Adjacent work: PDF receipts, encrypted blob+share mock, NATS tunnel, SHA256 Zapier action

Around remaining blockers (Zapier login, live Verae): generate PDF receipts
without extra deps; AES-256-GCM object store with tenant isolation and share
tokens; scripts/nats-tunnel.sh to NS1; SHA256 Hash Text local Zapier action;
scripts/test-offline.sh for the no-login suite.

Learned: other-tenant object GET is 403; share token is the mock unwrap path.
This commit is contained in:
George Lambert 2026-09-09 02:59:06 -04:00
parent c8f9d01a04
commit 645a24909a
45 changed files with 1053 additions and 24 deletions

16
scripts/nats-tunnel.sh Executable file
View file

@ -0,0 +1,16 @@
#!/usr/bin/env bash
# SSH tunnel NS1 JetStream (127.0.0.1:4222 on 70.88.205.138) to local 14222.
set -euo pipefail
HOST="${NATS_SSH_HOST:-marchon@70.88.205.138}"
LOCAL_PORT="${NATS_LOCAL_PORT:-14222}"
REMOTE="127.0.0.1:4222"
if nc -z 127.0.0.1 "$LOCAL_PORT" 2>/dev/null; then
echo "already listening on 127.0.0.1:${LOCAL_PORT}"
exit 0
fi
ssh -fN -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 \
-L "${LOCAL_PORT}:${REMOTE}" "$HOST"
echo "NATS_URL=nats://127.0.0.1:${LOCAL_PORT}"
echo "export NATS_URL=nats://127.0.0.1:${LOCAL_PORT} NATS_ENABLED=true"