marchon/verae-staff-iam
Watch
1
0
Fork
You've already forked verae-staff-iam
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
16 commits 5 branches 0 tags 500 KiB
Commit graph

16 commits

This branch
This branch
All branches
Author SHA1 Message Date
George Lambert
ca117eb458 feat: LAB_CA_ENABLE opt-in lab mint via lab-test-ca.sh (prod refused) 
POST /enroll/csr returns 201 + X-Lab-CA when lab-pki ready; default 501.
 2026-10-14 01:08:21 -04:00
George Lambert
7a211356a7 feat: lab-test-ca.sh openssl lab CA (not wired to enroll) 
LAB ONLY self-signed root + sign CSR; POST /enroll/csr still 501.
 2026-10-14 01:00:38 -04:00
George Lambert
566b29f4ac feat: GET /roles/catalog and /users/:id/roles for starter/ender/admin 
Public catalog for dual-staff SoT when edge STAFF_IAM_URL is set.
 2026-10-14 00:55:27 -04:00
George Lambert
5e2d0b979a feat: TODO-7 A4 — CSR PEM shape validation before 501 
Invalid PEM armor → 400; valid-looking still 501 not_implemented; audit without PEM body.
 2026-10-13 23:38:37 -04:00
George Lambert
f8d0a1249f feat: enroll status csrSchemaUrl always; TEST-CA-DESIGN doc 
TODO-6 L4/I4 — PKI next-level scaffold without fake mint.
 2026-10-13 23:23:48 -04:00
George Lambert
ae820a5db6 feat: GET /enroll/csr/schema field map (mint still 501) 
Schema-only CSR contract for future live PKI; no fake crypto.
 2026-10-13 23:08:58 -04:00
George Lambert
128ad01ff9 feat: POST /enroll/csr returns 501 scaffold (no fake PKI mint) 
Honest not_implemented CSR path with nextSteps; backlog updated.
 2026-10-13 22:25:53 -04:00
George Lambert
533c30bd35 docs: PKI-MINT-BACKLOG for live device-cert not shipped 2026-10-13 21:58:50 -04:00
George Lambert
f8067cbca9 docs: ENROLL.md refresh and TOTP.md for staff 2FA and device-cert status 
Document STAFF_TOTP_REQUIRED and enroll/status fields for operators.
 2026-10-13 21:46:31 -04:00
George Lambert
d026f7eeb4 feat: enroll panel proxyHeadersSeen chips on login/app 2026-10-13 21:18:29 -04:00
George Lambert
9ce87e8a20 feat: 2026 brand staff IAM — TOTP gate, enroll/status, UI kit 
- STAFF_TOTP_REQUIRED enroll path and TOTP helpers
- enroll/status nextSteps, proxyHeadersSeen, ENROLL.md
- Brand kit on login/app public pages
 2026-10-13 21:11:59 -04:00
George Lambert
7805b3045b feat: Security tab hooks for TOTP and mTLS cert minting 
Add Account Security UI with password change, authenticator enrollment,
and a reserved client-certificate mint slot (window.StaffIamSecurity.onCertMount)
so the parallel mTLS login work can wire without clobbering force-change/TOTP.

JSON APIs (/check etc.) return 403 must_change_password rather than HTML 302
so department doors can redirect cleanly.
 2026-10-05 15:42:05 -04:00
George Lambert
0078a64b07 feat: force first-login password change + optional TOTP 
New staff accounts default to mustChangePassword=true. After login,
/check and staff doors return 403 must_change_password until
POST /password/change succeeds; then /enroll-2fa offers optional
authenticator setup (skip allowed). Login requires totpCode when
enabled. Admin POST /admin/mark-must-change re-marks invite owners.
 2026-10-05 15:39:34 -04:00
George Lambert
b8670c8e18 feat: staff role interface switcher and session currentRole 
- IAM sessions carry capabilities[] + currentRole; POST /session/role switches
- ROLE_INTERFACES map roles to CS/Sales/Acct/Admin/Fleet door URLs
- CORS for *.zapier.georgelambert.org so staff UIs can call IAM
- Top-right Interface dropdown when user has >=2 capabilities
- Admin People & roles UI already assigns roles; clarified framing
- Shared switcher in verae-staff-ui; fallbacks in CS/Sales/Acct/staff plane
 2026-10-05 15:27:37 -04:00
George Lambert
a341a1e187 docs: bring README.md in line with Standard Readme 2026-09-22 09:58:35 -04:00
George Lambert
84fd73fe95 Initial import of verae-staff-iam from zapier monorepo 2026-09-11 19:55:17 -04:00