData, UsersCreateUserResponse, UsersReadUserMeResponse, UsersDeleteUserMeResponse, UsersUpdateUserMeData, UsersUpdateUserMeResponse, UsersUpdatePasswordMeData, UsersUpdatePasswordMeResponse, UsersRegisterUserData, UsersRegisterUserResponse, UsersReadUserByIdData, UsersReadUserByIdResponse, UsersUpdateUserData, UsersUpdateUserResponse, UsersDeleteUserData, UsersDeleteUserResponse, UtilsTestEmailData, UtilsTestEmailResponse, UtilsHealthCheckResponse, UtilsHealthResponse, WorkersReadWorkersResponse, WorkersIssueTokenData, WorkersIssueTokenResponse, WorkersReadRuntimeResponse } from './types.gen';
+import type { AlertsReadAlertsConfigResponse, AlertsSaveAlertsConfigData, AlertsSaveAlertsConfigResponse, AlertsTestChannelData, AlertsTestChannelResponse, ArtifactsPutArtifactData, ArtifactsPutArtifactResponse, ArtifactsGetArtifactData, ArtifactsGetArtifactResponse, CloudReadStatusResponse, CloudEnrollData, CloudEnrollResponse, CloudAddRemoteUserData, CloudAddRemoteUserResponse, CloudDisconnectResponse, DashboardsReadDashboardsResponse, DashboardsReadDashboardData, DashboardsReadDashboardResponse, DashboardsCreateDashboardData, DashboardsCreateDashboardResponse, DashboardsSaveDashboardData, DashboardsSaveDashboardResponse, DashboardsDeleteDashboardData, DashboardsDeleteDashboardResponse, DashboardsPublishDashboardData, DashboardsPublishDashboardResponse, DashboardsDiscardDashboardDraftData, DashboardsDiscardDashboardDraftResponse, DashboardsRenameDashboardData, DashboardsRenameDashboardResponse, FlowsReadFlowsResponse, FlowsReadNodeTypesResponse, FlowsReadGraphResponse, FlowsReadLibraryResponse, FlowsDeleteSharedNodeData, FlowsDeleteSharedNodeResponse, FlowsReadFlowData, FlowsReadFlowResponse, FlowsSaveFlowData, FlowsSaveFlowResponse, FlowsDeleteFlowData, FlowsDeleteFlowResponse, FlowsPublishFlowData, FlowsPublishFlowResponse, FlowsDiscardDraftData, FlowsDiscardDraftResponse, FlowsRenameFlowData, FlowsRenameFlowResponse, FlowsReadNodeSourceData, FlowsReadNodeSourceResponse, FlowsSaveNodeSourceData, FlowsSaveNodeSourceResponse, FlowsShareNodeData, FlowsShareNodeResponse, FlowsUnshareNodeData, FlowsUnshareNodeResponse, FlowsStartFlowData, FlowsStartFlowResponse, FlowsStopFlowData, FlowsStopFlowResponse, FlowsPauseFlowData, FlowsPauseFlowResponse, FlowsResumeFlowData, FlowsResumeFlowResponse, FlowsStepFlowData, FlowsStepFlowResponse, FlowsValidateFlowData, FlowsValidateFlowResponse, FlowsRunFlowData, FlowsRunFlowResponse, FlowsTriggerNodeData, FlowsTriggerNodeResponse, FlowsCancelNodeData, FlowsCancelNodeResponse, FlowsReadFlowStateData, FlowsReadFlowStateResponse, FlowsReadMessageHistoryData, FlowsReadMessageHistoryResponse, LoginLoginAccessTokenData, LoginLoginAccessTokenResponse, LoginTestTokenResponse, LoginRecoverPasswordData, LoginRecoverPasswordResponse, LoginResetPasswordData, LoginResetPasswordResponse, LoginRecoverPasswordHtmlContentData, LoginRecoverPasswordHtmlContentResponse, MessagesReadMessagesResponse, MessagesPublishMessageData, MessagesPublishMessageResponse, MessagesReadMessageHistoryData, MessagesReadMessageHistoryResponse, ModulesReadModulesResponse, ModulesApplyModulesData, ModulesApplyModulesResponse, OauthRegisterClientData, OauthRegisterClientResponse, OauthAuthorizeValidateData, OauthAuthorizeValidateResponse, OauthAuthorizeData, OauthAuthorizeResponse, OauthTokenData, OauthTokenResponse, OauthReadClientsResponse, OauthRevokeClientData, OauthRevokeClientResponse, ObservabilityReadSummaryResponse, ObservabilityReadTimeseriesData, ObservabilityReadTimeseriesResponse, ObservabilityReadFlowRollupsData, ObservabilityReadFlowRollupsResponse, ObservabilityReadRunsData, ObservabilityReadRunsResponse, ObservabilityReadEventsData, ObservabilityReadEventsResponse, ObservabilityReadDeadLettersData, ObservabilityReadDeadLettersResponse, PanelsReadPanelsResponse, PanelsSavePanelsData, PanelsSavePanelsResponse, PanelsStartPairingResponse, PanelsPollPairingData, PanelsPollPairingResponse, PanelsPendingDeviceData, PanelsPendingDeviceResponse, PanelsApprovePairingData, PanelsApprovePairingResponse, PanelsReadPanelData, PanelsReadPanelResponse, PrivateCreateUserData, PrivateCreateUserResponse, RunsCreateRunData, RunsCreateRunResponse, RunsCreateSweepData, RunsCreateSweepResponse, RunsReadRunsData, RunsReadRunsResponse, RunsReadRunData, RunsReadRunResponse, RunsCancelRunData, RunsCancelRunResponse, RunsReadMetricsData, RunsReadMetricsResponse, RunsCompareMetricData, RunsCompareMetricResponse, SecretsReadSecretsResponse, SecretsSaveSecretData, SecretsSaveSecretResponse, SecretsDeleteSecretData, SecretsDeleteSecretResponse, UsersReadUsersData, UsersReadUsersResponse, UsersCreateUserData, UsersCreateUserResponse, UsersReadUserMeResponse, UsersDeleteUserMeResponse, UsersUpdateUserMeData, UsersUpdateUserMeResponse, UsersUpdatePasswordMeData, UsersUpdatePasswordMeResponse, UsersRegisterUserData, UsersRegisterUserResponse, UsersReadUserByIdData, UsersReadUserByIdResponse, UsersUpdateUserData, UsersUpdateUserResponse, UsersDeleteUserData, UsersDeleteUserResponse, UtilsTestEmailData, UtilsTestEmailResponse, UtilsHealthCheckResponse, UtilsHealthResponse, WorkersReadWorkersResponse, WorkersIssueTokenData, WorkersIssueTokenResponse, WorkersReadRuntimeResponse } from './types.gen';
 
