Add OAuth admin management for strategy switch console

Author: Pigbibi

docs/index.html

@@ -618,7 +618,33 @@ <h2 data-i18n="summary">切换摘要</h2>
         { key: "paper", label: "paper", target_name: "paper", account_selector: "PAPER" },
       ],
       ibkr: [
-        { key: "u0000000", label: "u0000000", target_name: "u0000000", account_selector: "u0000000" },
+        {
+          key: "u15998061",
+          label: "u15998061",
+          target_name: "u15998061",
+          account_selector: "U15998061",
+          deployment_selector: "live-u1599-tqqq",
+          account_scope: "live-u1599-tqqq",
+          service_name: "interactive-brokers-live-u1599-tqqq-service",
+        },
+        {
+          key: "u16608560",
+          label: "u16608560",
+          target_name: "u16608560",
+          account_selector: "U16608560",
+          deployment_selector: "live-u1660-soxl",
+          account_scope: "live-u1660-soxl",
+          service_name: "interactive-brokers-live-u1660-soxl-service",
+        },
+        {
+          key: "u18336562",
+          label: "u18336562",
+          target_name: "u18336562",
+          account_selector: "U18336562",
+          deployment_selector: "live-u1833-smart-dca",
+          account_scope: "live-u1833-smart-dca",
+          service_name: "interactive-brokers-live-u1833-smart-dca-service",
+        },
       ],
       schwab: [
         { key: "default", label: "default", target_name: "default" },
@@ -669,7 +695,7 @@ <h2 data-i18n="summary">切换摘要</h2>
       en: {
         appTitle: "Strategy Switch",
         appSubtitle: "Pick platform, target account, and strategy. One action switches everything.",
-        loginManage: "Login",
+        loginManage: "Login Management",
         activePlatform: "Active Platform",
         account: "Target account",
         strategy: "Strategy",
@@ -719,7 +745,7 @@ <h2 data-i18n="summary">切换摘要</h2>
       configSource: "default",
       forms: {
         longbridge: { accountKey: "hk", strategy: "tqqq_growth_income", executionMode: "live" },
-        ibkr: { accountKey: "u0000000", strategy: "tqqq_growth_income", executionMode: "live" },
+        ibkr: { accountKey: "u15998061", strategy: "tqqq_growth_income", executionMode: "live" },
         schwab: { accountKey: "default", strategy: "tqqq_growth_income", executionMode: "live" },
         firstrade: { accountKey: "default", strategy: "tqqq_growth_income", executionMode: "live" },
       },

docs/strategy_switch_admin_backend.md

@@ -1,55 +1,50 @@
 # Strategy Switch Admin Backend
 
-Goal: keep the personal strategy switch console simple while avoiding code changes for every login or account dropdown update.
+Goal: keep the open-source switch page public and read-only by default, while allowing an authenticated admin to manage who can switch strategies and which account routes appear in the dropdown.
 
-## Current Mode
+## Current Implementation
 
-- GitHub OAuth signs users in.
-- `ALLOWED_GITHUB_LOGINS` controls who can dispatch a switch.
-- `STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON` controls signed-in account dropdowns.
-- The GitHub dispatch token stays in Worker secrets and is never sent to the browser.
+- Login method: GitHub OAuth 2.0.
+- Public access: unsigned visitors can view the page, but cannot dispatch the workflow.
+- Allowed switch users: `ALLOWED_GITHUB_LOGINS`, KV `auth_config.allowed_logins`, and all admins.
+- Admin users: `STRATEGY_SWITCH_ADMIN_LOGINS` plus KV `auth_config.admin_logins`.
+- Account dropdowns: KV `account_options` first, falling back to `STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON`.
+- Audit log: each admin save appends to KV `audit_log`, capped at 50 entries.
 
