# OPAX Web TUI

This project provides a starter scaffold for a Google-login-gated web control plane. It consists of a React frontend and a Node.js backend.

The frontend provides a terminal-like interface for interacting with the system. The backend handles user authentication via Google OAuth2 and provides a secure boundary for potential agent integrations.

## Local Development

To run the application locally, first install the dependencies:
```bash
npm install
```

Then, start the development server:
```bash
npm run dev
```

### Configuration

The backend requires several environment variables for configuration. For local development, you can create a `.env` file in the `opax-web/backend/` directory.

- Do not commit `.env` files to Git.
- **NEVER** use or copy production secrets into a local `.env` file.
- For configuration that requires secrets, use local, rotatable test values.
- Production secrets must be stored and delivered via the dedicated secrets solution described in `SECURITY.md`.

Required configuration keys:
- `FRONTEND_URL`
- `ALLOWED_EMAILS`
- `GOOGLE_CLIENT_ID`
- `GOOGLE_CLIENT_SECRET`
- `SESSION_SECRET`

**Note:** The outbound agent integration is currently disabled by default (fail-closed). The backend will not attempt to connect to any external agent services.

## Security

**IMPORTANT:** Never commit passwords, tokens, OAuth client secrets, or service account keys to the Git repository. If any credential is accidentally exposed, it **MUST** be revoked and rotated immediately.

For more details, see `SECURITY.md`.