Bind each customer to a Verae userId for hop tracing

Signup registers/binds a Verae central user and stores veraeUserId. Public access stays the zappier API key. Chain JWTs stay server-side behind tokenRef. Authz, billing, and jobs.watch carry veraeUserId.

packages/verae-access-authz/src/policy.js

@@ -89,6 +89,8 @@ export function authorize(req) {
     plane,
     subject: internal,
     principal: req?.principal || null,
+    veraeUserId: req?.veraeUserId || req?.payload?.veraeUserId || null,
+    traceId: req?.traceId || req?.payload?.traceId || null,
     reason: 'ok',
   };
 }

packages/verae-access-authz/test/policy.test.js

@@ -60,6 +60,19 @@ test('access-prefixed address is mapped to internal', () => {
   assert.equal(authorize({ plane: 'web', subject: addr }).allow, false);
 });
 
+test('allow echoes veraeUserId for hop tracing', () => {
+  const out = authorize({
+    plane: 'web',
+    subject: 'verae.billing.statement.get',
+    principal: 'cust_1',
+    veraeUserId: 'vu_deadbeefdeadbeef',
+    traceId: 'tr-1',
+  });
+  assert.equal(out.allow, true);
+  assert.equal(out.veraeUserId, 'vu_deadbeefdeadbeef');
+  assert.equal(out.traceId, 'tr-1');
+});
+
 test('unknown plane and authz subjects denied', () => {
   assert.equal(authorize({ plane: 'partner', subject: 'verae.archive.put' }).allow, false);
   assert.equal(authorize({ plane: 'web', subject: 'verae.access.authz.check' }).allow, false);