-This is enough for the first deployment. Its main limitation is that user and account changes require updating Worker secrets.
+## Cloudflare KV
 
-## Recommended Admin Mode
+Bind the namespace:
 
-Keep GitHub OAuth and use an admin-only `/admin` page:
+```toml
+[[kv_namespaces]]
+binding = "STRATEGY_SWITCH_CONFIG"
+id = "..."
+```
 
-- Bootstrap admins come from `STRATEGY_SWITCH_ADMIN_LOGINS`; keep your own GitHub login there.
-- Admin actions:
-  - The current version verifies admin identity and shows configured account counts for the four platforms.
-  - After KV is connected, add or remove allowed GitHub logins.
-  - After KV is connected, edit account dropdowns for the four platforms.
-  - After KV is connected, review recent permission and account-config changes.
-- Storage:
-  - Cloudflare KV namespace: `STRATEGY_SWITCH_CONFIG`.
-  - key `auth_config`: `allowed_logins` and `admin_logins`.
-  - key `account_options`: platform account dropdowns.
-  - key `audit_log`: recent admin changes.
+KV keys:
+
+```text
+auth_config
+account_options
+audit_log
+```
+
+Without the KV binding, `/admin` is read-only and the Worker falls back to secrets.
 
 ## Permission Rules
 
 - Not signed in: public read-only page.
-- Signed in but not allowlisted: no switch, no admin page.
+- Signed in but not allowlisted: no switch and no admin page.
 - Allowlisted: can dispatch switches.
-- Admin-listed: can manage login permissions and account dropdowns.
-- `STRATEGY_SWITCH_ADMIN_LOGINS` remains the break-glass admin source so you cannot remove yourself through the UI.
+- Admin-listed: can open `/admin` and manage allowed logins, admin logins, and account dropdown JSON.
+- `STRATEGY_SWITCH_ADMIN_LOGINS` remains the break-glass admin source and is preserved on save.
 
 ## Security Boundary
 
 - The admin backend stores GitHub logins and account routing metadata only.
 - Broker passwords, tokens, API keys, and cloud credentials stay out of this config.
-- Admin writes use POST and the existing Worker same-origin checks.
-- Sessions keep HttpOnly, Secure, SameSite=Lax, and HMAC-signed cookies.
-- Dispatch tokens remain separate from admin config and are never readable from frontend code.
-- Audit logs record time, admin login, and action type, but never secrets.
-
-## Rollout
-
-1. Ship the current secret-backed console.
-2. The read-only `/admin` verification page is already available for `STRATEGY_SWITCH_ADMIN_LOGINS`.
-3. Add Worker KV reads with secret fallback.
-4. Add `/api/admin/config` write operations for admins.
-5. Add audit logs and last-version rollback.
+- Admin writes use POST and same-origin checks.
+- Sessions use HttpOnly, Secure, SameSite=Lax, and HMAC-signed cookies.
+- The GitHub dispatch token stays in Worker secrets and is never returned to frontend or admin APIs.
 
-This avoids a database, custom user system, or broad RBAC while still giving a practical backend for a personal open-source project.
+This keeps the personal system simple: no database, review flow, or custom RBAC, while preventing strangers from operating the public page.

docs/strategy_switch_admin_backend.zh-CN.md

@@ -1,54 +1,50 @@
-# 策略切换登录权限后台方案
+# 策略切换登录权限后台
 
-目标：保持个人量化系统足够简单，同时不用每次改权限或账号下拉都重新改代码。
+目标：开源页面可以公开查看，但只有登录并通过权限校验的 GitHub 账号能一键切换策略；管理员可以自己维护登录名单和账号下拉，不需要每次改代码。
 
-## 当前模式
+## 当前实现
 
-- GitHub OAuth 登录。
-- `ALLOWED_GITHUB_LOGINS` 控制谁能触发切换。
-- `STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON` 控制登录后可选账号。
-- GitHub dispatch token 只在 Worker secret 里，前端拿不到。
+- 登录方式：GitHub OAuth 2.0。
+- 公开访问：未登录用户只能看到只读切换页，不能触发 workflow。
+- 可切换用户：来自 `ALLOWED_GITHUB_LOGINS`、KV `auth_config.allowed_logins` 和管理员名单。
+- 管理员：来自 `STRATEGY_SWITCH_ADMIN_LOGINS` 和 KV `auth_config.admin_logins`。
+- 账号下拉：优先读取 KV `account_options`，没有 KV 配置时回退 `STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON`。
+- 审计：管理员保存配置后写入 KV `audit_log`，保留最近 50 条。
 
