Milestone 0: import zappier billing, Verae middleware, and Zapier research
Compose-ready workspace: packages/zappier (rate card, portal, Stripe), packages/verae-zapier-middleware (timestamp + NATS), packages/verae-zapier (CLI app), vendor/zapier-platform, and research/zapier vendor corpus. Gate 0 structure checks pass. Product code and research are not yet wired.
This commit is contained in:
commit
b4150c8250
1364 changed files with 6814366 additions and 0 deletions
8
research/zapier/verae-zapier-api/.gitignore
vendored
Normal file
8
research/zapier/verae-zapier-api/.gitignore
vendored
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
node_modules/
|
||||
**/node_modules/
|
||||
**/data/
|
||||
.env
|
||||
*.log
|
||||
.DS_Store
|
||||
/tmp/
|
||||
verae-zapier-middleware/data/
|
||||
84
research/zapier/verae-zapier-api/README.md
Normal file
84
research/zapier/verae-zapier-api/README.md
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
# Verae Zapier Platform
|
||||
|
||||
Integration stack connecting **Zapier** to the Verae Timestamping Service (`https://api.veraetime.net`) via a hybrid **HTTP middleware edge + NATS JetStream workers**.
|
||||
|
||||
## Architecture (bottom line)
|
||||
|
||||
```text
|
||||
Users → Zapier UI
|
||||
Zapier cloud runs verae-zapier (CLI app)
|
||||
→ HTTPS → verae-zapier-middleware /zapier/v1/*
|
||||
→ (sync) HTTPS → api.veraetime.net
|
||||
→ (async) NATS JetStream → workers → api.veraetime.net
|
||||
→ Zapier REST Hook URLs
|
||||
```
|
||||
|
||||
- Zapier **never** connects to NATS.
|
||||
- Middleware HTTP handles auth, billing, and the public API surface.
|
||||
- NATS owns job watching, completion events, and reliable webhook delivery.
|
||||
|
||||
## Packages
|
||||
|
||||
| Path | Role |
|
||||
|------|------|
|
||||
| `verae-zapier-middleware/` | Express proxy + NATS workers (you host) |
|
||||
| `verae-zapier/` | Zapier Platform CLI app (runs on Zapier) |
|
||||
| `docs/` | Architecture + developer function reference |
|
||||
| `TODO.md` | Dependency-ordered plan with **test gates** |
|
||||
|
||||
## Quick start
|
||||
|
||||
```bash
|
||||
cd /Users/marchon/datacubes/verae-zapier-api
|
||||
|
||||
# Install (middleware)
|
||||
cd verae-zapier-middleware && npm install && cd ..
|
||||
|
||||
# Run documentation/structure gate
|
||||
npm run gate:0
|
||||
|
||||
# Run debug facility tests (Phase 1)
|
||||
npm run gate:1
|
||||
|
||||
# Enable failure tracing at runtime (examples)
|
||||
export DEBUG_VERAE=1 # all namespaces
|
||||
export DEBUG_VERAE=auth,nats,jobs # selected
|
||||
export DEBUG_VERAE_LEVEL=debug # debug | info | warn | error
|
||||
```
|
||||
|
||||
## Implementation order
|
||||
|
||||
Work **only** in the order defined in [TODO.md](TODO.md). Each phase ends with a **GATE** that must pass before the next phase.
|
||||
|
||||
```bash
|
||||
npm run gate:all # phases 0–12 in order; stops on first failure
|
||||
```
|
||||
|
||||
## Documentation map
|
||||
|
||||
| Document | Contents |
|
||||
|----------|----------|
|
||||
| [TODO.md](TODO.md) | Phased plan, dependencies, gates |
|
||||
| [docs/architecture/overview.md](docs/architecture/overview.md) | System design |
|
||||
| [docs/architecture/nats-subjects.md](docs/architecture/nats-subjects.md) | Subjects, streams, payloads |
|
||||
| [docs/developer/debugging.md](docs/developer/debugging.md) | Runtime debug tracing |
|
||||
| [docs/developer/modules/](docs/developer/modules/) | Function I/O reference per module |
|
||||
| [docs/plans/phase-gates.md](docs/plans/phase-gates.md) | Gate commands and acceptance criteria |
|
||||
|
||||
## Environment (middleware)
|
||||
|
||||
| Variable | Default | Purpose |
|
||||
|----------|---------|---------|
|
||||
| `PORT` | `3100` | HTTP listen port |
|
||||
| `VERAE_API_BASE_URL` | `http://localhost:8080` | Upstream Verae API |
|
||||
| `MOCK_VERAE` | `false` | Local mock of Verae HTTP API |
|
||||
| `NATS_URL` | `nats://127.0.0.1:4222` | NATS server |
|
||||
| `NATS_ENABLED` | `false` | Use JetStream workers vs in-process poller |
|
||||
| `TOKEN_SECRET` | dev secret | HMAC for middleware session tokens |
|
||||
| `DEBUG_VERAE` | unset | Runtime debug namespaces |
|
||||
| `DEBUG_VERAE_LEVEL` | `debug` | Minimum log level when debug enabled |
|
||||
| `STORE_PATH` | `./data/store.json` | MVP tenant/usage store |
|
||||
|
||||
## License
|
||||
|
||||
UNLICENSED — internal Verae platform work.
|
||||
657
research/zapier/verae-zapier-api/TODO.md
Normal file
657
research/zapier/verae-zapier-api/TODO.md
Normal file
|
|
@ -0,0 +1,657 @@
|
|||
# Verae Zapier Platform — Implementation TODO
|
||||
|
||||
**Product goal:** Hybrid **HTTP edge + NATS workers** middleware between Zapier servers and `https://api.veraetime.net`.
|
||||
|
||||
**Architecture bottom line:**
|
||||
|
||||
- Zapier never speaks NATS (HTTPS only).
|
||||
- `verae-zapier` (CLI app) runs on Zapier infrastructure and calls middleware.
|
||||
- `verae-zapier-middleware` exposes `/zapier/v1/*` (auth, billing, sync API).
|
||||
- **NATS + JetStream** owns job watching, completion events, and webhook delivery.
|
||||
- Workers call `api.veraetime.net` over HTTPS and POST REST Hooks to Zapier.
|
||||
|
||||
**How to use this file**
|
||||
|
||||
1. Work **top to bottom**. Phases are dependency-ordered.
|
||||
2. Every phase ends with a **GATE** (tests must pass) before the next phase starts.
|
||||
3. Mark items `[x]` only after the gate command succeeds and results are recorded under **Gate log**.
|
||||
4. Do not skip gates. Parallel work is only allowed **within** a phase when items share no dependency.
|
||||
|
||||
**Runtime debug**
|
||||
|
||||
- Failure tracing is off by default.
|
||||
- Enable at runtime: `DEBUG_VERAE=1` or `DEBUG_VERAE=auth,nats,jobs,webhooks,http,billing`.
|
||||
- See [docs/developer/debugging.md](docs/developer/debugging.md).
|
||||
|
||||
**Primary docs**
|
||||
|
||||
| Doc | Purpose |
|
||||
|-----|---------|
|
||||
| [README.md](README.md) | Repo overview and quick start |
|
||||
| [docs/architecture/overview.md](docs/architecture/overview.md) | System diagram and data flows |
|
||||
| [docs/architecture/nats-subjects.md](docs/architecture/nats-subjects.md) | Subject topology and payloads |
|
||||
| [docs/developer/modules/](docs/developer/modules/) | Per-module function reference |
|
||||
| [docs/plans/phase-gates.md](docs/plans/phase-gates.md) | Gate commands and acceptance criteria |
|
||||
| [docs/api/middleware-openapi.yaml](docs/api/middleware-openapi.yaml) | Zapier-facing OpenAPI |
|
||||
|
||||
---
|
||||
|
||||
## Legend
|
||||
|
||||
| Marker | Meaning |
|
||||
|--------|---------|
|
||||
| `[ ]` | Not started |
|
||||
| `[~]` | In progress |
|
||||
| `[x]` | Done and **gate passed** |
|
||||
| **BLOCKED** | Waiting on listed dependency |
|
||||
| **GATE** | Mandatory test validation — no next phase until green |
|
||||
|
||||
---
|
||||
|
||||
## Phase 0 — Repository baseline and documentation contract
|
||||
|
||||
**Depends on:** nothing
|
||||
**Unblocks:** Phase 1+
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 0.1 Create monorepo layout (`verae-zapier-middleware/`, `verae-zapier/`, `docs/`)
|
||||
- [x] 0.2 Write architecture overview and NATS subject map
|
||||
- [x] 0.3 Write developer module documentation skeleton for all planned modules
|
||||
- [x] 0.4 Document debugging facility contract (`DEBUG_VERAE`, namespaces, redaction rules)
|
||||
- [x] 0.5 Write this dependency-ordered `TODO.md` with test gates
|
||||
- [x] 0.6 Add root `README.md` and package scripts for gated testing
|
||||
|
||||
### GATE 0 — Documentation and structure
|
||||
|
||||
```bash
|
||||
cd /Users/marchon/datacubes/verae-zapier-api
|
||||
npm run gate:0
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Required paths exist (see `scripts/gate-0-structure.mjs`)
|
||||
- `TODO.md`, architecture docs, debugging doc, module docs present
|
||||
- No empty required doc stubs
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | structure + docs gate |
|
||||
|
||||
---
|
||||
|
||||
## Phase 1 — Debug runtime facility
|
||||
|
||||
**Depends on:** Phase 0 GATE
|
||||
**Unblocks:** All code phases (debug used everywhere)
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 1.1 Implement `src/debug/logger.js` — namespaced logger, levels, redact secrets
|
||||
- [x] 1.2 Implement `src/debug/trace.js` — request/job correlation IDs
|
||||
- [x] 1.3 Implement `src/debug/config.js` — parse `DEBUG_VERAE` / `DEBUG_VERAE_LEVEL` at runtime
|
||||
- [x] 1.4 Unit tests: enable/disable namespaces, redaction of tokens/passwords/api keys
|
||||
- [x] 1.5 Document every debug export in `docs/developer/modules/debug.md`
|
||||
|
||||
### GATE 1 — Debug facility
|
||||
|
||||
```bash
|
||||
npm run gate:1
|
||||
# equivalent: node --test verae-zapier-middleware/test/unit/debug*.test.js
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Logger silent when `DEBUG_VERAE` unset
|
||||
- Enabling `DEBUG_VERAE=auth` only emits auth namespace
|
||||
- Redaction masks `Bearer`, `zmw_`, `zmt_`, password fields
|
||||
- Correlation ID stable across nested `trace.run` calls
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | 11/11 unit tests |
|
||||
|
||||
---
|
||||
|
||||
## Phase 2 — Config, errors, and core HTTP shell
|
||||
|
||||
**Depends on:** Phase 1 GATE
|
||||
**Unblocks:** Auth, clients, routes
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 2.1 `src/config.js` — env load, plan limits, NATS flags, debug passthrough
|
||||
- [x] 2.2 `src/errors.js` — `AppError`, `asyncHandler`, `sendError` with debug dumps on 5xx
|
||||
- [x] 2.3 `src/app.js` / `src/index.js` — Express app, `/health`, `/zapier` mount
|
||||
- [x] 2.4 Unit tests for config defaults and health endpoint
|
||||
- [x] 2.5 Module docs: `config.md` (+ function-reference for errors/app)
|
||||
|
||||
### GATE 2 — HTTP shell
|
||||
|
||||
```bash
|
||||
npm run gate:2
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- `GET /health` returns `{ status: "ok" }`
|
||||
- Unknown routes return structured JSON error
|
||||
- Config reads `VERAE_API_BASE_URL`, `NATS_URL`, `NATS_ENABLED`, `DEBUG_VERAE`
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | health + config unit tests; /zapier returns 501 until Phase 5–6 routes |
|
||||
|
||||
---
|
||||
|
||||
## Phase 3 — Persistence stores (tenants, usage, webhooks)
|
||||
|
||||
**Depends on:** Phase 2 GATE
|
||||
**Unblocks:** Auth bridge, billing, webhook subscribe API
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 3.1 `src/store/db.js` — load/persist store (file for MVP; interface ready for Redis/Postgres)
|
||||
- [x] 3.2 `src/store/tenants.js` — CRUD, API key lookup, `resolveLimits`
|
||||
- [x] 3.3 `src/store/usage.js` — monthly counters, overage
|
||||
- [x] 3.4 `src/store/webhooks.js` — subscribe/unsubscribe/list by tenant+event
|
||||
- [x] 3.5 Unit tests for limits, API key mapping, webhook isolation per tenant
|
||||
- [x] 3.6 Module docs for each store file
|
||||
|
||||
### GATE 3 — Stores
|
||||
|
||||
```bash
|
||||
npm run gate:3
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Create tenant → API key resolves to same tenant
|
||||
- Free plan limits applied; enterprise contract overrides
|
||||
- Webhook for tenant A never returned for tenant B
|
||||
- Persist + reload round-trip preserves data
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | store unit tests |
|
||||
|
||||
---
|
||||
|
||||
## Phase 4 — Tokens and Verae HTTP client
|
||||
|
||||
**Depends on:** Phase 3 GATE
|
||||
**Unblocks:** Auth service, timestamp/verify services
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 4.1 `src/lib/tokens.js` — API keys (`zmw_`), session tokens (`zmt_`), HMAC sign/verify
|
||||
- [x] 4.2 `src/clients/veraeClient.js` — login, validate, timestamp, status, verify, waitForJob
|
||||
- [x] 4.3 Mock mode (`MOCK_VERAE=true`) for offline tests
|
||||
- [x] 4.4 Debug spans for outbound HTTP (url, method, status, duration; **no raw secrets**)
|
||||
- [x] 4.5 Unit tests: mock client lifecycle (create → pending → completed)
|
||||
- [x] 4.6 Module docs: `tokens.md`, `veraeClient.md`
|
||||
|
||||
### GATE 4 — Client + tokens
|
||||
|
||||
```bash
|
||||
npm run gate:4
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Session token forge fails without secret
|
||||
- Mock create returns `jobId`; wait reaches `completed`
|
||||
- Debug log with `DEBUG_VERAE=http` shows request metadata without Authorization header values
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | tokens + mock client |
|
||||
|
||||
---
|
||||
|
||||
## Phase 5 — Auth bridge and entitlements (HTTP, no NATS yet)
|
||||
|
||||
**Depends on:** Phase 4 GATE
|
||||
**Unblocks:** Timestamp/verify routes, Zapier custom auth
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 5.1 `src/services/authService.js` — login credentials, login API key, resolveAuthContext, validateSession
|
||||
- [x] 5.2 `src/services/entitlementService.js` — checkEntitlement, recordUsage
|
||||
- [x] 5.3 `src/middleware/authenticate.js` — Bearer / x-api-key
|
||||
- [x] 5.4 `src/middleware/rateLimit.js` — per-plan RPM
|
||||
- [x] 5.5 `src/routes/authRoutes.js` — `POST /login`, `GET /me` under `/zapier/v1/auth`
|
||||
- [x] 5.6 Integration tests: API key → me; quota 402; rate limit
|
||||
- [x] 5.7 Module docs for auth + entitlement + middleware
|
||||
|
||||
### GATE 5 — Auth + billing gates
|
||||
|
||||
```bash
|
||||
npm run gate:5
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Seeded free tenant can call `/zapier/v1/auth/me`
|
||||
- Exceeding free timestamp quota returns `402` + `QUOTA_EXCEEDED`
|
||||
- Invalid key returns `401`
|
||||
- Debug `DEBUG_VERAE=auth,billing` traces tenantId/plan without password
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | auth me + quota |
|
||||
|
||||
---
|
||||
|
||||
## Phase 6 — Sync HTTP API path (in-process poller fallback)
|
||||
|
||||
**Depends on:** Phase 5 GATE
|
||||
**Unblocks:** NATS swap-in (Phase 7+), Zapier app wiring
|
||||
|
||||
**Note:** Implements full product behavior with `NATS_ENABLED=false` so Zapier can work before NATS.
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 6.1 `src/services/timestampService.js` — create, createAndWait, batch, getStatus
|
||||
- [x] 6.2 `src/services/verifyService.js` — verify, verifyBatch
|
||||
- [x] 6.3 `src/services/webhookService.js` — subscribe/unsubscribe/deliver (HTTP)
|
||||
- [x] 6.4 Routes: timestamp, verify, status, webhooks
|
||||
- [x] 6.5 In-process `src/workers/inProcessJobPoller.js` (legacy path, feature-flagged)
|
||||
- [x] 6.6 Integration tests with `MOCK_VERAE=true`, `NATS_ENABLED=false`
|
||||
- [x] 6.7 Module docs for services + routes
|
||||
|
||||
### GATE 6 — Full HTTP middleware (no NATS)
|
||||
|
||||
```bash
|
||||
npm run gate:6
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- `POST /zapier/v1/timestamp` → 202 + jobId
|
||||
- `POST /zapier/v1/timestamp/wait` → completed status with certificate fields
|
||||
- `POST /zapier/v1/verify` → valid true/false
|
||||
- Webhook subscribe stores targetUrl; simulated complete invokes deliver (mock)
|
||||
- All tests pass with NATS disabled
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | full HTTP mock path |
|
||||
|
||||
---
|
||||
|
||||
## Phase 7 — NATS connection, streams, and publishers
|
||||
|
||||
**Depends on:** Phase 6 GATE
|
||||
**Unblocks:** Workers, production multi-instance
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 7.1 Add local NATS JetStream to `docker-compose.yml`
|
||||
- [x] 7.2 `src/nats/subjects.js` — subject constants
|
||||
- [x] 7.3 `src/nats/connection.js` — connect, reconnect, ensure streams/consumers
|
||||
- [x] 7.4 `src/nats/publishers.js` — enqueueWatch, publishJobEvent, enqueueWebhook
|
||||
- [x] 7.5 Unit/integration tests against test NATS (or mocked JetStream interface)
|
||||
- [x] 7.6 Module docs: `nats-connection.md`, `nats-subjects.md`, `nats-publishers.md`
|
||||
- [x] 7.7 Debug namespace `nats` for publish/ack/error tracing
|
||||
|
||||
### GATE 7 — NATS infrastructure
|
||||
|
||||
```bash
|
||||
npm run gate:7
|
||||
# starts NATS if needed, ensures streams, runs nats tests
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Streams `ZAPIER_JOBS`, `ZAPIER_EVENTS`, `ZAPIER_WEBHOOKS` exist
|
||||
- Publish + pull consume one message end-to-end
|
||||
- Connection failure surfaces structured error; debug logs connection lifecycle
|
||||
- `NATS_ENABLED=false` still loads app without connecting
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | nats-server JetStream |
|
||||
|
||||
---
|
||||
|
||||
## Phase 8 — NATS workers (job poller + webhook deliver)
|
||||
|
||||
**Depends on:** Phase 7 GATE
|
||||
**Unblocks:** Hybrid production path
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 8.1 `src/workers/jobPollerWorker.js` — durable consumer on `verae.zapier.jobs.watch`
|
||||
- [x] 8.2 `src/workers/webhookWorker.js` — durable consumer on `verae.zapier.webhooks.deliver`
|
||||
- [x] 8.3 Wire `timestampService` to publish watch jobs when `NATS_ENABLED=true`
|
||||
- [x] 8.4 Events consumer routes `jobs.events` → enqueue webhook deliveries for matching hooks
|
||||
- [x] 8.5 **Never** put raw Verae JWT in NATS when avoidable — use `tokenRef` or re-login
|
||||
- [x] 8.6 Integration tests: create → worker poll → event → webhook HTTP mock
|
||||
- [x] 8.7 Module docs for workers; failure tracing via `DEBUG_VERAE=jobs,webhooks,nats`
|
||||
|
||||
### GATE 8 — Async path with NATS
|
||||
|
||||
```bash
|
||||
npm run gate:8
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- With NATS up and `NATS_ENABLED=true`, async create eventually completes via worker
|
||||
- Webhook target receives POST with `timestamp.completed` payload
|
||||
- Redelivery: failing webhook is retried (JetStream max_deliver)
|
||||
- Two concurrent workers do not double-complete same job (queue group)
|
||||
- In-process poller **not** started when NATS enabled
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | workers watch→webhook |
|
||||
|
||||
---
|
||||
|
||||
## Phase 9 — `/timestamp/wait` via NATS events
|
||||
|
||||
**Depends on:** Phase 8 GATE
|
||||
**Unblocks:** Efficient Zapier “Create and Wait” under multi-instance
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] 9.1 API waits on job event (subscription or inbox) after enqueue watch
|
||||
- [ ] 9.2 Hard timeout returns `{ jobId, status: "pending" }` (document Zapier fallback)
|
||||
- [ ] 9.3 Tests: fast complete; timeout path; cancellation on client disconnect (if feasible)
|
||||
- [ ] 9.4 Docs update: wait semantics, Zapier multi-step fallback
|
||||
|
||||
### GATE 9 — Wait path
|
||||
|
||||
```bash
|
||||
npm run gate:9
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Wait returns completed when worker finishes before timeout
|
||||
- Wait returns pending + jobId on timeout without hanging forever
|
||||
- Debug shows wait correlation id linking HTTP request → NATS event
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| | | |
|
||||
|
||||
---
|
||||
|
||||
## Phase 10 — Tenant signup / admin provision
|
||||
|
||||
**Depends on:** Phase 6 GATE (can parallel Phase 7–9 after 6)
|
||||
**Unblocks:** Self-serve and enterprise keys for Zapier
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 10.1 `src/services/tenantService.js` — selfServeSignup, provisionTenant
|
||||
- [x] 10.2 Routes: public signup, admin tenants (`X-Admin-Secret`)
|
||||
- [x] 10.3 Scripts: `seed-audiences.js`, `create-test-account.js`
|
||||
- [x] 10.4 Tests for free signup and enterprise contract validation
|
||||
- [x] 10.5 Module docs: `tenantService.md`, `tenantRoutes.md`
|
||||
|
||||
### GATE 10 — Tenancy
|
||||
|
||||
```bash
|
||||
npm run gate:10
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Signup returns `apiKey` + free plan
|
||||
- Enterprise without contract rejected
|
||||
- Admin list does not leak passwords
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | signup + admin |
|
||||
|
||||
---
|
||||
|
||||
## Phase 11 — Zapier CLI app (`verae-zapier`)
|
||||
|
||||
**Depends on:** Phase 6 GATE minimum; Phase 8 recommended for triggers
|
||||
**Unblocks:** Private invites on Zapier
|
||||
|
||||
### Tasks
|
||||
|
||||
- [x] 11.1 `authentication.js` — custom API key → `/zapier/v1/auth/me`
|
||||
- [x] 11.2 `index.js` — beforeRequest API key; afterResponse map 402/403
|
||||
- [x] 11.3 Creates: timestamp_and_wait, create_timestamp, verify, batch
|
||||
- [x] 11.4 Search: job_status
|
||||
- [x] 11.5 Trigger: timestamp_completed REST Hook
|
||||
- [x] 11.6 Unit tests with mocked middleware (nock or local server)
|
||||
- [x] 11.7 `MIDDLEWARE_BASE_URL` env documentation
|
||||
- [x] 11.8 Developer docs for each Zapier operation module
|
||||
|
||||
### GATE 11 — Zapier package
|
||||
|
||||
```bash
|
||||
npm run gate:11
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Auth test module returns tenant/plan label fields
|
||||
- Each create/search perform builds correct middleware URL/body
|
||||
- Trigger subscribe/unsubscribe payload shapes match middleware
|
||||
- `zapier-platform validate` / local test suite green (when CLI available)
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| 2026-08-11 | pass | zapier package unit tests |
|
||||
|
||||
---
|
||||
|
||||
## Phase 12 — End-to-end validation (local stack)
|
||||
|
||||
**Depends on:** Gates 8, 10, 11
|
||||
**Unblocks:** Remote deploy
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] 12.1 `docker-compose.yml`: middleware + NATS (+ optional mock Verae)
|
||||
- [ ] 12.2 Compose smoke script: health, auth, timestamp wait, webhook
|
||||
- [ ] 12.3 Debug mode runbook: reproduce a failed job with `DEBUG_VERAE=*`
|
||||
- [ ] 12.4 Record sample traces in `docs/developer/debugging.md`
|
||||
|
||||
### GATE 12 — E2E local
|
||||
|
||||
```bash
|
||||
npm run gate:12
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Compose stack healthy
|
||||
- One full async path and one wait path succeed
|
||||
- One REST Hook delivery succeeds against mock receiver
|
||||
- Gate script exits 0
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| | | |
|
||||
|
||||
---
|
||||
|
||||
## Phase 13 — Production wiring to api.veraetime.net
|
||||
|
||||
**Depends on:** Phase 12 GATE
|
||||
**Unblocks:** Real customer traffic
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] 13.1 Set `VERAE_API_BASE_URL=https://api.veraetime.net`, `MOCK_VERAE=false`
|
||||
- [ ] 13.2 Provision dedicated Zapier service user on Verae (not shared admin long-term)
|
||||
- [ ] 13.3 TLS, secrets management (`TOKEN_SECRET`, `ADMIN_SECRET`, NATS auth)
|
||||
- [ ] 13.4 Public HTTPS URL for middleware (required for Zapier cloud → you)
|
||||
- [ ] 13.5 Live smoke tests (non-destructive verify + one timestamp)
|
||||
- [ ] 13.6 Runbook: incident tracing with debug flags (no secrets in logs)
|
||||
|
||||
### GATE 13 — Production smoke
|
||||
|
||||
```bash
|
||||
npm run gate:13
|
||||
# requires env: PRODUCTION_SMOKE=1 and real credentials
|
||||
```
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Login + timestamp + status against live API succeed
|
||||
- No secrets printed in CI logs
|
||||
- Documented rollback: `NATS_ENABLED=false` still serves sync path
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| | | |
|
||||
|
||||
---
|
||||
|
||||
## Phase 14 — Private Zapier push and invite
|
||||
|
||||
**Depends on:** Phase 13 GATE
|
||||
**Unblocks:** Beta users
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] 14.1 `zapier-platform register` / `link`
|
||||
- [ ] 14.2 `zapier-platform push` private version
|
||||
- [ ] 14.3 Invite internal users; validate real Zap (Drive/Sheets → Timestamp → Slack)
|
||||
- [ ] 14.4 Collect failures; enable `DEBUG_VERAE` only on middleware staging for repro
|
||||
- [ ] 14.5 Update Progress / changelog
|
||||
|
||||
### GATE 14 — Human acceptance
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- At least one real Zap runs end-to-end with production middleware
|
||||
- Auth connection label shows tenant + plan
|
||||
- Async trigger or wait path verified by human sign-off
|
||||
|
||||
**Gate log**
|
||||
|
||||
| Date | Result | Notes |
|
||||
|------|--------|-------|
|
||||
| | | |
|
||||
|
||||
---
|
||||
|
||||
## Phase 15 — Hardening (post-beta)
|
||||
|
||||
**Depends on:** Phase 14
|
||||
**Unblocks:** Public listing consideration
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] 15.1 Replace file store with Postgres/Redis
|
||||
- [ ] 15.2 NATS mTLS / account auth
|
||||
- [ ] 15.3 Webhook SSRF protections
|
||||
- [ ] 15.4 Usage stream consumer for billing export
|
||||
- [ ] 15.5 Optional: Verae core publishes completion to NATS (drop polling)
|
||||
- [ ] 15.6 Security review of tokenRef vs password-at-rest
|
||||
|
||||
### GATE 15 — Hardening checklist
|
||||
|
||||
**Pass criteria**
|
||||
|
||||
- Written security review checklist completed
|
||||
- Load test: N concurrent workers, no duplicate webhook storms
|
||||
- Backup/restore drill for tenant store
|
||||
|
||||
---
|
||||
|
||||
## Dependency graph (summary)
|
||||
|
||||
```text
|
||||
0 Docs/structure
|
||||
└─▶ 1 Debug facility
|
||||
└─▶ 2 HTTP shell
|
||||
└─▶ 3 Stores
|
||||
└─▶ 4 Tokens + Verae client
|
||||
└─▶ 5 Auth + entitlements
|
||||
└─▶ 6 Sync HTTP API (+ in-process poller)
|
||||
├─▶ 7 NATS infra ──▶ 8 Workers ──▶ 9 Wait-via-NATS
|
||||
├─▶ 10 Tenancy (parallel after 6)
|
||||
└─▶ 11 Zapier app (after 6; triggers prefer 8)
|
||||
└─▶ 12 E2E local (needs 8,10,11)
|
||||
└─▶ 13 Production Verae
|
||||
└─▶ 14 Private Zapier push
|
||||
└─▶ 15 Hardening
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## npm gate commands (root)
|
||||
|
||||
| Script | Phase | What it runs |
|
||||
|--------|-------|--------------|
|
||||
| `npm run gate:0` | 0 | Structure + doc presence |
|
||||
| `npm run gate:1` | 1 | Debug unit tests |
|
||||
| `npm run gate:2` | 2 | Config/errors/app tests |
|
||||
| `npm run gate:3` | 3 | Store tests |
|
||||
| `npm run gate:4` | 4 | Tokens + client tests |
|
||||
| `npm run gate:5` | 5 | Auth + entitlement tests |
|
||||
| `npm run gate:6` | 6 | HTTP integration (NATS off) |
|
||||
| `npm run gate:7` | 7 | NATS stream tests |
|
||||
| `npm run gate:8` | 8 | Worker integration |
|
||||
| `npm run gate:9` | 9 | Wait path tests |
|
||||
| `npm run gate:10` | 10 | Tenant tests |
|
||||
| `npm run gate:11` | 11 | Zapier package tests |
|
||||
| `npm run gate:12` | 12 | Compose E2E |
|
||||
| `npm run gate:13` | 13 | Live smoke (opt-in) |
|
||||
| `npm run gate:all` | 0–12 | All automated gates in order; stop on first failure |
|
||||
|
||||
---
|
||||
|
||||
## Definition of done (platform MVP)
|
||||
|
||||
- [ ] All gates 0–12 green on clean machine
|
||||
- [ ] `NATS_ENABLED=true` path used for job watch + webhooks
|
||||
- [ ] `NATS_ENABLED=false` fallback still passes gate 6
|
||||
- [ ] Developer docs cover every module’s exported functions (params + returns)
|
||||
- [ ] Debug can be enabled at runtime without redeploy (`DEBUG_VERAE=...`)
|
||||
- [ ] No secrets in logs when debug is on (redaction tests green)
|
||||
- [ ] Private Zapier version pushed and one human E2E Zap succeeds (gate 14)
|
||||
|
||||
---
|
||||
|
||||
## Working rules for implementers
|
||||
|
||||
1. **No phase advancement without gate.**
|
||||
2. **Write tests first or with the code** for that phase’s modules.
|
||||
3. **Document every new export** in `docs/developer/modules/<name>.md` and JSDoc in source.
|
||||
4. **Instrument with `debug`** at boundaries: auth resolve, outbound Verae, NATS publish/consume, webhook HTTP.
|
||||
5. **Prefer failing a gate** over merging incomplete behavior.
|
||||
6. Update the **Gate log** tables when a gate passes.
|
||||
25
research/zapier/verae-zapier-api/docker-compose.yml
Normal file
25
research/zapier/verae-zapier-api/docker-compose.yml
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
# Local stack for Phase 7+ (NATS) and Phase 12 E2E.
|
||||
# Middleware HTTP can run without NATS when NATS_ENABLED=false.
|
||||
|
||||
services:
|
||||
nats:
|
||||
image: nats:2.10
|
||||
command: ["-js", "-m", "8222"]
|
||||
ports:
|
||||
- "4222:4222"
|
||||
- "8222:8222"
|
||||
|
||||
middleware:
|
||||
build: ./verae-zapier-middleware
|
||||
ports:
|
||||
- "3100:3100"
|
||||
environment:
|
||||
PORT: "3100"
|
||||
VERAE_API_BASE_URL: ${VERAE_API_BASE_URL:-https://api.veraetime.net}
|
||||
MOCK_VERAE: ${MOCK_VERAE:-true}
|
||||
NATS_ENABLED: ${NATS_ENABLED:-false}
|
||||
NATS_URL: nats://nats:4222
|
||||
TOKEN_SECRET: ${TOKEN_SECRET:-dev-secret}
|
||||
DEBUG_VERAE: ${DEBUG_VERAE:-}
|
||||
depends_on:
|
||||
- nats
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
openapi: 3.0.0
|
||||
info:
|
||||
title: Verae Zapier Middleware API
|
||||
description: |
|
||||
Zapier-facing HTTP surface. Zapier CLI app calls these routes only.
|
||||
Async job watching and webhook delivery may use NATS behind this API.
|
||||
version: 0.1.0
|
||||
servers:
|
||||
- url: http://localhost:3100
|
||||
description: Local middleware
|
||||
paths:
|
||||
/health:
|
||||
get:
|
||||
summary: Liveness probe
|
||||
operationId: health
|
||||
responses:
|
||||
'200':
|
||||
description: OK
|
||||
/zapier/v1/auth/me:
|
||||
get:
|
||||
summary: Validate API key connection (Zapier auth test)
|
||||
operationId: authMe
|
||||
security:
|
||||
- BearerAuth: []
|
||||
responses:
|
||||
'200':
|
||||
description: Tenant + plan + usage
|
||||
'401':
|
||||
description: Unauthorized
|
||||
/zapier/v1/timestamp:
|
||||
post:
|
||||
summary: Create timestamp (async jobId)
|
||||
operationId: createTimestamp
|
||||
security:
|
||||
- BearerAuth: []
|
||||
responses:
|
||||
'202':
|
||||
description: Accepted
|
||||
/zapier/v1/timestamp/wait:
|
||||
post:
|
||||
summary: Create timestamp and wait for completion
|
||||
operationId: createTimestampAndWait
|
||||
security:
|
||||
- BearerAuth: []
|
||||
responses:
|
||||
'200':
|
||||
description: Completed or failed status
|
||||
/zapier/v1/verify:
|
||||
post:
|
||||
summary: Verify certificate
|
||||
operationId: verifyTimestamp
|
||||
security:
|
||||
- BearerAuth: []
|
||||
responses:
|
||||
'200':
|
||||
description: Verification result
|
||||
/zapier/v1/webhooks/subscribe:
|
||||
post:
|
||||
summary: REST Hook subscribe
|
||||
operationId: webhookSubscribe
|
||||
security:
|
||||
- BearerAuth: []
|
||||
responses:
|
||||
'201':
|
||||
description: Subscribed
|
||||
/zapier/v1/webhooks/unsubscribe:
|
||||
delete:
|
||||
summary: REST Hook unsubscribe
|
||||
operationId: webhookUnsubscribe
|
||||
security:
|
||||
- BearerAuth: []
|
||||
responses:
|
||||
'200':
|
||||
description: Unsubscribed
|
||||
components:
|
||||
securitySchemes:
|
||||
BearerAuth:
|
||||
type: http
|
||||
scheme: bearer
|
||||
description: Middleware API key (zmw_…) or session token (zmt_…)
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
# NATS Subject Topology
|
||||
|
||||
All subjects are prefixed with `verae.zapier.` to isolate this platform from other Verae messaging.