 export class AlertsService {
     /**
@@ -128,8 +128,10 @@ export class CloudService {
      * Enroll
      * Redeem a claim code and start dialling the portal.
      *
-     * The account performing this is recorded as the one every portal session
-     * will act as. There is no way to widen that later from the portal side.
+     * The account performing this is mapped to the portal account that owns the
+     * installation, so the owner's portal sessions arrive here as them. Widening
+     * that to anyone else is a local decision made one person at a time, below —
+     * never something the portal can do from its side.
      * @param data The data for the request.
      * @param data.requestBody
      * @returns Message Successful Response
@@ -147,6 +149,32 @@ export class CloudService {
         });
     }
     
+    /**
+     * Add Remote User
+     * Admit a portal account, and give it a local user of its own.
+     *
+     * The point of the local user is that it is ordinary: a remote person shows
+     * up in Admin → Users like everyone else, holds no superuser flag, and is
+     * removed by deleting them there. They have no password because they never
+     * sign in here — the portal vouches for them, and this row is what says which
+     * of our accounts that vouching amounts to.
+     * @param data The data for the request.
+     * @param data.requestBody
+     * @returns UserPublic Successful Response
+     * @throws ApiError
+     */
+    public static addRemoteUser(data: CloudAddRemoteUserData): CancelablePromise<CloudAddRemoteUserResponse> {
+        return __request(OpenAPI, {
+            method: 'POST',
+            url: '/api/v1/cloud/users',
+            body: data.requestBody,
+            mediaType: 'application/json',
+            errors: {
+                422: 'Validation Error'
+            }
+        });
+    }
+    
     /**
      * Disconnect
      * Sever the connection from this side.

frontend/src/client/types.gen.ts

@@ -801,6 +801,10 @@ export type RegisteredClients = {
     count: number;
 };
 
+export type RemoteUserBody = {
+    code: string;
+};
+
 /**
  * Which events go to which channels.
  */
@@ -964,6 +968,7 @@ export type UserPublic = {
     is_superuser?: boolean;
     full_name?: (string | null);
     id: string;
+    portal_sub?: (string | null);
     created_at?: (string | null);
 };
 
@@ -1092,6 +1097,12 @@ export type CloudEnrollData = {
 
 export type CloudEnrollResponse = (Message);
 
+export type CloudAddRemoteUserData = {
+    requestBody: RemoteUserBody;
+};
+
+export type CloudAddRemoteUserResponse = (UserPublic);
+
 export type CloudDisconnectResponse = (Message);
 
 export type DashboardsReadDashboardsResponse = (DashboardsPublic);

frontend/src/components/Admin/columns.tsx

@@ -35,7 +35,16 @@ export const columns: ColumnDef<UserTableData>[] = [
     accessorKey: "email",
     header: "Email",
     cell: ({ row }) => (
-      <span className="text-muted-foreground">{row.original.email}</span>
+      <div className="flex items-center gap-2">
+        <span className="text-muted-foreground">{row.original.email}</span>
+        {/* Signs in through the portal, never here — worth saying, because
+            deleting this row is what ends their remote access. */}
+        {row.original.portal_sub && (
+          <Badge variant="outline" className="text-xs">
+            Portal
+          </Badge>
+        )}
+      </div>
     ),
   },
   {

frontend/src/components/UserSettings/RemoteAccess.tsx

@@ -29,17 +29,21 @@ type CloudStatus = {
 }
 
 /**
- * Connecting this installation to a Fluksio portal, or cutting it loose.
+ * Connecting this installation to a Fluksio portal, or cutting it loose, and
+ * admitting other portal accounts to it.
  *
- * Deliberately blunt about what it grants: a remote session acts as the
- * account that enrolled, and this screen says which one. Everything here is
- * optional — an installation nobody enrolls never contacts anything.
+ * Deliberately blunt about what it grants: the account that enrolled is what
+ * the portal owner's sessions act as, and this screen says which one. Anyone
+ * else gets in only by being added here, as a local user of their own.
+ * Everything here is optional — an installation nobody enrolls never contacts
+ * anything.
  */
 export function RemoteAccess() {
   const queryClient = useQueryClient()
   const { showErrorToast, showSuccessToast } = useCustomToast()
   const [portalUrl, setPortalUrl] = useState(DEFAULT_PORTAL)
   const [code, setCode] = useState("")
+  const [joinCode, setJoinCode] = useState("")
   const [confirmDisconnect, setConfirmDisconnect] = useState(false)
 
   const { data: status } = useQuery<CloudStatus>({
@@ -67,6 +71,18 @@ export function RemoteAccess() {
     onError: handleError.bind(showErrorToast),
   })
 
+  const addRemoteUser = useMutation({
+    mutationFn: () =>
+      CloudService.addRemoteUser({ requestBody: { code: joinCode.trim() } }),
+    onSuccess: (user) => {
+      setJoinCode("")
+      showSuccessToast(`Added ${user.email}`)
+      // They are an ordinary user from here on, and the Admin page lists them.
+      queryClient.invalidateQueries({ queryKey: ["users"] })
+    },
+    onError: handleError.bind(showErrorToast),
+  })
+
   const disconnect = useMutation({
     mutationFn: () => CloudService.disconnect(),
     onSuccess: () => {
@@ -90,39 +106,80 @@ export function RemoteAccess() {
       </div>
 
