marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add internal staff IAM: named users, roles, and management permissions.
Some checks are pending
offline / test (push) Waiting to run
Details

Browse source 
verae-staff-iam (:3028) is the people directory — owner, billing-admin,
cs, sales, accounting, operator, viewer — with scrypt passwords, sessions,
and an audit log. Admin console login uses it when STAFF_IAM_URL is set
and hides tabs the account cannot use. CS/sales/accounting/staff/fleet
check permissions such as cs.credit and fleet.operate. Shared staff key
remains only as a fallback when IAM is unset.
This commit is contained in:
George Lambert 2026-09-11 18:36:12 -04:00
parent 2740d51446
commit d299d245e8
41 changed files with 1337 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

35
packages/zappier-accounting-export/src/iam-gate.js Normal file
View file

@ -0,0 +1,35 @@
export function iamBase() {
return (process.env.STAFF_IAM_URL || '').replace(/\/$/, '');
}
export async function iamCheck(req, permission) {
const base = iamBase();
if (!base) {
if (process.env.STAFF_AUTH === '1') {
const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
const r = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
return { ok: Boolean(r && r.ok) };
}
return { ok: true, skipped: true };
}
const q = permission ? `?permission=${encodeURIComponent(permission)}` : '';
const r = await fetch(`${base}/check${q}`, {
headers: { cookie: req.headers.cookie || '', authorization: req.headers.authorization || '' },
}).catch(() => null);
if (!r) return { ok: false, status: 502 };
const body = await r.json().catch(() => ({}));
return { ok: r.ok, status: r.status, ...body };
}
export async function denyOrRedirect(req, res, json, { permission, html }) {
const out = await iamCheck(req, permission);
if (out.ok) return true;
const login = iamBase() || (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3028').replace(/\/$/, '');
if (html) {
res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
res.end();
return false;
}
json(out.status === 403 ? 403 : 401, { error: out.reason || 'unauthorized', permission });
return false;
}

14
packages/zappier-accounting-export/src/server.js
View file

@ -6,6 +6,7 @@ import path from 'node:path';
import { fileURLToPath } from 'node:url';
import { SUBJECTS, billingRequest } from './nats-billing.js';
import { listCustomers, withCustomerName } from './names.js';
import { denyOrRedirect } from './iam-gate.js';
const PORT = Number(process.env.PORT || 3013);
const EDGE = (process.env.ZAPPIER_ADMIN_URL || 'http://127.0.0.1:3000').replace(/\/$/, '');
@ -27,15 +28,7 @@ const server = http.createServer(async (req, res) => {
const json = (code, obj) => send(code, 'application/json', JSON.stringify(obj));
try {
if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
if (process.env.STAFF_AUTH === '1') {
const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
const chk = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
if (!chk || !chk.ok) {
res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
res.end();
return;
}
}
if (!(await denyOrRedirect(req, res, json, { permission: 'accounting.review', html: true }))) return;
return send(200, 'text/html; charset=utf-8', fs.readFileSync(path.join(PUBLIC, 'index.html')));
}
if (req.method === 'GET' && url.pathname === '/health') {
@ -46,6 +39,7 @@ const server = http.createServer(async (req, res) => {
}
const review = url.pathname.match(/^\/review\/([^/]+)$/);
if (req.method === 'GET' && review) {
if (!(await denyOrRedirect(req, res, json, { permission: 'accounting.review' }))) return;
const id = decodeURIComponent(review[1]);
const nats = await billingRequest(SUBJECTS.STATEMENT_GET, { customerId: id });
if (nats) return json(200, await withCustomerName({ ...nats, source: 'nats' }, id, EDGE, KEY));
@ -58,10 +52,12 @@ const server = http.createServer(async (req, res) => {
const period = url.searchParams.get('period');
const q = period ? `?period=${encodeURIComponent(period)}` : '';
if (req.method === 'GET' && url.pathname === '/export/quickbooks.iif') {
if (!(await denyOrRedirect(req, res, json, { permission: 'accounting.export' }))) return;
const r = await edge(`/admin/api/exports/quickbooks.iif${q}`);
return send(r.status, 'text/plain', await r.text());
}
if (req.method === 'GET' && url.pathname === '/export/accounting.csv') {
if (!(await denyOrRedirect(req, res, json, { permission: 'accounting.export' }))) return;
const r = await edge(`/admin/api/exports/accounting.csv${q}`);
return send(r.status, 'text/csv', await r.text());
}