|
||||
|
||||
## Streams
|
||||
|
||||
| Stream | Subjects | Retention | Purpose |
|
||||
|--------|----------|-----------|---------|
|
||||
| `ZAPIER_JOBS` | `verae.zapier.jobs.watch` | Work queue | Poll Verae for job status |
|
||||
| `ZAPIER_EVENTS` | `verae.zapier.jobs.events` | Limits (time) | Terminal job outcomes |
|
||||
| `ZAPIER_WEBHOOKS` | `verae.zapier.webhooks.deliver` | Work queue | POST to Zapier hook URLs |
|
||||
| `ZAPIER_USAGE` (optional) | `verae.zapier.usage` | Limits | Billing export |
|
||||
|
||||
## Subjects
|
||||
|
||||
### `verae.zapier.jobs.watch`
|
||||
|
||||
**Published by:** HTTP edge after successful `POST /api/timestamp` (or batch item).
|
||||
**Consumed by:** `job-poller` durable consumer (queue group).
|
||||
|
||||
**Payload**
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `tenantId` | string | yes | Owning tenant |
|
||||
| `jobId` | string | yes | Verae job id |
|
||||
| `tokenRef` | string | preferred | Opaque ref to resolve Verae credentials (avoid raw JWT) |
|
||||
| `veraeToken` | string | discouraged | Only if tokenRef unavailable; redacted in logs |
|
||||
| `enqueuedAt` | ISO-8601 | yes | Enqueue time |
|
||||
| `attempt` | number | yes | Delivery attempt (0-based) |
|
||||
| `maxAttempts` | number | yes | Stop after this many polls |
|
||||
| `intervalMs` | number | yes | Suggested delay between polls |
|
||||
| `traceId` | string | yes | Correlation id for debug |
|
||||
|
||||
### `verae.zapier.jobs.events`
|
||||
|
||||
**Published by:** Job poller when status is `completed`, `failed`, or `timeout`.
|
||||
**Consumed by:** Event router → webhook enqueue; optional waiters on HTTP edge.
|
||||
|
||||
**Payload**
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `event` | string | yes | `timestamp.completed` \| `timestamp.failed` \| `timestamp.timeout` |
|
||||
| `tenantId` | string | yes | Tenant id |
|
||||
| `jobId` | string | yes | Job id |
|
||||
| `status` | object | yes | Verae `StatusResponse` shape (or synthetic timeout) |
|
||||
| `traceId` | string | yes | Correlation id |
|
||||
| `emittedAt` | ISO-8601 | yes | Event time |
|
||||
|
||||
### `verae.zapier.webhooks.deliver`
|
||||
|
||||
**Published by:** Event router for each matching subscription.
|
||||
**Consumed by:** `webhook-deliver` queue group.
|
||||
|
||||
**Payload**
|
||||
|
||||
| Field | Type | Required | Description |
|
||||
|-------|------|----------|-------------|
|
||||
| `hookId` | string | yes | Stored subscription id |
|
||||
| `tenantId` | string | yes | Tenant |
|
||||
| `targetUrl` | string | yes | Zapier REST Hook URL |
|
||||
| `event` | string | yes | Event name |
|
||||
| `payload` | object | yes | Body POSTed to Zapier |
|
||||
| `attempt` | number | yes | Attempt count |
|
||||
| `traceId` | string | yes | Correlation id |
|
||||
|
||||
### `verae.zapier.usage` (optional)
|
||||
|
||||
| Field | Type | Description |
|
||||
|-------|------|-------------|
|
||||
| `tenantId` | string | Tenant |
|
||||
| `action` | string | `timestamp` \| `verify` \| `status` \| … |
|
||||
| `amount` | number | Increment |
|
||||
| `at` | ISO-8601 | Timestamp |
|
||||
|
||||
## Consumers
|
||||
|
||||
| Name | Stream | Mode | Notes |
|
||||
|------|--------|------|-------|
|
||||
| `job-poller` | `ZAPIER_JOBS` | Pull, queue | Nak with delay when still pending |
|
||||
| `event-webhook-router` | `ZAPIER_EVENTS` | Push/pull | Fan-out to deliver subjects |
|
||||
| `webhook-deliver` | `ZAPIER_WEBHOOKS` | Pull, queue | HTTP POST with backoff |
|
||||
| `usage-writer` | `ZAPIER_USAGE` | Optional | Persist metering |
|
||||
|
||||
## Ack semantics
|
||||
|
||||
| Situation | Action |
|
||||
|-----------|--------|
|
||||
| Job still `pending` | `Nak` with delay ≈ `intervalMs` or republish with `attempt+1` |
|
||||
| Job terminal | Publish event, `Ack` watch message |
|
||||
| Webhook HTTP 2xx | `Ack` |
|
||||
| Webhook HTTP 5xx / network | `Nak` / redelivery until `max_deliver` |
|
||||
| Poison message | Term after max_deliver; write DLQ log with `DEBUG_VERAE=webhooks` |
|
||||
|
||||
## Security rules
|
||||
|
||||
1. Prefer `tokenRef` over embedding Verae JWTs in messages.
|
||||
2. NATS must use private network + auth (Phase 15: mTLS).
|
||||
3. Debug logs must redact tokens and `targetUrl` query secrets if any.
|
||||
4. Treat `targetUrl` as untrusted egress (timeouts, size limits, SSRF allowlist later).
|
||||
132
research/zapier/verae-zapier-api/docs/architecture/overview.md
Normal file
132
research/zapier/verae-zapier-api/docs/architecture/overview.md
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
# Architecture Overview
|
||||
|
||||
## Purpose
|
||||
|
||||
Connect Zapier automations to Verae blockchain timestamping without:
|
||||
|
||||
- exposing raw Verae JWTs to end users,
|
||||
- requiring Zapier to poll async jobs,
|
||||
- coupling billing/plans to the core timestamping API,
|
||||
- running multi-instance middleware with in-memory only job queues.
|
||||
|
||||
## Components
|
||||
|
||||
### 1. `verae-zapier` (Zapier Platform CLI app)
|
||||
|
||||
**Runs on:** Zapier’s cloud when a Zap step executes.
|
||||
|
||||
**Responsibilities:**
|
||||
|
||||
- Custom auth field `api_key` (middleware-issued `zmw_…` keys).
|
||||
- Map Zapier actions/searches/triggers to middleware HTTPS routes.
|
||||
- Attach `Authorization: Bearer <api_key>` on every request.
|
||||
- Translate middleware `402` / `403` into user-visible Zapier errors.
|
||||
|
||||
**Does not:**
|
||||
|
||||
- Call `api.veraetime.net` directly.
|
||||
- Speak NATS.
|
||||
- Enforce plan quotas (middleware does).
|
||||
|
||||
### 2. `verae-zapier-middleware` HTTP edge
|
||||
|
||||
**Runs on:** Your infrastructure (public HTTPS).
|
||||
|
||||
**Responsibilities:**
|
||||
|
||||
- Tenant identity and API keys.
|
||||
- Auth bridge: API key → Verae login → JWT (server-side).
|
||||
- Entitlement checks and usage metering.
|
||||
- Synchronous API surface under `/zapier/v1/*`.
|
||||
- REST Hook subscribe/unsubscribe storage.
|
||||
- Publish async work to NATS when `NATS_ENABLED=true`.
|
||||
|
||||
### 3. NATS + JetStream
|
||||
|
||||
**Runs on:** Private network with middleware.
|
||||
|
||||
**Responsibilities:**
|
||||
|
||||
- Durable work queue for job status polling.
|
||||
- Event stream for terminal job states.
|
||||
- Work queue for Zapier webhook HTTP delivery with retries.
|
||||
|
||||
### 4. Workers
|
||||
|
||||
**Runs on:** Same deploy as middleware or separate worker processes.
|
||||
|
||||
| Worker | Consumes | Calls |
|
||||
|--------|----------|-------|
|
||||
| Job poller | `verae.zapier.jobs.watch` | `GET /api/status/{jobId}` on Verae |
|
||||
| Event router | `verae.zapier.jobs.events` | Enqueues webhook deliveries |
|
||||
| Webhook deliver | `verae.zapier.webhooks.deliver` | `POST` Zapier `targetUrl` |
|
||||
|
||||
### 5. `api.veraetime.net` (Verae Timestamping Service)
|
||||
|
||||
**Source of truth** for login, timestamp jobs, status, and verification.
|
||||
|
||||
OpenAPI: production Swagger / `Verae-Swagger.yaml`.
|
||||
|
||||
## Request flows
|
||||
|
||||
### A. Create Timestamp (async)
|
||||
|
||||
```text
|
||||
Zapier → POST /zapier/v1/timestamp
|
||||
Middleware: authenticate, checkEntitlement, POST /api/timestamp
|
||||
Middleware: publish jobs.watch → return 202 { jobId }
|
||||
Worker: poll status until terminal → publish jobs.events
|
||||
Event router: match webhooks → publish webhooks.deliver
|
||||
Webhook worker: POST hooks.zapier.com/...
|
||||
```
|
||||
|
||||
### B. Create Timestamp and Wait
|
||||
|
||||
```text
|
||||
Zapier → POST /zapier/v1/timestamp/wait
|
||||
Middleware: create + wait for jobs.events (or in-process wait if NATS off)
|
||||
→ return StatusResponse (completed/failed) or pending+jobId on timeout
|
||||
```
|
||||
|
||||
### C. Auth connection test
|
||||
|
||||
```text
|
||||
Zapier → GET /zapier/v1/auth/me Authorization: Bearer zmw_…
|
||||
Middleware: resolve API key → tenant → optional validate Verae token
|
||||
→ { tenantId, plan, usage, ... }
|
||||
```
|
||||
|
||||
## Feature flags
|
||||
|
||||
| Flag | Effect |
|
||||
|------|--------|
|
||||
| `NATS_ENABLED=false` | In-process job poller; still full HTTP API (Phase 6 path) |
|
||||
| `NATS_ENABLED=true` | JetStream workers; no in-process poller |
|
||||
| `MOCK_VERAE=true` | No live Verae; deterministic mock jobs for tests |
|
||||
| `DEBUG_VERAE=…` | Runtime failure tracing (see debugging.md) |
|
||||
|
||||
## Security boundaries
|
||||
|
||||
```text
|
||||
Public Internet
|
||||
├─ Zapier → Middleware HTTPS only
|
||||
└─ Middleware → Zapier webhook HTTPS only
|
||||
|
||||
Private
|
||||
├─ Middleware ↔ NATS
|
||||
└─ Middleware/Workers → api.veraetime.net HTTPS
|
||||
```
|
||||
|
||||
Never expose NATS ports to the public internet.
|
||||
|
||||
## Scaling model
|
||||
|
||||
- **HTTP edge:** scale replicas behind a load balancer (stateless except shared store).
|
||||
- **NATS consumers:** queue groups — adding workers increases poll/deliver throughput.
|
||||
- **Store:** file JSON is MVP single-node; Postgres/Redis required for multi-node (Phase 15).
|
||||
|
||||
## Related documents
|
||||
|
||||
- [nats-subjects.md](nats-subjects.md) — subjects, streams, payload schemas
|
||||
- [../plans/phase-gates.md](../plans/phase-gates.md) — test gates
|
||||
- [../../TODO.md](../../TODO.md) — full implementation order
|
||||
147
research/zapier/verae-zapier-api/docs/developer/debugging.md
Normal file
147
research/zapier/verae-zapier-api/docs/developer/debugging.md
Normal file
|
|
@ -0,0 +1,147 @@
|
|||
# Runtime Debugging and Failure Tracing
|
||||
|
||||
## Goals
|
||||
|
||||
- Trace failures across **HTTP → NATS → Verae → Zapier webhook** without redeploying.
|
||||
- Keep secrets out of logs even when debug is enabled.
|
||||
- Allow selective namespaces so production noise stays low.
|
||||
|
||||
## Enabling debug (runtime)
|
||||
|
||||
Debug is **off** when `DEBUG_VERAE` is unset or empty.
|
||||
|
||||
```bash
|
||||
# Everything
|
||||
export DEBUG_VERAE=1
|
||||
# or
|
||||
export DEBUG_VERAE=*
|
||||
|
||||
# Selected namespaces (comma-separated)
|
||||
export DEBUG_VERAE=auth,nats,jobs,webhooks,http,billing,trace
|
||||
|
||||
# Minimum level: debug | info | warn | error
|
||||
export DEBUG_VERAE_LEVEL=debug
|
||||
|
||||
# Optional: write to file as well as stderr
|
||||
export DEBUG_VERAE_FILE=/var/log/verae-zapier-debug.log
|
||||
```
|
||||
|
||||
Restart is **not** required if the process reads env only at boot — current implementation reads env at process start. To change flags:
|
||||
|
||||
```bash
|
||||
# systemd / docker: update env and restart one replica
|
||||
# or send future SIGHUP support (Phase 15)
|
||||
```
|
||||
|
||||
### Docker example
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
DEBUG_VERAE: "auth,jobs,nats,webhooks"
|
||||
DEBUG_VERAE_LEVEL: "debug"
|
||||
```
|
||||
|
||||
## Namespaces
|
||||
|
||||
| Namespace | What it traces |
|
||||
|-----------|----------------|
|
||||
| `auth` | API key resolve, session parse, login outcomes (no passwords) |
|
||||
| `billing` | Entitlement checks, quota decisions, plan limits |
|
||||
| `http` | Outbound Verae requests: method, path, status, duration |
|
||||
| `nats` | Connect, publish, consume, ack/nak, stream ensure |
|
||||
| `jobs` | Watch enqueue, poll attempts, terminal transitions |
|
||||
| `webhooks` | Subscribe, deliver attempts, HTTP status to Zapier |
|
||||
| `trace` | Correlation id enter/exit spans |
|
||||
| `app` | Boot, config summary (redacted), shutdown |
|
||||
|
||||
`DEBUG_VERAE=1` or `*` enables **all** namespaces.
|
||||
|
||||
## Correlation IDs
|
||||
|
||||
Every inbound HTTP request should get a `traceId` (generated or from `X-Trace-Id` header).
|
||||
|
||||
That id is:
|
||||
|
||||
- returned optionally as `X-Trace-Id` on responses,
|
||||
- attached to NATS payloads as `traceId`,
|
||||
- included in every debug line for that flow.
|
||||
|
||||
Example log line:
|
||||
|
||||
```text
|
||||
2026-08-11T16:00:00.000Z DEBUG jobs [trace=a1b2c3d4] poll attempt=3 jobId=550e… status=pending
|
||||
```
|
||||
|
||||
## Redaction rules
|
||||
|
||||
Always redacted (replaced with `[REDACTED]`):
|
||||
|
||||
- Headers: `authorization`, `x-api-key`, `cookie`
|
||||
- Fields named: `password`, `veraePassword`, `token`, `veraeToken`, `accessToken`, `apiKey`, `api_key`, `secret`
|
||||
- String values matching: `Bearer …`, `zmw_…`, `zmt_…`, long JWTs (`eyJ…`)
|
||||
|
||||
`targetUrl` host is kept; query string may be stripped if it contains tokens.
|
||||
|
||||
## Using debug for common failures
|
||||
|
||||
### 401 from middleware
|
||||
|
||||
```bash
|
||||
DEBUG_VERAE=auth,trace npm start
|
||||
# reproduce Zapier connection test
|
||||
# look for resolveAuthContext failures
|
||||
```
|
||||
|
||||
### Job never completes / trigger never fires
|
||||
|
||||
```bash
|
||||
DEBUG_VERAE=jobs,nats,webhooks,http
|
||||
# confirm: watch published → poll status → event emitted → deliver POST status
|
||||
```
|
||||
|
||||
### 402 quota
|
||||
|
||||
```bash
|
||||
DEBUG_VERAE=billing
|
||||
# confirm plan limits vs usage counters
|
||||
```
|
||||
|
||||
### Verae upstream errors
|
||||
|
||||
```bash
|
||||
DEBUG_VERAE=http,jobs
|
||||
# status codes and paths only; body may be summarized
|
||||
```
|
||||
|
||||
## Programmatic API
|
||||
|
||||
See [modules/debug.md](modules/debug.md) and source under `verae-zapier-middleware/src/debug/`.
|
||||
|
||||
```js
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
import { withTrace, getTraceId } from '../debug/trace.js';
|
||||
|
||||
const log = createDebugger('jobs');
|
||||
|
||||
log.debug('poll start', { jobId });
|
||||
log.error('poll failed', { jobId, err: err.message });
|
||||
```
|
||||
|
||||
## Tests
|
||||
|
||||
Phase 1 gate verifies:
|
||||
|
||||
- silence when disabled,
|
||||
- namespace filtering,
|
||||
- redaction,
|
||||
- trace id propagation.
|
||||
|
||||
```bash
|
||||
npm run gate:1
|
||||
```
|
||||
|
||||
## Production caution
|
||||
|
||||
- Prefer staging with narrowed namespaces.
|
||||
- Never commit files containing live debug output with customer data.
|
||||
- CI should run with debug off except dedicated debug unit tests that assert redaction.
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
# Developer Module Index
|
||||
|
||||
Each module document lists **every exported function**, its purpose, inputs, outputs, and side effects.
|
||||
|
||||
Implementation status follows [TODO.md](../../../TODO.md) phases. Docs describe the **target contract** so implementers and reviewers share one API surface.
|
||||
|
||||
## Middleware (`verae-zapier-middleware/src`)
|
||||
|
||||
| Module doc | Source path | Phase |
|
||||
|------------|-------------|-------|
|
||||
| [debug.md](debug.md) | `debug/` | 1 |
|
||||
| [config.md](config.md) | `config.js` | 2 |
|
||||
| [errors.md](errors.md) | `errors.js` | 2 |
|
||||
| [app.md](app.md) | `app.js`, `index.js` | 2 |
|
||||
| [store-db.md](store-db.md) | `store/db.js` | 3 |
|
||||
| [store-tenants.md](store-tenants.md) | `store/tenants.js` | 3 |
|
||||
| [store-usage.md](store-usage.md) | `store/usage.js` | 3 |
|
||||
| [store-webhooks.md](store-webhooks.md) | `store/webhooks.js` | 3 |
|
||||
| [tokens.md](tokens.md) | `lib/tokens.js` | 4 |
|
||||
| [veraeClient.md](veraeClient.md) | `clients/veraeClient.js` | 4 |
|
||||
| [authService.md](authService.md) | `services/authService.js` | 5 |
|
||||
| [entitlementService.md](entitlementService.md) | `services/entitlementService.js` | 5 |
|
||||
| [middleware-http.md](middleware-http.md) | `middleware/*.js` | 5 |
|
||||
| [timestampService.md](timestampService.md) | `services/timestampService.js` | 6 |
|
||||
| [verifyService.md](verifyService.md) | `services/verifyService.js` | 6 |
|
||||
| [webhookService.md](webhookService.md) | `services/webhookService.js` | 6 |
|
||||
| [routes.md](routes.md) | `routes/*.js` | 6 |
|
||||
| [nats.md](nats.md) | `nats/*.js` | 7 |
|
||||
| [workers.md](workers.md) | `workers/*.js` | 8–9 |
|
||||
| [tenantService.md](tenantService.md) | `services/tenantService.js` | 10 |
|
||||
|
||||
## Zapier app (`verae-zapier`)
|
||||
|
||||
| Module doc | Source path | Phase |
|
||||
|------------|-------------|-------|
|
||||
| [zapier-app.md](zapier-app.md) | `index.js`, `authentication.js`, creates/searches/triggers | 11 |
|
||||
|
||||
## Documentation rules
|
||||
|
||||
When you add or change an export:
|
||||
|
||||
1. Update JSDoc in the source file (`@param`, `@returns`, purpose sentence).
|
||||
2. Update the matching module markdown table.
|
||||
3. Add/adjust unit tests in the phase that owns the module.
|
||||
4. Instrument boundaries with `createDebugger('<namespace>')`.
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
# Module: `config`
|
||||
|
||||
**Path:** `verae-zapier-middleware/src/config.js`
|
||||
**Phase:** 2
|
||||
**Debug namespace:** `app`
|
||||
|
||||
## Purpose
|
||||
|
||||
Central runtime settings for HTTP, Verae upstream, NATS flags, and plan limits.
|
||||
|
||||
## Exports
|
||||
|
||||
### `loadEnvFile()`
|
||||
|
||||
Loads `.env` without overriding existing env vars. Called at module load.
|
||||
|
||||
### `config`
|
||||
|
||||
See [function-reference.md](function-reference.md#configjs) for field table.
|
||||
|
||||
### `PLAN_LIMITS`
|
||||
|
||||
Default quotas per plan name (`free` | `starter` | `pro` | `enterprise`).
|
||||
|
||||
## Environment variables
|
||||
|
||||
Documented in `verae-zapier-middleware/.env.example` and root `README.md`.
|
||||
103
research/zapier/verae-zapier-api/docs/developer/modules/debug.md
Normal file
103
research/zapier/verae-zapier-api/docs/developer/modules/debug.md
Normal file
|
|
@ -0,0 +1,103 @@
|
|||
# Module: `debug`
|
||||
|
||||
**Path:** `verae-zapier-middleware/src/debug/`
|
||||
**Phase:** 1
|
||||
**Purpose:** Runtime-toggleable failure tracing with secret redaction and correlation IDs.
|
||||
|
||||
## Files
|
||||
|
||||
| File | Role |
|
||||
|------|------|
|
||||
| `config.js` | Parse env into enable/namespaces/level |
|
||||
| `redact.js` | Strip secrets from log metadata |
|
||||
| `logger.js` | Namespaced `createDebugger` |
|
||||
| `trace-context.js` | ALS store (no logger import) |
|
||||
| `trace.js` | `withTrace`, Express middleware |
|
||||
| `index.js` | Public barrel export |
|
||||
|
||||
---
|
||||
|
||||
## `parseDebugVeraeEnv(raw)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Interpret `DEBUG_VERAE` env string |
|
||||
| **Input** | `raw: string \| undefined` |
|
||||
| **Output** | `{ enabled: boolean, namespaces: Set<string>\|null }` |
|
||||
| **Notes** | `1`/`*` → all namespaces; `"auth,nats"` → allow-list |
|
||||
|
||||
## `loadDebugConfig(env?)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Build full debug config from environment |
|
||||
| **Input** | `env?: NodeJS.ProcessEnv` (default `process.env`) |
|
||||
| **Output** | `DebugConfig` `{ enabled, namespaces, level, filePath }` |
|
||||
|
||||
## `shouldLog(config, namespace, messageLevel)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Decide if a line should emit |
|
||||
| **Input** | config, namespace string, level |
|
||||
| **Output** | `boolean` |
|
||||
|
||||
## `redact(input)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Deep-redact secrets for safe logging |
|
||||
| **Input** | any JSON-like value |
|
||||
| **Output** | redacted clone |
|
||||
|
||||
## `createDebugger(namespace)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Get `{ debug, info, warn, error }` logger for a namespace |
|
||||
| **Input** | `namespace: string` |
|
||||
| **Output** | `Debugger` |
|
||||
| **Side effects** | Writes to stderr (or test sink) when enabled |
|
||||
|
||||
### `Debugger.debug|info|warn|error(message, meta?)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **Input** | `message: string`, `meta?: Record<string, unknown>` |
|
||||
| **Output** | `void` |
|
||||
|
||||
## `withTrace(options, fn)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Run work under a correlation id |
|
||||
| **Input** | `{ traceId?, span? }`, `fn: () => T\|Promise<T>` |
|
||||
| **Output** | `T\|Promise<T>` |
|
||||
|
||||
## `getTraceId()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Read active correlation id |
|
||||
| **Output** | `string\|null` |
|
||||
|
||||
## `traceMiddleware(req, res, next)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Per-request Express trace context |
|
||||
| **Input** | Express `(req, res, next)` |
|
||||
| **Output** | `void` |
|
||||
| **Sets** | `req.traceId`, response header `X-Trace-Id` |
|
||||
|
||||
## `setDebugTestSink(sink)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Capture log lines in unit tests |
|
||||
| **Input** | `((line: string) => void) \| null` |
|
||||
| **Output** | `void` |
|
||||
|
||||
## Env reference
|
||||
|
||||
See [../debugging.md](../debugging.md).
|
||||
|
|
@ -0,0 +1,486 @@
|
|||
# Function Reference — All Modules
|
||||
|
||||
Canonical I/O contracts for the Verae Zapier middleware and Zapier app.
|
||||
Source of truth for reviewers; keep in sync with JSDoc in code.
|
||||
|
||||
Namespaces for debug: `auth`, `billing`, `http`, `nats`, `jobs`, `webhooks`, `trace`, `app`.
|
||||
|
||||
---
|
||||
|
||||
## config.js
|
||||
|
||||
### `loadEnvFile()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Load `.env` into `process.env` if keys are unset |
|
||||
| **Input** | none (reads file next to package root) |
|
||||
| **Output** | `void` |
|
||||
|
||||
### `config` (exported object)
|
||||
|
||||
| Field | Type | Description |
|
||||
|-------|------|-------------|
|
||||
| `port` | number | HTTP port |
|
||||
| `host` | string | Bind address |
|
||||
| `veraeApiBaseUrl` | string | Upstream Verae base URL (no trailing slash) |
|
||||
| `mockVerae` | boolean | Use mock client |
|
||||
| `natsEnabled` | boolean | Use JetStream workers |
|
||||
| `natsUrl` | string | NATS connection URL |
|
||||
| `tokenSecret` | string | HMAC secret for `zmt_` tokens |
|
||||
| `jobPollIntervalMs` | number | Poll delay |
|
||||
| `jobPollMaxAttempts` | number | Max poll attempts |
|
||||
| `storePath` | string | Absolute path to store file |
|
||||
| `upgradeUrl` | string | Billing upgrade link for 402 bodies |
|
||||
| `adminSecret` | string | Admin route secret |
|
||||
|
||||
### `PLAN_LIMITS`
|
||||
|
||||
Map of plan name → `{ timestamps, verifications, batch, batchMaxItems, requestsPerMinute }`.
|
||||
`null` means unlimited.
|
||||
|
||||
---
|
||||
|
||||
## errors.js
|
||||
|
||||
### `class AppError extends Error`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Structured operational errors returned as JSON |
|
||||
| **Constructor** | `(message: string, { status?, code?, details? })` |
|
||||
| **Properties** | `status: number`, `code: string`, `details: unknown` |
|
||||
|
||||
### `asyncHandler(fn)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Wrap async Express handlers so rejections hit error middleware |
|
||||
| **Input** | `(req, res, next) => Promise<any>` |
|
||||
| **Output** | Express middleware function |
|
||||
|
||||
### `sendError(res, err)`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Write JSON error response; log 5xx with debug |
|
||||
| **Input** | Express `res`, `Error\|AppError` |
|
||||
| **Output** | `void` |
|
||||
|
||||
---
|
||||
|
||||
## app.js / index.js
|
||||
|
||||
### `createApp()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Build Express application (no listen) |
|
||||
| **Input** | none |
|
||||
| **Output** | `express.Application` |
|
||||
| **Mounts** | `GET /health`, `/zapier/*`, error handler, `traceMiddleware` |
|
||||
|
||||
### `main()` (index.js)
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Boot store, optional NATS, workers, listen |
|
||||
| **Input** | none |
|
||||
| **Output** | `Promise<void>` |
|
||||
|
||||
---
|
||||
|
||||
## store/db.js
|
||||
|
||||
### `loadStore()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Load JSON store into memory |
|
||||
| **Output** | store object |
|
||||
|
||||
### `getStore()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Access in-memory store |
|
||||
| **Output** | `{ tenants, apiKeys, usage, webhooks, jobWatchers }` |
|
||||
|
||||
### `persist()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Flush store to disk |
|
||||
| **Output** | `void` |
|
||||
|
||||
---
|
||||
|
||||
## store/tenants.js
|
||||
|
||||
### `getTenant(tenantId)`
|
||||
|
||||
| Input | `tenantId: string` |
|
||||
| Output | `Tenant\|null` |
|
||||
|
||||
### `getTenantByApiKey(apiKey)`
|
||||
|
||||
| Input | `apiKey: string` |
|
||||
| Output | `Tenant\|null` |
|
||||
|
||||
### `listTenants()`
|
||||
|
||||
| Output | `Tenant[]` |
|
||||
|
||||
### `createTenant({ id, name, plan, veraeUsername, veraePassword, contract?, apiKey?, metadata? })`
|
||||
|
||||
| Output | `{ tenant: Tenant, apiKey: string }` |
|
||||
|
||||
### `resolveLimits(tenant)`
|
||||
|
||||
| Output | Effective limits including enterprise contract overrides |
|
||||
|
||||
---
|
||||
|
||||
## store/usage.js
|
||||
|
||||
### `getUsage(tenantId)`
|
||||
|
||||
| Output | counters for current period |
|
||||
|
||||
### `getUsageSummary(tenantId)`
|
||||
|
||||
| Output | public-safe usage + limits snapshot |
|
||||
|
||||
### `incrementUsage(tenantId, metric, amount?)`
|
||||
|
||||
| For | Atomically increment a counter and persist |
|
||||
|
||||
---
|
||||
|
||||
## store/webhooks.js
|
||||
|
||||
### `createWebhook({ tenantId, targetUrl, event })`
|
||||
|
||||
| Output | `{ id, tenantId, targetUrl, event, createdAt }` |
|
||||
|
||||
### `deleteWebhook({ tenantId, hookId?, targetUrl? })`
|
||||
|
||||
| Output | `boolean` removed |
|
||||
|
||||
### `getActiveWebhooks(tenantId, event)`
|
||||
|
||||
| Output | `Webhook[]` |
|
||||
|
||||
### `listWebhooksForTenant(tenantId)`
|
||||
|
||||
| Output | `Webhook[]` |
|
||||
|
||||
---
|
||||
|
||||
## lib/tokens.js
|
||||
|
||||
### `issueSessionToken({ tenantId, veraeToken, expiresAt })`
|
||||
|
||||
| Output | `string` (`zmt_…`) |
|
||||
|
||||
### `parseSessionToken(token)`
|
||||
|
||||
| Output | `{ tenantId, veraeToken, expiresAt, nonce }\|null` |
|
||||
|
||||
### `generateApiKey()`
|
||||
|
||||
| Output | `string` (`zmw_…`) |
|
||||
|
||||
### `isApiKey(value)`
|
||||
|
||||
| Output | `boolean` |
|
||||
|
||||
### `extractBearerToken(header)`
|
||||
|
||||
| Input | `Authorization` header string |
|
||||
| Output | token string or `null` |
|
||||
|
||||
---
|
||||
|
||||
## clients/veraeClient.js
|
||||
|
||||
All methods that hit the network log under `DEBUG_VERAE=http`.
|
||||
|
||||
### `veraeClient.login(credentials)`
|
||||
|
||||
| Input | `{ username, password }` |
|
||||
| Output | `{ token, expiresAt, user }` |
|
||||
|
||||
### `veraeClient.validate(token)`
|
||||
|
||||
| Input | Verae JWT |
|
||||
| Output | validation object |
|
||||
|
||||
### `veraeClient.createTimestamp(token, body)`
|
||||
|
||||
| Input | JWT, `{ data, hashAlg? }` |
|
||||
| Output | `{ jobId }` |
|
||||
|
||||
### `veraeClient.createBatchTimestamp(token, body)`
|
||||
|
||||
| Input | JWT, `{ items: [{ data, hashAlg? }] }` |
|
||||
| Output | `{ jobIds: string[] }` |
|
||||
|
||||
### `veraeClient.getStatus(token, jobId)`
|
||||
|
||||
| Output | StatusResponse |
|
||||
|
||||
### `veraeClient.getBatchStatus(token, body)`
|
||||
|
||||
| Input | `{ jobIds: string[] }` |
|
||||
| Output | `{ results }` |
|
||||
|
||||
### `veraeClient.verify(token, body)`
|
||||
|
||||
| Input | `{ certificate }` |
|
||||
| Output | `{ valid, timestamp?, blockIndex? }` |
|
||||
|
||||
### `veraeClient.verifyBatch(token, body)`
|
||||
|
||||
| Input | `{ certificates: string[] }` |
|
||||
| Output | `{ results }` |
|
||||
|
||||
### `veraeClient.waitForJob(token, jobId, { maxAttempts, intervalMs })`
|
||||
|
||||
| Output | terminal StatusResponse or throws `GATEWAY_TIMEOUT` |
|
||||
|
||||
---
|
||||
|
||||
## services/authService.js
|
||||
|
||||
Debug namespace: `auth`.
|
||||
|
||||
### `loginWithCredentials({ username, password, tenant? })`
|
||||
|
||||
| Output | `{ accessToken, expiresAt, tenant, user }` |
|
||||
|
||||
### `loginWithApiKey(apiKey)`
|
||||
|
||||
| Output | same as loginWithCredentials after tenant lookup |
|
||||
|
||||
### `resolveAuthContext(rawToken)`
|
||||
|
||||
| Input | API key or session token |
|
||||
| Output | `{ tenantId, tenant, veraeToken, authMethod }` |
|
||||
|
||||
### `validateSession(rawToken)`
|
||||
|
||||
| Output | `{ valid, tenantId, authMethod, user }` |
|
||||
|
||||
---
|
||||
|
||||
## services/entitlementService.js
|
||||
|
||||
Debug namespace: `billing`.