       {status.enrolled ? (
-        <div className="flex flex-col gap-4 rounded-lg border border-border p-4">
-          <dl className="grid gap-3 sm:grid-cols-2">
-            <Field label="Status">
-              {status.connected
-                ? "Connected"
-                : status.last_error
-                  ? `Reconnecting — ${status.last_error}`
-                  : "Reconnecting…"}
-            </Field>
-            <Field label="Portal">{status.portal_url ?? "—"}</Field>
-            <Field label="Acting as">
-              {status.portal_account ?? "—"}
-              <span className="mt-1 block text-xs text-muted-foreground">
-                Anyone signed in to the portal for this installation gets this
-                account's rights here.
-              </span>
-            </Field>
-            <Field label="Installation">
-              <span className="font-mono text-xs">
-                {status.installation_id ?? "—"}
-              </span>
-            </Field>
-          </dl>
-          <div>
-            <Button
-              variant="destructive"
-              className="rounded-full"
-              onClick={() => setConfirmDisconnect(true)}
-            >
-              Disconnect
-            </Button>
+        <>
+          <div className="flex flex-col gap-4 rounded-lg border border-border p-4">
+            <dl className="grid gap-3 sm:grid-cols-2">
+              <Field label="Status">
+                {status.connected
+                  ? "Connected"
+                  : status.last_error
+                    ? `Reconnecting — ${status.last_error}`
+                    : "Reconnecting…"}
+              </Field>
+              <Field label="Portal">{status.portal_url ?? "—"}</Field>
+              <Field label="Acting as">
+                {status.portal_account ?? "—"}
+                <span className="mt-1 block text-xs text-muted-foreground">
+                  Portal sessions of this account get this account's rights
+                  here. Anyone else gets in only once added below, as their own
+                  user.
+                </span>
+              </Field>
+              <Field label="Installation">
+                <span className="font-mono text-xs">
+                  {status.installation_id ?? "—"}
+                </span>
+              </Field>
+            </dl>
+            <div>
+              <Button
+                variant="destructive"
+                className="rounded-full"
+                onClick={() => setConfirmDisconnect(true)}
+              >
+                Disconnect
+              </Button>
+            </div>
           </div>
-        </div>
+
+          <div className="flex flex-col gap-4 rounded-lg border border-border p-4">
+            <div>
+              <h3 className="font-medium">Remote users</h3>
+              <p className="text-sm text-muted-foreground">
+                Let someone else reach this installation through the portal.
+                They get a user of their own here — not yours, and never a
+                superuser, so they cannot pass access on.
+              </p>
+            </div>
+            <div className="grid gap-2">
+              <Label htmlFor="join-code">Code</Label>
+              <Input
+                id="join-code"
+                value={joinCode}
+                placeholder="XXXX-XXXX"
+                className="font-mono tracking-widest"
+                onChange={(event) =>
+                  setJoinCode(event.target.value.toUpperCase())
+                }
+              />
+              <p className="text-xs text-muted-foreground">
+                They get a code at fluksio.com → Installations → Join an
+                installation. Added users appear under Admin → Users; deleting
+                them there ends their access.
+              </p>
+            </div>
+            <div>
+              <Button
+                className="rounded-full"
+                variant="outline"
+                disabled={!joinCode.trim() || addRemoteUser.isPending}
+                onClick={() => addRemoteUser.mutate()}
+              >
+                {addRemoteUser.isPending ? "Adding…" : "Add remote user"}
+              </Button>
+            </div>
+          </div>
+        </>
       ) : (
         <div className="flex flex-col gap-4 rounded-lg border border-border p-4">
           <div className="grid gap-2">