History

George Lambert d299d245e8 Some checks are pending offline / test (push) Waiting to run Details Add internal staff IAM: named users, roles, and management permissions. verae-staff-iam (:3028) is the people directory — owner, billing-admin, cs, sales, accounting, operator, viewer — with scrypt passwords, sessions, and an audit log. Admin console login uses it when STAFF_IAM_URL is set and hides tabs the account cannot use. CS/sales/accounting/staff/fleet check permissions such as cs.credit and fleet.operate. Shared staff key remains only as a fallback when IAM is unset.		2026-09-11 18:36:12 -04:00
..
public	Add internal staff IAM: named users, roles, and management permissions.	2026-09-11 18:36:12 -04:00
src	Add internal staff IAM: named users, roles, and management permissions.	2026-09-11 18:36:12 -04:00
test	Add internal staff IAM: named users, roles, and management permissions.	2026-09-11 18:36:12 -04:00
NATS.md	Add internal staff IAM: named users, roles, and management permissions.	2026-09-11 18:36:12 -04:00
package.json	Add internal staff IAM: named users, roles, and management permissions.	2026-09-11 18:36:12 -04:00
README.md	Add internal staff IAM: named users, roles, and management permissions.	2026-09-11 18:36:12 -04:00
SUMMARY.md	Add internal staff IAM: named users, roles, and management permissions.	2026-09-11 18:36:12 -04:00

README.md

verae-staff-iam

Named internal staff accounts with roles and permissions. Source of truth for who may use CS, sales, accounting, the staff plane, the operator console, and the billing admin console.

Forgejo: https://git.georgelambert.org/marchon/verae-staff-iam

Port :3028. UI: sign-in, people, roles, audit.

Seed lab users

Username	Password	Roles
`admin`	`admin-dev-key`	owner (all)
`cs`	`cs-dev-key`	cs
`sales`	`sales-dev-key`	sales
`accounting`	`acct-dev-key`	accounting
`operator`	`fleet-dev-key`	operator

Override with IAM_OWNER_PASSWORD, IAM_CS_PASSWORD, etc. Persist: STAFF_IAM_PATH.

Wire other doors

STAFF_IAM_URL=http://127.0.0.1:3028
STAFF_AUTH=1   # department HTML still redirects if check fails

GET /check?permission=cs.credit — cookie or Authorization: Bearer. Cookie name remains staff_session. Multi-host: STAFF_COOKIE_DOMAIN.

Roles

owner, iam-admin, billing-admin, cs, sales, accounting, operator, viewer. Permissions are listed on /roles.