|
||||
|
||||
### `checkEntitlement(tenantId, action, { amount? })`
|
||||
|
||||
| Actions | `timestamp`, `verify`, `batch_timestamp` |
|
||||
| Throws | `402 QUOTA_EXCEEDED`, `403 PLAN_UPGRADE_REQUIRED` |
|
||||
| Output | `{ tenant, limits, usage }` |
|
||||
|
||||
### `recordUsage(tenantId, action, { amount? })`
|
||||
|
||||
| Output | `void` |
|
||||
|
||||
---
|
||||
|
||||
## middleware/authenticate.js
|
||||
|
||||
### `authenticate(req, res, next)`
|
||||
|
||||
| For | Populate `req.auth` via `resolveAuthContext` |
|
||||
| Reads | `Authorization: Bearer` or `x-api-key` |
|
||||
|
||||
## middleware/rateLimit.js
|
||||
|
||||
### `rateLimit(req, res, next)`
|
||||
|
||||
| For | Enforce plan `requestsPerMinute` |
|
||||
| Throws | `429 RATE_LIMITED` |
|
||||
|
||||
---
|
||||
|
||||
## services/timestampService.js
|
||||
|
||||
Debug: `jobs`, `billing`, `http`.
|
||||
|
||||
### `createTimestamp(ctx, body)`
|
||||
|
||||
| Input | auth context, `{ data, hashAlg? }` |
|
||||
| Output | `{ jobId }` |
|
||||
| Side effects | usage++, enqueue watch (NATS or in-process) |
|
||||
|
||||
### `createTimestampAndWait(ctx, body)`
|
||||
|
||||
| Output | StatusResponse (or pending on timeout when NATS wait enabled) |
|
||||
|
||||
### `createBatchTimestamp(ctx, body)`
|
||||
|
||||
| Output | `{ jobIds }` |
|
||||
|
||||
### `getJobStatus(ctx, jobId)` / `getBatchJobStatus` / `getJobVerification`
|
||||
|
||||
| Output | status payloads from Verae |
|
||||
|
||||
---
|
||||
|
||||
## services/verifyService.js
|
||||
|
||||
### `verifyTimestamp(ctx, body)` / `verifyBatch(ctx, body)`
|
||||
|
||||
| Output | verify results; records usage |
|
||||
|
||||
---
|
||||
|
||||
## services/webhookService.js
|
||||
|
||||
Debug: `webhooks`.
|
||||
|
||||
### `subscribe(ctx, { targetUrl, event })`
|
||||
|
||||
| Output | webhook record |
|
||||
|
||||
### `unsubscribe(ctx, { hookId?, targetUrl? })`
|
||||
|
||||
| Output | `{ removed: true }` |
|
||||
|
||||
### `deliverWebhook(targetUrl, payload)`
|
||||
|
||||
| Output | `{ ok: boolean, status: number }` |
|
||||
|
||||
---
|
||||
|
||||
## services/tenantService.js
|
||||
|
||||
### `selfServeSignup({ email, name, veraeUsername, veraePassword })`
|
||||
|
||||
| Output | `{ tenant, apiKey, zapierSetup }` |
|
||||
|
||||
### `provisionTenant({ id?, name, plan, veraeUsername, veraePassword, contract?, metadata?, audience? })`
|
||||
|
||||
| Output | `{ tenant, apiKey }` |
|
||||
|
||||
### `listProvisionedTenants()`
|
||||
|
||||
| Output | public tenant summaries (no passwords) |
|
||||
|
||||
---
|
||||
|
||||
## nats/subjects.js
|
||||
|
||||
### Constants
|
||||
|
||||
`SUBJECTS.JOBS_WATCH`, `JOBS_EVENTS`, `WEBHOOKS_DELIVER`, `USAGE`
|
||||
`STREAMS.ZAPIER_JOBS`, `ZAPIER_EVENTS`, `ZAPIER_WEBHOOKS`
|
||||
|
||||
---
|
||||
|
||||
## nats/connection.js
|
||||
|
||||
### `connectNats(url?)`
|
||||
|
||||
| Output | `{ nc, js, jsm }` NATS connection handles |
|
||||
|
||||
### `ensureStreams(jsm)`
|
||||
|
||||
| For | Idempotent stream create |
|
||||
| Output | `Promise<void>` |
|
||||
|
||||
### `closeNats()`
|
||||
|
||||
| Output | `Promise<void>` |
|
||||
|
||||
---
|
||||
|
||||
## nats/publishers.js
|
||||
|
||||
### `enqueueWatch(jobWatchPayload)`
|
||||
|
||||
| Input | see architecture/nats-subjects.md |
|
||||
| Output | `Promise<{ seq }>` |
|
||||
|
||||
### `publishJobEvent(eventPayload)`
|
||||
|
||||
| Output | `Promise<void>` |
|
||||
|
||||
### `enqueueWebhook(deliverPayload)`
|
||||
|
||||
| Output | `Promise<void>` |
|
||||
|
||||
---
|
||||
|
||||
## workers/jobPollerWorker.js
|
||||
|
||||
### `startJobPollerWorker()`
|
||||
|
||||
| For | Pull-consume watch queue; poll Verae; emit events |
|
||||
| Output | stop handle `{ stop() }` |
|
||||
|
||||
## workers/webhookWorker.js
|
||||
|
||||
### `startWebhookWorker()`
|
||||
|
||||
| For | Deliver POSTs to Zapier with retry via JetStream |
|
||||
| Output | `{ stop() }` |
|
||||
|
||||
## workers/inProcessJobPoller.js
|
||||
|
||||
### `startInProcessJobPoller()` / `stopInProcessJobPoller()`
|
||||
|
||||
| For | Phase 6 fallback when `NATS_ENABLED=false` |
|
||||
|
||||
---
|
||||
|
||||
## Routes (all under `/zapier`)
|
||||
|
||||
| Method | Path | Handler purpose |
|
||||
|--------|------|-----------------|
|
||||
| POST | `/v1/auth/login` | Credentials or api_key → session |
|
||||
| GET | `/v1/auth/me` | Validate connection for Zapier |
|
||||
| POST | `/v1/timestamp` | Async create |
|
||||
| POST | `/v1/timestamp/wait` | Create and wait |
|
||||
| POST | `/v1/timestamp/batch` | Batch create |
|
||||
| POST | `/v1/verify` | Verify certificate |
|
||||
| GET | `/v1/status/:jobId` | Job status |
|
||||
| POST | `/v1/webhooks/subscribe` | REST Hook subscribe |
|
||||
| DELETE | `/v1/webhooks/unsubscribe` | REST Hook unsubscribe |
|
||||
| POST | `/v1/signup` | Self-serve tenant |
|
||||
| POST | `/v1/admin/tenants` | Admin provision |
|
||||
|
||||
---
|
||||
|
||||
## Zapier app modules
|
||||
|
||||
### `authentication.test` / fields
|
||||
|
||||
| Input from user | `api_key` |
|
||||
| Test URL | `GET {MIDDLEWARE_BASE_URL}/zapier/v1/auth/me` |
|
||||
|
||||
### `beforeRequest: addApiKey`
|
||||
|
||||
| Sets | `Authorization: Bearer ${bundle.authData.api_key}` |
|
||||
|
||||
### Creates
|
||||
|
||||
| Key | Middleware path |
|
||||
|-----|-----------------|
|
||||
| `timestamp_and_wait` | POST `/zapier/v1/timestamp/wait` |
|
||||
| `create_timestamp` | POST `/zapier/v1/timestamp` |
|
||||
| `verify_timestamp` | POST `/zapier/v1/verify` |
|
||||
| `batch_timestamp` | POST `/zapier/v1/timestamp/batch` |
|
||||
|
||||
### Search `job_status`
|
||||
|
||||
| Path | GET `/zapier/v1/status/{jobId}` |
|
||||
|
||||
### Trigger `timestamp_completed`
|
||||
|
||||
| Subscribe | POST `/zapier/v1/webhooks/subscribe` |
|
||||
| Unsubscribe | DELETE `/zapier/v1/webhooks/unsubscribe` |
|
||||
| Perform | return `[bundle.cleanedRequest]` |
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
# Module: `nats`
|
||||
|
||||
**Path:** `verae-zapier-middleware/src/nats/`
|
||||
**Phase:** 7
|
||||
**Debug namespace:** `nats`
|
||||
|
||||
## Files
|
||||
|
||||
| File | Purpose |
|
||||
|------|---------|
|
||||
| `subjects.js` | Subject, stream, consumer name constants |
|
||||
| `connection.js` | Connect, ensure streams, close |
|
||||
| `publishers.js` | enqueueWatch, publishJobEvent, enqueueWebhook |
|
||||
|
||||
## Function contracts
|
||||
|
||||
Full I/O tables: [function-reference.md](function-reference.md#natssubjectsjs)
|
||||
Payload schemas: [../../architecture/nats-subjects.md](../../architecture/nats-subjects.md)
|
||||
|
||||
## Implementation status
|
||||
|
||||
Stubs throw until **GATE 7**. Call sites must check `config.natsEnabled` and fall back to in-process poller (Phase 6).
|
||||
|
||||
## Security
|
||||
|
||||
- Prefer `tokenRef` over raw Verae JWT in messages.
|
||||
- All publish paths log via `createDebugger('nats')` with redaction.
|
||||
- NATS must remain private (not exposed to Zapier).
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
# Module: `workers`
|
||||
|
||||
**Path:** `verae-zapier-middleware/src/workers/`
|
||||
**Phases:** 6 (in-process), 8–9 (NATS)
|
||||
|
||||
## Files
|
||||
|
||||
| File | Phase | Purpose |
|
||||
|------|-------|---------|
|
||||
| `inProcessJobPoller.js` | 6 | Fallback poller when `NATS_ENABLED=false` |
|
||||
| `jobPollerWorker.js` | 8 | JetStream job watch consumer |
|
||||
| `webhookWorker.js` | 8 | JetStream webhook deliver consumer |
|
||||
|
||||
## `startJobPollerWorker()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | Poll Verae until job terminal; publish events |
|
||||
| **Input** | none (uses NATS + config) |
|
||||
| **Output** | `Promise<{ stop: () => Promise<void> }>` |
|
||||
| **Debug** | `jobs`, `http`, `nats` |
|
||||
|
||||
## `startWebhookWorker()`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **For** | POST completion payloads to Zapier hook URLs |
|
||||
| **Output** | `Promise<{ stop: () => Promise<void> }>` |
|
||||
| **Debug** | `webhooks`, `nats` |
|
||||
|
||||
## Rules
|
||||
|
||||
- Only one of in-process poller **or** NATS job worker should run.
|
||||
- Never log raw JWTs or full webhook secrets.
|
||||
- Queue groups allow horizontal scale without double delivery.
|
||||
189
research/zapier/verae-zapier-api/docs/plans/phase-gates.md
Normal file
189
research/zapier/verae-zapier-api/docs/plans/phase-gates.md
Normal file
|
|
@ -0,0 +1,189 @@
|
|||
# Phase Gates — Commands and Acceptance Criteria
|
||||
|
||||
Gates enforce **test-before-next-step**. Run from repository root:
|
||||
|
||||
```bash
|
||||
cd /Users/marchon/datacubes/verae-zapier-api
|
||||
npm run gate:N
|
||||
```
|
||||
|
||||
`npm run gate:all` runs gates `0` … `12` sequentially and **exits non-zero** on first failure.
|
||||
|
||||
## Gate 0 — Structure and documentation
|
||||
|
||||
```bash
|
||||
npm run gate:0
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Layout | `TODO.md`, `README.md`, middleware + zapier dirs, docs tree |
|
||||
| Architecture | `docs/architecture/overview.md`, `nats-subjects.md` |
|
||||
| Developer | `docs/developer/debugging.md`, `docs/developer/modules/*.md` |
|
||||
| Plan | `docs/plans/phase-gates.md` |
|
||||
|
||||
## Gate 1 — Debug facility
|
||||
|
||||
```bash
|
||||
npm run gate:1
|
||||
```
|
||||
|
||||
Tests: `verae-zapier-middleware/test/unit/debug*.test.js`
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Off by default | No output when `DEBUG_VERAE` unset |
|
||||
| Namespace filter | `auth` does not emit `nats` lines |
|
||||
| Redaction | Tokens/passwords not present in formatted output |
|
||||
| Trace | Child spans inherit `traceId` |
|
||||
|
||||
## Gate 2 — HTTP shell
|
||||
|
||||
```bash
|
||||
npm run gate:2
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Health | `GET /health` → 200 `{ status: "ok" }` |
|
||||
| Errors | Thrown `AppError` → JSON `{ error, code }` |
|
||||
| Config | Reads NATS and debug env keys |
|
||||
|
||||
## Gate 3 — Stores
|
||||
|
||||
```bash
|
||||
npm run gate:3
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Tenants | API key maps to tenant |
|
||||
| Limits | Plan + enterprise contract |
|
||||
| Webhooks | Tenant isolation |
|
||||
| Persist | Reload preserves state |
|
||||
|
||||
## Gate 4 — Tokens + Verae client
|
||||
|
||||
```bash
|
||||
npm run gate:4
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| HMAC | Bad signature rejected |
|
||||
| Mock job | create → wait → completed |
|
||||
| HTTP debug | No Authorization values logged |
|
||||
|
||||
## Gate 5 — Auth + entitlements
|
||||
|
||||
```bash
|
||||
npm run gate:5
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Me | Valid API key |
|
||||
| 401 | Invalid key |
|
||||
| 402 | Over quota |
|
||||
|
||||
## Gate 6 — Sync HTTP API (NATS off)
|
||||
|
||||
```bash
|
||||
NATS_ENABLED=false MOCK_VERAE=true npm run gate:6
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Timestamp | 202 + jobId |
|
||||
| Wait | completed status |
|
||||
| Verify | boolean valid |
|
||||
| Webhooks | subscribe stored |
|
||||
|
||||
## Gate 7 — NATS infrastructure
|
||||
|
||||
```bash
|
||||
npm run gate:7
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Streams | Created/idempotent ensure |
|
||||
| Pub/sub | One message round-trip |
|
||||
| Flag off | App boots without NATS |
|
||||
|
||||
## Gate 8 — Workers
|
||||
|
||||
```bash
|
||||
NATS_ENABLED=true MOCK_VERAE=true npm run gate:8
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Watch→event | Terminal event published |
|
||||
| Webhook | Mock receiver got POST |
|
||||
| Queue group | No double complete |
|
||||
|
||||
## Gate 9 — Wait via NATS
|
||||
|
||||
```bash
|
||||
npm run gate:9
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Success | Wait returns completed |
|
||||
| Timeout | Returns pending + jobId |
|
||||
|
||||
## Gate 10 — Tenancy
|
||||
|
||||
```bash
|
||||
npm run gate:10
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Signup | free + apiKey |
|
||||
| Enterprise | requires contract |
|
||||
|
||||
## Gate 11 — Zapier package
|
||||
|
||||
```bash
|
||||
npm run gate:11
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Auth module | fields + test URL |
|
||||
| Creates | correct middleware paths |
|
||||
| Trigger | subscribe shapes |
|
||||
|
||||
## Gate 12 — E2E local compose
|
||||
|
||||
```bash
|
||||
npm run gate:12
|
||||
```
|
||||
|
||||
| Check | Requirement |
|
||||
|-------|-------------|
|
||||
| Stack | health green |
|
||||
| Paths | async + wait + hook |
|
||||
|
||||
## Gate 13 — Production smoke (opt-in)
|
||||
|
||||
```bash
|
||||
PRODUCTION_SMOKE=1 npm run gate:13
|
||||
```
|
||||
|
||||
Requires real secrets; skipped in default `gate:all`.
|
||||
|
||||
## Gate 14 — Human acceptance
|
||||
|
||||
Manual checklist in `TODO.md` (not automated).
|
||||
|
||||
## Gate 15 — Hardening
|
||||
|
||||
Checklist + load notes in `TODO.md`.
|
||||
|
||||
## Recording results
|
||||
|
||||
After each green gate, update the **Gate log** table in `TODO.md` with date and `pass`.
|
||||
29
research/zapier/verae-zapier-api/package.json
Normal file
29
research/zapier/verae-zapier-api/package.json
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
{
|
||||
"name": "verae-zapier-api",
|
||||
"version": "0.1.0",
|
||||
"private": true,
|
||||
"description": "Verae ↔ Zapier platform: middleware, NATS workers, Zapier CLI app, gated plan",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"gate:0": "node scripts/gate-0-structure.mjs",
|
||||
"gate:1": "npm --prefix verae-zapier-middleware run test:gate1",
|
||||
"gate:2": "npm --prefix verae-zapier-middleware run test:gate2",
|
||||
"gate:3": "npm --prefix verae-zapier-middleware run test:gate3",
|
||||
"gate:4": "npm --prefix verae-zapier-middleware run test:gate4",
|
||||
"gate:5": "npm --prefix verae-zapier-middleware run test:gate5",
|
||||
"gate:6": "npm --prefix verae-zapier-middleware run test:gate6",
|
||||
"gate:7": "npm --prefix verae-zapier-middleware run test:gate7",
|
||||
"gate:8": "npm --prefix verae-zapier-middleware run test:gate8",
|
||||
"gate:9": "node scripts/gate-not-ready.mjs 9",
|
||||
"gate:10": "npm --prefix verae-zapier-middleware run test:gate10",
|
||||
"gate:11": "node --test verae-zapier/test/app.test.js",
|
||||
"gate:12": "node scripts/gate-not-ready.mjs 12",
|
||||
"gate:13": "node scripts/gate-not-ready.mjs 13",
|
||||
"gate:all": "node scripts/gate-all.mjs",
|
||||
"test:middleware": "npm --prefix verae-zapier-middleware test"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=22.0.0"
|
||||
},
|
||||
"license": "UNLICENSED"
|
||||
}
|
||||
103
research/zapier/verae-zapier-api/scripts/gate-0-structure.mjs
Normal file
103
research/zapier/verae-zapier-api/scripts/gate-0-structure.mjs
Normal file
|
|
@ -0,0 +1,103 @@
|
|||
#!/usr/bin/env node
|
||||
/**
|
||||
* GATE 0 — Repository structure and documentation presence.
|
||||
* Fails if required plan/docs/source paths are missing or empty.
|
||||
*/
|
||||
|
||||
import { existsSync, statSync, readdirSync } from 'node:fs';
|
||||
import { resolve, dirname, join } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
||||
const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
|
||||
|
||||
/** @type {string[]} */
|
||||
const requiredFiles = [
|
||||
'TODO.md',
|
||||
'README.md',
|
||||
'package.json',
|
||||
'docs/architecture/overview.md',
|
||||
'docs/architecture/nats-subjects.md',
|
||||
'docs/developer/debugging.md',
|
||||
'docs/developer/modules/README.md',
|
||||
'docs/developer/modules/debug.md',
|
||||
'docs/developer/modules/function-reference.md',
|
||||
'docs/plans/phase-gates.md',
|
||||
'verae-zapier-middleware/package.json',
|
||||
'verae-zapier-middleware/src/debug/config.js',
|
||||
'verae-zapier-middleware/src/debug/logger.js',
|
||||
'verae-zapier-middleware/src/debug/redact.js',
|
||||
'verae-zapier-middleware/src/debug/trace.js',
|
||||
'verae-zapier-middleware/src/debug/index.js',
|
||||
'verae-zapier-middleware/src/config.js',
|
||||
'verae-zapier-middleware/src/errors.js',
|
||||
'verae-zapier-middleware/src/app.js',
|
||||
'verae-zapier-middleware/src/nats/subjects.js',
|
||||
'verae-zapier-middleware/src/nats/connection.js',
|
||||
'verae-zapier-middleware/src/nats/publishers.js',
|
||||
'verae-zapier-middleware/src/workers/jobPollerWorker.js',
|
||||
'verae-zapier-middleware/src/workers/webhookWorker.js',
|
||||
'verae-zapier-middleware/test/unit/debug.test.js',
|
||||
];
|
||||
|
||||
/** @type {string[]} */
|
||||
const requiredDirs = [
|
||||
'docs/developer/modules',
|
||||
'verae-zapier-middleware/src/debug',
|
||||
'verae-zapier-middleware/src/nats',
|
||||
'verae-zapier-middleware/src/workers',
|
||||
'verae-zapier',
|
||||
];
|
||||
|
||||
let failed = false;
|
||||
|
||||
function fail(msg) {
|
||||
console.error(`FAIL: ${msg}`);
|
||||
failed = true;
|
||||
}
|
||||
|
||||
function ok(msg) {
|
||||
console.log(`OK: ${msg}`);
|
||||
}
|
||||
|
||||
for (const rel of requiredDirs) {
|
||||
const p = join(root, rel);
|
||||
if (!existsSync(p) || !statSync(p).isDirectory()) {
|
||||
fail(`missing directory ${rel}`);
|
||||
} else {
|
||||
ok(`dir ${rel}`);
|
||||
}
|
||||
}
|
||||
|
||||
for (const rel of requiredFiles) {
|
||||
const p = join(root, rel);
|
||||
if (!existsSync(p) || !statSync(p).isFile()) {
|
||||
fail(`missing file ${rel}`);
|
||||
continue;
|
||||
}
|
||||
const size = statSync(p).size;
|
||||
if (size < 40) {
|
||||
fail(`file too small (${size}b): ${rel}`);
|
||||
} else {
|
||||
ok(`file ${rel} (${size}b)`);
|
||||
}
|
||||
}
|
||||
|
||||
// TODO.md must mention gates and NATS
|
||||
const todo = await import('node:fs').then((fs) =>
|
||||
fs.readFileSync(join(root, 'TODO.md'), 'utf8'),
|
||||
);
|
||||
for (const needle of ['GATE 0', 'NATS', 'DEBUG_VERAE', 'gate:all', 'api.veraetime.net']) {
|
||||
if (!todo.includes(needle)) {
|
||||
fail(`TODO.md missing required term: ${needle}`);
|
||||
} else {
|
||||
ok(`TODO.md contains "${needle}"`);
|
||||
}
|
||||
}
|
||||
|
||||
if (failed) {
|
||||
console.error('\nGATE 0 FAILED');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
console.log('\nGATE 0 PASSED');
|
||||
process.exit(0);
|
||||
27
research/zapier/verae-zapier-api/scripts/gate-all.mjs
Normal file
27
research/zapier/verae-zapier-api/scripts/gate-all.mjs
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
#!/usr/bin/env node
|
||||
/**
|
||||
* Run gates 0–12 in dependency order. Stops on first failure.
|
||||
*/
|
||||
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { resolve, dirname } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
|
||||
const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
|
||||
const gates = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12];
|
||||
|
||||
for (const g of gates) {
|
||||
console.log(`\n========== GATE ${g} ==========`);
|
||||
const result = spawnSync('npm', ['run', `gate:${g}`], {
|
||||
cwd: root,
|
||||
stdio: 'inherit',
|
||||
shell: true,
|
||||
});
|
||||
if (result.status !== 0) {
|
||||
console.error(`\ngate:all stopped at GATE ${g}`);
|
||||
process.exit(result.status ?? 1);
|
||||
}
|
||||
}
|
||||
|
||||
console.log('\ngate:all PASSED (0–12)');
|
||||
process.exit(0);
|
||||
12
research/zapier/verae-zapier-api/scripts/gate-not-ready.mjs
Normal file
12
research/zapier/verae-zapier-api/scripts/gate-not-ready.mjs
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
#!/usr/bin/env node
|
||||
/**
|
||||
* Placeholder for gates whose implementation phase is not complete.
|
||||
* Exits non-zero so `gate:all` stops at the correct dependency boundary.
|
||||
*/
|
||||
|
||||
const phase = process.argv[2] ?? '?';
|
||||
console.error(
|
||||
`GATE ${phase} not ready: implement Phase ${phase} per TODO.md, then replace this stub with real tests.`,
|
||||
);
|
||||
console.error('Do not advance past incomplete gates.');
|
||||
process.exit(1);
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
# HTTP
|
||||
PORT=3100
|
||||
HOST=0.0.0.0
|
||||
|
||||
# Upstream Verae
|
||||
VERAE_API_BASE_URL=https://api.veraetime.net
|
||||
MOCK_VERAE=false
|
||||
|
||||
# NATS (Phase 7+)
|
||||
NATS_ENABLED=false
|
||||
NATS_URL=nats://127.0.0.1:4222
|
||||
|
||||
# Security
|
||||
TOKEN_SECRET=change-me-in-production
|
||||
ADMIN_SECRET=change-me-admin
|
||||
|
||||
# Job polling
|
||||
JOB_POLL_INTERVAL_MS=2000
|
||||
JOB_POLL_MAX_ATTEMPTS=60
|
||||
|
||||
# Store
|
||||
STORE_PATH=./data/store.json
|
||||
|
||||
# Billing UX
|
||||
UPGRADE_URL=https://veraetime.net/billing
|
||||
|
||||
# Runtime debug (see docs/developer/debugging.md)
|
||||
# DEBUG_VERAE=auth,nats,jobs,webhooks,http,billing
|
||||
# DEBUG_VERAE_LEVEL=debug
|
||||
# DEBUG_VERAE_FILE=/tmp/verae-zapier-debug.log
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
FROM node:22-alpine
|
||||
WORKDIR /app
|
||||
COPY package.json ./
|
||||
RUN npm install --omit=dev
|
||||
COPY src ./src
|
||||
ENV PORT=3100
|
||||
EXPOSE 3100
|
||||
CMD ["node", "src/index.js"]
|
||||
870
research/zapier/verae-zapier-api/verae-zapier-middleware/package-lock.json
generated
Normal file
870
research/zapier/verae-zapier-api/verae-zapier-middleware/package-lock.json
generated
Normal file
|
|
@ -0,0 +1,870 @@
|
|||
{
|
||||
"name": "verae-zapier-middleware",
|
||||
"version": "0.1.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "verae-zapier-middleware",
|
||||
"version": "0.1.0",
|
||||
"license": "UNLICENSED",
|
||||
"dependencies": {
|
||||
"express": "^4.21.2",
|
||||
"nats": "^2.28.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=22.0.0"
|
||||
},
|
||||
"optionalDependencies": {
|
||||
"nats": "^2.28.2"
|
||||
}
|
||||
},
|
||||
"node_modules/accepts": {
|
||||
"version": "1.3.8",
|
||||
"resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
|
||||
"integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"mime-types": "~2.1.34",
|
||||
"negotiator": "0.6.3"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/array-flatten": {
|
||||
"version": "1.1.1",
|
||||
"resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
|
||||
"integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/body-parser": {
|
||||
"version": "1.20.6",
|
||||
"resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
|
||||
"integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"bytes": "~3.1.2",
|
||||
"content-type": "~1.0.5",
|
||||
"debug": "2.6.9",
|
||||
"depd": "2.0.0",
|
||||
"destroy": "~1.2.0",
|
||||
"http-errors": "~2.0.1",
|
||||
"iconv-lite": "~0.4.24",
|
||||
"on-finished": "~2.4.1",
|
||||
"qs": "~6.15.1",
|
||||
"raw-body": "~2.5.3",
|
||||
"type-is": "~1.6.18",
|
||||
"unpipe": "~1.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.8",
|
||||
"npm": "1.2.8000 || >= 1.4.16"
|
||||
}
|
||||
},
|
||||
"node_modules/bytes": {
|
||||
"version": "3.1.2",
|
||||
"resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
|
||||
"integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/call-bind-apply-helpers": {
|
||||
"version": "1.0.2",
|
||||
"resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
|
||||
"integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"es-errors": "^1.3.0",
|
||||
"function-bind": "^1.1.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/call-bound": {
|
||||
"version": "1.0.4",
|
||||
"resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
|
||||
"integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"call-bind-apply-helpers": "^1.0.2",
|
||||
"get-intrinsic": "^1.3.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/content-disposition": {
|
||||
"version": "0.5.4",
|
||||
"resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
|
||||
"integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"safe-buffer": "5.2.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/content-type": {
|
||||
"version": "1.0.5",
|
||||
"resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
|
||||
"integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/cookie": {
|
||||
"version": "0.7.2",
|
||||
"resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
|
||||
"integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/cookie-signature": {
|
||||
"version": "1.0.7",
|
||||
"resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
|
||||
"integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/debug": {
|
||||
"version": "2.6.9",
|
||||
"resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
|
||||
"integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"ms": "2.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/depd": {
|
||||
"version": "2.0.0",
|
||||
"resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
|
||||
"integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/destroy": {
|
||||
"version": "1.2.0",
|
||||
"resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
|
||||
"integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8",
|
||||
"npm": "1.2.8000 || >= 1.4.16"
|
||||
}
|
||||
},
|
||||
"node_modules/dunder-proto": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
|
||||
"integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"call-bind-apply-helpers": "^1.0.1",
|
||||
"es-errors": "^1.3.0",
|
||||
"gopd": "^1.2.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/ee-first": {
|
||||
"version": "1.1.1",
|
||||
"resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
|
||||
"integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/encodeurl": {
|
||||
"version": "2.0.0",
|
||||
"resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
|
||||
"integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/es-define-property": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
|
||||
"integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/es-errors": {
|
||||
"version": "1.3.0",
|
||||
"resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
|
||||
"integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/es-object-atoms": {
|
||||
"version": "1.1.2",
|
||||
"resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
|
||||
"integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"es-errors": "^1.3.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/escape-html": {
|
||||
"version": "1.0.3",
|
||||
"resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
|
||||
"integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/etag": {
|
||||
"version": "1.8.1",
|
||||
"resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
|
||||
"integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/express": {
|
||||
"version": "4.22.2",
|
||||
"resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
|
||||
"integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"accepts": "~1.3.8",
|
||||
"array-flatten": "1.1.1",
|
||||
"body-parser": "~1.20.5",
|
||||
"content-disposition": "~0.5.4",
|
||||
"content-type": "~1.0.4",
|
||||
"cookie": "~0.7.1",
|
||||
"cookie-signature": "~1.0.6",
|
||||
"debug": "2.6.9",
|
||||
"depd": "2.0.0",
|
||||
"encodeurl": "~2.0.0",
|
||||
"escape-html": "~1.0.3",
|
||||
"etag": "~1.8.1",
|
||||
"finalhandler": "~1.3.1",
|
||||
"fresh": "~0.5.2",
|
||||
"http-errors": "~2.0.0",
|
||||
"merge-descriptors": "1.0.3",
|
||||
"methods": "~1.1.2",
|
||||
"on-finished": "~2.4.1",
|
||||
"parseurl": "~1.3.3",
|
||||
"path-to-regexp": "~0.1.12",
|
||||
"proxy-addr": "~2.0.7",
|
||||
"qs": "~6.15.1",
|
||||
"range-parser": "~1.2.1",
|
||||
"safe-buffer": "5.2.1",
|
||||
"send": "~0.19.0",
|
||||
"serve-static": "~1.16.2",
|
||||
"setprototypeof": "1.2.0",
|
||||
"statuses": "~2.0.1",
|
||||
"type-is": "~1.6.18",
|
||||
"utils-merge": "1.0.1",
|
||||
"vary": "~1.1.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.10.0"
|
||||
},
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/express"
|
||||
}
|
||||
},
|
||||
"node_modules/finalhandler": {
|
||||
"version": "1.3.2",
|
||||
"resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
|
||||
"integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"debug": "2.6.9",
|
||||
"encodeurl": "~2.0.0",
|
||||
"escape-html": "~1.0.3",
|
||||
"on-finished": "~2.4.1",
|
||||
"parseurl": "~1.3.3",
|
||||
"statuses": "~2.0.2",
|
||||
"unpipe": "~1.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/forwarded": {
|
||||
"version": "0.2.0",
|
||||
"resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
|
||||
"integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/fresh": {
|
||||
"version": "0.5.2",
|
||||
"resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
|
||||
"integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/function-bind": {
|
||||
"version": "1.1.2",
|
||||
"resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
|
||||
"integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
|
||||
"license": "MIT",
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/get-intrinsic": {
|
||||
"version": "1.3.0",
|
||||
"resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
|
||||
"integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"call-bind-apply-helpers": "^1.0.2",
|
||||
"es-define-property": "^1.0.1",
|
||||
"es-errors": "^1.3.0",
|
||||
"es-object-atoms": "^1.1.1",
|
||||
"function-bind": "^1.1.2",
|
||||
"get-proto": "^1.0.1",
|
||||
"gopd": "^1.2.0",
|
||||
"has-symbols": "^1.1.0",
|
||||
"hasown": "^2.0.2",
|
||||
"math-intrinsics": "^1.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/get-proto": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
|
||||
"integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"dunder-proto": "^1.0.1",
|
||||
"es-object-atoms": "^1.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/gopd": {
|
||||
"version": "1.2.0",
|
||||
"resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
|
||||
"integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/has-symbols": {
|
||||
"version": "1.1.0",
|
||||
"resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
|
||||
"integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/hasown": {
|
||||
"version": "2.0.4",
|
||||
"resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
|
||||
"integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"function-bind": "^1.1.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/http-errors": {
|
||||
"version": "2.0.1",
|
||||
"resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
|
||||
"integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"depd": "~2.0.0",
|
||||
"inherits": "~2.0.4",
|
||||
"setprototypeof": "~1.2.0",
|
||||
"statuses": "~2.0.2",
|
||||
"toidentifier": "~1.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
},
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/express"
|
||||
}
|
||||
},
|
||||
"node_modules/iconv-lite": {
|
||||
"version": "0.4.24",
|
||||
"resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
|
||||
"integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"safer-buffer": ">= 2.1.2 < 3"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/inherits": {
|
||||
"version": "2.0.4",
|
||||
"resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
|
||||
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/ipaddr.js": {
|
||||
"version": "1.9.1",
|
||||
"resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
|
||||
"integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.10"
|
||||
}
|
||||
},
|
||||
"node_modules/math-intrinsics": {
|
||||
"version": "1.1.0",
|
||||
"resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
|
||||
"integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/media-typer": {
|
||||
"version": "0.3.0",
|
||||
"resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
|
||||
"integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/merge-descriptors": {
|
||||
"version": "1.0.3",
|
||||
"resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
|
||||
"integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
|
||||
"license": "MIT",
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/sindresorhus"
|
||||
}
|
||||
},
|
||||
"node_modules/methods": {
|
||||
"version": "1.1.2",
|
||||
"resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
|
||||
"integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/mime": {
|
||||
"version": "1.6.0",
|
||||
"resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
|
||||
"integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
|
||||
"license": "MIT",
|
||||
"bin": {
|
||||
"mime": "cli.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
}
|
||||
},
|
||||
"node_modules/mime-db": {
|
||||
"version": "1.52.0",
|
||||
"resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
|
||||
"integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/mime-types": {
|
||||
"version": "2.1.35",
|
||||
"resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
|
||||
"integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"mime-db": "1.52.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/ms": {
|
||||
"version": "2.0.0",
|
||||
"resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
|
||||
"integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/nats": {
|
||||
"version": "2.28.2",
|
||||
"resolved": "https://registry.npmjs.org/nats/-/nats-2.28.2.tgz",
|
||||
"integrity": "sha512-02cvR8EPach+0BfVaQjPgsbPFn6uMjEQAuvXS2ppg8jiWEm2KYdfmeFmtshiU9b2+kFh3LSEKMEaIfRgk3K8tw==",
|
||||
"deprecated": "Package moved. Use @nats-io/transport-node from https://github.com/nats-io/nats.js",
|
||||
"license": "Apache-2.0",
|
||||
"optional": true,
|
||||
"dependencies": {
|
||||
"nkeys.js": "1.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 14.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/negotiator": {
|
||||
"version": "0.6.3",
|
||||
"resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
|
||||
"integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/nkeys.js": {
|
||||
"version": "1.1.0",
|
||||
"resolved": "https://registry.npmjs.org/nkeys.js/-/nkeys.js-1.1.0.tgz",
|
||||
"integrity": "sha512-tB/a0shZL5UZWSwsoeyqfTszONTt4k2YS0tuQioMOD180+MbombYVgzDUYHlx+gejYK6rgf08n/2Df99WY0Sxg==",
|
||||
"license": "Apache-2.0",
|
||||
"optional": true,
|
||||
"dependencies": {
|
||||
"tweetnacl": "1.0.3"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=10.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/object-inspect": {
|
||||
"version": "1.13.4",
|
||||
"resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
|
||||
"integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/on-finished": {
|
||||
"version": "2.4.1",
|
||||
"resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
|
||||
"integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"ee-first": "1.1.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/parseurl": {
|
||||
"version": "1.3.3",
|
||||
"resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
|
||||
"integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/path-to-regexp": {
|
||||
"version": "0.1.13",
|
||||
"resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
|
||||
"integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/proxy-addr": {
|
||||
"version": "2.0.7",
|
||||
"resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
|
||||
"integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"forwarded": "0.2.0",
|
||||
"ipaddr.js": "1.9.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.10"
|
||||
}
|
||||
},
|
||||
"node_modules/qs": {
|
||||
"version": "6.15.3",
|
||||
"resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
|
||||
"integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
|
||||
"license": "BSD-3-Clause",
|
||||
"dependencies": {
|
||||
"es-define-property": "^1.0.1",
|
||||
"side-channel": "^1.1.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=0.6"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/range-parser": {
|
||||
"version": "1.2.1",
|
||||
"resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
|
||||
"integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/raw-body": {
|
||||
"version": "2.5.3",
|
||||
"resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
|
||||
"integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"bytes": "~3.1.2",
|
||||
"http-errors": "~2.0.1",
|
||||
"iconv-lite": "~0.4.24",
|
||||
"unpipe": "~1.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/safe-buffer": {
|
||||
"version": "5.2.1",
|
||||
"resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
|
||||
"integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/feross"
|
||||
},
|
||||
{
|
||||
"type": "patreon",
|
||||
"url": "https://www.patreon.com/feross"
|
||||
},
|
||||
{
|
||||
"type": "consulting",
|
||||
"url": "https://feross.org/support"
|
||||
}
|
||||
],
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/safer-buffer": {
|
||||
"version": "2.1.2",
|
||||
"resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
|
||||
"integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/send": {
|
||||
"version": "0.19.2",
|
||||
"resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
|
||||
"integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"debug": "2.6.9",
|
||||
"depd": "2.0.0",
|
||||
"destroy": "1.2.0",
|
||||
"encodeurl": "~2.0.0",
|
||||
"escape-html": "~1.0.3",
|
||||
"etag": "~1.8.1",
|
||||
"fresh": "~0.5.2",
|
||||
"http-errors": "~2.0.1",
|
||||
"mime": "1.6.0",
|
||||
"ms": "2.1.3",
|
||||
"on-finished": "~2.4.1",
|
||||
"range-parser": "~1.2.1",
|
||||
"statuses": "~2.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.8.0"
|
||||
}
|
||||
},
|
||||
"node_modules/send/node_modules/ms": {
|
||||
"version": "2.1.3",
|
||||
"resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
|
||||
"integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/serve-static": {
|
||||
"version": "1.16.3",
|
||||
"resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
|
||||
"integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"encodeurl": "~2.0.0",
|
||||
"escape-html": "~1.0.3",
|
||||
"parseurl": "~1.3.3",
|
||||
"send": "~0.19.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.8.0"
|
||||
}
|
||||
},
|
||||
"node_modules/setprototypeof": {
|
||||
"version": "1.2.0",
|
||||
"resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
|
||||
"integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/side-channel": {
|
||||
"version": "1.1.1",
|
||||
"resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
|
||||
"integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"es-errors": "^1.3.0",
|
||||
"object-inspect": "^1.13.4",
|
||||
"side-channel-list": "^1.0.1",
|
||||
"side-channel-map": "^1.0.1",
|
||||
"side-channel-weakmap": "^1.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/side-channel-list": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
|
||||
"integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"es-errors": "^1.3.0",
|
||||
"object-inspect": "^1.13.4"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/side-channel-map": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
|
||||
"integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"call-bound": "^1.0.2",
|
||||
"es-errors": "^1.3.0",
|
||||
"get-intrinsic": "^1.2.5",
|
||||
"object-inspect": "^1.13.3"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/side-channel-weakmap": {
|
||||
"version": "1.0.2",
|
||||
"resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
|
||||
"integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"call-bound": "^1.0.2",
|
||||
"es-errors": "^1.3.0",
|
||||
"get-intrinsic": "^1.2.5",
|
||||
"object-inspect": "^1.13.3",
|
||||
"side-channel-map": "^1.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/ljharb"
|
||||
}
|
||||
},
|
||||
"node_modules/statuses": {
|
||||
"version": "2.0.2",
|
||||
"resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
|
||||
"integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/toidentifier": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
|
||||
"integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/tweetnacl": {
|
||||
"version": "1.0.3",
|
||||
"resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-1.0.3.tgz",
|
||||
"integrity": "sha512-6rt+RN7aOi1nGMyC4Xa5DdYiukl2UWCbcJft7YhxReBGQD7OAM8Pbxw6YMo4r2diNEA8FEmu32YOn9rhaiE5yw==",
|
||||
"license": "Unlicense",
|
||||
"optional": true
|
||||
},
|
||||
"node_modules/type-is": {
|
||||
"version": "1.6.18",
|
||||
"resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
|
||||
"integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"media-typer": "0.3.0",
|
||||
"mime-types": "~2.1.24"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/unpipe": {
|
||||
"version": "1.0.0",
|
||||
"resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
|
||||
"integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/utils-merge": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
|
||||
"integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/vary": {
|
||||
"version": "1.1.2",
|
||||
"resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
|
||||
"integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"name": "verae-zapier-middleware",
|
||||
"version": "0.1.0",
|
||||
"description": "HTTP edge + NATS workers bridging Zapier and api.veraetime.net",
|
||||
"type": "module",
|
||||
"main": "src/index.js",
|
||||
"scripts": {
|
||||
"start": "node src/index.js",
|
||||
"dev": "node --watch src/index.js",
|
||||
"test": "MOCK_VERAE=true NATS_ENABLED=false node --test test/unit/**/*.test.js test/integration/auth.test.js test/integration/http-api.test.js",
|
||||
"test:unit": "MOCK_VERAE=true NATS_ENABLED=false node --test test/unit/**/*.test.js",
|
||||
"test:gate1": "node --test test/unit/debug.test.js",
|
||||
"test:gate2": "MOCK_VERAE=true node --test test/unit/config.test.js test/unit/app.test.js",
|
||||
"test:gate3": "MOCK_VERAE=true NATS_ENABLED=false node --test test/unit/store.test.js",
|
||||
"test:gate4": "MOCK_VERAE=true NATS_ENABLED=false node --test test/unit/tokens.test.js test/unit/veraeClient.test.js",
|
||||
"test:gate5": "MOCK_VERAE=true NATS_ENABLED=false node --test test/integration/auth.test.js",
|
||||
"test:gate6": "MOCK_VERAE=true NATS_ENABLED=false JOB_POLL_INTERVAL_MS=20 JOB_POLL_MAX_ATTEMPTS=50 node --test test/integration/http-api.test.js",
|
||||
"test:gate7": "MOCK_VERAE=true NATS_ENABLED=true NATS_FORCE_CONNECT=1 NATS_URL=nats://127.0.0.1:4222 node --test test/integration/nats.test.js",
|
||||
"test:gate8": "MOCK_VERAE=true NATS_ENABLED=true NATS_FORCE_CONNECT=1 NATS_URL=nats://127.0.0.1:4222 JOB_POLL_INTERVAL_MS=50 node --test test/integration/nats-workers.test.js",
|
||||
"test:gate10": "MOCK_VERAE=true NATS_ENABLED=false node --test test/integration/tenants.test.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=22.0.0"
|
||||
},
|
||||
"dependencies": {
|
||||
"express": "^4.21.2",
|
||||
"nats": "^2.28.2"
|
||||
},
|
||||
"keywords": [
|
||||
"verae",
|
||||
"zapier",
|
||||
"middleware",
|
||||
"nats",
|
||||
"timestamping"
|
||||
],
|
||||
"license": "UNLICENSED"
|
||||
}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
/**
|
||||
* @fileoverview Express application factory for the Zapier-facing HTTP edge.
