History

George Lambert c32b65038a Some checks are pending offline / test (push) Waiting to run Details Turn lab IAM on, move portal to access-web, harden sessions and receipts. Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can credit (agent is the IAM user) and cannot export; operator can fleet POST; admin /me is owner. Portal is the public web door at :3021/portal/. IAM sessions persist; login is rate-limited per user; receipt PDF is branded. lan-134 stays disabled.		2026-09-11 18:59:18 -04:00
..
src	Turn lab IAM on, move portal to access-web, harden sessions and receipts.	2026-09-11 18:59:18 -04:00
test	Turn lab IAM on, move portal to access-web, harden sessions and receipts.	2026-09-11 18:59:18 -04:00
NATS.md	Separate Zapier, web, API, and leaf access planes with NATS authz	2026-09-11 16:05:05 -04:00
package-lock.json	Separate Zapier, web, API, and leaf access planes with NATS authz	2026-09-11 16:05:05 -04:00
package.json	Separate Zapier, web, API, and leaf access planes with NATS authz	2026-09-11 16:05:05 -04:00
README.md	Turn lab IAM on, move portal to access-web, harden sessions and receipts.	2026-09-11 18:59:18 -04:00

README.md

verae-access-web

Direct web access plane. Customer browsers hit this process, not Zapier and not the NATS port.

Forgejo: https://git.georgelambert.org/marchon/verae-access-web

Every NATS hop is verae.access.web.* → verae.access.authz.check → internal verae.billing.statement.get (reload only, not CS credits).

Route	Job
`GET /health`	`{ plane: "web" }`
`GET /portal/`	Customer portal (static)
`` `/portal/api/`	Proxy to loopback zappier-edge
`GET /statement/:id`	Authz then statement
`POST /reload`	Authz then `balance.adjust` kind=reload

Port :3021. Customer portal (public door): http://0.0.0.0:3021/portal/ — static from packages/zappier/portal, /portal/api proxied to loopback zappier-edge. Edge itself stays on 127.0.0.1:3000.