Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

packages/verae-access-authz/test/health.test.js

@@ -0,0 +1,35 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+test('authz health policy and check', async () => {
+  const port = 18020;
+  const child = spawn(process.execPath, ['src/server.js'], {
+    cwd: root,
+    env: { ...process.env, PORT: String(port) },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((r) => setTimeout(r, 400));
+  try {
+    const h = await (await fetch(`http://127.0.0.1:${port}/health`)).json();
+    assert.equal(h.role, 'verae-access-authz');
+    const ok = await fetch(`http://127.0.0.1:${port}/check`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ plane: 'web', subject: 'verae.billing.statement.get' }),
+    });
+    assert.equal(ok.status, 200);
+    const no = await fetch(`http://127.0.0.1:${port}/check`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ plane: 'leaf', subject: 'verae.billing.balance.adjust' }),
+    });
+    assert.equal(no.status, 403);
+  } finally {
+    child.kill('SIGTERM');
+  }
+});

packages/verae-access-authz/test/policy.test.js

@@ -0,0 +1,66 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { authorize } from '../src/policy.js';
+import { accessAddress, parseAddress, PLANES } from '../src/subjects.js';
+
+test('five access planes', () => {
+  assert.deepEqual([...PLANES], ['zapier', 'web', 'api', 'leaf', 'staff']);
+});
+
+test('web may read statement and reload, not archive or jobs', () => {
+  assert.equal(authorize({ plane: 'web', subject: 'verae.billing.statement.get' }).allow, true);
+  assert.equal(
+    authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'reload' }).allow,
+    true,
+  );
+  assert.equal(
+    authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow,
+    false,
+  );
+  assert.equal(authorize({ plane: 'web', subject: 'verae.archive.put' }).allow, false);
+  assert.equal(authorize({ plane: 'web', subject: 'verae.zapier.jobs.watch' }).allow, false);
+});
+
+test('leaf may archive and jobs, not billing adjust', () => {
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.put' }).allow, true);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.reply.abc' }).allow, true);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.zapier.jobs.watch' }).allow, true);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.balance.adjust' }).allow, false);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.statement.get' }).allow, false);
+});
+
+test('zapier may meter and jobs, not customer statement or credits', () => {
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.zapier.jobs.watch' }).allow, true);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.usage.recorded' }).allow, true);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.statement.get' }).allow, false);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.balance.adjust' }).allow, false);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.archive.put' }).allow, false);
+});
+
+test('api may statement and usage, not credits or archive', () => {
+  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.statement.get' }).allow, true);
+  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.usage.recorded' }).allow, true);
+  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.balance.adjust' }).allow, false);
+  assert.equal(authorize({ plane: 'api', subject: 'verae.archive.query' }).allow, false);
+});
+
+test('staff may credit and statement, not archive', () => {
+  assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow, true);
+  assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.statement.get' }).allow, true);
+  assert.equal(authorize({ plane: 'staff', subject: 'verae.archive.put' }).allow, false);
+});
+
+test('access-prefixed address is mapped to internal', () => {
+  const addr = accessAddress('leaf', 'verae.archive.put');
+  assert.equal(addr, 'verae.access.leaf.archive.put');
+  const parsed = parseAddress(addr);
+  assert.equal(parsed.plane, 'leaf');
+  assert.equal(parsed.internal, 'verae.archive.put');
+  assert.equal(authorize({ plane: 'leaf', subject: addr }).allow, true);
+  assert.equal(authorize({ plane: 'web', subject: addr }).allow, false);
+});
+
+test('unknown plane and authz subjects denied', () => {
+  assert.equal(authorize({ plane: 'partner', subject: 'verae.archive.put' }).allow, false);
+  assert.equal(authorize({ plane: 'web', subject: 'verae.access.authz.check' }).allow, false);
+});