marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Separate Zapier, web, API, and leaf access planes with NATS authz
Some checks are pending
offline / test (push) Waiting to run
Details

Browse source 
Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).
This commit is contained in:
George Lambert 2026-09-11 16:05:05 -04:00
parent ac38676645
commit 1b199ca4d4
117 changed files with 2640 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

33
packages/overview/08-diagrams.md
View file

@ -8,23 +8,24 @@ SVG files in [`diagrams/`](diagrams/). The same shapes are repeated below in mer
```mermaid
flowchart LR
Z[Zapier cloud apps] -->|HTTPS x-api-key| E[zappier-edge]
Cust[customer portal] -->|HTTPS statement| E
CS[customer-service] -->|NATS statement/adjust| N[NATS 3-node cluster]
SA[sales-pricing] -->|NATS statement| N
AC[accounting-export] -->|NATS statement| N
E -->|NATS billing| N
BAL[account-balance] -->|reply verae.billing.*| N
E -->|HTTPS metered| M[verae-middleware]
M -->|HTTPS| C[Verae chain]
M -->|JetStream| N
Z[Zapier cloud] -->|HTTPS plane=zapier| AZ[access-zapier]
Web[customer browser] -->|HTTPS plane=web| AW[access-web]
API[customer API] -->|HTTPS plane=api| AA[access-api]
Leaf[S2S leaf] -->|verae.access.leaf.in| AL[access-leaf]
AZ --> Authz[access-authz]
AW --> Authz
AA --> Authz
AL --> Authz
CS[staff CS/sales] --> Authz
Authz -->|allow| N[NATS cluster]
BAL[account-balance] --> N
AZ -->|HTTPS| M[verae-middleware]
M --> N
N --> P[job-poller]
N --> W[webhook-deliver]
N --> A[archive-aggregator]
N --> R[WORM x N]
N --> T[tree-node x N]
P -->|HTTPS status| C
W -->|HTTPS REST Hook| Z
N --> R[WORM]
N --> T[tree-node]
P --> C[Verae chain]
M --> C
```
## 8.2 NATS.IO 3-server cluster