feat: super admin sees all machines across every account

sankara@reddy.sh is the super admin. The overview endpoint returns
machines from every account (via a table scan) and includes the owner
sub on each row so the portal can pass it back for rename/revoke/remove
actions. Normal users are unaffected — they still see only their own
machines.

- Add listAllMachines() scan to store.ts
- Add SUPER_ADMINS set and isSuperAdmin() check in handler.ts
- overview() uses listAllMachines for super admins, includes owner field
- machineAction() accepts owner param for cross-account actions
- Portal.jsx passes owner on rename/revoke/remove when present

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: reddy-sh

amplify/functions/api/handler.ts

@@ -38,7 +38,7 @@ import { liveness, mergeEntries, profileOf } from '../../../shared/profile.mjs';
 import { cached, fail, json, preflight, type Cors } from './http';
 import { callerOf, type Caller } from './jwt';
 import {
-  diffEndings, hashesEqual, isStale, newSecret, packSnapshot, previousOf, sha256Hex, unpackSnapshot,
+    diffEndings, hashesEqual, isStale, newSecret, packSnapshot, previousOf, sha256Hex, unpackSnapshot,
 } from './protocol';
 import * as store from './store';
 
@@ -59,6 +59,13 @@ const BOARD_CACHE_SECONDS = 60;
 // failure than a board that says a machine's detail did not fit.
 const OVERVIEW_SNAPSHOT_BUDGET = 4 * 1024 * 1024;
 
+// Super admins see every machine on every account. Keep this a compile-time
+// constant so it is never wider than what the code reviews say it is.
+const SUPER_ADMINS = new Set([
+  'sankara@reddy.sh',
+]);
+const isSuperAdmin = (c: Caller) => SUPER_ADMINS.has(c.email ?? '');
+
 /* ── the event ──────────────────────────────────────────────────────── */
 
 function rawBody(event: LambdaFunctionURLEvent): Buffer | null {
@@ -401,7 +408,10 @@ function publicMachine(m: Record<string, any>) {
 }
 
 async function overview(caller: Caller, event: LambdaFunctionURLEvent, cors: Cors) {
-  const rows = await store.listMachines(caller.sub);
+  const admin = isSuperAdmin(caller);
+  const rows = admin
+    ? await store.listAllMachines()
+    : await store.listMachines(caller.sub);
   rows.sort((a, b) => ((a.createdAt ?? '') < (b.createdAt ?? '') ? 1 : -1));
 
   // `?live=0` asks for the rows without the readings — a much smaller answer,
@@ -426,6 +436,8 @@ async function overview(caller: Caller, event: LambdaFunctionURLEvent, cors: Cor
 
   const machines = rows.map((m) => ({
     ...publicMachine(m),
+    // Super admin sees which account owns each machine.
+    ...(admin ? { owner: m.sub } : {}),
     snapshot: byId.get(m.id) ?? null,
     // Says which of the two reasons a reading is missing: the caller did not
     // ask for it, or it did not fit. A board that cannot tell them apart shows
@@ -436,7 +448,7 @@ async function overview(caller: Caller, event: LambdaFunctionURLEvent, cors: Cor
   return json(200, {
     generatedAt: new Date().toISOString(),
     machines,
-    account: { publicId: publicIdOf(caller.sub), email: caller.email },
+    account: { publicId: publicIdOf(caller.sub), email: caller.email, superAdmin: admin },
   }, cors);
 }
 
@@ -453,16 +465,21 @@ async function machineAction(
   const id = str(req?.id, 64);
   if (!id) return fail(400, 'id is required', cors);
 
-  const m = await store.getMachine(caller.sub, id);
+  // Super admins pass the owner's sub so the action reaches the right
+  // partition. Normal callers always act on their own machines.
+  const admin = isSuperAdmin(caller);
+  const ownerSub = admin && typeof req?.owner === 'string' ? req.owner : caller.sub;
+
+  const m = await store.getMachine(ownerSub, id);
   if (!m) return fail(404, 'no such machine on this account', cors);
 
   if (path === '/api/v1/machines/rename') {
     const label = str(req?.label, 120).trim();
     if (!label) return fail(400, 'a machine needs a name', cors);
-    const taken = (await store.listMachines(caller.sub))
+    const taken = (await store.listMachines(ownerSub))
       .some((other) => other.id !== id && other.label === label);
     if (taken) return fail(409, 'another machine on this board already has that name', cors);
-    await store.updateMachine(caller.sub, id, { label });
+    await store.updateMachine(ownerSub, id, { label });
     return json(200, { ok: true, label }, cors);
   }
 
