Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

packages/zappier-customer-service/src/nats-billing.js

@@ -1,20 +1,44 @@
 export const SUBJECTS = {
   STATEMENT_GET: 'verae.billing.statement.get',
   BALANCE_ADJUST: 'verae.billing.balance.adjust',
+  AUTHZ_CHECK: 'verae.access.authz.check',
 };
+const PLANE = 'staff';
+
+async function authz(subject, payload) {
+  const http = process.env.AUTHZ_URL;
+  if (!http && !process.env.NATS_URL) return { allow: true, subject };
+  if (http) {
+    const r = await fetch(`${http.replace(/\/$/, '')}/check`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ plane: PLANE, subject, kind: payload?.kind, payload, principal: payload?.agent }),
+    });
+    return r.json();
+  }
+  return { allow: true, subject };
+}
 
 export async function billingRequest(subject, payload) {
+  const decision = await authz(subject, payload);
+  if (decision && decision.allow === false) {
+    const err = new Error(decision.reason || 'denied');
+    err.status = 403;
+    err.decision = decision;
+    throw err;
+  }
   const url = process.env.NATS_URL;
   if (!url) return null;
   try {
     const { connect, StringCodec } = await import('nats');
     const nc = await connect({ servers: url.split(','), name: 'zappier-customer-service' });
     const sc = StringCodec();
-    const m = await nc.request(subject, sc.encode(JSON.stringify(payload)), { timeout: 2000 });
+    const m = await nc.request(subject, sc.encode(JSON.stringify({ ...payload, plane: PLANE })), { timeout: 2000 });
     const out = JSON.parse(sc.decode(m.data) || '{}');
     await nc.close();
     return out;
-  } catch {
+  } catch (err) {
+    if (err.status === 403) throw err;
     return null;
   }
 }

packages/zappier-customer-service/src/server.js

@@ -71,7 +71,7 @@ const server = http.createServer(async (req, res) => {
     }
     json(404, { error: 'not found' });
   } catch (err) {
-    json(502, { error: err.message });
+    json(err.status === 403 ? 403 : 502, { error: err.message, ...(err.decision || {}) });
   }
 });