marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Turn lab IAM on, move portal to access-web, harden sessions and receipts.
Some checks are pending
offline / test (push) Waiting to run
Details

Browse source 
Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can
credit (agent is the IAM user) and cannot export; operator can fleet
POST; admin /me is owner. Portal is the public web door at :3021/portal/.
IAM sessions persist; login is rate-limited per user; receipt PDF is
branded. lan-134 stays disabled.
This commit is contained in:
George Lambert 2026-09-11 18:59:18 -04:00
parent d299d245e8
commit c32b65038a
20 changed files with 277 additions and 73 deletions
Download patch file Download diff file Expand all files Collapse all files

71
packages/verae-zapier-middleware/src/lib/receiptPdf.js
View file

@ -1,41 +1,66 @@
/**
* Minimal PDF builder for retrieval receipts (no native deps).
* Branded PDF retrieval receipt (no native deps).
* @module lib/receiptPdf
*/
/**
* @param {string} s
* @returns {string}
*/
function pdfEscape(s) {
return String(s).replace(/\\/g, '\\\\').replace(/\(/g, '\\(').replace(/\)/g, '\\)');
}
function wrap(s, n) {
const str = String(s || '');
const out = [];
for (let i = 0; i < str.length; i += n) out.push(str.slice(i, i + n));
return out.length ? out : [''];
}
/**
* @param {object} receipt
* @returns {Buffer}
*/
export function buildReceiptPdf(receipt) {
const lines = [
'Verae Time — certified retrieval receipt',
`Type: ${receipt.type}`,
`Job ID: ${receipt.jobId}`,
`SHA256: ${receipt.sha256 ?? ''}`,
`Original timestamp: ${receipt.timestamp ?? ''}`,
`Retrieved at: ${receipt.extraSeal?.retrievedAt ?? ''}`,
`Tenant: ${receipt.extraSeal?.tenantId ?? ''}`,
`Seal event: ${receipt.extraSeal?.event ?? ''}`,
`Certificate: ${String(receipt.certificate ?? '').slice(0, 80)}`,
];
const lines = [];
const add = (label, value) => {
lines.push({ kind: 'label', text: label });
wrap(value, 86).forEach((t) => lines.push({ kind: 'value', text: t }));
lines.push({ kind: 'gap' });
};
add('Job ID', receipt.jobId);
add('SHA-256', receipt.sha256 ?? '');
add('Original timestamp', receipt.timestamp ?? '');
add('Retrieved at', receipt.extraSeal?.retrievedAt ?? '');
add('Tenant', receipt.extraSeal?.tenantId ?? '');
add('Seal event', receipt.extraSeal?.event ?? '');
add('Certificate', String(receipt.certificate ?? '').slice(0, 240));
const commands = lines
.map((line, i) => {
const y = 720 - i * 18;
return `BT /F1 11 Tf 50 ${y} Td (${pdfEscape(line)}) Tj ET`;
})
.join('\n');
const ops = [];
ops.push('0.192 0.180 0.506 rg');
ops.push('0 742 612 50 re f');
ops.push('1 1 1 rg');
ops.push('BT /F1 16 Tf 36 760 Td (Verae Time) Tj ET');
ops.push('BT /F1 9 Tf 36 746 Td (CERTIFIED RETRIEVAL RECEIPT) Tj ET');
ops.push('0.09 0.10 0.15 rg');
let y = 710;
for (const line of lines) {
if (line.kind === 'gap') {
y -= 8;
continue;
}
const size = line.kind === 'label' ? 8 : 11;
ops.push(`BT /F1 ${size} Tf 36 ${y} Td (${pdfEscape(line.text)}) Tj ET`);
y -= line.kind === 'label' ? 12 : 14;
}
ops.push('0.192 0.180 0.506 rg');
ops.push('36 48 540 0.8 re f');
ops.push('0.42 0.44 0.52 rg');
ops.push(
'BT /F1 8 Tf 36 34 Td (This is a certified retrieval receipt. The extra-seal event is recorded with the hash. It is not a substitute for the chain record.) Tj ET',
);
ops.push(
`BT /F1 8 Tf 36 22 Td (${pdfEscape('Verae Time x Zapier · type ' + (receipt.type || 'verae.retrieval-receipt'))}) Tj ET`,
);
const stream = `${commands}\n`;
const stream = `${ops.join('\n')}\n`;
const objects = [
'1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj',
'2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj',