George Lambert
d299d245e8
Some checks are pending
offline / test (push) Waiting to run
verae-staff-iam (:3028) is the people directory — owner, billing-admin, cs, sales, accounting, operator, viewer — with scrypt passwords, sessions, and an audit log. Admin console login uses it when STAFF_IAM_URL is set and hides tabs the account cannot use. CS/sales/accounting/staff/fleet check permissions such as cs.credit and fleet.operate. Shared staff key remains only as a fallback when IAM is unset. |
||
|---|---|---|
| .. | ||
| src | ||
| test | ||
| NATS.md | ||
| package.json | ||
| README.md | ||
| SUMMARY.md | ||
verae-staff-session
Shared cookie login for CS / sales / accounting / access-staff HTML.
Forgejo: https://git.georgelambert.org/marchon/verae-staff-session
Port :3027. Set STAFF_AUTH=1 on the department servers and STAFF_SESSION_URL=http://127.0.0.1:3027. Cookie host is the browser host (ports share 127.0.0.1). JSON APIs stay open unless you also send x-staff-key.
Default key: STAFF_KEY or ADMIN_KEY or admin-dev-key.
Multiple hostnames
Cookies are host-scoped. On one operator box (127.0.0.1) that is enough. For several DNS names, put one reverse proxy in front and set STAFF_COOKIE_DOMAIN:
server {
server_name staff.example.com;
location /session/ { proxy_pass http://127.0.0.1:3027/; }
location /cs/ { proxy_pass http://127.0.0.1:3011/; }
location /sales/ { proxy_pass http://127.0.0.1:3012/; }
location /acct/ { proxy_pass http://127.0.0.1:3013/; }
location /staff/ { proxy_pass http://127.0.0.1:3025/; }
}
STAFF_COOKIE_DOMAIN=.example.com
STAFF_COOKIE_SECURE=1
STAFF_SESSION_URL=https://staff.example.com/session
STAFF_AUTH=1