-这个模式可以先上线。它的缺点是：新增登录用户或账号 target 时，需要改 Worker secret。
+## Cloudflare KV
 
-## 推荐后台模式
+绑定 namespace：
 
-保留 GitHub OAuth，使用一个只给管理员看的 `/admin` 页面：
+```toml
+[[kv_namespaces]]
+binding = "STRATEGY_SWITCH_CONFIG"
+id = "..."
+```
 
-- 管理员：由 `STRATEGY_SWITCH_ADMIN_LOGINS` 启动配置，建议只放你自己的 GitHub login。
-- 可操作内容：
-  - 当前已支持验证管理员身份，并展示四个平台已加载账号数量。
-  - 后续接 KV 后，可添加或移除允许登录的 GitHub 用户名。
-  - 后续接 KV 后，可编辑四个平台的账号下拉配置。
-  - 后续接 KV 后，可查看最近的权限和账号配置修改记录。
-- 存储：
-  - Cloudflare KV namespace：`STRATEGY_SWITCH_CONFIG`。
-  - key `auth_config`：保存 `allowed_logins`、`admin_logins`。
-  - key `account_options`：保存四个平台账号下拉。
-  - key `audit_log`：保存最近 50 条管理操作。
+使用的 key：
+
+```text
+auth_config
+account_options
+audit_log
+```
+
+没有绑定 KV 时，`/admin` 只读；登录和切换仍可通过 Worker secrets 运行。
 
 ## 权限规则
 
-- 未登录：只能看公开只读页。
+- 未登录：只能查看公开页面。
 - 登录但不在 allowlist：不能切换，也不能进入后台。
-- 登录且在 allowlist：可以一键切换。
-- 登录且在 admin list：可以进入后台管理权限和账号配置。
-- `STRATEGY_SWITCH_ADMIN_LOGINS` 是兜底管理员，不通过后台删除，避免把自己锁在外面。
+- allowlist 用户：可以一键切换。
+- admin 用户：可以进入 `/admin`，维护 allowlist、admin list 和账号下拉 JSON。
+- `STRATEGY_SWITCH_ADMIN_LOGINS` 是兜底管理员来源，后台保存时会自动保留，避免把自己锁在外面。
 
 ## 安全边界
 
-- 后台只管理 GitHub login 和账号路由信息，不保存 broker 密码、token、API key。
-- 所有后台写操作使用 POST，并复用当前 Worker 的 Same-Origin 校验。
-- session cookie 继续使用 HttpOnly、Secure、SameSite=Lax 和 HMAC 签名。
-- dispatch token 与后台配置分离；管理员能改账号路由，但不能在前端读取 token。
-- 每次后台修改写 audit log，至少记录时间、管理员 login、操作类型，不记录密钥。
-
-## 分阶段落地
-
-1. 先上线当前 secret 模式：页面一键切换、账号配置由 `STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON` 提供。
-2. `/admin` 只读验证页已经具备：可验证 `STRATEGY_SWITCH_ADMIN_LOGINS` 管理权限，并展示已加载账号数量。
-3. 给 Worker 增加 KV 读取：优先读 KV，没有 KV 时回退到 secrets。
-4. 增加 `/api/admin/config` 写接口：管理员可更新 allowlist 和账号配置。
-5. 增加 audit log 与回滚：保留最近版本，改错后可以恢复。
+- 后台只保存 GitHub login 和账号路由信息。
+- 不保存 broker 密码、token、API key 或云密钥。
+- 后台写操作使用 POST，并校验 Same-Origin。
+- session cookie 使用 HttpOnly、Secure、SameSite=Lax 和 HMAC 签名。
+- GitHub dispatch token 只在 Worker secret 中，前端和后台配置接口都不会返回。
 