|
||||
* @module app
|
||||
*/
|
||||
|
||||
import express from 'express';
|
||||
import { sendError } from './errors.js';
|
||||
import { createDebugger } from './debug/logger.js';
|
||||
import { traceMiddleware } from './debug/trace.js';
|
||||
import { apiRoutes } from './routes/index.js';
|
||||
import { loadStore } from './store/db.js';
|
||||
|
||||
const log = createDebugger('app');
|
||||
|
||||
/**
|
||||
* Create the Express app (does not listen).
|
||||
*
|
||||
* @param {{ load?: boolean }} [options]
|
||||
* @returns {import('express').Express}
|
||||
*/
|
||||
export function createApp(options = {}) {
|
||||
if (options.load !== false) {
|
||||
loadStore();
|
||||
}
|
||||
|
||||
const app = express();
|
||||
app.disable('x-powered-by');
|
||||
|
||||
app.use(express.json({ limit: '1mb' }));
|
||||
app.use(traceMiddleware);
|
||||
|
||||
/**
|
||||
* Liveness probe.
|
||||
*/
|
||||
app.get('/health', (_req, res) => {
|
||||
res.json({
|
||||
status: 'ok',
|
||||
service: 'verae-zapier-middleware',
|
||||
});
|
||||
});
|
||||
|
||||
app.use('/zapier', apiRoutes);
|
||||
|
||||
app.use((err, _req, res, _next) => {
|
||||
sendError(res, err);
|
||||
});
|
||||
|
||||
log.info('express app created');
|
||||
return app;
|
||||
}
|
||||
|
|
@ -0,0 +1,287 @@
|
|||
/**
|
||||
* @fileoverview HTTP client for api.veraetime.net (with mock mode).
|
||||
* @module clients/veraeClient
|
||||
*/
|
||||
|
||||
import { randomUUID } from 'node:crypto';
|
||||
import { config } from '../config.js';
|
||||
import { AppError } from '../errors.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('http');
|
||||
|
||||
const mockJobs = new Map();
|
||||
|
||||
/**
|
||||
* @param {number} ms
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
function delay(ms) {
|
||||
return new Promise((resolve) => setTimeout(resolve, ms));
|
||||
}
|
||||
|
||||
async function mockLogin({ username, password }) {
|
||||
if (!username || !password) {
|
||||
throw new AppError('Invalid credentials', { status: 401, code: 'UNAUTHORIZED' });
|
||||
}
|
||||
const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
|
||||
return {
|
||||
token: `mock-jwt-${username}`,
|
||||
expiresAt,
|
||||
user: {
|
||||
id: randomUUID(),
|
||||
username,
|
||||
role: username.includes('admin') ? 'admin' : 'user',
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
async function mockValidate(token) {
|
||||
if (!token?.startsWith('mock-jwt-')) {
|
||||
throw new AppError('Invalid or expired token', { status: 401, code: 'UNAUTHORIZED' });
|
||||
}
|
||||
const username = token.replace('mock-jwt-', '');
|
||||
return {
|
||||
valid: true,
|
||||
userId: randomUUID(),
|
||||
username,
|
||||
role: 'user',
|
||||
expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
|
||||
};
|
||||
}
|
||||
|
||||
async function mockCreateTimestamp({ data, hashAlg }) {
|
||||
if (!data) {
|
||||
throw new AppError('Invalid input data', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const jobId = randomUUID();
|
||||
mockJobs.set(jobId, {
|
||||
id: jobId,
|
||||
status: 'pending',
|
||||
createdAt: Date.now(),
|
||||
data,
|
||||
hashAlg: hashAlg ?? 'SHA256',
|
||||
});
|
||||
|
||||
setTimeout(() => {
|
||||
const job = mockJobs.get(jobId);
|
||||
if (!job) return;
|
||||
job.status = 'completed';
|
||||
job.result = `mock-cert-${jobId}`;
|
||||
job.completedAt = new Date().toISOString();
|
||||
job.metadata = {
|
||||
blockIndex: 42,
|
||||
timestamp: job.completedAt,
|
||||
certificate: job.result,
|
||||
};
|
||||
}, 150);
|
||||
|
||||
return { jobId };
|
||||
}
|
||||
|
||||
async function mockGetStatus(jobId) {
|
||||
const job = mockJobs.get(jobId);
|
||||
if (!job) {
|
||||
throw new AppError('Job not found', { status: 404, code: 'NOT_FOUND' });
|
||||
}
|
||||
return {
|
||||
id: job.id,
|
||||
status: job.status,
|
||||
result: job.result,
|
||||
completedAt: job.completedAt,
|
||||
metadata: job.metadata,
|
||||
error: job.error,
|
||||
};
|
||||
}
|
||||
|
||||
async function mockVerify({ certificate }) {
|
||||
if (!certificate) {
|
||||
throw new AppError('Invalid input data', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const valid = certificate.startsWith('mock-cert-') || certificate.startsWith('eyJ');
|
||||
return valid
|
||||
? { valid: true, timestamp: new Date().toISOString(), blockIndex: 42 }
|
||||
: { valid: false };
|
||||
}
|
||||
|
||||
/**
|
||||
* Low-level fetch to Verae API.
|
||||
* @param {string} path
|
||||
* @param {{ method?: string, token?: string, body?: unknown }} [options]
|
||||
* @returns {Promise<any>}
|
||||
*/
|
||||
async function request(path, { method = 'GET', token, body } = {}) {
|
||||
const url = `${config.veraeApiBaseUrl}${path}`;
|
||||
const headers = { Accept: 'application/json' };
|
||||
|
||||
if (token) {
|
||||
headers.Authorization = `Bearer ${token}`;
|
||||
}
|
||||
if (body !== undefined) {
|
||||
headers['Content-Type'] = 'application/json';
|
||||
}
|
||||
|
||||
const started = Date.now();
|
||||
log.debug('verae request', { method, path, hasToken: Boolean(token) });
|
||||
|
||||
const response = await fetch(url, {
|
||||
method,
|
||||
headers,
|
||||
body: body !== undefined ? JSON.stringify(body) : undefined,
|
||||
});
|
||||
|
||||
let payload = null;
|
||||
const text = await response.text();
|
||||
if (text) {
|
||||
try {
|
||||
payload = JSON.parse(text);
|
||||
} catch {
|
||||
payload = { error: text };
|
||||
}
|
||||
}
|
||||
|
||||
log.debug('verae response', {
|
||||
method,
|
||||
path,
|
||||
status: response.status,
|
||||
durationMs: Date.now() - started,
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
throw new AppError(payload?.error ?? `Verae API error (${response.status})`, {
|
||||
status: response.status,
|
||||
code: payload?.code ?? 'VERAE_API_ERROR',
|
||||
details: payload,
|
||||
});
|
||||
}
|
||||
|
||||
return payload;
|
||||
}
|
||||
|
||||
/**
|
||||
* Verae API client (mock when config.mockVerae is true).
|
||||
*/
|
||||
export const veraeClient = {
|
||||
/**
|
||||
* @param {{ username: string, password: string }} credentials
|
||||
*/
|
||||
async login(credentials) {
|
||||
if (config.mockVerae) return mockLogin(credentials);
|
||||
return request('/auth/login', { method: 'POST', body: credentials });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
*/
|
||||
async validate(token) {
|
||||
if (config.mockVerae) return mockValidate(token);
|
||||
return request('/auth/validate', { token });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
* @param {{ data: string, hashAlg?: string }} body
|
||||
*/
|
||||
async createTimestamp(token, body) {
|
||||
if (config.mockVerae) return mockCreateTimestamp(body);
|
||||
return request('/api/timestamp', { method: 'POST', token, body });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
* @param {{ items: Array<{ data: string, hashAlg?: string }> }} body
|
||||
*/
|
||||
async createBatchTimestamp(token, body) {
|
||||
if (config.mockVerae) {
|
||||
const jobIds = [];
|
||||
for (const item of body.items ?? []) {
|
||||
const res = await mockCreateTimestamp(item);
|
||||
jobIds.push(res.jobId);
|
||||
}
|
||||
return { jobIds };
|
||||
}
|
||||
return request('/api/batch/timestamp', { method: 'POST', token, body });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
* @param {string} jobId
|
||||
*/
|
||||
async getStatus(token, jobId) {
|
||||
if (config.mockVerae) return mockGetStatus(jobId);
|
||||
return request(`/api/status/${encodeURIComponent(jobId)}`, { token });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
* @param {{ jobIds: string[] }} body
|
||||
*/
|
||||
async getBatchStatus(token, body) {
|
||||
if (config.mockVerae) {
|
||||
const results = {};
|
||||
for (const jobId of body.jobIds ?? []) {
|
||||
results[jobId] = await mockGetStatus(jobId);
|
||||
}
|
||||
return { results };
|
||||
}
|
||||
return request('/api/batch/status', { method: 'POST', token, body });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
* @param {{ certificate: string }} body
|
||||
*/
|
||||
async verify(token, body) {
|
||||
if (config.mockVerae) return mockVerify(body);
|
||||
return request('/api/verify', { method: 'POST', token, body });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
* @param {{ certificates: string[] }} body
|
||||
*/
|
||||
async verifyBatch(token, body) {
|
||||
if (config.mockVerae) {
|
||||
const results = [];
|
||||
for (const certificate of body.certificates ?? []) {
|
||||
results.push(await mockVerify({ certificate }));
|
||||
}
|
||||
return { results };
|
||||
}
|
||||
return request('/api/batch/verify', { method: 'POST', token, body });
|
||||
},
|
||||
|
||||
/**
|
||||
* @param {string} token
|
||||
* @param {string} jobId
|
||||
*/
|
||||
async getJobVerification(token, jobId) {
|
||||
if (config.mockVerae) return mockGetStatus(jobId);
|
||||
return request(`/api/verify/${encodeURIComponent(jobId)}`, { token });
|
||||
},
|
||||
|
||||
/**
|
||||
* Poll until completed/failed or timeout.
|
||||
* @param {string} token
|
||||
* @param {string} jobId
|
||||
* @param {{ maxAttempts: number, intervalMs: number }} options
|
||||
*/
|
||||
async waitForJob(token, jobId, { maxAttempts, intervalMs }) {
|
||||
for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
|
||||
const status = await this.getStatus(token, jobId);
|
||||
if (status.status === 'completed' || status.status === 'failed') {
|
||||
return status;
|
||||
}
|
||||
await delay(intervalMs);
|
||||
}
|
||||
throw new AppError(`Job ${jobId} timed out`, { status: 504, code: 'GATEWAY_TIMEOUT' });
|
||||
},
|
||||
};
|
||||
|
||||
/**
|
||||
* Clear mock jobs (tests only).
|
||||
* @returns {void}
|
||||
*/
|
||||
export function clearMockJobs() {
|
||||
mockJobs.clear();
|
||||
}
|
||||
|
|
@ -0,0 +1,142 @@
|
|||
/**
|
||||
* @fileoverview Process configuration for the Verae Zapier middleware.
|
||||
* @module config
|
||||
*
|
||||
* Loads optional `.env` then exports typed settings used by HTTP, NATS, and workers.
|
||||
*/
|
||||
|
||||
import { readFileSync, existsSync } from 'node:fs';
|
||||
import { resolve, dirname } from 'node:path';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { createDebugger } from './debug/logger.js';
|
||||
|
||||
const log = createDebugger('app');
|
||||
const __dirname = dirname(fileURLToPath(import.meta.url));
|
||||
const rootDir = resolve(__dirname, '..');
|
||||
|
||||
/**
|
||||
* Load KEY=VALUE pairs from `.env` without overriding existing process.env keys.
|
||||
* @returns {void}
|
||||
*/
|
||||
export function loadEnvFile() {
|
||||
const envPath = resolve(rootDir, '.env');
|
||||
if (!existsSync(envPath)) return;
|
||||
|
||||
for (const line of readFileSync(envPath, 'utf8').split('\n')) {
|
||||
const trimmed = line.trim();
|
||||
if (!trimmed || trimmed.startsWith('#')) continue;
|
||||
const eq = trimmed.indexOf('=');
|
||||
if (eq === -1) continue;
|
||||
const key = trimmed.slice(0, eq).trim();
|
||||
const value = trimmed.slice(eq + 1).trim();
|
||||
if (!(key in process.env)) {
|
||||
process.env[key] = value;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
loadEnvFile();
|
||||
|
||||
/**
|
||||
* @param {string|undefined} value
|
||||
* @param {boolean} [fallback=false]
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function bool(value, fallback = false) {
|
||||
if (value === undefined) return fallback;
|
||||
return ['1', 'true', 'yes', 'on'].includes(String(value).toLowerCase());
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string|undefined} value
|
||||
* @param {number} fallback
|
||||
* @returns {number}
|
||||
*/
|
||||
function int(value, fallback) {
|
||||
const parsed = Number.parseInt(value ?? '', 10);
|
||||
return Number.isFinite(parsed) ? parsed : fallback;
|
||||
}
|
||||
|
||||
/**
|
||||
* Runtime configuration object.
|
||||
* @type {{
|
||||
* port: number,
|
||||
* host: string,
|
||||
* veraeApiBaseUrl: string,
|
||||
* mockVerae: boolean,
|
||||
* natsEnabled: boolean,
|
||||
* natsUrl: string,
|
||||
* tokenSecret: string,
|
||||
* jobPollIntervalMs: number,
|
||||
* jobPollMaxAttempts: number,
|
||||
* storePath: string,
|
||||
* upgradeUrl: string,
|
||||
* adminSecret: string,
|
||||
* }}
|
||||
*/
|
||||
export const config = {
|
||||
port: int(process.env.PORT, 3100),
|
||||
host: process.env.HOST ?? '0.0.0.0',
|
||||
veraeApiBaseUrl: (process.env.VERAE_API_BASE_URL ?? 'http://localhost:8080').replace(
|
||||
/\/$/,
|
||||
'',
|
||||
),
|
||||
mockVerae: bool(process.env.MOCK_VERAE, false),
|
||||
natsEnabled: bool(process.env.NATS_ENABLED, false),
|
||||
natsUrl: process.env.NATS_URL ?? 'nats://127.0.0.1:4222',
|
||||
tokenSecret: process.env.TOKEN_SECRET ?? 'dev-secret-change-me',
|
||||
jobPollIntervalMs: int(process.env.JOB_POLL_INTERVAL_MS, 2000),
|
||||
jobPollMaxAttempts: int(process.env.JOB_POLL_MAX_ATTEMPTS, 60),
|
||||
storePath: resolve(rootDir, process.env.STORE_PATH ?? './data/store.json'),
|
||||
upgradeUrl: process.env.UPGRADE_URL ?? 'https://veraetime.net/billing',
|
||||
adminSecret: process.env.ADMIN_SECRET ?? 'change-me-admin',
|
||||
};
|
||||
|
||||
/**
|
||||
* Default plan limits. `null` numeric fields mean unlimited.
|
||||
* @type {Record<string, {
|
||||
* timestamps: number|null,
|
||||
* verifications: number|null,
|
||||
* batch: boolean,
|
||||
* batchMaxItems: number|null,
|
||||
* requestsPerMinute: number
|
||||
* }>}
|
||||
*/
|
||||
export const PLAN_LIMITS = {
|
||||
free: {
|
||||
timestamps: 50,
|
||||
verifications: 50,
|
||||
batch: false,
|
||||
batchMaxItems: 0,
|
||||
requestsPerMinute: 30,
|
||||
},
|
||||
starter: {
|
||||
timestamps: 500,
|
||||
verifications: 500,
|
||||
batch: true,
|
||||
batchMaxItems: 10,
|
||||
requestsPerMinute: 120,
|
||||
},
|
||||
pro: {
|
||||
timestamps: 5000,
|
||||
verifications: 5000,
|
||||
batch: true,
|
||||
batchMaxItems: 100,
|
||||
requestsPerMinute: 600,
|
||||
},
|
||||
enterprise: {
|
||||
timestamps: null,
|
||||
verifications: null,
|
||||
batch: true,
|
||||
batchMaxItems: null,
|
||||
requestsPerMinute: 3000,
|
||||
},
|
||||
};
|
||||
|
||||
log.info('config loaded', {
|
||||
veraeApiBaseUrl: config.veraeApiBaseUrl,
|
||||
mockVerae: config.mockVerae,
|
||||
natsEnabled: config.natsEnabled,
|
||||
natsUrl: config.natsUrl,
|
||||
port: config.port,
|
||||
});
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
/**
|
||||
* @fileoverview Runtime debug configuration.
|
||||
*
|
||||
* Reads process environment at call time of {@link loadDebugConfig} so tests can
|
||||
* mutate `process.env` between cases. Production servers typically load once at boot.
|
||||
*
|
||||
* @module debug/config
|
||||
*/
|
||||
|
||||
/**
|
||||
* @typedef {Object} DebugConfig
|
||||
* @property {boolean} enabled - True when any debug output should be produced.
|
||||
* @property {Set<string>|null} namespaces - Allowed namespaces; `null` means all.
|
||||
* @property {'debug'|'info'|'warn'|'error'} level - Minimum severity to emit.
|
||||
* @property {string|null} filePath - Optional secondary log file path.
|
||||
*/
|
||||
|
||||
const LEVEL_ORDER = { debug: 10, info: 20, warn: 30, error: 40 };
|
||||
|
||||
/**
|
||||
* Parse `DEBUG_VERAE` into an enabled flag and optional namespace allow-list.
|
||||
*
|
||||
* @param {string|undefined} raw - Raw env value (e.g. `"1"`, `"*"`, `"auth,nats"`).
|
||||
* @returns {{ enabled: boolean, namespaces: Set<string>|null }}
|
||||
*
|
||||
* @example
|
||||
* parseDebugVeraeEnv('auth,jobs'); // { enabled: true, namespaces: Set{'auth','jobs'} }
|
||||
* parseDebugVeraeEnv(undefined); // { enabled: false, namespaces: null }
|
||||
*/
|
||||
export function parseDebugVeraeEnv(raw) {
|
||||
if (raw === undefined || raw === null) {
|
||||
return { enabled: false, namespaces: null };
|
||||
}
|
||||
|
||||
const trimmed = String(raw).trim();
|
||||
if (!trimmed || trimmed === '0' || trimmed.toLowerCase() === 'false' || trimmed.toLowerCase() === 'off') {
|
||||
return { enabled: false, namespaces: null };
|
||||
}
|
||||
|
||||
if (trimmed === '1' || trimmed === '*' || trimmed.toLowerCase() === 'true' || trimmed.toLowerCase() === 'all') {
|
||||
return { enabled: true, namespaces: null };
|
||||
}
|
||||
|
||||
const parts = trimmed
|
||||
.split(',')
|
||||
.map((p) => p.trim().toLowerCase())
|
||||
.filter(Boolean);
|
||||
|
||||
if (parts.length === 0) {
|
||||
return { enabled: false, namespaces: null };
|
||||
}
|
||||
|
||||
return { enabled: true, namespaces: new Set(parts) };
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalize a level string to a known level.
|
||||
*
|
||||
* @param {string|undefined} raw - Env level value.
|
||||
* @param {'debug'|'info'|'warn'|'error'} [fallback='debug'] - Default level.
|
||||
* @returns {'debug'|'info'|'warn'|'error'}
|
||||
*/
|
||||
export function parseLevel(raw, fallback = 'debug') {
|
||||
const value = String(raw ?? fallback).toLowerCase();
|
||||
if (value in LEVEL_ORDER) return /** @type {'debug'|'info'|'warn'|'error'} */ (value);
|
||||
return fallback;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load full debug configuration from `process.env`.
|
||||
*
|
||||
* Environment variables:
|
||||
* - `DEBUG_VERAE` — enable + namespaces (see {@link parseDebugVeraeEnv})
|
||||
* - `DEBUG_VERAE_LEVEL` — minimum level
|
||||
* - `DEBUG_VERAE_FILE` — optional log file path
|
||||
*
|
||||
* @param {NodeJS.ProcessEnv} [env=process.env] - Environment map (injectable for tests).
|
||||
* @returns {DebugConfig}
|
||||
*/
|
||||
export function loadDebugConfig(env = process.env) {
|
||||
const { enabled, namespaces } = parseDebugVeraeEnv(env.DEBUG_VERAE);
|
||||
return {
|
||||
enabled,
|
||||
namespaces,
|
||||
level: parseLevel(env.DEBUG_VERAE_LEVEL, 'debug'),
|
||||
filePath: env.DEBUG_VERAE_FILE ? String(env.DEBUG_VERAE_FILE) : null,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a message at `messageLevel` in `namespace` should be emitted.
|
||||
*
|
||||
* @param {DebugConfig} config - Active config.
|
||||
* @param {string} namespace - Logger namespace (e.g. `auth`).
|
||||
* @param {'debug'|'info'|'warn'|'error'} messageLevel - Message severity.
|
||||
* @returns {boolean}
|
||||
*/
|
||||
export function shouldLog(config, namespace, messageLevel) {
|
||||
if (!config.enabled) return false;
|
||||
if (config.namespaces && !config.namespaces.has(String(namespace).toLowerCase())) {
|
||||
return false;
|
||||
}
|
||||
return LEVEL_ORDER[messageLevel] >= LEVEL_ORDER[config.level];
|
||||
}
|
||||
|
||||
export { LEVEL_ORDER };
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
/**
|
||||
* @fileoverview Public exports for the runtime debug facility.
|
||||
* @module debug
|
||||
*/
|
||||
|
||||
export {
|
||||
loadDebugConfig,
|
||||
parseDebugVeraeEnv,
|
||||
parseLevel,
|
||||
shouldLog,
|
||||
LEVEL_ORDER,
|
||||
} from './config.js';
|
||||
|
||||
export { createDebugger, formatLogLine, setDebugTestSink } from './logger.js';
|
||||
|
||||
export { redact, redactString } from './redact.js';
|
||||
|
||||
export {
|
||||
generateTraceId,
|
||||
getTraceId,
|
||||
getTraceContext,
|
||||
withTrace,
|
||||
traceMiddleware,
|
||||
} from './trace.js';
|
||||
|
|
@ -0,0 +1,121 @@
|
|||
/**
|
||||
* @fileoverview Namespaced debug logger with runtime enable/disable.
|
||||
* @module debug/logger
|
||||
*/
|
||||
|
||||
import { appendFileSync } from 'node:fs';
|
||||
import { loadDebugConfig, shouldLog } from './config.js';
|
||||
import { redact } from './redact.js';
|
||||
import { getTraceId } from './trace-context.js';
|
||||
|
||||
/**
|
||||
* @typedef {Object} Debugger
|
||||
* @property {(msg: string, meta?: Record<string, unknown>) => void} debug
|
||||
* @property {(msg: string, meta?: Record<string, unknown>) => void} info
|
||||
* @property {(msg: string, meta?: Record<string, unknown>) => void} warn
|
||||
* @property {(msg: string, meta?: Record<string, unknown>) => void} error
|
||||
* @property {string} namespace
|
||||
*/
|
||||
|
||||
/**
|
||||
* Optional sink for tests — when set, lines go here instead of/in addition to stderr.
|
||||
* @type {null|((line: string) => void)}
|
||||
*/
|
||||
let testSink = null;
|
||||
|
||||
/**
|
||||
* Install a test sink that captures formatted log lines.
|
||||
* Used only by unit tests; do not use in production code.
|
||||
*
|
||||
* @param {null|((line: string) => void)} sink - Callback or null to clear.
|
||||
* @returns {void}
|
||||
*/
|
||||
export function setDebugTestSink(sink) {
|
||||
testSink = sink;
|
||||
}
|
||||
|
||||
/**
|
||||
* Format a single log line.
|
||||
*
|
||||
* @param {object} parts
|
||||
* @param {string} parts.level
|
||||
* @param {string} parts.namespace
|
||||
* @param {string} parts.message
|
||||
* @param {Record<string, unknown>|undefined} parts.meta
|
||||
* @param {string|null} parts.traceId
|
||||
* @returns {string}
|
||||
*/
|
||||
export function formatLogLine({ level, namespace, message, meta, traceId }) {
|
||||
const ts = new Date().toISOString();
|
||||
const tracePart = traceId ? ` [trace=${traceId}]` : '';
|
||||
const metaPart =
|
||||
meta && Object.keys(meta).length > 0 ? ` ${JSON.stringify(redact(meta))}` : '';
|
||||
return `${ts} ${level.toUpperCase()} ${namespace}${tracePart} ${message}${metaPart}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Emit a log line to stderr, optional file, and optional test sink.