@@ -471,7 +488,7 @@ async function machineAction(
     // 401 and it stops rather than buffering. The pointers go too, so nothing
     // can resolve to this machine on the strength of a credential it no longer
     // has.
-    await store.updateMachine(caller.sub, id, {
+    await store.updateMachine(ownerSub, id, {
       status: 'revoked',
       keyHash: null,
       enrollTokenHash: null,
@@ -481,16 +498,16 @@ async function machineAction(
     if (m.keyHash) await store.dropKeyPointer(m.keyHash);
     if (m.enrollTokenHash) await store.dropTokenPointer(m.enrollTokenHash);
     await store.dropLive(id);
-    await rebuildAggregate(caller.sub, new Date().toISOString());
+    await rebuildAggregate(ownerSub, new Date().toISOString());
     return json(200, { ok: true }, cors);
   }
 
   if (path === '/api/v1/machines/remove') {
     if (m.keyHash) await store.dropKeyPointer(m.keyHash);
     if (m.enrollTokenHash) await store.dropTokenPointer(m.enrollTokenHash);
     await store.dropLive(id);
-    await store.deleteMachine(caller.sub, id);
-    await rebuildAggregate(caller.sub, new Date().toISOString());
+    await store.deleteMachine(ownerSub, id);
+    await rebuildAggregate(ownerSub, new Date().toISOString());
     return json(200, { ok: true }, cors);
   }
 

amplify/functions/api/store.ts

@@ -32,7 +32,7 @@ import {
     GetCommand,
     PutCommand,
     QueryCommand,
-    UpdateCommand,
+    UpdateCommand
 } from '@aws-sdk/lib-dynamodb';
 
 const TABLE = process.env.TABLE_NAME as string;
@@ -105,6 +105,25 @@ export async function listMachines(sub: string): Promise<Machine[]> {
   return out;
 }
 
+/* All machines across every account. Only for the super admin overview —
+ * a table scan, so this must never be on a hot path. */
+export async function listAllMachines(): Promise<Machine[]> {
+  const out: Machine[] = [];
+  let start: Record<string, any> | undefined;
+  do {
+    const page = await doc.send(new ScanCommand({
+      TableName: TABLE,
+      FilterExpression: 'begins_with(#sk, :m)',
+      ExpressionAttributeNames: { '#sk': 'sk' },
+      ExpressionAttributeValues: { ':m': 'M#' },
+      ExclusiveStartKey: start,
+    }));
+    out.push(...(page.Items ?? []));
+    start = page.LastEvaluatedKey;
+  } while (start);
+  return out;
+}
+
 export async function putMachine(item: Machine): Promise<void> {
   await doc.send(new PutCommand({ TableName: TABLE, Item: item }));
 }

site/src/components/Portal.jsx

@@ -182,22 +182,25 @@ export default function Portal({ onClose, user, onUser, onSelfHost }) {
       }
     },
     rename: async (id, label) => {
-      await api('/api/v1/machines/rename', { method: 'POST', body: { id, label } })
+      const owner = (machines ?? []).find(m => m.id === id)?.owner
+      await api('/api/v1/machines/rename', { method: 'POST', body: { id, label, owner } })
       setMachines(prev => (prev ?? []).map(m => (m.id === id ? { ...m, label } : m)))
     },
     /* Revoking clears the key hash: the next heartbeat gets a 401 and the
        agent stops. Re-joining takes a fresh registration. */
     revoke: async (id) => {
-      await api('/api/v1/machines/revoke', { method: 'POST', body: { id } })
+      const owner = (machines ?? []).find(m => m.id === id)?.owner
+      await api('/api/v1/machines/revoke', { method: 'POST', body: { id, owner } })
       setMachines(prev => (prev ?? []).map(m => (
         m.id === id ? { ...m, status: 'revoked', snapshot: null } : m
       )))
     },
     remove: async (id) => {
-      await api('/api/v1/machines/remove', { method: 'POST', body: { id } })
+      const owner = (machines ?? []).find(m => m.id === id)?.owner
+      await api('/api/v1/machines/remove', { method: 'POST', body: { id, owner } })
       setMachines(prev => (prev ?? []).filter(m => m.id !== id))
     },
-  }), [])
+  }), [machines])
 
   /* ── the public leaderboard, which nobody joins by accident ── */
   const publicBoard = useMemo(() => ({