verae-staff-ui/docs/PR-staff-role-switcher.md

PR: feature/staff-role-switcher (verae-staff-ui)

Repo: verae-staff-ui
Branch: feature/staff-role-switcher → main
Forgejo: https://git.georgelambert.org/marchon/verae-staff-ui
Companion PR: verae-staff-iam same branch (docs/PR-staff-role-switcher.md)

Paste this body (or link this file) when opening the Forgejo pull request.

Summary

Shared staff review UI picks up the 2026 brand kit, a top-right role interface switcher (calls IAM POST /session/role), hash lookup panel polish, and operator docs that point at ENROLL, TOTP, and PKI READY packs in sibling verae-staff-iam.

Why

• CS and access-staff share one review template; multi-role operators need the same Interface chrome as IAM app.html.
• Review hosts must stay plum-branded and must not emit customer xVerae- token keys.
• Operators opening staff-ui need one place to find enroll / 2FA / production PKI refuse docs.

What landed (vs main)

Role switcher

• public/role-switcher.js — mounts when capabilities ≥ 2; GET /me + POST /session/role against IAM origin (meta[name=staff-iam] or iam.<base>)
• Wired from review / load path so department doors inherit chrome

Brand + review

• public/brand/tokens.css + public/verae-ui-kit.css
• public/review.html — 2026 kit, hash lookup panel
• src/load.js inlines brand kit for hosts that only emit HTML

Operator docs

• docs/README.md links sibling IAM ENROLL / TOTP / PRODUCTION-PKI-REFUSE and edge SUPPORT

Link: ENROLL · TOTP · PKI READY packs

Paths are monorepo-relative from this package (../../verae-staff-iam/…). On Forgejo, open the companion IAM PR or clone verae-staff-iam on the same branch.

Pack	Sibling path	Role
ENROLL	verae-staff-iam/ENROLL.md	Device cert mTLS status + CSR scaffold (default 501)
TOTP	verae-staff-iam/TOTP.md	Staff authenticator + STAFF_TOTP_REQUIRED
PROD-CA cutover (READY)	docs/PROD-CA-CUTOVER-RUNBOOK.md	Production CA mint/renew/revoke cutover (ops)
AuthZ enroll (READY)	docs/AUTHZ-ENROLL-DESIGN.md	Design before real AuthZ mint path
CRL/OCSP deploy (READY)	docs/CRL-OCSP-DEPLOY-CHECKLIST.md	Production CRL/OCSP deploy checklist
Refuse matrix	docs/PRODUCTION-PKI-REFUSE.md	Lab 201 vs prod 501; no live mint in IAM
IAM PR body	docs/PR-staff-role-switcher.md	Full IAM change list + invariants

Staff-ui does not mint certs or run TOTP crypto; it only consumes IAM session/role APIs and documents the operator path.

Test plan

cd verae-staff-ui
npm test
# expect: 2/2 pass (title fill + plum brand kit inline, no customer token key)

Manual: load review HTML with STAFF_IAM_URL / meta staff-iam pointing at a running IAM on feature/staff-role-switcher; multi-role user shows Interface dropdown.

Merge notes

• Merge with verae-staff-iam feature/staff-role-switcher so /session/role and catalog exist.
• Monorepo hosts that copy packages/verae-staff-ui/public/review.html should pick up brand + switcher together.
• No production PKI behavior changes in this package.

Out of scope

• IAM server logic (see companion PR)
• Edge support APIs (see zappier-edge SUPPORT)
• Customer portal UI