|
||||
*
|
||||
* @param {string} line - Full formatted line.
|
||||
* @param {string|null} filePath - Optional file from config.
|
||||
* @returns {void}
|
||||
*/
|
||||
function emit(line, filePath) {
|
||||
if (testSink) {
|
||||
testSink(line);
|
||||
} else {
|
||||
// eslint-disable-next-line no-console
|
||||
console.error(line);
|
||||
}
|
||||
if (filePath) {
|
||||
try {
|
||||
appendFileSync(filePath, `${line}\n`, 'utf8');
|
||||
} catch {
|
||||
// ignore file errors in debug path
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a namespaced debugger bound to current env configuration.
|
||||
*
|
||||
* Configuration is re-read on every log call so tests can toggle `DEBUG_VERAE`
|
||||
* without reloading modules. Slight cost is acceptable for debug-only paths.
|
||||
*
|
||||
* @param {string} namespace - Namespace such as `auth`, `nats`, `jobs`.
|
||||
* @returns {Debugger} Logger with debug/info/warn/error methods.
|
||||
*
|
||||
* @example
|
||||
* const log = createDebugger('jobs');
|
||||
* log.debug('poll start', { jobId: 'abc' });
|
||||
*/
|
||||
export function createDebugger(namespace) {
|
||||
const ns = String(namespace || 'app').toLowerCase();
|
||||
|
||||
/**
|
||||
* @param {'debug'|'info'|'warn'|'error'} level
|
||||
* @param {string} message
|
||||
* @param {Record<string, unknown>} [meta]
|
||||
*/
|
||||
function write(level, message, meta) {
|
||||
const config = loadDebugConfig();
|
||||
if (!shouldLog(config, ns, level)) return;
|
||||
|
||||
const line = formatLogLine({
|
||||
level,
|
||||
namespace: ns,
|
||||
message: String(message),
|
||||
meta,
|
||||
traceId: getTraceId(),
|
||||
});
|
||||
emit(line, config.filePath);
|
||||
}
|
||||
|
||||
return {
|
||||
namespace: ns,
|
||||
debug: (message, meta) => write('debug', message, meta),
|
||||
info: (message, meta) => write('info', message, meta),
|
||||
warn: (message, meta) => write('warn', message, meta),
|
||||
error: (message, meta) => write('error', message, meta),
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,93 @@
|
|||
/**
|
||||
* @fileoverview Secret redaction for debug logs.
|
||||
* @module debug/redact
|
||||
*/
|
||||
|
||||
const SENSITIVE_KEYS = new Set([
|
||||
'password',
|
||||
'veraepassword',
|
||||
'token',
|
||||
'veraetoken',
|
||||
'accesstoken',
|
||||
'apikey',
|
||||
'api_key',
|
||||
'secret',
|
||||
'authorization',
|
||||
'x-api-key',
|
||||
'cookie',
|
||||
'sessionkey',
|
||||
]);
|
||||
|
||||
const BEARER_RE = /^Bearer\s+.+/i;
|
||||
const API_KEY_RE = /^zmw_[A-Za-z0-9_-]+/;
|
||||
const SESSION_RE = /^zmt_[A-Za-z0-9_.-]+/;
|
||||
const JWT_RE = /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/;
|
||||
|
||||
/**
|
||||
* Redact a single string value if it looks like a secret.
|
||||
*
|
||||
* @param {string} value - Raw string.
|
||||
* @returns {string} Original or `[REDACTED]`.
|
||||
*/
|
||||
export function redactString(value) {
|
||||
if (typeof value !== 'string') return value;
|
||||
if (
|
||||
BEARER_RE.test(value) ||
|
||||
API_KEY_RE.test(value) ||
|
||||
SESSION_RE.test(value) ||
|
||||
JWT_RE.test(value)
|
||||
) {
|
||||
return '[REDACTED]';
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
/**
|
||||
* Deep-clone plain data structures while redacting sensitive keys and values.
|
||||
*
|
||||
* @param {unknown} input - Any JSON-like value.
|
||||
* @param {number} [depth=0] - Recursion depth guard.
|
||||
* @returns {unknown} Redacted structure safe for logging.
|
||||
*
|
||||
* @example
|
||||
* redact({ password: 'x', jobId: '1' }); // { password: '[REDACTED]', jobId: '1' }
|
||||
*/
|
||||
export function redact(input, depth = 0) {
|
||||
if (depth > 8) return '[MaxDepth]';
|
||||
|
||||
if (input === null || input === undefined) return input;
|
||||
|
||||
if (typeof input === 'string') return redactString(input);
|
||||
|
||||
if (typeof input === 'number' || typeof input === 'boolean') return input;
|
||||
|
||||
if (input instanceof Error) {
|
||||
return { name: input.name, message: redactString(input.message), stack: undefined };
|
||||
}
|
||||
|
||||
if (Array.isArray(input)) {
|
||||
return input.map((item) => redact(item, depth + 1));
|
||||
}
|
||||
|
||||
if (typeof input === 'object') {
|
||||
/** @type {Record<string, unknown>} */
|
||||
const out = {};
|
||||
for (const [key, value] of Object.entries(input)) {
|
||||
if (SENSITIVE_KEYS.has(key.toLowerCase())) {
|
||||
out[key] = '[REDACTED]';
|
||||
} else if (key.toLowerCase() === 'targeturl' && typeof value === 'string') {
|
||||
try {
|
||||
const u = new URL(value);
|
||||
out[key] = `${u.origin}${u.pathname}`;
|
||||
} catch {
|
||||
out[key] = '[REDACTED_URL]';
|
||||
}
|
||||
} else {
|
||||
out[key] = redact(value, depth + 1);
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
return String(input);
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
/**
|
||||
* @fileoverview AsyncLocalStorage-backed trace context (no logger dependency).
|
||||
* Split from trace.js to avoid circular imports with logger.js.
|
||||
* @module debug/trace-context
|
||||
*/
|
||||
|
||||
import { AsyncLocalStorage } from 'node:async_hooks';
|
||||
import { randomBytes } from 'node:crypto';
|
||||
|
||||
/**
|
||||
* @typedef {Object} TraceContext
|
||||
* @property {string} traceId
|
||||
* @property {string} [span]
|
||||
*/
|
||||
|
||||
/** @type {AsyncLocalStorage<TraceContext>} */
|
||||
export const traceStorage = new AsyncLocalStorage();
|
||||
|
||||
/**
|
||||
* Generate a short opaque trace id (16 hex chars).
|
||||
* @returns {string}
|
||||
*/
|
||||
export function generateTraceId() {
|
||||
return randomBytes(8).toString('hex');
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {string|null}
|
||||
*/
|
||||
export function getTraceId() {
|
||||
return traceStorage.getStore()?.traceId ?? null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {TraceContext|null}
|
||||
*/
|
||||
export function getTraceContext() {
|
||||
return traceStorage.getStore() ?? null;
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
/**
|
||||
* @fileoverview Correlation / trace IDs for failure tracing across HTTP and NATS.
|
||||
* @module debug/trace
|
||||
*/
|
||||
|
||||
import { createDebugger } from './logger.js';
|
||||
import {
|
||||
traceStorage,
|
||||
generateTraceId,
|
||||
getTraceId,
|
||||
getTraceContext,
|
||||
} from './trace-context.js';
|
||||
|
||||
export { generateTraceId, getTraceId, getTraceContext };
|
||||
|
||||
const log = createDebugger('trace');
|
||||
|
||||
/**
|
||||
* Run `fn` within a trace context. Nested calls inherit the same `traceId`
|
||||
* unless `traceId` is explicitly overridden.
|
||||
*
|
||||
* @template T
|
||||
* @param {object|(() => T|Promise<T>)} options - Options or the callback itself.
|
||||
* @param {string} [options.traceId] - Existing id (e.g. from `X-Trace-Id` header).
|
||||
* @param {string} [options.span] - Human label for this span (logged when debug on).
|
||||
* @param {() => T|Promise<T>} [fn] - Work to execute inside the context when options is an object.
|
||||
* @returns {T|Promise<T>} Return value of `fn`.
|
||||
*
|
||||
* @example
|
||||
* await withTrace({ span: 'timestamp.wait', traceId: req.headers['x-trace-id'] }, async () => {
|
||||
* // getTraceId() is stable here and in awaited children
|
||||
* });
|
||||
*/
|
||||
export function withTrace(options, fn) {
|
||||
const opts = typeof options === 'function' ? {} : options ?? {};
|
||||
const callback = typeof options === 'function' ? options : fn;
|
||||
|
||||
if (typeof callback !== 'function') {
|
||||
throw new TypeError('withTrace requires a function to execute');
|
||||
}
|
||||
|
||||
const parent = traceStorage.getStore();
|
||||
const traceId = opts.traceId || parent?.traceId || generateTraceId();
|
||||
const span = opts.span || parent?.span || 'root';
|
||||
|
||||
const ctx = { traceId, span };
|
||||
|
||||
return traceStorage.run(ctx, () => {
|
||||
log.debug('span enter', { span });
|
||||
try {
|
||||
const result = callback();
|
||||
if (result && typeof result.then === 'function') {
|
||||
return result.then(
|
||||
(value) => {
|
||||
log.debug('span exit', { span, ok: true });
|
||||
return value;
|
||||
},
|
||||
(err) => {
|
||||
log.debug('span exit', { span, ok: false, error: err?.message });
|
||||
throw err;
|
||||
},
|
||||
);
|
||||
}
|
||||
log.debug('span exit', { span, ok: true });
|
||||
return result;
|
||||
} catch (err) {
|
||||
log.debug('span exit', { span, ok: false, error: err?.message });
|
||||
throw err;
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Express middleware that establishes a trace context per request.
|
||||
*
|
||||
* Reads `X-Trace-Id` when present; otherwise generates a new id.
|
||||
* Sets `req.traceId` and response header `X-Trace-Id`.
|
||||
*
|
||||
* @param {import('express').Request} req
|
||||
* @param {import('express').Response} res
|
||||
* @param {import('express').NextFunction} next
|
||||
* @returns {void}
|
||||
*/
|
||||
export function traceMiddleware(req, res, next) {
|
||||
const incoming = req.headers['x-trace-id'];
|
||||
const traceId =
|
||||
typeof incoming === 'string' && incoming.trim() ? incoming.trim() : generateTraceId();
|
||||
|
||||
req.traceId = traceId;
|
||||
res.setHeader('X-Trace-Id', traceId);
|
||||
|
||||
withTrace({ traceId, span: `${req.method} ${req.path}` }, () => {
|
||||
next();
|
||||
});
|
||||
}
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
/**
|
||||
* @fileoverview Structured errors and Express helpers.
|
||||
* @module errors
|
||||
*/
|
||||
|
||||
import { createDebugger } from './debug/logger.js';
|
||||
import { getTraceId } from './debug/trace-context.js';
|
||||
|
||||
const log = createDebugger('app');
|
||||
|
||||
/**
|
||||
* Operational error with HTTP status and machine-readable code.
|
||||
*/
|
||||
export class AppError extends Error {
|
||||
/**
|
||||
* @param {string} message - Human-readable error.
|
||||
* @param {object} [options]
|
||||
* @param {number} [options.status=500] - HTTP status code.
|
||||
* @param {string} [options.code='INTERNAL_ERROR'] - Machine code.
|
||||
* @param {unknown} [options.details] - Optional structured details (safe for clients).
|
||||
*/
|
||||
constructor(message, { status = 500, code = 'INTERNAL_ERROR', details } = {}) {
|
||||
super(message);
|
||||
this.name = 'AppError';
|
||||
this.status = status;
|
||||
this.code = code;
|
||||
this.details = details;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Wrap an async Express handler so rejected promises reach the error middleware.
|
||||
*
|
||||
* @param {(req: import('express').Request, res: import('express').Response, next: import('express').NextFunction) => Promise<unknown>} fn
|
||||
* @returns {import('express').RequestHandler}
|
||||
*/
|
||||
export function asyncHandler(fn) {
|
||||
return (req, res, next) => {
|
||||
Promise.resolve(fn(req, res, next)).catch(next);
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a JSON error response. Logs server errors when debug is enabled.
|
||||
*
|
||||
* @param {import('express').Response} res
|
||||
* @param {Error|AppError} err
|
||||
* @returns {void}
|
||||
*/
|
||||
export function sendError(res, err) {
|
||||
const status = err instanceof AppError ? err.status : 500;
|
||||
const code = err instanceof AppError ? err.code : 'INTERNAL_ERROR';
|
||||
const message = err?.message || 'Internal server error';
|
||||
const details = err instanceof AppError ? err.details : undefined;
|
||||
const traceId = getTraceId();
|
||||
|
||||
if (status >= 500) {
|
||||
log.error('request failed', {
|
||||
status,
|
||||
code,
|
||||
message,
|
||||
traceId,
|
||||
stack: err?.stack,
|
||||
});
|
||||
} else {
|
||||
log.debug('client error', { status, code, message, traceId });
|
||||
}
|
||||
|
||||
res.status(status).json({
|
||||
error: message,
|
||||
code,
|
||||
...(details !== undefined ? { details } : {}),
|
||||
...(traceId ? { traceId } : {}),
|
||||
});
|
||||
}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
/**
|
||||
* @fileoverview Process entrypoint: HTTP listen + optional in-process poller.
|
||||
* @module index
|
||||
*/
|
||||
|
||||
import { createApp } from './app.js';
|
||||
import { config } from './config.js';
|
||||
import { createDebugger } from './debug/logger.js';
|
||||
import { startInProcessJobPoller } from './workers/inProcessJobPoller.js';
|
||||
import { connectNats, ensureStreams } from './nats/connection.js';
|
||||
import { startJobPollerWorker } from './workers/jobPollerWorker.js';
|
||||
import { startWebhookWorker } from './workers/webhookWorker.js';
|
||||
|
||||
const log = createDebugger('app');
|
||||
|
||||
/**
|
||||
* Start the HTTP server and background workers.
|
||||
* @returns {import('http').Server}
|
||||
*/
|
||||
export function startServer() {
|
||||
const app = createApp();
|
||||
|
||||
if (config.natsEnabled) {
|
||||
connectNats()
|
||||
.then(({ jsm }) => ensureStreams(jsm))
|
||||
.then(() => Promise.all([startJobPollerWorker(), startWebhookWorker()]))
|
||||
.then(() => log.info('NATS workers started'))
|
||||
.catch((err) => log.error('NATS worker start failed', { error: err.message }));
|
||||
} else {
|
||||
startInProcessJobPoller();
|
||||
}
|
||||
|
||||
const server = app.listen(config.port, config.host, () => {
|
||||
log.info('middleware listening', {
|
||||
host: config.host,
|
||||
port: config.port,
|
||||
veraeApiBaseUrl: config.veraeApiBaseUrl,
|
||||
mockVerae: config.mockVerae,
|
||||
natsEnabled: config.natsEnabled,
|
||||
});
|
||||
// eslint-disable-next-line no-console
|
||||
console.log(
|
||||
`Verae Zapier middleware listening on http://${config.host}:${config.port}`,
|
||||
);
|
||||
});
|
||||
return server;
|
||||
}
|
||||
|
||||
if (process.argv[1]?.includes('index.js')) {
|
||||
startServer();
|
||||
}
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
/**
|
||||
* @fileoverview API keys and HMAC session tokens for the middleware auth bridge.
|
||||
* @module lib/tokens
|
||||
*/
|
||||
|
||||
import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
|
||||
import { config } from '../config.js';
|
||||
|
||||
const TOKEN_PREFIX = 'zmt_';
|
||||
const API_KEY_PREFIX = 'zmw_';
|
||||
|
||||
/**
|
||||
* @param {string} payload
|
||||
* @returns {string}
|
||||
*/
|
||||
function sign(payload) {
|
||||
return createHmac('sha256', config.tokenSecret).update(payload).digest('base64url');
|
||||
}
|
||||
|
||||
/**
|
||||
* Issue a signed middleware session token embedding tenant + Verae JWT.
|
||||
*
|
||||
* @param {object} params
|
||||
* @param {string} params.tenantId
|
||||
* @param {string} params.veraeToken
|
||||
* @param {string} [params.expiresAt]
|
||||
* @returns {string} Token string starting with `zmt_`
|
||||
*/
|
||||
export function issueSessionToken({ tenantId, veraeToken, expiresAt }) {
|
||||
const payload = Buffer.from(
|
||||
JSON.stringify({
|
||||
tenantId,
|
||||
veraeToken,
|
||||
expiresAt,
|
||||
nonce: randomBytes(8).toString('hex'),
|
||||
}),
|
||||
).toString('base64url');
|
||||
const signature = sign(payload);
|
||||
return `${TOKEN_PREFIX}${payload}.${signature}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse and verify a session token.
|
||||
*
|
||||
* @param {string} token
|
||||
* @returns {{ tenantId: string, veraeToken: string, expiresAt?: string, nonce?: string }|null}
|
||||
*/
|
||||
export function parseSessionToken(token) {
|
||||
if (!token?.startsWith(TOKEN_PREFIX)) return null;
|
||||
|
||||
const raw = token.slice(TOKEN_PREFIX.length);
|
||||
const dot = raw.lastIndexOf('.');
|
||||
if (dot === -1) return null;
|
||||
|
||||
const payload = raw.slice(0, dot);
|
||||
const signature = raw.slice(dot + 1);
|
||||
const expected = sign(payload);
|
||||
|
||||
const sigBuf = Buffer.from(signature);
|
||||
const expBuf = Buffer.from(expected);
|
||||
if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
try {
|
||||
return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a new public API key (`zmw_…`).
|
||||
* @returns {string}
|
||||
*/
|
||||
export function generateApiKey() {
|
||||
return `${API_KEY_PREFIX}${randomBytes(24).toString('base64url')}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {unknown} value
|
||||
* @returns {boolean}
|
||||
*/
|
||||
export function isApiKey(value) {
|
||||
return typeof value === 'string' && value.startsWith(API_KEY_PREFIX);
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract bearer credential from an Authorization header.
|
||||
* @param {string|undefined} header
|
||||
* @returns {string|null}
|
||||
*/
|
||||
export function extractBearerToken(header) {
|
||||
if (!header) return null;
|
||||
const match = String(header).match(/^Bearer\s+(.+)$/i);
|
||||
return match?.[1] ?? null;
|
||||
}
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
/**
|
||||
* @fileoverview Express auth middleware — populates req.auth.
|
||||
* @module middleware/authenticate
|
||||
*/
|
||||
|
||||
import { extractBearerToken } from '../lib/tokens.js';
|
||||
import { resolveAuthContext } from '../services/authService.js';
|
||||
import { asyncHandler } from '../errors.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('auth');
|
||||
|
||||
/**
|
||||
* Resolve Bearer or x-api-key into `req.auth`.
|
||||
*/
|
||||
export const authenticate = asyncHandler(async (req, res, next) => {
|
||||
const rawToken =
|
||||
extractBearerToken(req.headers.authorization) ?? req.headers['x-api-key'] ?? null;
|
||||
|
||||
req.auth = await resolveAuthContext(rawToken);
|
||||
log.debug('authenticated', {
|
||||
tenantId: req.auth.tenantId,
|
||||
method: req.auth.authMethod,
|
||||
plan: req.auth.tenant?.plan,
|
||||
});
|
||||
next();
|
||||
});
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
/**
|
||||
* @fileoverview Simple in-memory per-tenant rate limiter.
|
||||
* @module middleware/rateLimit
|
||||
*/
|
||||
|
||||
import { AppError, asyncHandler } from '../errors.js';
|
||||
import { getTenant, resolveLimits } from '../store/tenants.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('billing');
|
||||
|
||||
/** @type {Map<string, { windowStart: number, count: number }>} */
|
||||
const windows = new Map();
|
||||
|
||||
/**
|
||||
* Reset rate limit windows (tests).
|
||||
* @returns {void}
|
||||
*/
|
||||
export function resetRateLimitWindows() {
|
||||
windows.clear();
|
||||
}
|
||||
|
||||
/**
|
||||
* Enforce plan requestsPerMinute using a 60s sliding fixed window.
|
||||
*/
|
||||
export const rateLimit = asyncHandler(async (req, res, next) => {
|
||||
const tenantId = req.auth?.tenantId;
|
||||
if (!tenantId) return next();
|
||||
|
||||
const tenant = getTenant(tenantId);
|
||||
const limits = tenant
|
||||
? resolveLimits(tenant)
|
||||
: { requestsPerMinute: 30 };
|
||||
|
||||
const rpm = limits.requestsPerMinute ?? 30;
|
||||
const now = Date.now();
|
||||
const windowMs = 60_000;
|
||||
|
||||
let entry = windows.get(tenantId);
|
||||
if (!entry || now - entry.windowStart >= windowMs) {
|
||||
entry = { windowStart: now, count: 0 };
|
||||
windows.set(tenantId, entry);
|
||||
}
|
||||
|
||||
entry.count += 1;
|
||||
if (entry.count > rpm) {
|
||||
log.debug('rate limited', { tenantId, count: entry.count, rpm });
|
||||
throw new AppError('Rate limit exceeded', {
|
||||
status: 429,
|
||||
code: 'RATE_LIMITED',
|
||||
details: { requestsPerMinute: rpm },
|
||||
});
|
||||
}
|
||||
|
||||
next();
|
||||
});
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
/**
|
||||
* @fileoverview NATS + JetStream connection lifecycle.
|
||||
* @module nats/connection
|
||||
*/
|
||||
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
import { config } from '../config.js';
|
||||
import { SUBJECTS, STREAMS } from './subjects.js';
|
||||
|
||||
const log = createDebugger('nats');
|
||||
|
||||
/** @type {import('nats').NatsConnection|null} */
|
||||
let nc = null;
|
||||
/** @type {import('nats').JetStreamClient|null} */
|
||||
let js = null;
|
||||
/** @type {import('nats').JetStreamManager|null} */
|
||||
let jsm = null;
|
||||
|
||||
/**
|
||||
* Connect to NATS and return JetStream handles.
|
||||
*
|
||||
* @param {string} [url=config.natsUrl]
|
||||
* @returns {Promise<{ nc: import('nats').NatsConnection, js: import('nats').JetStreamClient, jsm: import('nats').JetStreamManager }>}
|
||||
*/
|
||||
export async function connectNats(url = config.natsUrl) {
|
||||
if (!config.natsEnabled && process.env.NATS_FORCE_CONNECT !== '1') {
|
||||
log.debug('connect skipped — NATS_ENABLED=false');
|
||||
throw new Error('NATS is disabled (NATS_ENABLED=false)');
|
||||
}
|
||||
|
||||
if (nc && js && jsm) {
|
||||
return { nc, js, jsm };
|
||||
}
|
||||
|
||||
log.info('connecting to NATS', { url });
|
||||
|
||||
const { connect } = await import('nats');
|
||||
nc = await connect({ servers: url, name: 'verae-zapier-middleware' });
|
||||
js = nc.jetstream();
|
||||
jsm = await nc.jetstreamManager();
|
||||
|
||||
log.info('NATS connected', { url });
|
||||
return { nc, js, jsm };
|
||||
}
|
||||
|
||||
/**
|
||||
* Idempotently create JetStream streams required by this middleware.
|
||||
*
|
||||
* @param {import('nats').JetStreamManager} [manager]
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
export async function ensureStreams(manager) {
|
||||
const m = manager ?? jsm;
|
||||
if (!m) {
|
||||
throw new Error('JetStream manager not available — call connectNats first');
|
||||
}
|
||||
|
||||
/** @type {Array<{ name: string, subjects: string[] }>} */
|
||||
const defs = [
|
||||
{ name: STREAMS.ZAPIER_JOBS, subjects: [SUBJECTS.JOBS_WATCH] },
|
||||
{ name: STREAMS.ZAPIER_EVENTS, subjects: [SUBJECTS.JOBS_EVENTS] },
|
||||
{ name: STREAMS.ZAPIER_WEBHOOKS, subjects: [SUBJECTS.WEBHOOKS_DELIVER] },
|
||||
];
|
||||
|
||||
for (const def of defs) {
|
||||
try {
|
||||
await m.streams.info(def.name);
|
||||
log.debug('stream exists', { stream: def.name });
|
||||
} catch {
|
||||
await m.streams.add({
|
||||
name: def.name,
|
||||
subjects: def.subjects,
|
||||
retention: 'limits',
|
||||
storage: 'file',
|
||||
max_age: 24 * 60 * 60 * 1e9, // 24h in ns
|
||||
num_replicas: 1,
|
||||
});
|
||||
log.info('stream created', { stream: def.name, subjects: def.subjects });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Close the shared NATS connection if open.
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
export async function closeNats() {
|
||||
if (!nc) {
|
||||
log.debug('closeNats: no active connection');
|
||||
return;
|
||||
}
|
||||
log.info('closing NATS connection');
|
||||
await nc.drain();
|
||||
nc = null;
|
||||
js = null;
|
||||
jsm = null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {import('nats').JetStreamClient|null}
|
||||
*/
|
||||
export function getJetStream() {
|
||||
return js;
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {boolean}
|
||||
*/
|
||||
export function isNatsConnected() {
|
||||
return Boolean(nc && !nc.isClosed());
|
||||
}
|
||||
|
|
@ -0,0 +1,95 @@
|
|||
/**
|
||||
* @fileoverview JetStream publishers for jobs, events, and webhooks.
|
||||
* @module nats/publishers
|
||||
*/
|
||||
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
import { getTraceId } from '../debug/trace-context.js';
|
||||
import { SUBJECTS } from './subjects.js';
|
||||
import { getJetStream, connectNats } from './connection.js';
|
||||
|
||||
const log = createDebugger('nats');
|
||||
|
||||
/**
|
||||
* @returns {Promise<import('nats').JetStreamClient>}
|
||||
*/
|
||||
async function requireJs() {
|
||||
let js = getJetStream();
|
||||
if (!js) {
|
||||
const handles = await connectNats();
|
||||
js = handles.js;
|
||||
}
|
||||
return js;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} partial
|
||||
* @returns {Promise<{ seq: number }>}
|
||||
*/
|
||||
export async function enqueueWatch(partial) {
|
||||
const msg = {
|
||||
attempt: 0,
|
||||
enqueuedAt: new Date().toISOString(),
|
||||
traceId: getTraceId() || 'no-trace',
|
||||
...partial,
|
||||
};
|
||||
|
||||
log.debug('enqueueWatch', {
|
||||
subject: SUBJECTS.JOBS_WATCH,
|
||||
tenantId: msg.tenantId,
|
||||
jobId: msg.jobId,
|
||||
attempt: msg.attempt,
|
||||
traceId: msg.traceId,
|
||||
});
|
||||
|
||||
const js = await requireJs();
|
||||
const ack = await js.publish(SUBJECTS.JOBS_WATCH, JSON.stringify(msg));
|
||||
return { seq: Number(ack.seq) };
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} partial
|
||||
* @returns {Promise<{ seq: number }>}
|
||||
*/
|
||||
export async function publishJobEvent(partial) {
|
||||
const msg = {
|
||||
emittedAt: new Date().toISOString(),
|
||||
traceId: getTraceId() || 'no-trace',
|
||||
...partial,
|
||||
};
|
||||
|
||||
log.debug('publishJobEvent', {
|
||||
subject: SUBJECTS.JOBS_EVENTS,
|
||||
event: msg.event,
|
||||
jobId: msg.jobId,
|
||||
tenantId: msg.tenantId,
|
||||
});
|
||||
|
||||
const js = await requireJs();
|
||||
const ack = await js.publish(SUBJECTS.JOBS_EVENTS, JSON.stringify(msg));
|
||||
return { seq: Number(ack.seq) };
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} partial
|
||||
* @returns {Promise<{ seq: number }>}
|
||||
*/
|
||||
export async function enqueueWebhook(partial) {
|
||||
const msg = {
|
||||
attempt: 1,
|
||||
traceId: getTraceId() || 'no-trace',
|
||||
...partial,
|
||||
};
|
||||
|
||||
log.debug('enqueueWebhook', {
|
||||
subject: SUBJECTS.WEBHOOKS_DELIVER,
|
||||
hookId: msg.hookId,
|
||||
tenantId: msg.tenantId,
|
||||
event: msg.event,
|
||||
targetUrl: msg.targetUrl,
|
||||
});
|
||||
|
||||
const js = await requireJs();
|
||||
const ack = await js.publish(SUBJECTS.WEBHOOKS_DELIVER, JSON.stringify(msg));
|
||||
return { seq: Number(ack.seq) };
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
/**
|
||||
* @fileoverview NATS subject and stream name constants.
|
||||
* @module nats/subjects
|
||||
*
|
||||
* See docs/architecture/nats-subjects.md for payload schemas.
|
||||
*/
|
||||
|
||||
/**
|
||||
* Subject strings used by publishers and consumers.
|
||||
* @readonly
|
||||
*/
|
||||
export const SUBJECTS = Object.freeze({
|
||||
/** Work queue: poll Verae job status */
|
||||
JOBS_WATCH: 'verae.zapier.jobs.watch',
|
||||
/** Terminal job outcomes */
|
||||
JOBS_EVENTS: 'verae.zapier.jobs.events',
|
||||
/** Work queue: HTTP POST to Zapier REST Hooks */
|
||||
WEBHOOKS_DELIVER: 'verae.zapier.webhooks.deliver',
|
||||
/** Optional metering stream */
|
||||
USAGE: 'verae.zapier.usage',
|
||||
});
|
||||
|
||||
/**
|
||||
* JetStream stream names.
|
||||
* @readonly
|
||||
*/
|
||||
export const STREAMS = Object.freeze({
|
||||
ZAPIER_JOBS: 'ZAPIER_JOBS',
|
||||
ZAPIER_EVENTS: 'ZAPIER_EVENTS',
|
||||
ZAPIER_WEBHOOKS: 'ZAPIER_WEBHOOKS',
|
||||
ZAPIER_USAGE: 'ZAPIER_USAGE',
|
||||
});
|
||||
|
||||
/**
|
||||
* Durable consumer names (queue groups).
|
||||
* @readonly
|
||||
*/
|
||||
export const CONSUMERS = Object.freeze({
|
||||
JOB_POLLER: 'job-poller',
|
||||
EVENT_WEBHOOK_ROUTER: 'event-webhook-router',
|
||||
WEBHOOK_DELIVER: 'webhook-deliver',
|
||||
USAGE_WRITER: 'usage-writer',
|
||||
});
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
/**
|
||||
* @fileoverview Auth routes under /zapier/v1/auth
|
||||
* @module routes/authRoutes
|
||||
*/
|
||||
|
||||
import { Router } from 'express';
|
||||
import { asyncHandler, AppError } from '../errors.js';
|
||||
import { loginWithCredentials, loginWithApiKey, validateSession } from '../services/authService.js';
|
||||
import { getUsageSummary } from '../store/usage.js';
|
||||
import { getTenant } from '../store/tenants.js';
|
||||
import { extractBearerToken } from '../lib/tokens.js';
|
||||
|
||||
export const authRoutes = Router();
|
||||
|
||||
authRoutes.post(
|
||||
'/login',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { username, password, api_key: apiKey } = req.body ?? {};
|
||||
|
||||
if (apiKey) {
|
||||
const session = await loginWithApiKey(apiKey);
|
||||
return res.json(session);
|
||||
}
|
||||
|
||||
if (!username || !password) {
|
||||
throw new AppError('username and password are required', {
|
||||
status: 400,
|
||||
code: 'VALIDATION_ERROR',
|
||||
});
|
||||
}
|
||||
|
||||
const session = await loginWithCredentials({ username, password });
|
||||
res.json(session);
|
||||
}),
|
||||
);
|
||||
|
||||
authRoutes.get(
|
||||
'/me',
|
||||
asyncHandler(async (req, res) => {
|
||||
const rawToken =
|
||||
extractBearerToken(req.headers.authorization) ?? req.headers['x-api-key'] ?? null;
|
||||
|
||||
if (!rawToken) {
|
||||
throw new AppError('Missing authorization token', { status: 401, code: 'UNAUTHORIZED' });
|
||||
}
|
||||
|
||||
const validation = await validateSession(rawToken);
|
||||
const tenant = getTenant(validation.tenantId);
|
||||
const usage = getUsageSummary(validation.tenantId);
|
||||
|
||||
res.json({
|
||||
...validation,
|
||||
plan: tenant?.plan ?? validation.plan ?? 'free',
|
||||
usage,
|
||||
});
|
||||
}),
|
||||
);
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
/**
|
||||
* @fileoverview Mount all /zapier routes.
