George Lambert
c32b65038a
Some checks are pending
offline / test (push) Waiting to run
Fleet and department doors now check STAFF_IAM_URL. Walkthrough: cs can credit (agent is the IAM user) and cannot export; operator can fleet POST; admin /me is owner. Portal is the public web door at :3021/portal/. IAM sessions persist; login is rate-limited per user; receipt PDF is branded. lan-134 stays disabled.
74 lines
3.6 KiB
Markdown
74 lines
3.6 KiB
Markdown
# Action log
|
||
|
||
## 2026-09-11 — bootstrap
|
||
|
||
- Created this repo to record decisions while executing cleanup items 1–5 (and a second pass on 2–5).
|
||
- Assumption: single developer, lab only; breaking changes allowed.
|
||
|
||
## Step 1 — account-balance is the prepaid source of truth
|
||
|
||
- Persist books to `BOOKS_PATH` (atomic JSON).
|
||
- Mutations go through `balance.adjust` / `usage.recorded`; edge cache `balanceCents` is updated from the books reply only.
|
||
- Local cache mutate only when `NATS_URL` and `ACCOUNT_BALANCE_URL` are both unset (tests).
|
||
|
||
## Step 2 — identity join
|
||
|
||
- `zappier-identity` mailbox: `verae.identity.bind` / `verae.identity.lookup`.
|
||
- Portal + middleware tenants store `veraeUserId`; JWT never public.
|
||
|
||
## Step 3 — access planes are the public doors
|
||
|
||
- zappier-edge binds loopback (`127.0.0.1:3000`).
|
||
- Public: access-web `:3021`, access-api `:3022`, access-leaf `:3023`, access-zapier `:3024`, access-staff `:3025`.
|
||
|
||
## Step 4 — leaf hardening
|
||
|
||
- `verae-nats-accounts` holds nats.conf + subject policy.
|
||
- Leaf token required; billing subjects denied in policy file and access-leaf.
|
||
|
||
## Step 5 — fleet spawn
|
||
|
||
- Prefer local machines for HTTP `spawn.command` services.
|
||
- Disable lan-134 unless `FLEET_ENABLE_LAN134=1`.
|
||
- SSH spawn timeout 8s; failed hosts skipped.
|
||
|
||
## 2026-09-11 — IAM on lab, portal door, hardening
|
||
|
||
- Restarted fleet with `STAFF_IAM_URL`. Walk: cs credits (agent=`cs`) and is 403 on accounting export; operator fleet POST 200, cs 403; admin `/me` permissions `*`.
|
||
- Portal public door `verae-access-web` `:3021/portal/` (static + `/portal/api` → loopback edge).
|
||
- IAM sessions persist in JSON; login rate-limit per IP+username (8/10min); credits stamp IAM username as authz principal.
|
||
- lan-134 remains disabled unless `FLEET_ENABLE_LAN134=1`. Receipt PDF branded (indigo header + legal footer).
|
||
|
||
## 2026-09-11 — staff IAM
|
||
|
||
- New `verae-staff-iam` :3028 — users, roles, permissions, sessions, audit UI.
|
||
- Admin login uses IAM when `STAFF_IAM_URL` is set; tabs hide without permission.
|
||
- CS/sales/accounting/access-staff/fleet mutating APIs check `cs.credit`, `sales.quote`, `accounting.export`, `fleet.operate`, etc.
|
||
- Seed: admin/cs/sales/accounting/operator. Shared staff key is fallback only.
|
||
|
||
## 2026-09-11 — last three UI leftovers
|
||
|
||
- Swagger `/docs` stays stock; banner names it OpenAPI explorer.
|
||
- Shared template `verae-staff-ui` for CS + access-staff.
|
||
- `STAFF_COOKIE_DOMAIN` + nginx example for multi-host.
|
||
|
||
## 2026-09-11 — names, staff session, exclusive jobs.events
|
||
|
||
- Account-balance stores display names (`customer.put` + lookup by name). Edge writes names on customer create/edit; CS/sales/accounting/staff join from edge if the ledger has no name.
|
||
- New repo `verae-staff-session` (:3027). Department HTML redirects when `STAFF_AUTH=1`.
|
||
- `JOBS_EVENTS_EXCLUSIVE=1` makes `verae-jobs-events` the durable consumer; middleware webhook router backs off.
|
||
- Catalog index is cards. Disabled fleet machines are grey, not degraded yellow.
|
||
|
||
## 2026-09-11 — UI design-system pass
|
||
|
||
- Restyled CS/sales/accounting/access-staff to portal indigo; dollars + names.
|
||
- Fleet ⋯ menus, role chips, Docs cards, 0.0.0.0 copy, simulator indigo (orange = faults).
|
||
- Portal masked API key; admin customer drawer; empty invoice illustrations.
|
||
- Catalog system-ui. New independent repo **UI-Docs** (walkthrough, screenshots, UI-REVIEW.pdf).
|
||
|
||
## Second pass (2–5)
|
||
|
||
- Identity used from portal when `IDENTITY_URL` set.
|
||
- Leaf loads allow-list from nats-accounts `policy.json`.
|
||
- Staff plane is a first-class mailbox (`verae-access-staff`).
|
||
- jobs.events mailbox process `verae-jobs-events` (passthrough + count).
|