George Lambert
2bb3884a1b
Some checks are pending
offline / test (push) Waiting to run
CS/sales/accounting/staff list endpoints and sales pricing writes require IAM; fleet service env sets STAFF_AUTH=1. Department tests use a private books file so lab NATS does not leak into them.
91 lines
4 KiB
JavaScript
91 lines
4 KiB
JavaScript
#!/usr/bin/env node
|
|
/** Staff access plane (CS / sales / accounting). Not Zapier, not customer API. */
|
|
import fs from 'node:fs';
|
|
import http from 'node:http';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { listCustomers, withCustomerName } from './names.js';
|
|
import { staffPageHtml } from './staff-page.js';
|
|
import { denyOrRedirect } from './iam-gate.js';
|
|
|
|
const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
|
|
const PORT = Number(process.env.PORT || 3025);
|
|
const AUTHZ = (process.env.AUTHZ_URL || 'http://127.0.0.1:3020').replace(/\/$/, '');
|
|
const BOOKS = (process.env.ACCOUNT_BALANCE_URL || 'http://127.0.0.1:3010').replace(/\/$/, '');
|
|
const EDGE = (process.env.ZAPPIER_ADMIN_URL || 'http://127.0.0.1:3000').replace(/\/$/, '');
|
|
const KEY = process.env.ZAPPIER_ADMIN_KEY || 'admin-dev-key';
|
|
const PLANE = 'staff';
|
|
|
|
async function check(subject, extra = {}) {
|
|
const r = await fetch(`${AUTHZ}/check`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ plane: PLANE, subject, ...extra }),
|
|
});
|
|
return r.json();
|
|
}
|
|
|
|
const server = http.createServer(async (req, res) => {
|
|
const url = new URL(req.url || '/', `http://127.0.0.1:${PORT}`);
|
|
const json = (code, obj) => {
|
|
res.writeHead(code, { 'content-type': 'application/json' });
|
|
res.end(JSON.stringify(obj));
|
|
};
|
|
try {
|
|
if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
|
|
if (!(await denyOrRedirect(req, res, json, { permission: 'staff.plane', html: true }))) return;
|
|
res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
|
|
res.end(
|
|
await staffPageHtml(
|
|
{
|
|
title: 'Staff access',
|
|
kicker: 'staff plane · after authz',
|
|
lede: 'CS / sales / accounting door. Review and credit go through authz, then account-balance. Amounts are dollars.',
|
|
},
|
|
path.join(PUBLIC, 'index.html'),
|
|
),
|
|
);
|
|
return;
|
|
}
|
|
if (req.method === 'GET' && url.pathname === '/health') {
|
|
return json(200, { ok: true, role: 'verae-access-staff', plane: PLANE });
|
|
}
|
|
if (req.method === 'GET' && url.pathname === '/customers') {
|
|
if (!(await denyOrRedirect(req, res, json, { permission: 'staff.plane' }))) return;
|
|
return json(200, { customers: await listCustomers(EDGE, KEY) });
|
|
}
|
|
const review = url.pathname.match(/^\/review\/([^/]+)$/);
|
|
if (req.method === 'GET' && review) {
|
|
if (!(await denyOrRedirect(req, res, json, { permission: 'staff.plane' }))) return;
|
|
const id = decodeURIComponent(review[1]);
|
|
const gate = await check('verae.billing.statement.get', { principal: id });
|
|
if (!gate.allow) return json(403, gate);
|
|
const r = await fetch(`${BOOKS}/statement/${encodeURIComponent(id)}`);
|
|
const body = await withCustomerName({ ...(await r.json()), plane: PLANE, source: 'account-balance' }, id, EDGE, KEY);
|
|
return json(r.status, body);
|
|
}
|
|
if (req.method === 'POST' && url.pathname === '/credits') {
|
|
const who = await denyOrRedirect(req, res, json, { permission: 'cs.credit' });
|
|
if (!who) return;
|
|
const chunks = [];
|
|
for await (const c of req) chunks.push(c);
|
|
const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
|
|
if (who.user?.username) body.agent = who.user.username;
|
|
const gate = await check('verae.billing.balance.adjust', { kind: 'credit', principal: body.agent });
|
|
if (!gate.allow) return json(403, gate);
|
|
const r = await fetch(`${BOOKS}/adjust`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ ...body, kind: 'credit' }),
|
|
});
|
|
return json(r.status, { ...(await r.json()), plane: PLANE });
|
|
}
|
|
json(404, { error: 'not found' });
|
|
} catch (err) {
|
|
json(502, { error: err.message });
|
|
}
|
|
});
|
|
|
|
server.listen(PORT, '0.0.0.0', () => {
|
|
process.stdout.write(`verae-access-staff http://0.0.0.0:${PORT}/ plane=${PLANE}\n`);
|
|
});
|