Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

packages/verae-fleet/services/access-staff.json

@@ -16,7 +16,8 @@
   "env": {
     "PORT": "3025",
     "AUTHZ_URL": "http://127.0.0.1:3020",
-    "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010"
+    "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
   },
   "nats": { "in": [], "out": ["verae.access.authz.check"] }
 }

packages/verae-fleet/services/accounting-export.json

@@ -17,7 +17,8 @@
     "PORT": "3013",
     "ZAPPIER_ADMIN_URL": "http://127.0.0.1:3000",
     "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
-    "NATS_URL": "nats://127.0.0.1:4222"
+    "NATS_URL": "nats://127.0.0.1:4222",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
   },
   "nats": { "in": [], "out": ["verae.billing.statement.get"] }
 }

packages/verae-fleet/services/customer-service.json

@@ -18,7 +18,8 @@
     "ZAPPIER_ADMIN_URL": "http://127.0.0.1:3000",
     "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
     "NATS_URL": "nats://127.0.0.1:4222",
-    "AUTHZ_URL": "http://127.0.0.1:3020"
+    "AUTHZ_URL": "http://127.0.0.1:3020",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
   },
   "nats": {
     "in": [],

packages/verae-fleet/services/sales-pricing.json

@@ -18,7 +18,8 @@
     "ZAPPIER_ADMIN_URL": "http://127.0.0.1:3000",
     "ACCOUNT_BALANCE_URL": "http://127.0.0.1:3010",
     "NATS_URL": "nats://127.0.0.1:4222",
-    "AUTHZ_URL": "http://127.0.0.1:3020"
+    "AUTHZ_URL": "http://127.0.0.1:3020",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028"
   },
   "nats": { "in": [], "out": ["verae.billing.statement.get"] }
 }

packages/verae-fleet/services/staff-iam.json

@@ -0,0 +1,20 @@
+{
+  "id": "staff-iam",
+  "title": "Internal staff IAM (users, roles, permissions)",
+  "kind": "http",
+  "package": "verae-staff-iam",
+  "role": "staff-iam",
+  "managed": true,
+  "runtime": "HTTP :3028",
+  "health": { "type": "http", "path": "/health", "timeoutMs": 2000 },
+  "ports": { "healthBase": 3028 },
+  "spawn": {
+    "cwd": "../verae-staff-iam",
+    "command": "node",
+    "args": ["src/server.js"]
+  },
+  "env": {
+    "PORT": "3028"
+  },
+  "nats": { "in": [], "out": [] }
+}

packages/verae-fleet/services/zappier-edge.json

@@ -15,6 +15,7 @@
   },
   "env": {
     "PORT": "3000",
+    "STAFF_IAM_URL": "http://127.0.0.1:3028",
     "BIND": "127.0.0.1",
     "ZAPPIER_UPSTREAM": "http://127.0.0.1:3100",
     "CS_SERVICE_URL": "http://127.0.0.1:3011",

packages/verae-fleet/src/iam-gate.js

@@ -0,0 +1,35 @@
+export function iamBase() {
+  return (process.env.STAFF_IAM_URL || '').replace(/\/$/, '');
+}
+
+export async function iamCheck(req, permission) {
+  const base = iamBase();
+  if (!base) {
+    if (process.env.STAFF_AUTH === '1') {
+      const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
+      const r = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
+      return { ok: Boolean(r && r.ok) };
+    }
+    return { ok: true, skipped: true };
+  }
+  const q = permission ? `?permission=${encodeURIComponent(permission)}` : '';
+  const r = await fetch(`${base}/check${q}`, {
+    headers: { cookie: req.headers.cookie || '', authorization: req.headers.authorization || '' },
+  }).catch(() => null);
+  if (!r) return { ok: false, status: 502 };
+  const body = await r.json().catch(() => ({}));
+  return { ok: r.ok, status: r.status, ...body };
+}
+
+export async function denyOrRedirect(req, res, json, { permission, html }) {
+  const out = await iamCheck(req, permission);
+  if (out.ok) return true;
+  const login = iamBase() || (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3028').replace(/\/$/, '');
+  if (html) {
+    res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
+    res.end();
+    return false;
+  }
+  json(out.status === 403 ? 403 : 401, { error: out.reason || 'unauthorized', permission });
+  return false;
+}

packages/verae-fleet/src/server.js

@@ -10,6 +10,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { listServices } from './load.js';
 import { ACTIONS, Simulator } from '../../verae-zapier-simulator/src/pipeline.js';
+import { denyOrRedirect } from './iam-gate.js';
 
 const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
 
@@ -33,6 +34,16 @@ export function startControlServer(sup, mon) {
       if (req.method === 'GET' && url.pathname === '/health') {
         return json(res, 200, { ok: true, role: 'operator-console' });
       }
+      const gated =
+        url.pathname === '/' ||
+        url.pathname === '/index.html' ||
+        (url.pathname.startsWith('/api/') && req.method !== 'GET');
+      if (gated) {
+        const j = (code, obj) => json(res, code, obj);
+        if (!(await denyOrRedirect(req, res, j, { permission: 'fleet.operate', html: url.pathname === '/' || url.pathname === '/index.html' }))) {
+          return;
+        }
+      }
       if (req.method === 'GET' && url.pathname === '/api/sim/actions') {
         return json(res, 200, { actions: ACTIONS, state: sim.snapshot() });
       }