|
||||
* @module routes/index
|
||||
*/
|
||||
|
||||
import { Router } from 'express';
|
||||
import { authRoutes } from './authRoutes.js';
|
||||
import { timestampRoutes } from './timestampRoutes.js';
|
||||
import { verifyRoutes } from './verifyRoutes.js';
|
||||
import { statusRoutes } from './statusRoutes.js';
|
||||
import { webhookRoutes } from './webhookRoutes.js';
|
||||
import { publicTenantRoutes, adminTenantRoutes } from './tenantRoutes.js';
|
||||
import { authenticate } from '../middleware/authenticate.js';
|
||||
import { rateLimit } from '../middleware/rateLimit.js';
|
||||
|
||||
export const apiRoutes = Router();
|
||||
|
||||
// Public
|
||||
apiRoutes.use('/v1/auth', authRoutes);
|
||||
apiRoutes.use('/v1', publicTenantRoutes);
|
||||
apiRoutes.use('/v1/admin', adminTenantRoutes);
|
||||
|
||||
// Protected
|
||||
const protectedRoutes = Router();
|
||||
protectedRoutes.use(authenticate);
|
||||
protectedRoutes.use(rateLimit);
|
||||
|
||||
protectedRoutes.use('/timestamp', timestampRoutes);
|
||||
protectedRoutes.use('/verify', verifyRoutes);
|
||||
protectedRoutes.use('/status', statusRoutes);
|
||||
protectedRoutes.use('/webhooks', webhookRoutes);
|
||||
|
||||
apiRoutes.use('/v1', protectedRoutes);
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
/**
|
||||
* @module routes/statusRoutes
|
||||
*/
|
||||
|
||||
import { Router } from 'express';
|
||||
import { asyncHandler, AppError } from '../errors.js';
|
||||
import {
|
||||
getJobStatus,
|
||||
getBatchJobStatus,
|
||||
getJobVerification,
|
||||
} from '../services/timestampService.js';
|
||||
|
||||
export const statusRoutes = Router();
|
||||
|
||||
// Static/more-specific routes first
|
||||
statusRoutes.post(
|
||||
'/batch',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { jobIds } = req.body ?? {};
|
||||
if (!Array.isArray(jobIds) || jobIds.length === 0) {
|
||||
throw new AppError('jobIds array is required', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const result = await getBatchJobStatus(req.auth, { jobIds });
|
||||
res.json(result);
|
||||
}),
|
||||
);
|
||||
|
||||
statusRoutes.get(
|
||||
'/:jobId/verification',
|
||||
asyncHandler(async (req, res) => {
|
||||
const result = await getJobVerification(req.auth, req.params.jobId);
|
||||
res.json(result);
|
||||
}),
|
||||
);
|
||||
|
||||
statusRoutes.get(
|
||||
'/:jobId',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { jobId } = req.params;
|
||||
if (!jobId) {
|
||||
throw new AppError('jobId is required', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const result = await getJobStatus(req.auth, jobId);
|
||||
res.json(result);
|
||||
}),
|
||||
);
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
/**
|
||||
* @module routes/tenantRoutes
|
||||
*/
|
||||
|
||||
import { Router } from 'express';
|
||||
import { asyncHandler, AppError } from '../errors.js';
|
||||
import {
|
||||
selfServeSignup,
|
||||
provisionTenant,
|
||||
listProvisionedTenants,
|
||||
} from '../services/tenantService.js';
|
||||
import { config } from '../config.js';
|
||||
|
||||
export const publicTenantRoutes = Router();
|
||||
export const adminTenantRoutes = Router();
|
||||
|
||||
publicTenantRoutes.post(
|
||||
'/signup',
|
||||
asyncHandler(async (req, res) => {
|
||||
const result = await selfServeSignup(req.body ?? {});
|
||||
res.status(201).json(result);
|
||||
}),
|
||||
);
|
||||
|
||||
adminTenantRoutes.use((req, _res, next) => {
|
||||
const secret = req.headers['x-admin-secret'];
|
||||
if (secret !== config.adminSecret) {
|
||||
return next(new AppError('Invalid admin secret', { status: 403, code: 'FORBIDDEN' }));
|
||||
}
|
||||
next();
|
||||
});
|
||||
|
||||
adminTenantRoutes.post(
|
||||
'/tenants',
|
||||
asyncHandler(async (req, res) => {
|
||||
const result = await provisionTenant(req.body ?? {});
|
||||
res.status(201).json(result);
|
||||
}),
|
||||
);
|
||||
|
||||
adminTenantRoutes.get(
|
||||
'/tenants',
|
||||
asyncHandler(async (_req, res) => {
|
||||
res.json({ tenants: listProvisionedTenants() });
|
||||
}),
|
||||
);
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
/**
|
||||
* @module routes/timestampRoutes
|
||||
*/
|
||||
|
||||
import { Router } from 'express';
|
||||
import { asyncHandler, AppError } from '../errors.js';
|
||||
import {
|
||||
createTimestamp,
|
||||
createTimestampAndWait,
|
||||
createBatchTimestamp,
|
||||
} from '../services/timestampService.js';
|
||||
|
||||
export const timestampRoutes = Router();
|
||||
|
||||
timestampRoutes.post(
|
||||
'/',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { data, hashAlg } = req.body ?? {};
|
||||
if (!data) {
|
||||
throw new AppError('data is required', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const result = await createTimestamp(req.auth, { data, hashAlg });
|
||||
res.status(202).json(result);
|
||||
}),
|
||||
);
|
||||
|
||||
timestampRoutes.post(
|
||||
'/wait',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { data, hashAlg } = req.body ?? {};
|
||||
if (!data) {
|
||||
throw new AppError('data is required', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const result = await createTimestampAndWait(req.auth, { data, hashAlg });
|
||||
res.json(result);
|
||||
}),
|
||||
);
|
||||
|
||||
timestampRoutes.post(
|
||||
'/batch',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { items } = req.body ?? {};
|
||||
if (!Array.isArray(items) || items.length === 0) {
|
||||
throw new AppError('items array is required', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const result = await createBatchTimestamp(req.auth, { items });
|
||||
res.status(202).json(result);
|
||||
}),
|
||||
);
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
/**
|
||||
* @module routes/verifyRoutes
|
||||
*/
|
||||
|
||||
import { Router } from 'express';
|
||||
import { asyncHandler, AppError } from '../errors.js';
|
||||
import { verifyTimestamp, verifyBatch } from '../services/verifyService.js';
|
||||
|
||||
export const verifyRoutes = Router();
|
||||
|
||||
verifyRoutes.post(
|
||||
'/',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { certificate } = req.body ?? {};
|
||||
if (!certificate) {
|
||||
throw new AppError('certificate is required', { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
const result = await verifyTimestamp(req.auth, { certificate });
|
||||
res.json(result);
|
||||
}),
|
||||
);
|
||||
|
||||
verifyRoutes.post(
|
||||
'/batch',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { certificates } = req.body ?? {};
|
||||
if (!Array.isArray(certificates) || certificates.length === 0) {
|
||||
throw new AppError('certificates array is required', {
|
||||
status: 400,
|
||||
code: 'VALIDATION_ERROR',
|
||||
});
|
||||
}
|
||||
const result = await verifyBatch(req.auth, { certificates });
|
||||
res.json(result);
|
||||
}),
|
||||
);
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
/**
|
||||
* @module routes/webhookRoutes
|
||||
*/
|
||||
|
||||
import { Router } from 'express';
|
||||
import { asyncHandler, AppError } from '../errors.js';
|
||||
import { subscribe, unsubscribe } from '../services/webhookService.js';
|
||||
import { listWebhooksForTenant } from '../store/webhooks.js';
|
||||
|
||||
export const webhookRoutes = Router();
|
||||
|
||||
webhookRoutes.post(
|
||||
'/subscribe',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { targetUrl, event = 'timestamp.completed' } = req.body ?? {};
|
||||
try {
|
||||
const hook = subscribe(req.auth, { targetUrl, event });
|
||||
res.status(201).json(hook);
|
||||
} catch (err) {
|
||||
throw new AppError(err.message, { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
}),
|
||||
);
|
||||
|
||||
webhookRoutes.delete(
|
||||
'/unsubscribe',
|
||||
asyncHandler(async (req, res) => {
|
||||
const { hookId, targetUrl } = req.body ?? req.query ?? {};
|
||||
try {
|
||||
const result = unsubscribe(req.auth, { hookId, targetUrl });
|
||||
res.json(result);
|
||||
} catch (err) {
|
||||
throw new AppError(err.message, { status: 404, code: 'NOT_FOUND' });
|
||||
}
|
||||
}),
|
||||
);
|
||||
|
||||
webhookRoutes.get(
|
||||
'/',
|
||||
asyncHandler(async (req, res) => {
|
||||
const hooks = listWebhooksForTenant(req.auth.tenantId);
|
||||
res.json({ webhooks: hooks });
|
||||
}),
|
||||
);
|
||||
|
|
@ -0,0 +1,141 @@
|
|||
/**
|
||||
* @fileoverview Auth bridge: API keys / sessions → Verae JWT context.
|
||||
* @module services/authService
|
||||
*/
|
||||
|
||||
import { veraeClient } from '../clients/veraeClient.js';
|
||||
import { getTenantByApiKey, getTenant } from '../store/tenants.js';
|
||||
import { issueSessionToken, parseSessionToken, isApiKey } from '../lib/tokens.js';
|
||||
import { AppError } from '../errors.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('auth');
|
||||
|
||||
/**
|
||||
* Login with Verae username/password and issue middleware session token.
|
||||
*
|
||||
* @param {object} params
|
||||
* @param {string} params.username
|
||||
* @param {string} params.password
|
||||
* @param {object} [params.tenant]
|
||||
* @returns {Promise<{ accessToken: string, expiresAt: string, tenant: object, user: object }>}
|
||||
*/
|
||||
export async function loginWithCredentials({ username, password, tenant }) {
|
||||
log.debug('loginWithCredentials', { username, tenantId: tenant?.id });
|
||||
|
||||
const verae = await veraeClient.login({ username, password });
|
||||
|
||||
if (tenant?.veraeUsername && tenant.veraeUsername !== username) {
|
||||
throw new AppError('Credentials do not match tenant account', {
|
||||
status: 403,
|
||||
code: 'FORBIDDEN',
|
||||
});
|
||||
}
|
||||
|
||||
const tenantId = tenant?.id ?? `user:${verae.user.username}`;
|
||||
const accessToken = issueSessionToken({
|
||||
tenantId,
|
||||
veraeToken: verae.token,
|
||||
expiresAt: verae.expiresAt,
|
||||
});
|
||||
|
||||
return {
|
||||
accessToken,
|
||||
expiresAt: verae.expiresAt,
|
||||
tenant: tenant
|
||||
? { id: tenant.id, name: tenant.name, plan: tenant.plan }
|
||||
: { id: tenantId, name: verae.user.username, plan: 'free' },
|
||||
user: verae.user,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve API key to tenant and login with stored Verae credentials.
|
||||
* @param {string} apiKey
|
||||
* @returns {Promise<Awaited<ReturnType<typeof loginWithCredentials>>>}
|
||||
*/
|
||||
export async function loginWithApiKey(apiKey) {
|
||||
const tenant = getTenantByApiKey(apiKey);
|
||||
if (!tenant) {
|
||||
log.debug('invalid api key');
|
||||
throw new AppError('Invalid API key', { status: 401, code: 'UNAUTHORIZED' });
|
||||
}
|
||||
|
||||
if (!tenant.veraeUsername || !tenant.veraePassword) {
|
||||
throw new AppError('Tenant is missing Verae credentials', {
|
||||
status: 500,
|
||||
code: 'TENANT_MISCONFIGURED',
|
||||
});
|
||||
}
|
||||
|
||||
log.debug('loginWithApiKey', { tenantId: tenant.id, plan: tenant.plan });
|
||||
return loginWithCredentials({
|
||||
username: tenant.veraeUsername,
|
||||
password: tenant.veraePassword,
|
||||
tenant,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve bearer credential into request auth context.
|
||||
*
|
||||
* @param {string|null} rawToken
|
||||
* @returns {Promise<{ tenantId: string, tenant: object, veraeToken: string, authMethod: string }>}
|
||||
*/
|
||||
export async function resolveAuthContext(rawToken) {
|
||||
if (!rawToken) {
|
||||
throw new AppError('Missing authorization token', { status: 401, code: 'UNAUTHORIZED' });
|
||||
}
|
||||
|
||||
if (isApiKey(rawToken)) {
|
||||
const session = await loginWithApiKey(rawToken);
|
||||
const parsed = parseSessionToken(session.accessToken);
|
||||
const tenant = getTenant(session.tenant.id) ?? session.tenant;
|
||||
return {
|
||||
tenantId: session.tenant.id,
|
||||
tenant: { id: session.tenant.id, name: session.tenant.name, plan: session.tenant.plan },
|
||||
veraeToken: parsed.veraeToken,
|
||||
authMethod: 'api_key',
|
||||
fullTenant: tenant,
|
||||
};
|
||||
}
|
||||
|
||||
const parsed = parseSessionToken(rawToken);
|
||||
if (!parsed?.veraeToken) {
|
||||
throw new AppError('Invalid or expired session token', { status: 401, code: 'UNAUTHORIZED' });
|
||||
}
|
||||
|
||||
if (parsed.expiresAt && Date.parse(parsed.expiresAt) < Date.now()) {
|
||||
throw new AppError('Session token expired', { status: 401, code: 'TOKEN_EXPIRED' });
|
||||
}
|
||||
|
||||
const tenant = getTenant(parsed.tenantId);
|
||||
log.debug('session auth', { tenantId: parsed.tenantId });
|
||||
return {
|
||||
tenantId: parsed.tenantId,
|
||||
tenant: tenant
|
||||
? { id: tenant.id, name: tenant.name, plan: tenant.plan }
|
||||
: { id: parsed.tenantId, plan: 'free' },
|
||||
veraeToken: parsed.veraeToken,
|
||||
authMethod: 'session',
|
||||
fullTenant: tenant,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate auth and optionally ping Verae /auth/validate.
|
||||
* @param {string} rawToken
|
||||
* @returns {Promise<object>}
|
||||
*/
|
||||
export async function validateSession(rawToken) {
|
||||
const context = await resolveAuthContext(rawToken);
|
||||
const validation = await veraeClient.validate(context.veraeToken);
|
||||
|
||||
return {
|
||||
valid: true,
|
||||
tenantId: context.tenantId,
|
||||
plan: context.tenant.plan,
|
||||
authMethod: context.authMethod,
|
||||
user: validation,
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,160 @@
|
|||
/**
|
||||
* @fileoverview Plan quotas and usage recording.
|
||||
* @module services/entitlementService
|
||||
*/
|
||||
|
||||
import { config } from '../config.js';
|
||||
import { AppError } from '../errors.js';
|
||||
import { getTenant, resolveLimits } from '../store/tenants.js';
|
||||
import { getUsage, incrementUsage } from '../store/usage.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('billing');
|
||||
|
||||
function isUnlimited(value) {
|
||||
return value === null || value === undefined;
|
||||
}
|
||||
|
||||
function quotaExceeded({ limit, used, allowOverage }) {
|
||||
if (isUnlimited(limit)) return false;
|
||||
if (used < limit) return false;
|
||||
return !allowOverage;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure tenant may perform an action under plan limits.
|
||||
*
|
||||
* @param {string} tenantId
|
||||
* @param {'timestamp'|'verify'|'batch_timestamp'} action
|
||||
* @param {{ amount?: number }} [options]
|
||||
* @returns {{ tenant: object, limits: object, usage: object }}
|
||||
*/
|
||||
export function checkEntitlement(tenantId, action, { amount = 1 } = {}) {
|
||||
const tenant = getTenant(tenantId);
|
||||
if (!tenant) {
|
||||
throw new AppError('Unknown tenant', { status: 401, code: 'UNAUTHORIZED' });
|
||||
}
|
||||
|
||||
const limits = resolveLimits(tenant);
|
||||
const usage = getUsage(tenantId);
|
||||
|
||||
log.debug('checkEntitlement', {
|
||||
tenantId,
|
||||
action,
|
||||
plan: tenant.plan,
|
||||
amount,
|
||||
timestampsUsed: usage.timestamps,
|
||||
timestampsLimit: limits.timestamps,
|
||||
});
|
||||
|
||||
if (action === 'batch_timestamp') {
|
||||
if (!limits.batch) {
|
||||
throw new AppError('Batch timestamps require a paid plan', {
|
||||
status: 403,
|
||||
code: 'PLAN_UPGRADE_REQUIRED',
|
||||
details: { upgradeUrl: config.upgradeUrl },
|
||||
});
|
||||
}
|
||||
if (!isUnlimited(limits.batchMaxItems) && amount > limits.batchMaxItems) {
|
||||
throw new AppError(`Batch size exceeds plan limit of ${limits.batchMaxItems}`, {
|
||||
status: 403,
|
||||
code: 'BATCH_LIMIT_EXCEEDED',
|
||||
details: { upgradeUrl: config.upgradeUrl, limit: limits.batchMaxItems },
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
if (action === 'timestamp') {
|
||||
if (
|
||||
quotaExceeded({
|
||||
limit: limits.timestamps,
|
||||
used: usage.timestamps,
|
||||
allowOverage: limits.allowOverage,
|
||||
})
|
||||
) {
|
||||
const err = new AppError('Monthly timestamp quota exceeded', {
|
||||
status: 402,
|
||||
code: 'QUOTA_EXCEEDED',
|
||||
details: {
|
||||
limit: limits.timestamps,
|
||||
used: usage.timestamps,
|
||||
period: 'monthly',
|
||||
upgradeUrl: config.upgradeUrl,
|
||||
},
|
||||
});
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
if (action === 'verify') {
|
||||
if (
|
||||
quotaExceeded({
|
||||
limit: limits.verifications,
|
||||
used: usage.verifications,
|
||||
allowOverage: limits.allowOverage,
|
||||
})
|
||||
) {
|
||||
throw new AppError('Monthly verification quota exceeded', {
|
||||
status: 402,
|
||||
code: 'QUOTA_EXCEEDED',
|
||||
details: {
|
||||
limit: limits.verifications,
|
||||
used: usage.verifications,
|
||||
period: 'monthly',
|
||||
upgradeUrl: config.upgradeUrl,
|
||||
},
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
return { tenant, limits, usage };
|
||||
}
|
||||
|
||||
/**
|
||||
* Record usage after a successful action.
|
||||
*
|
||||
* @param {string} tenantId
|
||||
* @param {string} action
|
||||
* @param {{ amount?: number }} [options]
|
||||
* @returns {void}
|
||||
*/
|
||||
export function recordUsage(tenantId, action, { amount = 1 } = {}) {
|
||||
const tenant = getTenant(tenantId);
|
||||
if (!tenant) return;
|
||||
|
||||
const limits = resolveLimits(tenant);
|
||||
const usage = getUsage(tenantId);
|
||||
|
||||
if (action === 'timestamp') {
|
||||
if (
|
||||
!isUnlimited(limits.timestamps) &&
|
||||
usage.timestamps >= limits.timestamps &&
|
||||
limits.allowOverage
|
||||
) {
|
||||
incrementUsage(tenantId, 'overage.timestamps', amount);
|
||||
}
|
||||
incrementUsage(tenantId, 'timestamps', amount);
|
||||
}
|
||||
|
||||
if (action === 'verify') {
|
||||
if (
|
||||
!isUnlimited(limits.verifications) &&
|
||||
usage.verifications >= limits.verifications &&
|
||||
limits.allowOverage
|
||||
) {
|
||||
incrementUsage(tenantId, 'overage.verifications', amount);
|
||||
}
|
||||
incrementUsage(tenantId, 'verifications', amount);
|
||||
}
|
||||
|
||||
if (action === 'status') {
|
||||
incrementUsage(tenantId, 'statusChecks', amount);
|
||||
}
|
||||
|
||||
if (action === 'batch_timestamp') {
|
||||
incrementUsage(tenantId, 'batchTimestamps', amount);
|
||||
incrementUsage(tenantId, 'timestamps', amount);
|
||||
}
|
||||
|
||||
log.debug('recordUsage', { tenantId, action, amount });
|
||||
}
|
||||
|
|
@ -0,0 +1,137 @@
|
|||
/**
|
||||
* @fileoverview Self-serve signup and admin tenant provisioning.
|
||||
* @module services/tenantService
|
||||
*/
|
||||
|
||||
import { randomUUID } from 'node:crypto';
|
||||
import { createTenant, getTenant, listTenants } from '../store/tenants.js';
|
||||
import { veraeClient } from '../clients/veraeClient.js';
|
||||
import { AppError } from '../errors.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('auth');
|
||||
const ALLOWED_PLANS = new Set(['free', 'starter', 'pro', 'enterprise']);
|
||||
|
||||
function slugify(value) {
|
||||
return value
|
||||
.toLowerCase()
|
||||
.replace(/[^a-z0-9]+/g, '-')
|
||||
.replace(/^-|-$/g, '')
|
||||
.slice(0, 48);
|
||||
}
|
||||
|
||||
async function validateVeraeCredentials(username, password) {
|
||||
try {
|
||||
await veraeClient.login({ username, password });
|
||||
return true;
|
||||
} catch (err) {
|
||||
throw new AppError('Invalid Verae credentials', {
|
||||
status: 400,
|
||||
code: 'INVALID_VERAE_CREDENTIALS',
|
||||
details: { message: err.message },
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Public free-tier signup.
|
||||
* @param {{ email: string, name: string, veraeUsername: string, veraePassword: string }} params
|
||||
*/
|
||||
export async function selfServeSignup({ email, name, veraeUsername, veraePassword }) {
|
||||
if (!email || !name || !veraeUsername || !veraePassword) {
|
||||
throw new AppError('email, name, veraeUsername, and veraePassword are required', {
|
||||
status: 400,
|
||||
code: 'VALIDATION_ERROR',
|
||||
});
|
||||
}
|
||||
|
||||
await validateVeraeCredentials(veraeUsername, veraePassword);
|
||||
|
||||
const id = `tenant-${slugify(email)}-${randomUUID().slice(0, 8)}`;
|
||||
const { tenant, apiKey } = createTenant({
|
||||
id,
|
||||
name,
|
||||
plan: 'free',
|
||||
veraeUsername,
|
||||
veraePassword,
|
||||
contract: null,
|
||||
metadata: { email, audience: 'self-serve', createdVia: 'signup' },
|
||||
});
|
||||
|
||||
log.info('self-serve signup', { tenantId: tenant.id });
|
||||
|
||||
return {
|
||||
tenant: { id: tenant.id, name: tenant.name, plan: tenant.plan, email },
|
||||
apiKey,
|
||||
zapierSetup: {
|
||||
authType: 'custom',
|
||||
field: 'api_key',
|
||||
middlewareUrl: '/zapier/v1/auth/me',
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Admin provision (internal / enterprise).
|
||||
*/
|
||||
export async function provisionTenant({
|
||||
id,
|
||||
name,
|
||||
plan,
|
||||
veraeUsername,
|
||||
veraePassword,
|
||||
contract = null,
|
||||
metadata = {},
|
||||
audience = 'admin',
|
||||
}) {
|
||||
if (!name || !plan || !veraeUsername || !veraePassword) {
|
||||
throw new AppError('name, plan, veraeUsername, and veraePassword are required', {
|
||||
status: 400,
|
||||
code: 'VALIDATION_ERROR',
|
||||
});
|
||||
}
|
||||
|
||||
if (!ALLOWED_PLANS.has(plan)) {
|
||||
throw new AppError(`Invalid plan: ${plan}`, { status: 400, code: 'VALIDATION_ERROR' });
|
||||
}
|
||||
|
||||
if (plan === 'enterprise' && !contract) {
|
||||
throw new AppError('enterprise tenants require a contract object', {
|
||||
status: 400,
|
||||
code: 'VALIDATION_ERROR',
|
||||
});
|
||||
}
|
||||
|
||||
await validateVeraeCredentials(veraeUsername, veraePassword);
|
||||
|
||||
const tenantId = id ?? `tenant-${slugify(name)}-${randomUUID().slice(0, 8)}`;
|
||||
if (getTenant(tenantId)) {
|
||||
throw new AppError('Tenant already exists', { status: 409, code: 'CONFLICT' });
|
||||
}
|
||||
|
||||
const { tenant, apiKey } = createTenant({
|
||||
id: tenantId,
|
||||
name,
|
||||
plan,
|
||||
veraeUsername,
|
||||
veraePassword,
|
||||
contract,
|
||||
metadata: { ...metadata, audience, createdVia: 'provision' },
|
||||
});
|
||||
|
||||
log.info('tenant provisioned', { tenantId: tenant.id, plan, audience });
|
||||
return { tenant: { id: tenant.id, name: tenant.name, plan: tenant.plan }, apiKey };
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {Array<object>}
|
||||
*/
|
||||
export function listProvisionedTenants() {
|
||||
return listTenants().map((tenant) => ({
|
||||
id: tenant.id,
|
||||
name: tenant.name,
|
||||
plan: tenant.plan,
|
||||
audience: tenant.metadata?.audience ?? 'unknown',
|
||||
createdAt: tenant.createdAt,
|
||||
}));
|
||||
}
|
||||
|
|
@ -0,0 +1,122 @@
|
|||
/**
|
||||
* @fileoverview Timestamp create/status operations with billing + job enqueue.
|
||||
* @module services/timestampService
|
||||
*/
|
||||
|
||||
import { config } from '../config.js';
|
||||
import { veraeClient } from '../clients/veraeClient.js';
|
||||
import { enqueueJob } from '../store/jobWatchers.js';
|
||||
import { checkEntitlement, recordUsage } from './entitlementService.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
import { getTraceId } from '../debug/trace-context.js';
|
||||
|
||||
const log = createDebugger('jobs');
|
||||
|
||||
/**
|
||||
* Enqueue async job watch via NATS or in-process store.
|
||||
* @param {object} ctx
|
||||
* @param {string} jobId
|
||||
*/
|
||||
async function enqueueWatchForJob(ctx, jobId) {
|
||||
const traceId = getTraceId() ?? undefined;
|
||||
|
||||
if (config.natsEnabled) {
|
||||
const { enqueueWatch } = await import('../nats/publishers.js');
|
||||
await enqueueWatch({
|
||||
tenantId: ctx.tenantId,
|
||||
jobId,
|
||||
// Prefer re-login in worker; include token for MVP simplicity when mock
|
||||
veraeToken: ctx.veraeToken,
|
||||
maxAttempts: config.jobPollMaxAttempts,
|
||||
intervalMs: config.jobPollIntervalMs,
|
||||
traceId,
|
||||
});
|
||||
log.debug('watch enqueued on NATS', { jobId, tenantId: ctx.tenantId });
|
||||
return;
|
||||
}
|
||||
|
||||
enqueueJob({
|
||||
tenantId: ctx.tenantId,
|
||||
jobId,
|
||||
veraeToken: ctx.veraeToken,
|
||||
traceId,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx - Auth context with tenantId, veraeToken
|
||||
* @param {{ data: string, hashAlg?: string }} body
|
||||
* @returns {Promise<{ jobId: string }>}
|
||||
*/
|
||||
export async function createTimestamp(ctx, body) {
|
||||
checkEntitlement(ctx.tenantId, 'timestamp');
|
||||
const result = await veraeClient.createTimestamp(ctx.veraeToken, body);
|
||||
recordUsage(ctx.tenantId, 'timestamp');
|
||||
|
||||
await enqueueWatchForJob(ctx, result.jobId);
|
||||
|
||||
log.debug('timestamp created', { jobId: result.jobId, tenantId: ctx.tenantId });
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {{ data: string, hashAlg?: string }} body
|
||||
* @returns {Promise<object>} StatusResponse
|
||||
*/
|
||||
export async function createTimestampAndWait(ctx, body) {
|
||||
const created = await createTimestamp(ctx, body);
|
||||
const status = await veraeClient.waitForJob(ctx.veraeToken, created.jobId, {
|
||||
maxAttempts: config.jobPollMaxAttempts,
|
||||
intervalMs: config.jobPollIntervalMs,
|
||||
});
|
||||
recordUsage(ctx.tenantId, 'status');
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {{ items: Array<{ data: string, hashAlg?: string }> }} body
|
||||
*/
|
||||
export async function createBatchTimestamp(ctx, body) {
|
||||
const itemCount = body.items?.length ?? 0;
|
||||
checkEntitlement(ctx.tenantId, 'batch_timestamp', { amount: itemCount });
|
||||
const result = await veraeClient.createBatchTimestamp(ctx.veraeToken, body);
|
||||
recordUsage(ctx.tenantId, 'batch_timestamp', { amount: itemCount });
|
||||
|
||||
for (const jobId of result.jobIds ?? []) {
|
||||
await enqueueWatchForJob(ctx, jobId);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {string} jobId
|
||||
*/
|
||||
export async function getJobStatus(ctx, jobId) {
|
||||
const status = await veraeClient.getStatus(ctx.veraeToken, jobId);
|
||||
recordUsage(ctx.tenantId, 'status');
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {{ jobIds: string[] }} body
|
||||
*/
|
||||
export async function getBatchJobStatus(ctx, body) {
|
||||
const status = await veraeClient.getBatchStatus(ctx.veraeToken, body);
|
||||
recordUsage(ctx.tenantId, 'status', { amount: body.jobIds?.length ?? 1 });
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {string} jobId
|
||||
*/
|
||||
export async function getJobVerification(ctx, jobId) {
|
||||
const status = await veraeClient.getJobVerification(ctx.veraeToken, jobId);
|
||||
recordUsage(ctx.tenantId, 'status');
|
||||
return status;
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
/**
|
||||
* @fileoverview Certificate verification with usage metering.
|
||||
* @module services/verifyService
|
||||
*/
|
||||
|
||||
import { veraeClient } from '../clients/veraeClient.js';
|
||||
import { checkEntitlement, recordUsage } from './entitlementService.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('jobs');
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {{ certificate: string }} body
|
||||
*/
|
||||
export async function verifyTimestamp(ctx, body) {
|
||||
checkEntitlement(ctx.tenantId, 'verify');
|
||||
const result = await veraeClient.verify(ctx.veraeToken, body);
|
||||
recordUsage(ctx.tenantId, 'verify');
|
||||
log.debug('verify result', { tenantId: ctx.tenantId, valid: result.valid });
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {{ certificates: string[] }} body
|
||||
*/
|
||||
export async function verifyBatch(ctx, body) {
|
||||
const amount = body.certificates?.length ?? 1;
|
||||
checkEntitlement(ctx.tenantId, 'verify', { amount });
|
||||
const result = await veraeClient.verifyBatch(ctx.veraeToken, body);
|
||||
recordUsage(ctx.tenantId, 'verify', { amount });
|
||||
return result;
|
||||
}
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
/**
|
||||
* @fileoverview REST Hook subscribe/unsubscribe and HTTP delivery.
|
||||
* @module services/webhookService
|
||||
*/
|
||||
|
||||
import { createWebhook, deleteWebhook } from '../store/webhooks.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('webhooks');
|
||||
|
||||
const ALLOWED_EVENTS = new Set(['timestamp.completed', 'timestamp.failed']);
|
||||
|
||||
/**
|
||||
* @param {object} ctx - auth context
|
||||
* @param {{ targetUrl: string, event: string }} params
|
||||
*/
|
||||
export function subscribe(ctx, { targetUrl, event }) {
|
||||
if (!targetUrl) {
|
||||
throw new Error('targetUrl is required');
|
||||
}
|
||||
if (!ALLOWED_EVENTS.has(event)) {
|
||||
throw new Error(`Unsupported event: ${event}`);
|
||||
}
|
||||
|
||||
return createWebhook({
|
||||
tenantId: ctx.tenantId,
|
||||
targetUrl,
|
||||
event,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {object} ctx
|
||||
* @param {{ hookId?: string, targetUrl?: string }} params
|
||||
*/
|
||||
export function unsubscribe(ctx, { hookId, targetUrl }) {
|
||||
const removed = deleteWebhook({
|
||||
tenantId: ctx.tenantId,
|
||||
hookId,
|
||||
targetUrl,
|
||||
});
|
||||
|
||||
if (!removed) {
|
||||
throw new Error('Webhook subscription not found');
|
||||
}
|
||||
|
||||
return { removed: true };
|
||||
}
|
||||
|
||||
/**
|
||||
* POST payload to Zapier target URL.
|
||||
* @param {string} targetUrl
|
||||
* @param {object} payload
|
||||
* @returns {Promise<{ ok: boolean, status: number }>}
|
||||
*/
|
||||
export async function deliverWebhook(targetUrl, payload) {
|
||||
log.debug('deliverWebhook', { targetUrl, event: payload?.event });
|
||||
|
||||
const response = await fetch(targetUrl, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
'User-Agent': 'Verae-Zapier-Middleware/1.0',
|
||||
},
|
||||
body: JSON.stringify(payload),
|
||||
});
|
||||
|
||||
log.debug('deliverWebhook result', { status: response.status, ok: response.ok });
|
||||
return { ok: response.ok, status: response.status };
|
||||
}
|
||||
|
|
@ -0,0 +1,114 @@
|
|||
/**
|
||||
* @fileoverview JSON file-backed in-memory store (MVP persistence).
|
||||
* @module store/db
|
||||
*/
|
||||
|
||||
import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
|
||||
import { dirname } from 'node:path';
|
||||
import { config } from '../config.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('app');
|
||||
|
||||
/**
|
||||
* @typedef {Object} StoreShape
|
||||
* @property {Record<string, object>} tenants
|
||||
* @property {Record<string, string>} apiKeys - apiKey → tenantId
|
||||
* @property {Record<string, object>} usage - tenantId → counters
|
||||
* @property {object[]} webhooks
|
||||
* @property {object[]} jobWatchers
|
||||
*/
|
||||
|
||||
/** @type {StoreShape|null} */
|
||||
let store = null;
|
||||
|
||||
/**
|
||||
* Create an empty store document.
|
||||
* @returns {StoreShape}
|
||||
*/
|
||||
export function emptyStore() {
|
||||
return {
|
||||
tenants: {},
|
||||
apiKeys: {},
|
||||
usage: {},
|
||||
webhooks: [],
|
||||
jobWatchers: [],
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Load store from disk into memory (or create empty if missing).
|
||||
* @param {string} [path=config.storePath]
|
||||
* @returns {StoreShape}
|
||||
*/
|
||||
export function loadStore(path = config.storePath) {
|
||||
if (store) return store;
|
||||
|
||||
if (existsSync(path)) {
|
||||
try {
|
||||
const raw = readFileSync(path, 'utf8');
|
||||
const parsed = JSON.parse(raw);
|
||||
store = {
|
||||
...emptyStore(),
|
||||
...parsed,
|
||||
tenants: parsed.tenants ?? {},
|
||||
apiKeys: parsed.apiKeys ?? {},
|
||||
usage: parsed.usage ?? {},
|
||||
webhooks: Array.isArray(parsed.webhooks) ? parsed.webhooks : [],
|
||||
jobWatchers: Array.isArray(parsed.jobWatchers) ? parsed.jobWatchers : [],
|
||||
};
|
||||
log.debug('store loaded', { path, tenants: Object.keys(store.tenants).length });
|
||||
} catch (err) {
|
||||
log.error('store load failed, using empty', { path, error: err.message });
|
||||
store = emptyStore();
|
||||
}
|
||||
} else {
|
||||
store = emptyStore();
|
||||
log.debug('store initialized empty', { path });
|
||||
}
|
||||
|
||||
return store;
|
||||
}
|
||||
|
||||
/**
|
||||
* Access the in-memory store (loads if needed).
|
||||
* @returns {StoreShape}
|
||||
*/
|
||||
export function getStore() {
|
||||
if (!store) return loadStore();
|
||||
return store;
|
||||
}
|
||||
|
||||
/**
|
||||
* Replace the in-memory store (tests only).
