George Lambert
b4cccba80f
Add docs/PR-staff-role-switcher.md for the UI branch; link ENROLL, TOTP, and PKI READY packs in sibling verae-staff-iam plus companion IAM PR body.
70 lines
3.6 KiB
Markdown
70 lines
3.6 KiB
Markdown
# PR: feature/staff-role-switcher (verae-staff-ui)
|
|
|
|
**Repo:** `verae-staff-ui`
|
|
**Branch:** `feature/staff-role-switcher` → `main`
|
|
**Forgejo:** https://git.georgelambert.org/marchon/verae-staff-ui
|
|
**Companion PR:** `verae-staff-iam` same branch (`docs/PR-staff-role-switcher.md`)
|
|
|
|
Paste this body (or link this file) when opening the Forgejo pull request.
|
|
|
|
## Summary
|
|
|
|
Shared staff review UI picks up the **2026 brand kit**, a top-right **role interface switcher** (calls IAM `POST /session/role`), hash lookup panel polish, and operator docs that point at **ENROLL**, **TOTP**, and **PKI READY** packs in sibling `verae-staff-iam`.
|
|
|
|
## Why
|
|
|
|
- CS and access-staff share one review template; multi-role operators need the same Interface chrome as IAM app.html.
|
|
- Review hosts must stay plum-branded and must not emit customer `xVerae-` token keys.
|
|
- Operators opening staff-ui need one place to find enroll / 2FA / production PKI refuse docs.
|
|
|
|
## What landed (vs `main`)
|
|
|
|
### Role switcher
|
|
- [`public/role-switcher.js`](../public/role-switcher.js) — mounts when capabilities ≥ 2; `GET /me` + `POST /session/role` against IAM origin (`meta[name=staff-iam]` or `iam.<base>`)
|
|
- Wired from review / load path so department doors inherit chrome
|
|
|
|
### Brand + review
|
|
- `public/brand/tokens.css` + `public/verae-ui-kit.css`
|
|
- `public/review.html` — 2026 kit, hash lookup panel
|
|
- `src/load.js` inlines brand kit for hosts that only emit HTML
|
|
|
|
### Operator docs
|
|
- [`docs/README.md`](./README.md) links sibling IAM ENROLL / TOTP / PRODUCTION-PKI-REFUSE and edge SUPPORT
|
|
|
|
## Link: ENROLL · TOTP · PKI READY packs
|
|
|
|
Paths are monorepo-relative from this package (`../../verae-staff-iam/…`). On Forgejo, open the companion IAM PR or clone `verae-staff-iam` on the same branch.
|
|
|
|
| Pack | Sibling path | Role |
|
|
|------|--------------|------|
|
|
| **ENROLL** | [`verae-staff-iam/ENROLL.md`](../../verae-staff-iam/ENROLL.md) | Device cert mTLS status + CSR scaffold (default 501) |
|
|
| **TOTP** | [`verae-staff-iam/TOTP.md`](../../verae-staff-iam/TOTP.md) | Staff authenticator + `STAFF_TOTP_REQUIRED` |
|
|
| **PROD-CA cutover (READY)** | [`docs/PROD-CA-CUTOVER-RUNBOOK.md`](../../verae-staff-iam/docs/PROD-CA-CUTOVER-RUNBOOK.md) | Production CA mint/renew/revoke cutover (ops) |
|
|
| **AuthZ enroll (READY)** | [`docs/AUTHZ-ENROLL-DESIGN.md`](../../verae-staff-iam/docs/AUTHZ-ENROLL-DESIGN.md) | Design before real AuthZ mint path |
|
|
| **CRL/OCSP deploy (READY)** | [`docs/CRL-OCSP-DEPLOY-CHECKLIST.md`](../../verae-staff-iam/docs/CRL-OCSP-DEPLOY-CHECKLIST.md) | Production CRL/OCSP deploy checklist |
|
|
| Refuse matrix | [`docs/PRODUCTION-PKI-REFUSE.md`](../../verae-staff-iam/docs/PRODUCTION-PKI-REFUSE.md) | Lab 201 vs prod 501; no live mint in IAM |
|
|
| IAM PR body | [`docs/PR-staff-role-switcher.md`](../../verae-staff-iam/docs/PR-staff-role-switcher.md) | Full IAM change list + invariants |
|
|
|
|
Staff-ui does **not** mint certs or run TOTP crypto; it only consumes IAM session/role APIs and documents the operator path.
|
|
|
|
## Test plan
|
|
|
|
```sh
|
|
cd verae-staff-ui
|
|
npm test
|
|
# expect: 2/2 pass (title fill + plum brand kit inline, no customer token key)
|
|
```
|
|
|
|
Manual: load review HTML with `STAFF_IAM_URL` / `meta staff-iam` pointing at a running IAM on `feature/staff-role-switcher`; multi-role user shows Interface dropdown.
|
|
|
|
## Merge notes
|
|
|
|
- Merge **with** `verae-staff-iam` `feature/staff-role-switcher` so `/session/role` and catalog exist.
|
|
- Monorepo hosts that copy `packages/verae-staff-ui/public/review.html` should pick up brand + switcher together.
|
|
- No production PKI behavior changes in this package.
|
|
|
|
## Out of scope
|
|
|
|
- IAM server logic (see companion PR)
|
|
- Edge support APIs (see `zappier-edge` SUPPORT)
|
|
- Customer portal UI
|