Add internal staff IAM: named users, roles, and management permissions.

verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.

packages/verae-fleet/src/iam-gate.js

@@ -0,0 +1,35 @@
+export function iamBase() {
+  return (process.env.STAFF_IAM_URL || '').replace(/\/$/, '');
+}
+
+export async function iamCheck(req, permission) {
+  const base = iamBase();
+  if (!base) {
+    if (process.env.STAFF_AUTH === '1') {
+      const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
+      const r = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
+      return { ok: Boolean(r && r.ok) };
+    }
+    return { ok: true, skipped: true };
+  }
+  const q = permission ? `?permission=${encodeURIComponent(permission)}` : '';
+  const r = await fetch(`${base}/check${q}`, {
+    headers: { cookie: req.headers.cookie || '', authorization: req.headers.authorization || '' },
+  }).catch(() => null);
+  if (!r) return { ok: false, status: 502 };
+  const body = await r.json().catch(() => ({}));
+  return { ok: r.ok, status: r.status, ...body };
+}
+
+export async function denyOrRedirect(req, res, json, { permission, html }) {
+  const out = await iamCheck(req, permission);
+  if (out.ok) return true;
+  const login = iamBase() || (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3028').replace(/\/$/, '');
+  if (html) {
+    res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
+    res.end();
+    return false;
+  }
+  json(out.status === 403 ? 403 : 401, { error: out.reason || 'unauthorized', permission });
+  return false;
+}

packages/verae-fleet/src/server.js

@@ -10,6 +10,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { listServices } from './load.js';
 import { ACTIONS, Simulator } from '../../verae-zapier-simulator/src/pipeline.js';
+import { denyOrRedirect } from './iam-gate.js';
 
 const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
 
@@ -33,6 +34,16 @@ export function startControlServer(sup, mon) {
       if (req.method === 'GET' && url.pathname === '/health') {
         return json(res, 200, { ok: true, role: 'operator-console' });
       }
+      const gated =
+        url.pathname === '/' ||
+        url.pathname === '/index.html' ||
+        (url.pathname.startsWith('/api/') && req.method !== 'GET');
+      if (gated) {
+        const j = (code, obj) => json(res, code, obj);
+        if (!(await denyOrRedirect(req, res, j, { permission: 'fleet.operate', html: url.pathname === '/' || url.pathname === '/index.html' }))) {
+          return;
+        }
+      }
       if (req.method === 'GET' && url.pathname === '/api/sim/actions') {
         return json(res, 200, { actions: ACTIONS, state: sim.snapshot() });
       }