marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
master-zapier-plan-draft/packages/verae-staff-iam
History
George Lambert 2bb3884a1b
Some checks are pending
offline / test (push) Waiting to run
Details
Close remaining IAM JSON doors and re-walk the lab. 
CS/sales/accounting/staff list endpoints and sales pricing writes
require IAM; fleet service env sets STAFF_AUTH=1. Department tests
use a private books file so lab NATS does not leak into them.
2026-09-11 19:08:20 -04:00
..
public Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00
src Turn lab IAM on, move portal to access-web, harden sessions and receipts. 2026-09-11 18:59:18 -04:00
test Turn lab IAM on, move portal to access-web, harden sessions and receipts. 2026-09-11 18:59:18 -04:00
NATS.md Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00
package.json Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00
README.md Close remaining IAM JSON doors and re-walk the lab. 2026-09-11 19:08:20 -04:00
SUMMARY.md Add internal staff IAM: named users, roles, and management permissions. 2026-09-11 18:36:12 -04:00

README.md

verae-staff-iam

Named internal staff accounts with roles and permissions. Source of truth for who may use CS, sales, accounting, the staff plane, the operator console, and the billing admin console.

Forgejo: https://git.georgelambert.org/marchon/verae-staff-iam

Port :3028. UI: sign-in, people, roles, audit.

Seed lab users

Username Password Roles
admin admin-dev-key owner (all)
cs cs-dev-key cs
sales sales-dev-key sales
accounting acct-dev-key accounting
operator fleet-dev-key operator

Override with IAM_OWNER_PASSWORD, IAM_CS_PASSWORD, etc. Persist: STAFF_IAM_PATH (users, audit, sessions). Login is rate-limited (8 failures / 10 minutes / IP+username). JSON APIs return 401/403; HTML doors 302 to /login.

Wire other doors

STAFF_IAM_URL=http://127.0.0.1:3028
STAFF_AUTH=1   # department HTML still redirects if check fails

GET /check?permission=cs.credit — cookie or Authorization: Bearer. Cookie name remains staff_session. Multi-host: STAFF_COOKIE_DOMAIN.

Roles

owner, iam-admin, billing-admin, cs, sales, accounting, operator, viewer. Permissions are listed on /roles.