This service is intentionally separate from LMS APIs. LMS decides education-domain eligibility, while this gateway owns platform access grants, session ownership, agent command proxying, connection status, monitoring events, release, and emergency-stop workflows.

Run

bun install
bun run dev

Default URL: http://localhost:4500

Core APIs

GET /health
GET /api/platforms
GET /api/platforms/:id/status
GET /api/connections
POST /api/platform-access-grants
DELETE /api/platform-access-grants/:grantId
POST /api/platform-sessions
POST /api/platforms/:id/commands
POST /api/platforms/:id/release
POST /api/platforms/:id/emergency-stop
GET /api/events

Network Model

Students and instructors never connect directly to Headscale/Tailscale device endpoints. Clients call this gateway only. The gateway verifies auth, checks platform grants/session ownership, records audit context, and proxies allowed operations to the mobility agent running on each platform node.