marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
master-zapier-plan-draft/packages/verae-staff-iam
History
George Lambert c32b65038a
Some checks are pending
offline / test (push) Waiting to run
Details
Turn lab IAM on, move portal to access-web, harden sessions and receipts. 
Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can
credit (agent is the IAM user) and cannot export; operator can fleet
POST; admin /me is owner. Portal is the public web door at :3021/portal/.
IAM sessions persist; login is rate-limited per user; receipt PDF is
branded. lan-134 stays disabled.
2026-09-11 18:59:18 -04:00
..
public Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00
src Turn lab IAM on, move portal to access-web, harden sessions and receipts. 2026-09-11 18:59:18 -04:00
test Turn lab IAM on, move portal to access-web, harden sessions and receipts. 2026-09-11 18:59:18 -04:00
NATS.md Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00
package.json Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00
README.md Turn lab IAM on, move portal to access-web, harden sessions and receipts. 2026-09-11 18:59:18 -04:00
SUMMARY.md Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00

README.md

verae-staff-iam

Named internal staff accounts with roles and permissions. Source of truth for who may use CS, sales, accounting, the staff plane, the operator console, and the billing admin console.

Forgejo: https://git.georgelambert.org/marchon/verae-staff-iam

Port :3028. UI: sign-in, people, roles, audit.

Seed lab users

Username Password Roles
admin admin-dev-key owner (all)
cs cs-dev-key cs
sales sales-dev-key sales
accounting acct-dev-key accounting
operator fleet-dev-key operator

Override with IAM_OWNER_PASSWORD, IAM_CS_PASSWORD, etc. Persist: STAFF_IAM_PATH (users, audit, sessions). Login is rate-limited (8 failures / 10 minutes / IP).

Wire other doors

STAFF_IAM_URL=http://127.0.0.1:3028
STAFF_AUTH=1   # department HTML still redirects if check fails

GET /check?permission=cs.credit — cookie or Authorization: Bearer. Cookie name remains staff_session. Multi-host: STAFF_COOKIE_DOMAIN.

Roles

owner, iam-admin, billing-admin, cs, sales, accounting, operator, viewer. Permissions are listed on /roles.