marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add internal staff IAM: named users, roles, and management permissions.
Some checks are pending
offline / test (push) Waiting to run
Details

Browse source 
verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.
This commit is contained in:
George Lambert 2026-09-11 18:36:12 -04:00
parent 2740d51446
commit d299d245e8
41 changed files with 1337 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

13
packages/verae-access-staff/src/server.js
View file

@ -6,6 +6,7 @@ import path from 'node:path';
import { fileURLToPath } from 'node:url';
import { listCustomers, withCustomerName } from './names.js';
import { staffPageHtml } from './staff-page.js';
import { denyOrRedirect } from './iam-gate.js';
const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
const PORT = Number(process.env.PORT || 3025);
@ -32,15 +33,7 @@ const server = http.createServer(async (req, res) => {
};
try {
if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
if (process.env.STAFF_AUTH === '1') {
const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
const chk = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
if (!chk || !chk.ok) {
res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
res.end();
return;
}
}
if (!(await denyOrRedirect(req, res, json, { permission: 'staff.plane', html: true }))) return;
res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
res.end(
await staffPageHtml(
@ -62,6 +55,7 @@ const server = http.createServer(async (req, res) => {
}
const review = url.pathname.match(/^\/review\/([^/]+)$/);
if (req.method === 'GET' && review) {
if (!(await denyOrRedirect(req, res, json, { permission: 'staff.plane' }))) return;
const id = decodeURIComponent(review[1]);
const gate = await check('verae.billing.statement.get', { principal: id });
if (!gate.allow) return json(403, gate);
@ -70,6 +64,7 @@ const server = http.createServer(async (req, res) => {
return json(r.status, body);
}
if (req.method === 'POST' && url.pathname === '/credits') {
if (!(await denyOrRedirect(req, res, json, { permission: 'cs.credit' }))) return;
const chunks = [];
for await (const c of req) chunks.push(c);
const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');