bug(onboarding): AWS External ID field empty and editable — should be auto-generated and read-only

[rocketri]

Summary

The External ID field in the AWS account onboarding modal is blank and user-editable. CUDly should generate a unique External ID per account and display it read-only so users can copy it directly into their AWS IAM trust policy.

Impact

Security: An editable External ID means users can set any value (or leave it empty), which breaks cross-account role assumption security. The External ID is a shared secret between CUDly and the customer's AWS account — it must be CUDly-controlled, not user-chosen.

UX: There is nothing to copy into the AWS trust policy, so users must either invent their own value (defeating the security purpose) or leave it blank (making the assume-role call fail).

Steps to reproduce

1. Settings → Accounts → Add AWS Account
2. Observe the External ID field — it is empty and writable

Expected

• CUDly generates a stable UUID/token per account entry and pre-fills the field
• Field is readonly and has a copy-to-clipboard button
• Hint text explains this value must match the sts:ExternalId condition in the trust policy

Detected by

Automated AWS UX test, 2026-04-24

[cristim]

Fixed and merged in PR #36 (commit 544ae3e85).

Change

• Auto-generate: on Add AWS Account, CUDly now fills the External ID with crypto.randomUUID(). Existing accounts preserve their stored value on edit.
• Readonly: the input is marked readonly so users can't hand-craft a value that would defeat the security model.
• Copy: a new copy-to-clipboard button sits flush with the input (new .input-with-copy CSS layout).
• Hint: replaces the misleading 'External ID (optional)' label with inline guidance pointing operators at the sts:ExternalId condition of the IAM role trust policy.

Under the hood, copyToClipboard was extended to work with form inputs (reads .value) and nested wrappers (finds the .copy-btn via the input's parent). Existing callers (the CLI command display) are unchanged.

Verification on AWS Lambda deploy

• Deployed index.html contains <input type=text id=account-aws-external-id readonly=readonly>.
• The account-aws-external-id-copy button is present in the markup.
• The sts:ExternalId hint copy is present.

Azure Container Apps and GCP Cloud Run deploys were still in progress at comment time.