-这个方案不引入独立数据库、用户系统或复杂 RBAC，适合个人开源项目。真正的权限根仍然是你的 GitHub 账号和 Worker secret。
+这个方案保留个人项目的简单性：没有独立数据库、审批流或复杂 RBAC，但公开页面不能被陌生人直接操作。

web/strategy-switch-console/README.md

@@ -23,7 +23,7 @@ Optional variables:
 RUNTIME_SETTINGS_REPO=QuantStrategyLab/QuantRuntimeSettings
 RUNTIME_SETTINGS_WORKFLOW=manual-strategy-switch.yml
 RUNTIME_SETTINGS_REF=main
-STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON={"longbridge":[{"key":"hk","label":"hk","target_name":"hk","account_selector":"HK"},{"key":"sg","label":"sg","target_name":"sg","account_selector":"SG"},{"key":"paper","label":"paper","target_name":"paper","account_selector":"PAPER"}],"ibkr":[{"key":"u0000000","label":"u0000000","target_name":"u0000000","account_selector":"u0000000"}],"schwab":[{"key":"default","label":"default","target_name":"default"}],"firstrade":[{"key":"default","label":"default","target_name":"default"}]}
+STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON=<contents of account-options.example.json>
 ```
 
 `ALLOWED_GITHUB_LOGINS` and `STRATEGY_SWITCH_ADMIN_LOGINS` are comma-separated lists:
@@ -32,7 +32,7 @@ STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON={"longbridge":[{"key":"hk","label":"hk","ta
 your-github-login
 ```
 
-The login entrypoint is `/login` on the Worker domain. When the Worker is available, the page header shows the GitHub sign-in link. After sign-in, `/api/session` returns:
+The login entrypoint is `/login` on the Worker domain. The page header keeps a single Login Management entry. After sign-in, `/api/session` returns:
 
 ```json
 {
@@ -43,7 +43,21 @@ The login entrypoint is `/login` on the Worker domain. When the Worker is availa
 }
 ```
 
-`admin=true` means the login is listed in `STRATEGY_SWITCH_ADMIN_LOGINS`. You can also open `/admin` directly to verify admin permission; non-admin users receive 403.
+`admin=true` means the login is listed in `STRATEGY_SWITCH_ADMIN_LOGINS` or the KV-backed admin list. Open `/admin` to manage allowed GitHub logins and account dropdown routes; non-admin users receive 403.
+
+## Admin Management
+
+GitHub OAuth 2.0 is the only login method. Keep your own GitHub login in `STRATEGY_SWITCH_ADMIN_LOGINS`; that secret is the break-glass admin source and cannot be removed from the UI.
+
+For editable admin settings, bind a Cloudflare KV namespace named `STRATEGY_SWITCH_CONFIG`. The Worker uses these KV keys:
+
+```text
+auth_config
+account_options
+audit_log
+```
+
+Without the KV binding, `/admin` is read-only and the Worker falls back to `ALLOWED_GITHUB_LOGINS`, `STRATEGY_SWITCH_ADMIN_LOGINS`, and `STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON`.
 
 ## Page Asset
 
@@ -72,15 +86,19 @@ cd web/strategy-switch-console
 wrangler secret put STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON < /tmp/strategy-switch-accounts.json
 ```
 
+After `STRATEGY_SWITCH_CONFIG` is bound, admins can also edit and save the same account JSON from `/admin`. KV takes precedence over the secret; the secret remains a fallback.
+
 Each account item supports:
 
 ```json
 {
-  "key": "u0000000",
-  "label": "u0000000",
-  "target_name": "u0000000",
-  "account_selector": "u0000000",
-  "service_name": "interactive-brokers-u0000000-service"
+  "key": "u15998061",
+  "label": "u15998061",
+  "target_name": "u15998061",
+  "account_selector": "U15998061",
+  "deployment_selector": "live-u1599-tqqq",
+  "account_scope": "live-u1599-tqqq",
+  "service_name": "interactive-brokers-live-u1599-tqqq-service"
 }
 ```
 
@@ -116,6 +134,14 @@ wrangler secret put STRATEGY_SWITCH_ADMIN_LOGINS
 wrangler secret put STRATEGY_SWITCH_ACCOUNT_OPTIONS_JSON < /tmp/strategy-switch-accounts.json
 ```
 
+Create and bind KV if you want `/admin` to save changes:
+
+```bash
+wrangler kv namespace create STRATEGY_SWITCH_CONFIG
+```
+
+Add the returned namespace id to `wrangler.toml`.
+
 Deploy:
 
 ```bash