Adjacent work: PDF receipts, encrypted blob+share mock, NATS tunnel, SHA256 Zapier action

Around remaining blockers (Zapier login, live Verae): generate PDF receipts
without extra deps; AES-256-GCM object store with tenant isolation and share
tokens; scripts/nats-tunnel.sh to NS1; SHA256 Hash Text local Zapier action;
scripts/test-offline.sh for the no-login suite.

Learned: other-tenant object GET is 403; share token is the mock unwrap path.
This commit is contained in:
George Lambert 2026-09-09 02:59:06 -04:00
parent c8f9d01a04
commit 645a24909a
45 changed files with 1053 additions and 24 deletions

16
scripts/nats-tunnel.sh Executable file
View file

@ -0,0 +1,16 @@
#!/usr/bin/env bash
# SSH tunnel NS1 JetStream (127.0.0.1:4222 on 70.88.205.138) to local 14222.
set -euo pipefail
HOST="${NATS_SSH_HOST:-marchon@70.88.205.138}"
LOCAL_PORT="${NATS_LOCAL_PORT:-14222}"
REMOTE="127.0.0.1:4222"
if nc -z 127.0.0.1 "$LOCAL_PORT" 2>/dev/null; then
echo "already listening on 127.0.0.1:${LOCAL_PORT}"
exit 0
fi
ssh -fN -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 \
-L "${LOCAL_PORT}:${REMOTE}" "$HOST"
echo "NATS_URL=nats://127.0.0.1:${LOCAL_PORT}"
echo "export NATS_URL=nats://127.0.0.1:${LOCAL_PORT} NATS_ENABLED=true"

21
scripts/test-offline.sh Executable file
View file

@ -0,0 +1,21 @@
#!/usr/bin/env bash
# Tests that do not need Zapier login or live api.veraetime.net.
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
cd "$ROOT"
export MOCK_VERAE=true
npm run gate:0
npm run gate:1
npm run gate:2
npm run gate:3
npm run gate:4
npm run gate:5
npm run gate:6
npm run gate:10
npm run gate:11
npm --prefix packages/verae-zapier-middleware run test:hash
node --test packages/verae-zapier-middleware/test/integration/receipt.test.js
node --test packages/verae-zapier-middleware/test/integration/objects.test.js
npm run test:activate
npm run test:zappier
echo "OFFLINE SUITE PASSED"