|
||||
* @param {StoreShape|null} next
|
||||
* @returns {void}
|
||||
*/
|
||||
export function setStoreForTests(next) {
|
||||
store = next;
|
||||
}
|
||||
|
||||
/**
|
||||
* Persist the in-memory store to disk.
|
||||
* @param {string} [path=config.storePath]
|
||||
* @returns {void}
|
||||
*/
|
||||
export function persist(path = config.storePath) {
|
||||
const data = getStore();
|
||||
const dir = dirname(path);
|
||||
if (!existsSync(dir)) {
|
||||
mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
writeFileSync(path, JSON.stringify(data, null, 2), 'utf8');
|
||||
log.debug('store persisted', { path });
|
||||
}
|
||||
|
||||
/**
|
||||
* Force reload from disk (drops memory).
|
||||
* @param {string} [path=config.storePath]
|
||||
* @returns {StoreShape}
|
||||
*/
|
||||
export function reloadStore(path = config.storePath) {
|
||||
store = null;
|
||||
return loadStore(path);
|
||||
}
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
/**
|
||||
* @fileoverview In-process job watch queue (NATS_ENABLED=false path).
|
||||
* @module store/jobWatchers
|
||||
*/
|
||||
|
||||
import { randomUUID } from 'node:crypto';
|
||||
import { getStore, persist } from './db.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('jobs');
|
||||
|
||||
/**
|
||||
* @typedef {Object} JobWatcher
|
||||
* @property {string} id
|
||||
* @property {string} tenantId
|
||||
* @property {string} jobId
|
||||
* @property {string} veraeToken
|
||||
* @property {string} status
|
||||
* @property {number} attempts
|
||||
* @property {string} createdAt
|
||||
* @property {string} updatedAt
|
||||
* @property {string} [traceId]
|
||||
*/
|
||||
|
||||
/**
|
||||
* @param {object} params
|
||||
* @param {string} params.tenantId
|
||||
* @param {string} params.jobId
|
||||
* @param {string} params.veraeToken
|
||||
* @param {string} [params.traceId]
|
||||
* @returns {JobWatcher}
|
||||
*/
|
||||
export function enqueueJob({ tenantId, jobId, veraeToken, traceId }) {
|
||||
/** @type {JobWatcher} */
|
||||
const watcher = {
|
||||
id: randomUUID(),
|
||||
tenantId,
|
||||
jobId,
|
||||
veraeToken,
|
||||
status: 'pending',
|
||||
attempts: 0,
|
||||
createdAt: new Date().toISOString(),
|
||||
updatedAt: new Date().toISOString(),
|
||||
traceId,
|
||||
};
|
||||
|
||||
const store = getStore();
|
||||
store.jobWatchers.push(watcher);
|
||||
persist();
|
||||
log.debug('job enqueued', { watcherId: watcher.id, jobId, tenantId });
|
||||
return watcher;
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {JobWatcher[]}
|
||||
*/
|
||||
export function listPendingJobs() {
|
||||
return getStore().jobWatchers.filter((job) => job.status === 'pending');
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} id
|
||||
* @param {Partial<JobWatcher>} patch
|
||||
* @returns {JobWatcher|null}
|
||||
*/
|
||||
export function updateJobWatcher(id, patch) {
|
||||
const store = getStore();
|
||||
const index = store.jobWatchers.findIndex((job) => job.id === id);
|
||||
if (index === -1) return null;
|
||||
|
||||
store.jobWatchers[index] = {
|
||||
...store.jobWatchers[index],
|
||||
...patch,
|
||||
updatedAt: new Date().toISOString(),
|
||||
};
|
||||
persist();
|
||||
return store.jobWatchers[index];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} id
|
||||
* @returns {void}
|
||||
*/
|
||||
export function removeJobWatcher(id) {
|
||||
const store = getStore();
|
||||
store.jobWatchers = store.jobWatchers.filter((job) => job.id !== id);
|
||||
persist();
|
||||
log.debug('job watcher removed', { id });
|
||||
}
|
||||
|
|
@ -0,0 +1,137 @@
|
|||
/**
|
||||
* @fileoverview Tenant and API key persistence.
|
||||
* @module store/tenants
|
||||
*/
|
||||
|
||||
import { getStore, persist } from './db.js';
|
||||
import { generateApiKey } from '../lib/tokens.js';
|
||||
import { PLAN_LIMITS } from '../config.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('billing');
|
||||
|
||||
/**
|
||||
* @typedef {Object} Tenant
|
||||
* @property {string} id
|
||||
* @property {string} name
|
||||
* @property {string} plan
|
||||
* @property {string} veraeUsername
|
||||
* @property {string} veraePassword
|
||||
* @property {object|null} contract
|
||||
* @property {object} [metadata]
|
||||
* @property {string} createdAt
|
||||
*/
|
||||
|
||||
/**
|
||||
* @param {string} tenantId
|
||||
* @returns {Tenant|null}
|
||||
*/
|
||||
export function getTenant(tenantId) {
|
||||
return getStore().tenants[tenantId] ?? null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} apiKey
|
||||
* @returns {Tenant|null}
|
||||
*/
|
||||
export function getTenantByApiKey(apiKey) {
|
||||
const store = getStore();
|
||||
const tenantId = store.apiKeys[apiKey];
|
||||
return tenantId ? store.tenants[tenantId] ?? null : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {Tenant[]}
|
||||
*/
|
||||
export function listTenants() {
|
||||
return Object.values(getStore().tenants);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Tenant} tenant
|
||||
* @returns {Tenant}
|
||||
*/
|
||||
export function upsertTenant(tenant) {
|
||||
const store = getStore();
|
||||
store.tenants[tenant.id] = tenant;
|
||||
persist();
|
||||
log.debug('tenant upserted', { tenantId: tenant.id, plan: tenant.plan });
|
||||
return tenant;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a tenant and bind a new API key.
|
||||
*
|
||||
* @param {object} params
|
||||
* @param {string} params.id
|
||||
* @param {string} params.name
|
||||
* @param {string} [params.plan='free']
|
||||
* @param {string} params.veraeUsername
|
||||
* @param {string} params.veraePassword
|
||||
* @param {object|null} [params.contract=null]
|
||||
* @param {string} [params.apiKey]
|
||||
* @param {object} [params.metadata]
|
||||
* @returns {{ tenant: Tenant, apiKey: string }}
|
||||
*/
|
||||
export function createTenant({
|
||||
id,
|
||||
name,
|
||||
plan = 'free',
|
||||
veraeUsername,
|
||||
veraePassword,
|
||||
contract = null,
|
||||
apiKey = generateApiKey(),
|
||||
metadata = {},
|
||||
}) {
|
||||
const store = getStore();
|
||||
/** @type {Tenant} */
|
||||
const tenant = {
|
||||
id,
|
||||
name,
|
||||
plan,
|
||||
veraeUsername,
|
||||
veraePassword,
|
||||
contract,
|
||||
metadata,
|
||||
createdAt: new Date().toISOString(),
|
||||
};
|
||||
|
||||
store.tenants[id] = tenant;
|
||||
store.apiKeys[apiKey] = id;
|
||||
persist();
|
||||
|
||||
log.info('tenant created', { tenantId: id, plan, audience: metadata.audience });
|
||||
return { tenant, apiKey };
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve effective limits for a tenant (plan defaults or enterprise contract).
|
||||
*
|
||||
* @param {Tenant} tenant
|
||||
* @returns {{
|
||||
* timestamps: number|null,
|
||||
* verifications: number|null,
|
||||
* batch: boolean,
|
||||
* batchMaxItems: number|null,
|
||||
* requestsPerMinute: number,
|
||||
* allowOverage: boolean,
|
||||
* overageRates: object
|
||||
* }}
|
||||
*/
|
||||
export function resolveLimits(tenant) {
|
||||
if (tenant.plan === 'enterprise' && tenant.contract) {
|
||||
return {
|
||||
timestamps: tenant.contract.includedTimestamps ?? null,
|
||||
verifications: tenant.contract.includedVerifications ?? null,
|
||||
batch: tenant.contract.batch !== false,
|
||||
batchMaxItems: tenant.contract.batchMaxItems ?? null,
|
||||
requestsPerMinute:
|
||||
tenant.contract.requestsPerMinute ?? PLAN_LIMITS.enterprise.requestsPerMinute,
|
||||
allowOverage: tenant.contract.allowOverage ?? false,
|
||||
overageRates: tenant.contract.overageRates ?? {},
|
||||
};
|
||||
}
|
||||
|
||||
const base = PLAN_LIMITS[tenant.plan] ?? PLAN_LIMITS.free;
|
||||
return { ...base, allowOverage: false, overageRates: {} };
|
||||
}
|
||||
|
|
@ -0,0 +1,102 @@
|
|||
/**
|
||||
* @fileoverview Per-tenant usage metering counters.
|
||||
* @module store/usage
|
||||
*/
|
||||
|
||||
import { getStore, persist } from './db.js';
|
||||
import { getTenant, resolveLimits } from './tenants.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('billing');
|
||||
|
||||
/**
|
||||
* @returns {string} YYYY-MM period key
|
||||
*/
|
||||
function currentPeriod() {
|
||||
const d = new Date();
|
||||
return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} tenantId
|
||||
* @returns {{ period: string, timestamps: number, verifications: number, statusChecks: number, batchTimestamps: number, overage: object }}
|
||||
*/
|
||||
function emptyUsage(tenantId) {
|
||||
return {
|
||||
tenantId,
|
||||
period: currentPeriod(),
|
||||
timestamps: 0,
|
||||
verifications: 0,
|
||||
statusChecks: 0,
|
||||
batchTimestamps: 0,
|
||||
overage: { timestamps: 0, verifications: 0 },
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Get usage for tenant, rolling period if month changed.
|
||||
* @param {string} tenantId
|
||||
* @returns {ReturnType<typeof emptyUsage>}
|
||||
*/
|
||||
export function getUsage(tenantId) {
|
||||
const store = getStore();
|
||||
let usage = store.usage[tenantId];
|
||||
const period = currentPeriod();
|
||||
|
||||
if (!usage || usage.period !== period) {
|
||||
usage = emptyUsage(tenantId);
|
||||
store.usage[tenantId] = usage;
|
||||
}
|
||||
|
||||
return usage;
|
||||
}
|
||||
|
||||
/**
|
||||
* Public summary for /auth/me.
|
||||
* @param {string} tenantId
|
||||
* @returns {object}
|
||||
*/
|
||||
export function getUsageSummary(tenantId) {
|
||||
const usage = getUsage(tenantId);
|
||||
const tenant = getTenant(tenantId);
|
||||
const limits = tenant ? resolveLimits(tenant) : null;
|
||||
|
||||
return {
|
||||
period: usage.period,
|
||||
timestamps: usage.timestamps,
|
||||
verifications: usage.verifications,
|
||||
statusChecks: usage.statusChecks,
|
||||
batchTimestamps: usage.batchTimestamps,
|
||||
limits: limits
|
||||
? {
|
||||
timestamps: limits.timestamps,
|
||||
verifications: limits.verifications,
|
||||
batch: limits.batch,
|
||||
batchMaxItems: limits.batchMaxItems,
|
||||
}
|
||||
: null,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Increment a usage metric.
|
||||
*
|
||||
* @param {string} tenantId
|
||||
* @param {string} metric - e.g. `timestamps`, `verifications`, `statusChecks`, `batchTimestamps`, `overage.timestamps`
|
||||
* @param {number} [amount=1]
|
||||
* @returns {void}
|
||||
*/
|
||||
export function incrementUsage(tenantId, metric, amount = 1) {
|
||||
const usage = getUsage(tenantId);
|
||||
|
||||
if (metric.startsWith('overage.')) {
|
||||
const key = metric.slice('overage.'.length);
|
||||
usage.overage[key] = (usage.overage[key] ?? 0) + amount;
|
||||
} else {
|
||||
usage[metric] = (usage[metric] ?? 0) + amount;
|
||||
}
|
||||
|
||||
getStore().usage[tenantId] = usage;
|
||||
persist();
|
||||
log.debug('usage incremented', { tenantId, metric, amount, value: usage[metric] ?? usage.overage });
|
||||
}
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
/**
|
||||
* @fileoverview REST Hook subscription storage.
|
||||
* @module store/webhooks
|
||||
*/
|
||||
|
||||
import { randomUUID } from 'node:crypto';
|
||||
import { getStore, persist } from './db.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('webhooks');
|
||||
|
||||
/**
|
||||
* @typedef {Object} Webhook
|
||||
* @property {string} id
|
||||
* @property {string} tenantId
|
||||
* @property {string} targetUrl
|
||||
* @property {string} event
|
||||
* @property {string} createdAt
|
||||
*/
|
||||
|
||||
/**
|
||||
* @param {object} params
|
||||
* @param {string} params.tenantId
|
||||
* @param {string} params.targetUrl
|
||||
* @param {string} params.event
|
||||
* @returns {Webhook}
|
||||
*/
|
||||
export function createWebhook({ tenantId, targetUrl, event }) {
|
||||
/** @type {Webhook} */
|
||||
const hook = {
|
||||
id: randomUUID(),
|
||||
tenantId,
|
||||
targetUrl,
|
||||
event,
|
||||
createdAt: new Date().toISOString(),
|
||||
};
|
||||
|
||||
const store = getStore();
|
||||
store.webhooks.push(hook);
|
||||
persist();
|
||||
log.info('webhook created', { hookId: hook.id, tenantId, event });
|
||||
return hook;
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete a webhook for a tenant by id and/or targetUrl.
|
||||
*
|
||||
* @param {object} params
|
||||
* @param {string} params.tenantId
|
||||
* @param {string} [params.hookId]
|
||||
* @param {string} [params.targetUrl]
|
||||
* @returns {boolean} True if at least one webhook was removed.
|
||||
*/
|
||||
export function deleteWebhook({ tenantId, hookId, targetUrl }) {
|
||||
if (!hookId && !targetUrl) return false;
|
||||
|
||||
const store = getStore();
|
||||
const before = store.webhooks.length;
|
||||
|
||||
store.webhooks = store.webhooks.filter((hook) => {
|
||||
if (hook.tenantId !== tenantId) return true;
|
||||
if (hookId && hook.id === hookId) return false;
|
||||
if (!hookId && targetUrl && hook.targetUrl === targetUrl) return false;
|
||||
return true;
|
||||
});
|
||||
|
||||
const removedCount = before - store.webhooks.length;
|
||||
if (removedCount > 0) {
|
||||
persist();
|
||||
log.info('webhook deleted', { tenantId, hookId, removedCount });
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} tenantId
|
||||
* @param {string} event
|
||||
* @returns {Webhook[]}
|
||||
*/
|
||||
export function getActiveWebhooks(tenantId, event) {
|
||||
return getStore().webhooks.filter((h) => h.tenantId === tenantId && h.event === event);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} tenantId
|
||||
* @returns {Webhook[]}
|
||||
*/
|
||||
export function listWebhooksForTenant(tenantId) {
|
||||
return getStore().webhooks.filter((h) => h.tenantId === tenantId);
|
||||
}
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
/**
|
||||
* @fileoverview In-process job poller when NATS_ENABLED=false.
|
||||
* @module workers/inProcessJobPoller
|
||||
*/
|
||||
|
||||
import { config } from '../config.js';
|
||||
import { veraeClient } from '../clients/veraeClient.js';
|
||||
import {
|
||||
listPendingJobs,
|
||||
updateJobWatcher,
|
||||
removeJobWatcher,
|
||||
} from '../store/jobWatchers.js';
|
||||
import { getActiveWebhooks } from '../store/webhooks.js';
|
||||
import { deliverWebhook } from '../services/webhookService.js';
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
|
||||
const log = createDebugger('jobs');
|
||||
|
||||
let timer = null;
|
||||
let running = false;
|
||||
|
||||
/**
|
||||
* @param {import('../store/jobWatchers.js').JobWatcher} job
|
||||
*/
|
||||
async function processJob(job) {
|
||||
const attempts = job.attempts + 1;
|
||||
updateJobWatcher(job.id, { attempts });
|
||||
|
||||
if (attempts > config.jobPollMaxAttempts) {
|
||||
updateJobWatcher(job.id, { status: 'timeout' });
|
||||
removeJobWatcher(job.id);
|
||||
log.warn('job timeout', { jobId: job.jobId });
|
||||
return;
|
||||
}
|
||||
|
||||
let status;
|
||||
try {
|
||||
status = await veraeClient.getStatus(job.veraeToken, job.jobId);
|
||||
} catch (err) {
|
||||
log.debug('poll error', { jobId: job.jobId, error: err.message });
|
||||
return;
|
||||
}
|
||||
|
||||
if (status.status === 'pending') {
|
||||
return;
|
||||
}
|
||||
|
||||
const event = status.status === 'completed' ? 'timestamp.completed' : 'timestamp.failed';
|
||||
const hooks = getActiveWebhooks(job.tenantId, event);
|
||||
|
||||
for (const hook of hooks) {
|
||||
try {
|
||||
await deliverWebhook(hook.targetUrl, {
|
||||
event,
|
||||
jobId: job.jobId,
|
||||
tenantId: job.tenantId,
|
||||
status,
|
||||
});
|
||||
} catch (err) {
|
||||
log.error('webhook deliver failed', { hookId: hook.id, error: err.message });
|
||||
}
|
||||
}
|
||||
|
||||
updateJobWatcher(job.id, { status: status.status });
|
||||
removeJobWatcher(job.id);
|
||||
log.debug('job terminal', { jobId: job.jobId, status: status.status, hooks: hooks.length });
|
||||
}
|
||||
|
||||
async function tick() {
|
||||
if (running) return;
|
||||
running = true;
|
||||
try {
|
||||
const jobs = listPendingJobs();
|
||||
await Promise.all(jobs.map((job) => processJob(job)));
|
||||
} finally {
|
||||
running = false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Start interval poller (no-op if already started or NATS enabled).
|
||||
* @returns {void}
|
||||
*/
|
||||
export function startInProcessJobPoller() {
|
||||
if (config.natsEnabled) {
|
||||
log.info('in-process poller skipped (NATS_ENABLED=true)');
|
||||
return;
|
||||
}
|
||||
if (timer) return;
|
||||
|
||||
const interval = config.jobPollIntervalMs;
|
||||
timer = setInterval(() => {
|
||||
tick().catch((err) => log.error('poller tick failed', { error: err.message }));
|
||||
}, interval);
|
||||
|
||||
log.info('in-process job poller started', { intervalMs: interval });
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop interval poller.
|
||||
* @returns {void}
|
||||
*/
|
||||
export function stopInProcessJobPoller() {
|
||||
if (!timer) return;
|
||||
clearInterval(timer);
|
||||
timer = null;
|
||||
log.info('in-process job poller stopped');
|
||||
}
|
||||
|
|
@ -0,0 +1,158 @@
|
|||
/**
|
||||
* @fileoverview JetStream consumer that polls Verae job status.
|
||||
* @module workers/jobPollerWorker
|
||||
*/
|
||||
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
import { config } from '../config.js';
|
||||
import { SUBJECTS, CONSUMERS, STREAMS } from '../nats/subjects.js';
|
||||
import { connectNats, ensureStreams } from '../nats/connection.js';
|
||||
import { publishJobEvent } from '../nats/publishers.js';
|
||||
import { veraeClient } from '../clients/veraeClient.js';
|
||||
import { getTenant } from '../store/tenants.js';
|
||||
import { withTrace } from '../debug/trace.js';
|
||||
|
||||
const log = createDebugger('jobs');
|
||||
|
||||
let running = false;
|
||||
/** @type {AbortController|null} */
|
||||
let abort = null;
|
||||
|
||||
/**
|
||||
* Resolve a Verae token for polling (re-login via tenant if needed).
|
||||
* @param {object} msg
|
||||
* @returns {Promise<string>}
|
||||
*/
|
||||
async function resolveVeraeToken(msg) {
|
||||
if (msg.veraeToken) return msg.veraeToken;
|
||||
|
||||
const tenant = getTenant(msg.tenantId);
|
||||
if (!tenant?.veraeUsername) {
|
||||
throw new Error(`Cannot resolve token for tenant ${msg.tenantId}`);
|
||||
}
|
||||
const login = await veraeClient.login({
|
||||
username: tenant.veraeUsername,
|
||||
password: tenant.veraePassword,
|
||||
});
|
||||
return login.token;
|
||||
}
|
||||
|
||||
/**
|
||||
* Process one watch message.
|
||||
* @param {object} data
|
||||
* @param {{ ack: () => Promise<void>, nak: (delay?: number) => Promise<void> }} ctrl
|
||||
*/
|
||||
async function handleWatch(data, ctrl) {
|
||||
await withTrace({ traceId: data.traceId, span: 'job-poll' }, async () => {
|
||||
const attempt = (data.attempt ?? 0) + 1;
|
||||
const maxAttempts = data.maxAttempts ?? config.jobPollMaxAttempts;
|
||||
|
||||
if (attempt > maxAttempts) {
|
||||
await publishJobEvent({
|
||||
event: 'timestamp.timeout',
|
||||
tenantId: data.tenantId,
|
||||
jobId: data.jobId,
|
||||
status: { id: data.jobId, status: 'timeout' },
|
||||
traceId: data.traceId,
|
||||
});
|
||||
await ctrl.ack();
|
||||
return;
|
||||
}
|
||||
|
||||
const token = await resolveVeraeToken(data);
|
||||
let status;
|
||||
try {
|
||||
status = await veraeClient.getStatus(token, data.jobId);
|
||||
} catch (err) {
|
||||
log.debug('poll error, nak', { jobId: data.jobId, error: err.message });
|
||||
await ctrl.nak(config.jobPollIntervalMs);
|
||||
return;
|
||||
}
|
||||
|
||||
log.debug('poll status', { jobId: data.jobId, status: status.status, attempt });
|
||||
|
||||
if (status.status === 'pending') {
|
||||
await ctrl.nak(config.jobPollIntervalMs);
|
||||
return;
|
||||
}
|
||||
|
||||
const event =
|
||||
status.status === 'completed' ? 'timestamp.completed' : 'timestamp.failed';
|
||||
|
||||
await publishJobEvent({
|
||||
event,
|
||||
tenantId: data.tenantId,
|
||||
jobId: data.jobId,
|
||||
status,
|
||||
traceId: data.traceId,
|
||||
});
|
||||
await ctrl.ack();
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the durable job-poller worker loop.
|
||||
* @returns {Promise<{ stop: () => Promise<void> }>}
|
||||
*/
|
||||
export async function startJobPollerWorker() {
|
||||
if (running) {
|
||||
return { stop: async () => stopJobPollerWorker() };
|
||||
}
|
||||
|
||||
const { nc, js, jsm } = await connectNats();
|
||||
await ensureStreams(jsm);
|
||||
|
||||
// Ensure durable consumer (workqueue-style via filter + durable name)
|
||||
try {
|
||||
await jsm.consumers.add(STREAMS.ZAPIER_JOBS, {
|
||||
durable_name: CONSUMERS.JOB_POLLER,
|
||||
ack_policy: 'explicit',
|
||||
filter_subject: SUBJECTS.JOBS_WATCH,
|
||||
max_deliver: config.jobPollMaxAttempts + 5,
|
||||
ack_wait: 30_000_000_000, // 30s ns
|
||||
});
|
||||
} catch (err) {
|
||||
// already exists
|
||||
log.debug('consumer may exist', { error: err.message });
|
||||
}
|
||||
|
||||
const consumer = await js.consumers.get(STREAMS.ZAPIER_JOBS, CONSUMERS.JOB_POLLER);
|
||||
abort = new AbortController();
|
||||
running = true;
|
||||
log.info('job poller worker started', { consumer: CONSUMERS.JOB_POLLER });
|
||||
|
||||
(async () => {
|
||||
const messages = await consumer.consume({ max_messages: 10 });
|
||||
for await (const msg of messages) {
|
||||
if (abort?.signal.aborted) break;
|
||||
try {
|
||||
const data = JSON.parse(msg.string());
|
||||
await handleWatch(data, {
|
||||
ack: () => msg.ack(),
|
||||
nak: (delayMs = 1000) => msg.nak(delayMs),
|
||||
});
|
||||
} catch (err) {
|
||||
log.error('job poller handle failed', { error: err.message });
|
||||
try {
|
||||
msg.nak(1000);
|
||||
} catch {
|
||||
/* ignore */
|
||||
}
|
||||
}
|
||||
}
|
||||
})().catch((err) => log.error('job poller loop failed', { error: err.message }));
|
||||
|
||||
return {
|
||||
stop: async () => stopJobPollerWorker(),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
export async function stopJobPollerWorker() {
|
||||
abort?.abort();
|
||||
abort = null;
|
||||
running = false;
|
||||
log.info('job poller worker stopped');
|
||||
}
|
||||
|
|
@ -0,0 +1,138 @@
|
|||
/**
|
||||
* @fileoverview JetStream consumer that POSTs Zapier REST Hook payloads.
|
||||
* @module workers/webhookWorker
|
||||
*/
|
||||
|
||||
import { createDebugger } from '../debug/logger.js';
|
||||
import { SUBJECTS, CONSUMERS, STREAMS } from '../nats/subjects.js';
|
||||
import { connectNats, ensureStreams } from '../nats/connection.js';
|
||||
import { deliverWebhook } from '../services/webhookService.js';
|
||||
import { getActiveWebhooks } from '../store/webhooks.js';
|
||||
import { withTrace } from '../debug/trace.js';
|
||||
|
||||
const log = createDebugger('webhooks');
|
||||
|
||||
let running = false;
|
||||
/** @type {AbortController|null} */
|
||||
let abort = null;
|
||||
|
||||
/**
|
||||
* Route job events → per-hook deliver messages (inline or via re-publish).
|
||||
* Also handles direct deliver subjects.
|
||||
*
|
||||
* @param {object} data
|
||||
* @param {{ ack: () => Promise<void>, nak: (d?: number) => Promise<void> }} ctrl
|
||||
*/
|
||||
async function handleDeliver(data, ctrl) {
|
||||
await withTrace({ traceId: data.traceId, span: 'webhook-deliver' }, async () => {
|
||||
// Event router path: expand tenant hooks
|
||||
if (data.event && data.jobId && !data.targetUrl) {
|
||||
const hooks = getActiveWebhooks(data.tenantId, data.event);
|
||||
for (const hook of hooks) {
|
||||
await deliverWebhook(hook.targetUrl, {
|
||||
event: data.event,
|
||||
jobId: data.jobId,
|
||||
tenantId: data.tenantId,
|
||||
status: data.status,
|
||||
});
|
||||
}
|
||||
await ctrl.ack();
|
||||
return;
|
||||
}
|
||||
|
||||
if (!data.targetUrl) {
|
||||
log.warn('deliver missing targetUrl', { dataKeys: Object.keys(data) });
|
||||
await ctrl.ack();
|
||||
return;
|
||||
}
|
||||
|
||||
const result = await deliverWebhook(data.targetUrl, data.payload ?? data);
|
||||
if (result.ok) {
|
||||
await ctrl.ack();
|
||||
} else {
|
||||
log.debug('deliver non-2xx, nak', { status: result.status });
|
||||
await ctrl.nak(2000);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Start webhook delivery worker (consumes WEBHOOKS stream + optional events).
|
||||
* @returns {Promise<{ stop: () => Promise<void> }>}
|
||||
*/
|
||||
export async function startWebhookWorker() {
|
||||
if (running) {
|
||||
return { stop: async () => stopWebhookWorker() };
|
||||
}
|
||||
|
||||
const { js, jsm } = await connectNats();
|
||||
await ensureStreams(jsm);
|
||||
|
||||
// Events consumer → deliver
|
||||
try {
|
||||
await jsm.consumers.add(STREAMS.ZAPIER_EVENTS, {
|
||||
durable_name: CONSUMERS.EVENT_WEBHOOK_ROUTER,
|
||||
ack_policy: 'explicit',
|
||||
filter_subject: SUBJECTS.JOBS_EVENTS,
|
||||
max_deliver: 10,
|
||||
});
|
||||
} catch (err) {
|
||||
log.debug('events consumer may exist', { error: err.message });
|
||||
}
|
||||
|
||||
try {
|
||||
await jsm.consumers.add(STREAMS.ZAPIER_WEBHOOKS, {
|
||||
durable_name: CONSUMERS.WEBHOOK_DELIVER,
|
||||
ack_policy: 'explicit',
|
||||
filter_subject: SUBJECTS.WEBHOOKS_DELIVER,
|
||||
max_deliver: 10,
|
||||
});
|
||||
} catch (err) {
|
||||
log.debug('webhook consumer may exist', { error: err.message });
|
||||
}
|
||||
|
||||
abort = new AbortController();
|
||||
running = true;
|
||||
log.info('webhook worker started');
|
||||
|
||||
const runConsumer = async (stream, durable) => {
|
||||
const consumer = await js.consumers.get(stream, durable);
|
||||
const messages = await consumer.consume({ max_messages: 10 });
|
||||
for await (const msg of messages) {
|
||||
if (abort?.signal.aborted) break;
|
||||
try {
|
||||
const data = JSON.parse(msg.string());
|
||||
await handleDeliver(data, {
|
||||
ack: () => msg.ack(),
|
||||
nak: (d = 1000) => msg.nak(d),
|
||||
});
|
||||
} catch (err) {
|
||||
log.error('webhook handle failed', { error: err.message });
|
||||
try {
|
||||
msg.nak(1000);
|
||||
} catch {
|
||||
/* ignore */
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
runConsumer(STREAMS.ZAPIER_EVENTS, CONSUMERS.EVENT_WEBHOOK_ROUTER).catch((err) =>
|
||||
log.error('events consumer failed', { error: err.message }),
|
||||
);
|
||||
runConsumer(STREAMS.ZAPIER_WEBHOOKS, CONSUMERS.WEBHOOK_DELIVER).catch((err) =>
|
||||
log.error('webhooks consumer failed', { error: err.message }),
|
||||
);
|
||||
|
||||
return { stop: async () => stopWebhookWorker() };
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
export async function stopWebhookWorker() {
|
||||
abort?.abort();
|
||||
abort = null;
|
||||
running = false;
|
||||
log.info('webhook worker stopped');
|
||||
}
|
||||
|
|
@ -0,0 +1,93 @@
|
|||
/**
|
||||
* Shared test helpers — isolated store + seed tenants.
|
||||
*/
|
||||
|
||||
import { mkdtempSync, rmSync } from 'node:fs';
|
||||
import { tmpdir } from 'node:os';
|
||||
import { join } from 'node:path';
|
||||
import { setStoreForTests, loadStore, emptyStore, persist, getStore } from '../src/store/db.js';
|
||||
import { createTenant } from '../src/store/tenants.js';
|
||||
import { config } from '../src/config.js';
|
||||
|
||||
/**
|
||||
* Point store at a temp file and reset memory.
|
||||
* @returns {{ dir: string, storePath: string, cleanup: () => void }}
|
||||
*/
|
||||
export function useTempStore() {
|
||||
const dir = mkdtempSync(join(tmpdir(), 'verae-mw-'));
|
||||
const storePath = join(dir, 'store.json');
|
||||
config.storePath = storePath;
|
||||
setStoreForTests(null);
|
||||
loadStore(storePath);
|
||||
// ensure empty
|
||||
setStoreForTests(emptyStore());
|
||||
persist(storePath);
|
||||
|
||||
return {
|
||||
dir,
|
||||
storePath,
|
||||
cleanup: () => {
|
||||
setStoreForTests(null);
|
||||
try {
|
||||
rmSync(dir, { recursive: true, force: true });
|
||||
} catch {
|
||||
/* ignore */
|
||||
}
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Seed a free-plan tenant with known credentials (mock Verae).
|
||||
* @param {object} [overrides]
|
||||
* @returns {{ tenant: object, apiKey: string }}
|
||||
*/
|
||||
export function seedFreeTenant(overrides = {}) {
|
||||
return createTenant({
|
||||
id: overrides.id ?? 'tenant-test-free',
|
||||
name: overrides.name ?? 'Test Free',
|
||||
plan: 'free',
|
||||
veraeUsername: overrides.veraeUsername ?? 'zapuser',
|
||||
veraePassword: overrides.veraePassword ?? 'zappass',
|
||||
metadata: { audience: 'test' },
|
||||
...overrides,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Seed a pro tenant (batch allowed).
|
||||
*/
|
||||
export function seedProTenant() {
|
||||
return createTenant({
|
||||
id: 'tenant-test-pro',
|
||||
name: 'Test Pro',
|
||||
plan: 'pro',
|
||||
veraeUsername: 'prouser',
|
||||
veraePassword: 'propass',
|
||||
metadata: { audience: 'test' },
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Seed enterprise with contract.
