marchon/master-zapier-plan-draft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Bind each customer to a Verae userId for hop tracing
Some checks are pending
offline / test (push) Waiting to run
Details

Browse source 
Signup registers/binds a Verae central user and stores veraeUserId. Public access stays the zappier API key. Chain JWTs stay server-side behind tokenRef. Authz, billing, and jobs.watch carry veraeUserId.
This commit is contained in:
George Lambert 2026-09-11 16:18:06 -04:00
parent 1b199ca4d4
commit 345aeeead9
79 changed files with 703 additions and 95 deletions
Download patch file Download diff file Expand all files Collapse all files

5
packages/zappier/tests/portal.test.ts
View file

@ -19,7 +19,7 @@ async function signup(app: ReturnType<typeof buildApp>['app'], email = 'ada@exam
.post('/portal/api/signup')
.send({ name: 'Ada', email, password: 'super-secret-1' });
expect(res.status).toBe(201);
return res.body as { token: string; customer: { id: string; apiKey: string } };
return res.body as { token: string; customer: { id: string; apiKey: string; veraeUserId?: string } };
}
describe('portal signup + login', () => {
@ -34,6 +34,9 @@ describe('portal signup + login', () => {
expect(me.status).toBe(200);
expect(me.body.tierId).toBe('free');
expect(me.body.balanceCents).toBe(0);
expect(customer.veraeUserId).toMatch(/^vu_[0-9a-f]{16}$/);
expect(me.body.veraeUserId).toBe(customer.veraeUserId);
expect(JSON.stringify(me.body)).not.toMatch(/eyJ|mock-jwt|veraeToken/);
});
it('never leaks passwordHash or totpSecret through the API', async () => {