Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

packages/verae-access-zapier/src/server.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * Zapier Platform access plane only. No portal, no customer API keys, no leaf.
+ * Zapier cloud still never connects to NATS; this process does after authz.
+ */
+import http from 'node:http';
+
+const PORT = Number(process.env.PORT || 3024);
+const AUTHZ = (process.env.AUTHZ_URL || 'http://127.0.0.1:3020').replace(/\/$/, '');
+const MW = (process.env.ZAPPIER_UPSTREAM || 'http://127.0.0.1:3100').replace(/\/$/, '');
+const PLANE = 'zapier';
+
+async function check(subject, principal) {
+  const r = await fetch(`${AUTHZ}/check`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ plane: PLANE, subject, principal }),
+  });
+  return r.json();
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url || '/', `http://127.0.0.1:${PORT}`);
+  const json = (code, obj) => {
+    res.writeHead(code, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(obj));
+  };
+  try {
+    if (req.method === 'GET' && url.pathname === '/health') {
+      return json(200, { ok: true, role: 'verae-access-zapier', plane: PLANE });
+    }
+    if (url.pathname.startsWith('/portal') || url.pathname.startsWith('/admin')) {
+      return json(404, { error: 'zapier plane has no portal/admin', plane: PLANE });
+    }
+    if (req.method === 'POST' && (url.pathname === '/v1/timestamp' || url.pathname === '/zapier/v1/timestamp')) {
+      const gate = await check('verae.zapier.jobs.watch', 'zapier-app');
+      if (!gate.allow) return json(403, gate);
+      const chunks = [];
+      for await (const c of req) chunks.push(c);
+      const r = await fetch(`${MW}/zapier/v1/timestamp`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: Buffer.concat(chunks),
+      });
+      return json(r.status, { ...(await r.json().catch(() => ({}))), plane: PLANE });
+    }
+    json(404, { error: 'not found', plane: PLANE });
+  } catch (err) {
+    json(502, { error: err.message });
+  }
+});
+
+server.listen(PORT, '0.0.0.0', () => {
+  process.stdout.write(`verae-access-zapier http://0.0.0.0:${PORT}/ plane=${PLANE}\n`);
+});