|
||||
*/
|
||||
export function seedEnterpriseTenant() {
|
||||
return createTenant({
|
||||
id: 'tenant-test-ent',
|
||||
name: 'Test Enterprise',
|
||||
plan: 'enterprise',
|
||||
veraeUsername: 'entuser',
|
||||
veraePassword: 'entpass',
|
||||
contract: {
|
||||
includedTimestamps: 10,
|
||||
includedVerifications: 10,
|
||||
batch: true,
|
||||
batchMaxItems: 5,
|
||||
requestsPerMinute: 100,
|
||||
allowOverage: false,
|
||||
},
|
||||
metadata: { audience: 'enterprise' },
|
||||
});
|
||||
}
|
||||
|
||||
export { getStore, config };
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
/**
|
||||
* GATE 5 — Auth + entitlement HTTP tests
|
||||
*/
|
||||
|
||||
import { describe, it, before, after, beforeEach, afterEach } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { createApp } from '../../src/app.js';
|
||||
import { useTempStore, seedFreeTenant } from '../helpers.js';
|
||||
import { incrementUsage } from '../../src/store/usage.js';
|
||||
import { PLAN_LIMITS } from '../../src/config.js';
|
||||
import { checkEntitlement } from '../../src/services/entitlementService.js';
|
||||
import { AppError } from '../../src/errors.js';
|
||||
|
||||
describe('auth + entitlements HTTP', () => {
|
||||
/** @type {ReturnType<typeof useTempStore>} */
|
||||
let ctx;
|
||||
/** @type {import('http').Server} */
|
||||
let server;
|
||||
/** @type {number} */
|
||||
let port;
|
||||
/** @type {string} */
|
||||
let apiKey;
|
||||
|
||||
before(() => {
|
||||
ctx = useTempStore();
|
||||
const seeded = seedFreeTenant();
|
||||
apiKey = seeded.apiKey;
|
||||
|
||||
const app = createApp({ load: false });
|
||||
return new Promise((resolve) => {
|
||||
server = app.listen(0, '127.0.0.1', () => {
|
||||
port = server.address().port;
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
after(async () => {
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
ctx.cleanup();
|
||||
});
|
||||
|
||||
it('GET /zapier/v1/auth/me with valid API key', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/auth/me`, {
|
||||
headers: { Authorization: `Bearer ${apiKey}` },
|
||||
});
|
||||
assert.equal(res.status, 200);
|
||||
const body = await res.json();
|
||||
assert.equal(body.valid, true);
|
||||
assert.equal(body.plan, 'free');
|
||||
assert.ok(body.tenantId);
|
||||
assert.ok(body.usage);
|
||||
});
|
||||
|
||||
it('invalid key returns 401', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/auth/me`, {
|
||||
headers: { Authorization: 'Bearer zmw_invalidkeyxxxxxxxxxxxxxxxx' },
|
||||
});
|
||||
assert.equal(res.status, 401);
|
||||
const body = await res.json();
|
||||
assert.equal(body.code, 'UNAUTHORIZED');
|
||||
});
|
||||
|
||||
it('exceeding free timestamp quota throws 402 QUOTA_EXCEEDED', () => {
|
||||
const tenantId = 'tenant-test-free';
|
||||
const limit = PLAN_LIMITS.free.timestamps;
|
||||
// force usage to limit
|
||||
for (let i = 0; i < limit; i += 1) {
|
||||
incrementUsage(tenantId, 'timestamps', 1);
|
||||
}
|
||||
assert.throws(
|
||||
() => checkEntitlement(tenantId, 'timestamp'),
|
||||
(err) => err instanceof AppError && err.status === 402 && err.code === 'QUOTA_EXCEEDED',
|
||||
);
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,164 @@
|
|||
/**
|
||||
* GATE 6 — Full HTTP middleware (NATS off, MOCK_VERAE on)
|
||||
*/
|
||||
|
||||
import { describe, it, before, after } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import http from 'node:http';
|
||||
import { createApp } from '../../src/app.js';
|
||||
import { useTempStore, seedProTenant } from '../helpers.js';
|
||||
import { config } from '../../src/config.js';
|
||||
import { startInProcessJobPoller, stopInProcessJobPoller } from '../../src/workers/inProcessJobPoller.js';
|
||||
import { getActiveWebhooks } from '../../src/store/webhooks.js';
|
||||
|
||||
describe('HTTP API (mock verae, nats off)', () => {
|
||||
/** @type {ReturnType<typeof useTempStore>} */
|
||||
let ctx;
|
||||
/** @type {import('http').Server} */
|
||||
let server;
|
||||
/** @type {number} */
|
||||
let port;
|
||||
/** @type {string} */
|
||||
let apiKey;
|
||||
/** @type {object[]} */
|
||||
let webhookDeliveries;
|
||||
/** @type {import('http').Server} */
|
||||
let hookServer;
|
||||
/** @type {number} */
|
||||
let hookPort;
|
||||
|
||||
before(async () => {
|
||||
assert.equal(config.mockVerae, true);
|
||||
assert.equal(config.natsEnabled, false);
|
||||
|
||||
// Fast poll for wait path
|
||||
config.jobPollIntervalMs = 20;
|
||||
config.jobPollMaxAttempts = 50;
|
||||
|
||||
ctx = useTempStore();
|
||||
const seeded = seedProTenant();
|
||||
apiKey = seeded.apiKey;
|
||||
|
||||
webhookDeliveries = [];
|
||||
await new Promise((resolve) => {
|
||||
hookServer = http.createServer((req, res) => {
|
||||
let body = '';
|
||||
req.on('data', (c) => {
|
||||
body += c;
|
||||
});
|
||||
req.on('end', () => {
|
||||
webhookDeliveries.push(JSON.parse(body || '{}'));
|
||||
res.writeHead(200);
|
||||
res.end('ok');
|
||||
});
|
||||
});
|
||||
hookServer.listen(0, '127.0.0.1', () => {
|
||||
hookPort = hookServer.address().port;
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
|
||||
const app = createApp({ load: false });
|
||||
await new Promise((resolve) => {
|
||||
server = app.listen(0, '127.0.0.1', () => {
|
||||
port = server.address().port;
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
|
||||
startInProcessJobPoller();
|
||||
});
|
||||
|
||||
after(async () => {
|
||||
stopInProcessJobPoller();
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
await new Promise((resolve) => hookServer.close(resolve));
|
||||
ctx.cleanup();
|
||||
});
|
||||
|
||||
function authHeaders() {
|
||||
return {
|
||||
Authorization: `Bearer ${apiKey}`,
|
||||
'Content-Type': 'application/json',
|
||||
};
|
||||
}
|
||||
|
||||
it('POST /zapier/v1/timestamp → 202 + jobId', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/timestamp`, {
|
||||
method: 'POST',
|
||||
headers: authHeaders(),
|
||||
body: JSON.stringify({ data: 'payload-async' }),
|
||||
});
|
||||
assert.equal(res.status, 202);
|
||||
const body = await res.json();
|
||||
assert.ok(body.jobId);
|
||||
});
|
||||
|
||||
it('POST /zapier/v1/timestamp/wait → completed status', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/timestamp/wait`, {
|
||||
method: 'POST',
|
||||
headers: authHeaders(),
|
||||
body: JSON.stringify({ data: 'payload-wait', hashAlg: 'SHA256' }),
|
||||
});
|
||||
assert.equal(res.status, 200);
|
||||
const body = await res.json();
|
||||
assert.equal(body.status, 'completed');
|
||||
assert.ok(body.result);
|
||||
assert.ok(body.metadata?.certificate || body.result);
|
||||
});
|
||||
|
||||
it('POST /zapier/v1/verify → valid true', async () => {
|
||||
const waitRes = await fetch(`http://127.0.0.1:${port}/zapier/v1/timestamp/wait`, {
|
||||
method: 'POST',
|
||||
headers: authHeaders(),
|
||||
body: JSON.stringify({ data: 'to-verify' }),
|
||||
});
|
||||
const done = await waitRes.json();
|
||||
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/verify`, {
|
||||
method: 'POST',
|
||||
headers: authHeaders(),
|
||||
body: JSON.stringify({ certificate: done.result }),
|
||||
});
|
||||
assert.equal(res.status, 200);
|
||||
const body = await res.json();
|
||||
assert.equal(body.valid, true);
|
||||
});
|
||||
|
||||
it('webhook subscribe stores targetUrl; complete delivers', async () => {
|
||||
const sub = await fetch(`http://127.0.0.1:${port}/zapier/v1/webhooks/subscribe`, {
|
||||
method: 'POST',
|
||||
headers: authHeaders(),
|
||||
body: JSON.stringify({
|
||||
targetUrl: `http://127.0.0.1:${hookPort}/hook`,
|
||||
event: 'timestamp.completed',
|
||||
}),
|
||||
});
|
||||
assert.equal(sub.status, 201);
|
||||
const hook = await sub.json();
|
||||
assert.ok(hook.id);
|
||||
|
||||
const hooks = getActiveWebhooks('tenant-test-pro', 'timestamp.completed');
|
||||
assert.ok(hooks.some((h) => h.id === hook.id));
|
||||
|
||||
webhookDeliveries.length = 0;
|
||||
|
||||
const create = await fetch(`http://127.0.0.1:${port}/zapier/v1/timestamp`, {
|
||||
method: 'POST',
|
||||
headers: authHeaders(),
|
||||
body: JSON.stringify({ data: 'webhook-trigger-me' }),
|
||||
});
|
||||
const { jobId } = await create.json();
|
||||
assert.ok(jobId);
|
||||
|
||||
// Wait for in-process poller to deliver
|
||||
const deadline = Date.now() + 5000;
|
||||
while (webhookDeliveries.length === 0 && Date.now() < deadline) {
|
||||
await new Promise((r) => setTimeout(r, 50));
|
||||
}
|
||||
|
||||
assert.ok(webhookDeliveries.length >= 1, 'expected webhook delivery');
|
||||
assert.equal(webhookDeliveries[0].event, 'timestamp.completed');
|
||||
assert.equal(webhookDeliveries[0].jobId, jobId);
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
/**
|
||||
* GATE 8 — Job poller worker + webhook via NATS events
|
||||
*/
|
||||
|
||||
import { describe, it, before, after } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import http from 'node:http';
|
||||
import { config } from '../../src/config.js';
|
||||
import { useTempStore, seedProTenant } from '../helpers.js';
|
||||
import { connectNats, ensureStreams, closeNats } from '../../src/nats/connection.js';
|
||||
import { enqueueWatch } from '../../src/nats/publishers.js';
|
||||
import { startJobPollerWorker, stopJobPollerWorker } from '../../src/workers/jobPollerWorker.js';
|
||||
import { startWebhookWorker, stopWebhookWorker } from '../../src/workers/webhookWorker.js';
|
||||
import { createWebhook } from '../../src/store/webhooks.js';
|
||||
import { veraeClient, clearMockJobs } from '../../src/clients/veraeClient.js';
|
||||
|
||||
describe('NATS workers', () => {
|
||||
/** @type {ReturnType<typeof useTempStore>} */
|
||||
let ctx;
|
||||
/** @type {object[]} */
|
||||
let deliveries;
|
||||
/** @type {import('http').Server} */
|
||||
let hookServer;
|
||||
/** @type {number} */
|
||||
let hookPort;
|
||||
/** @type {string} */
|
||||
let tenantId;
|
||||
|
||||
before(async () => {
|
||||
assert.equal(config.mockVerae, true);
|
||||
config.natsEnabled = true;
|
||||
process.env.NATS_FORCE_CONNECT = '1';
|
||||
config.natsUrl = process.env.NATS_URL || 'nats://127.0.0.1:4222';
|
||||
config.jobPollIntervalMs = 50;
|
||||
config.jobPollMaxAttempts = 40;
|
||||
|
||||
clearMockJobs();
|
||||
ctx = useTempStore();
|
||||
const { tenant } = seedProTenant();
|
||||
tenantId = tenant.id;
|
||||
|
||||
deliveries = [];
|
||||
await new Promise((resolve) => {
|
||||
hookServer = http.createServer((req, res) => {
|
||||
let body = '';
|
||||
req.on('data', (c) => {
|
||||
body += c;
|
||||
});
|
||||
req.on('end', () => {
|
||||
deliveries.push(JSON.parse(body || '{}'));
|
||||
res.writeHead(200);
|
||||
res.end('ok');
|
||||
});
|
||||
});
|
||||
hookServer.listen(0, '127.0.0.1', () => {
|
||||
hookPort = hookServer.address().port;
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
|
||||
createWebhook({
|
||||
tenantId,
|
||||
targetUrl: `http://127.0.0.1:${hookPort}/hook`,
|
||||
event: 'timestamp.completed',
|
||||
});
|
||||
|
||||
await connectNats(config.natsUrl);
|
||||
await ensureStreams();
|
||||
await startJobPollerWorker();
|
||||
await startWebhookWorker();
|
||||
});
|
||||
|
||||
after(async () => {
|
||||
await stopJobPollerWorker();
|
||||
await stopWebhookWorker();
|
||||
await closeNats();
|
||||
await new Promise((r) => hookServer.close(r));
|
||||
ctx.cleanup();
|
||||
process.env.NATS_FORCE_CONNECT = '';
|
||||
});
|
||||
|
||||
it('watch → poll → event → webhook delivery', async () => {
|
||||
const login = await veraeClient.login({
|
||||
username: 'prouser',
|
||||
password: 'propass',
|
||||
});
|
||||
const { jobId } = await veraeClient.createTimestamp(login.token, {
|
||||
data: 'nats-worker-test',
|
||||
});
|
||||
|
||||
await enqueueWatch({
|
||||
tenantId,
|
||||
jobId,
|
||||
veraeToken: login.token,
|
||||
maxAttempts: 40,
|
||||
intervalMs: 50,
|
||||
});
|
||||
|
||||
const deadline = Date.now() + 8000;
|
||||
while (deliveries.length === 0 && Date.now() < deadline) {
|
||||
await new Promise((r) => setTimeout(r, 50));
|
||||
}
|
||||
|
||||
assert.ok(deliveries.length >= 1, 'expected webhook from NATS path');
|
||||
assert.equal(deliveries[0].event, 'timestamp.completed');
|
||||
assert.equal(deliveries[0].jobId, jobId);
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,117 @@
|
|||
/**
|
||||
* GATE 7 — NATS streams + publish/consume
|
||||
* Requires nats-server with JetStream on NATS_URL (default 127.0.0.1:4222)
|
||||
*/
|
||||
|
||||
import { describe, it, before, after } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { config } from '../../src/config.js';
|
||||
import { SUBJECTS, STREAMS } from '../../src/nats/subjects.js';
|
||||
import {
|
||||
connectNats,
|
||||
ensureStreams,
|
||||
closeNats,
|
||||
isNatsConnected,
|
||||
} from '../../src/nats/connection.js';
|
||||
import { enqueueWatch, publishJobEvent } from '../../src/nats/publishers.js';
|
||||
|
||||
describe('NATS infrastructure', () => {
|
||||
before(async () => {
|
||||
// Force connect even if NATS_ENABLED was false at boot — re-set for this process
|
||||
config.natsEnabled = true;
|
||||
process.env.NATS_FORCE_CONNECT = '1';
|
||||
config.natsUrl = process.env.NATS_URL || 'nats://127.0.0.1:4222';
|
||||
|
||||
try {
|
||||
await connectNats(config.natsUrl);
|
||||
await ensureStreams();
|
||||
} catch (err) {
|
||||
assert.fail(
|
||||
`NATS not available at ${config.natsUrl}: ${err.message}. Start: nats-server -js -p 4222`,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
after(async () => {
|
||||
await closeNats();
|
||||
process.env.NATS_FORCE_CONNECT = '';
|
||||
});
|
||||
|
||||
it('connects and reports connected', () => {
|
||||
assert.equal(isNatsConnected(), true);
|
||||
});
|
||||
|
||||
it('ensures streams exist (idempotent)', async () => {
|
||||
await ensureStreams();
|
||||
const { jsm } = await connectNats();
|
||||
for (const name of [STREAMS.ZAPIER_JOBS, STREAMS.ZAPIER_EVENTS, STREAMS.ZAPIER_WEBHOOKS]) {
|
||||
const info = await jsm.streams.info(name);
|
||||
assert.equal(info.config.name, name);
|
||||
}
|
||||
});
|
||||
|
||||
it('publish + pull consume one watch message', async () => {
|
||||
const { js, jsm } = await connectNats();
|
||||
|
||||
// Avoid consuming leftover messages from prior runs
|
||||
await jsm.streams.purge(STREAMS.ZAPIER_JOBS);
|
||||
|
||||
const durable = `test-pull-${Date.now()}`;
|
||||
await jsm.consumers.add(STREAMS.ZAPIER_JOBS, {
|
||||
durable_name: durable,
|
||||
ack_policy: 'explicit',
|
||||
filter_subject: SUBJECTS.JOBS_WATCH,
|
||||
deliver_policy: 'all',
|
||||
});
|
||||
|
||||
const jobId = `job-${Date.now()}`;
|
||||
const pub = await enqueueWatch({
|
||||
tenantId: 'tenant-nats-test',
|
||||
jobId,
|
||||
maxAttempts: 5,
|
||||
intervalMs: 100,
|
||||
});
|
||||
assert.ok(pub.seq >= 0);
|
||||
|
||||
const consumer = await js.consumers.get(STREAMS.ZAPIER_JOBS, durable);
|
||||
const messages = await consumer.fetch({ max_messages: 5, expires: 5000 });
|
||||
let got = null;
|
||||
for await (const msg of messages) {
|
||||
const data = JSON.parse(msg.string());
|
||||
msg.ack();
|
||||
if (data.jobId === jobId) {
|
||||
got = data;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
assert.ok(got, 'expected a message for our jobId');
|
||||
assert.equal(got.jobId, jobId);
|
||||
assert.equal(got.tenantId, 'tenant-nats-test');
|
||||
});
|
||||
|
||||
it('publishJobEvent works', async () => {
|
||||
const result = await publishJobEvent({
|
||||
event: 'timestamp.completed',
|
||||
tenantId: 't1',
|
||||
jobId: 'j1',
|
||||
status: { id: 'j1', status: 'completed' },
|
||||
});
|
||||
assert.ok(result.seq >= 0);
|
||||
});
|
||||
});
|
||||
|
||||
describe('NATS disabled path', () => {
|
||||
it('connectNats throws when disabled and not forced', async () => {
|
||||
const prev = config.natsEnabled;
|
||||
const force = process.env.NATS_FORCE_CONNECT;
|
||||
config.natsEnabled = false;
|
||||
process.env.NATS_FORCE_CONNECT = '';
|
||||
// close existing so we hit the disabled check on a fresh call path
|
||||
// Note: if already connected, connectNats returns cached — test isolation via disabled only when no cache
|
||||
// This tests the disabled branch of a new process conceptually; here we only assert flag behavior:
|
||||
assert.equal(config.natsEnabled, false);
|
||||
config.natsEnabled = prev;
|
||||
process.env.NATS_FORCE_CONNECT = force;
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,93 @@
|
|||
/**
|
||||
* GATE 10 — Signup and admin provision
|
||||
*/
|
||||
|
||||
import { describe, it, before, after } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { createApp } from '../../src/app.js';
|
||||
import { useTempStore } from '../helpers.js';
|
||||
import { config } from '../../src/config.js';
|
||||
|
||||
describe('tenancy', () => {
|
||||
let ctx;
|
||||
let server;
|
||||
let port;
|
||||
|
||||
before(async () => {
|
||||
ctx = useTempStore();
|
||||
const app = createApp({ load: false });
|
||||
await new Promise((resolve) => {
|
||||
server = app.listen(0, '127.0.0.1', () => {
|
||||
port = server.address().port;
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
after(async () => {
|
||||
await new Promise((r) => server.close(r));
|
||||
ctx.cleanup();
|
||||
});
|
||||
|
||||
it('POST /zapier/v1/signup returns free plan + apiKey', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/signup`, {
|
||||
method: 'POST',
|
||||
headers: { 'content-type': 'application/json' },
|
||||
body: JSON.stringify({
|
||||
email: 'user@example.com',
|
||||
name: 'Self Serve Co',
|
||||
veraeUsername: 'selfuser',
|
||||
veraePassword: 'selfpass',
|
||||
}),
|
||||
});
|
||||
assert.equal(res.status, 201);
|
||||
const body = await res.json();
|
||||
assert.equal(body.tenant.plan, 'free');
|
||||
assert.ok(body.apiKey.startsWith('zmw_'));
|
||||
});
|
||||
|
||||
it('enterprise without contract rejected', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/admin/tenants`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/json',
|
||||
'x-admin-secret': config.adminSecret,
|
||||
},
|
||||
body: JSON.stringify({
|
||||
name: 'Ent Co',
|
||||
plan: 'enterprise',
|
||||
veraeUsername: 'e',
|
||||
veraePassword: 'p',
|
||||
}),
|
||||
});
|
||||
assert.equal(res.status, 400);
|
||||
const body = await res.json();
|
||||
assert.equal(body.code, 'VALIDATION_ERROR');
|
||||
});
|
||||
|
||||
it('admin list does not leak passwords', async () => {
|
||||
const create = await fetch(`http://127.0.0.1:${port}/zapier/v1/admin/tenants`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'content-type': 'application/json',
|
||||
'x-admin-secret': config.adminSecret,
|
||||
},
|
||||
body: JSON.stringify({
|
||||
name: 'Pro Co',
|
||||
plan: 'pro',
|
||||
veraeUsername: 'puser',
|
||||
veraePassword: 'ppass',
|
||||
}),
|
||||
});
|
||||
assert.equal(create.status, 201);
|
||||
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/admin/tenants`, {
|
||||
headers: { 'x-admin-secret': config.adminSecret },
|
||||
});
|
||||
assert.equal(res.status, 200);
|
||||
const body = await res.json();
|
||||
const json = JSON.stringify(body);
|
||||
assert.doesNotMatch(json, /ppass/);
|
||||
assert.doesNotMatch(json, /veraePassword/);
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
/**
|
||||
* GATE 2 (partial) — HTTP shell health endpoint.
|
||||
*/
|
||||
|
||||
import { describe, it, before, after } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { createApp } from '../../src/app.js';
|
||||
|
||||
describe('createApp', () => {
|
||||
/** @type {import('http').Server} */
|
||||
let server;
|
||||
/** @type {number} */
|
||||
let port;
|
||||
|
||||
before(async () => {
|
||||
const app = createApp();
|
||||
await new Promise((resolve) => {
|
||||
server = app.listen(0, '127.0.0.1', resolve);
|
||||
});
|
||||
port = server.address().port;
|
||||
});
|
||||
|
||||
after(async () => {
|
||||
await new Promise((resolve) => server.close(resolve));
|
||||
});
|
||||
|
||||
it('GET /health returns ok', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/health`);
|
||||
assert.equal(res.status, 200);
|
||||
const body = await res.json();
|
||||
assert.equal(body.status, 'ok');
|
||||
assert.equal(body.service, 'verae-zapier-middleware');
|
||||
assert.ok(res.headers.get('x-trace-id'));
|
||||
});
|
||||
|
||||
it('protected /zapier path requires auth', async () => {
|
||||
const res = await fetch(`http://127.0.0.1:${port}/zapier/v1/timestamp`, {
|
||||
method: 'POST',
|
||||
headers: { 'content-type': 'application/json' },
|
||||
body: '{}',
|
||||
});
|
||||
assert.equal(res.status, 401);
|
||||
const body = await res.json();
|
||||
assert.equal(body.code, 'UNAUTHORIZED');
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
/**
|
||||
* GATE 2 (partial) — config exports.
|
||||
*/
|
||||
|
||||
import { describe, it } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { config, PLAN_LIMITS } from '../../src/config.js';
|
||||
|
||||
describe('config', () => {
|
||||
it('exposes required keys for HTTP and NATS', () => {
|
||||
for (const key of [
|
||||
'port',
|
||||
'host',
|
||||
'veraeApiBaseUrl',
|
||||
'mockVerae',
|
||||
'natsEnabled',
|
||||
'natsUrl',
|
||||
'tokenSecret',
|
||||
'jobPollIntervalMs',
|
||||
'jobPollMaxAttempts',
|
||||
'storePath',
|
||||
]) {
|
||||
assert.notEqual(config[key], undefined, `missing config.${key}`);
|
||||
}
|
||||
});
|
||||
|
||||
it('defines plan limits for free through enterprise', () => {
|
||||
for (const plan of ['free', 'starter', 'pro', 'enterprise']) {
|
||||
assert.ok(PLAN_LIMITS[plan], plan);
|
||||
assert.equal(typeof PLAN_LIMITS[plan].requestsPerMinute, 'number');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,165 @@
|
|||
/**
|
||||
* GATE 1 — Debug facility unit tests.
|
||||
* Must pass before Phase 2.
|
||||
*/
|
||||
|
||||
import { describe, it, beforeEach, afterEach } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
|
||||
import {
|
||||
parseDebugVeraeEnv,
|
||||
loadDebugConfig,
|
||||
shouldLog,
|
||||
createDebugger,
|
||||
setDebugTestSink,
|
||||
redact,
|
||||
withTrace,
|
||||
getTraceId,
|
||||
generateTraceId,
|
||||
} from '../../src/debug/index.js';
|
||||
|
||||
describe('parseDebugVeraeEnv', () => {
|
||||
it('disables when unset or empty', () => {
|
||||
assert.equal(parseDebugVeraeEnv(undefined).enabled, false);
|
||||
assert.equal(parseDebugVeraeEnv('').enabled, false);
|
||||
assert.equal(parseDebugVeraeEnv('off').enabled, false);
|
||||
});
|
||||
|
||||
it('enables all namespaces for 1 or *', () => {
|
||||
const a = parseDebugVeraeEnv('1');
|
||||
assert.equal(a.enabled, true);
|
||||
assert.equal(a.namespaces, null);
|
||||
|
||||
const b = parseDebugVeraeEnv('*');
|
||||
assert.equal(b.enabled, true);
|
||||
assert.equal(b.namespaces, null);
|
||||
});
|
||||
|
||||
it('parses comma-separated namespaces', () => {
|
||||
const { enabled, namespaces } = parseDebugVeraeEnv('auth, NATS, jobs');
|
||||
assert.equal(enabled, true);
|
||||
assert.ok(namespaces.has('auth'));
|
||||
assert.ok(namespaces.has('nats'));
|
||||
assert.ok(namespaces.has('jobs'));
|
||||
assert.equal(namespaces.has('webhooks'), false);
|
||||
});
|
||||
});
|
||||
|
||||
describe('shouldLog', () => {
|
||||
it('respects level thresholds', () => {
|
||||
const config = {
|
||||
enabled: true,
|
||||
namespaces: null,
|
||||
level: 'warn',
|
||||
filePath: null,
|
||||
};
|
||||
assert.equal(shouldLog(config, 'app', 'debug'), false);
|
||||
assert.equal(shouldLog(config, 'app', 'warn'), true);
|
||||
assert.equal(shouldLog(config, 'app', 'error'), true);
|
||||
});
|
||||
|
||||
it('filters by namespace', () => {
|
||||
const config = {
|
||||
enabled: true,
|
||||
namespaces: new Set(['auth']),
|
||||
level: 'debug',
|
||||
filePath: null,
|
||||
};
|
||||
assert.equal(shouldLog(config, 'auth', 'debug'), true);
|
||||
assert.equal(shouldLog(config, 'nats', 'debug'), false);
|
||||
});
|
||||
});
|
||||
|
||||
describe('redact', () => {
|
||||
it('redacts sensitive keys and token-like strings', () => {
|
||||
const out = redact({
|
||||
password: 'secret',
|
||||
apiKey: 'zmw_abc123def456ghi789jkl',
|
||||
jobId: 'keep-me',
|
||||
authorization: 'Bearer eyJhbGciOiJIUzI1NiJ9.aaa.bbb',
|
||||
nested: { veraeToken: 'zmt_payload.sig' },
|
||||
});
|
||||
|
||||
assert.equal(out.password, '[REDACTED]');
|
||||
assert.equal(out.apiKey, '[REDACTED]');
|
||||
assert.equal(out.jobId, 'keep-me');
|
||||
assert.equal(out.authorization, '[REDACTED]');
|
||||
assert.equal(out.nested.veraeToken, '[REDACTED]');
|
||||
});
|
||||
});
|
||||
|
||||
describe('createDebugger', () => {
|
||||
/** @type {string[]} */
|
||||
let lines;
|
||||
const prev = { ...process.env };
|
||||
|
||||
beforeEach(() => {
|
||||
lines = [];
|
||||
setDebugTestSink((line) => lines.push(line));
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
setDebugTestSink(null);
|
||||
for (const key of Object.keys(process.env)) {
|
||||
if (!(key in prev)) delete process.env[key];
|
||||
}
|
||||
Object.assign(process.env, prev);
|
||||
});
|
||||
|
||||
it('is silent when DEBUG_VERAE is unset', () => {
|
||||
delete process.env.DEBUG_VERAE;
|
||||
const log = createDebugger('auth');
|
||||
log.debug('should not appear', { x: 1 });
|
||||
assert.equal(lines.length, 0);
|
||||
});
|
||||
|
||||
it('emits only selected namespaces', () => {
|
||||
process.env.DEBUG_VERAE = 'auth';
|
||||
createDebugger('auth').debug('auth-line');
|
||||
createDebugger('nats').debug('nats-line');
|
||||
assert.equal(lines.length, 1);
|
||||
assert.match(lines[0], /auth-line/);
|
||||
assert.doesNotMatch(lines[0], /nats-line/);
|
||||
});
|
||||
|
||||
it('redacts secrets in meta', () => {
|
||||
process.env.DEBUG_VERAE = 'auth';
|
||||
createDebugger('auth').debug('login', {
|
||||
password: 'hunter2',
|
||||
token: 'zmw_supersecretvaluehere12',
|
||||
});
|
||||
assert.equal(lines.length, 1);
|
||||
assert.doesNotMatch(lines[0], /hunter2/);
|
||||
assert.doesNotMatch(lines[0], /zmw_supersecret/);
|
||||
assert.match(lines[0], /REDACTED/);
|
||||
});
|
||||
});
|
||||
|
||||
describe('withTrace', () => {
|
||||
it('propagates traceId to nested async work', async () => {
|
||||
const outerId = generateTraceId();
|
||||
let innerId = null;
|
||||
|
||||
await withTrace({ traceId: outerId, span: 'outer' }, async () => {
|
||||
assert.equal(getTraceId(), outerId);
|
||||
await withTrace({ span: 'inner' }, async () => {
|
||||
innerId = getTraceId();
|
||||
});
|
||||
});
|
||||
|
||||
assert.equal(innerId, outerId);
|
||||
assert.equal(getTraceId(), null);
|
||||
});
|
||||
});
|
||||
|
||||
describe('loadDebugConfig', () => {
|
||||
it('reads level and file from env', () => {
|
||||
process.env.DEBUG_VERAE = '1';
|
||||
process.env.DEBUG_VERAE_LEVEL = 'error';
|
||||
process.env.DEBUG_VERAE_FILE = '/tmp/verae-debug.log';
|
||||
const cfg = loadDebugConfig(process.env);
|
||||
assert.equal(cfg.enabled, true);
|
||||
assert.equal(cfg.level, 'error');
|
||||
assert.equal(cfg.filePath, '/tmp/verae-debug.log');
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,105 @@
|
|||
/**
|
||||
* GATE 3 — Store unit tests
|
||||
*/
|
||||
|
||||
import { describe, it, beforeEach, afterEach } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import {
|
||||
useTempStore,
|
||||
seedFreeTenant,
|
||||
seedEnterpriseTenant,
|
||||
} from '../helpers.js';
|
||||
import { getTenantByApiKey, resolveLimits, getTenant } from '../../src/store/tenants.js';
|
||||
import {
|
||||
createWebhook,
|
||||
getActiveWebhooks,
|
||||
listWebhooksForTenant,
|
||||
deleteWebhook,
|
||||
} from '../../src/store/webhooks.js';
|
||||
import { getUsage, incrementUsage } from '../../src/store/usage.js';
|
||||
import { reloadStore, getStore } from '../../src/store/db.js';
|
||||
|
||||
describe('stores', () => {
|
||||
/** @type {ReturnType<typeof useTempStore>} */
|
||||
let ctx;
|
||||
|
||||
beforeEach(() => {
|
||||
ctx = useTempStore();
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
ctx.cleanup();
|
||||
});
|
||||
|
||||
it('create tenant → API key resolves to same tenant', () => {
|
||||
const { tenant, apiKey } = seedFreeTenant();
|
||||
const found = getTenantByApiKey(apiKey);
|
||||
assert.ok(found);
|
||||
assert.equal(found.id, tenant.id);
|
||||
assert.equal(found.plan, 'free');
|
||||
});
|
||||
|
||||
it('free plan limits applied; enterprise contract overrides', () => {
|
||||
const { tenant: free } = seedFreeTenant();
|
||||
const freeLimits = resolveLimits(free);
|
||||
assert.equal(freeLimits.timestamps, 50);
|
||||
assert.equal(freeLimits.batch, false);
|
||||
|
||||
const { tenant: ent } = seedEnterpriseTenant();
|
||||
const entLimits = resolveLimits(ent);
|
||||
assert.equal(entLimits.timestamps, 10);
|
||||
assert.equal(entLimits.batch, true);
|
||||
assert.equal(entLimits.batchMaxItems, 5);
|
||||
});
|
||||
|
||||
it('webhook isolation per tenant', () => {
|
||||
seedFreeTenant({ id: 'a' });
|
||||
seedFreeTenant({ id: 'b', veraeUsername: 'u2' });
|
||||
|
||||
createWebhook({
|
||||
tenantId: 'a',
|
||||
targetUrl: 'https://hooks.example/a',
|
||||
event: 'timestamp.completed',
|
||||
});
|
||||
createWebhook({
|
||||
tenantId: 'b',
|
||||
targetUrl: 'https://hooks.example/b',
|
||||
event: 'timestamp.completed',
|
||||
});
|
||||
|
||||
const aHooks = listWebhooksForTenant('a');
|
||||
const bHooks = getActiveWebhooks('b', 'timestamp.completed');
|
||||
assert.equal(aHooks.length, 1);
|
||||
assert.equal(aHooks[0].targetUrl, 'https://hooks.example/a');
|
||||
assert.equal(bHooks.length, 1);
|
||||
assert.equal(bHooks[0].tenantId, 'b');
|
||||
});
|
||||
|
||||
it('persist + reload round-trip preserves data', () => {
|
||||
const { tenant, apiKey } = seedFreeTenant({ id: 'persist-me' });
|
||||
incrementUsage(tenant.id, 'timestamps', 3);
|
||||
createWebhook({
|
||||
tenantId: tenant.id,
|
||||
targetUrl: 'https://hooks.example/x',
|
||||
event: 'timestamp.completed',
|
||||
});
|
||||
|
||||
reloadStore(ctx.storePath);
|
||||
|
||||
assert.equal(getTenant('persist-me')?.name, tenant.name);
|
||||
assert.equal(getTenantByApiKey(apiKey)?.id, 'persist-me');
|
||||
assert.equal(getUsage('persist-me').timestamps, 3);
|
||||
assert.equal(getStore().webhooks.length, 1);
|
||||
});
|
||||
|
||||
it('deleteWebhook removes by id', () => {
|
||||
seedFreeTenant({ id: 'w' });
|
||||
const hook = createWebhook({
|
||||
tenantId: 'w',
|
||||
targetUrl: 'https://hooks.example/w',
|
||||
event: 'timestamp.completed',
|
||||
});
|
||||
assert.equal(deleteWebhook({ tenantId: 'w', hookId: hook.id }), true);
|
||||
assert.equal(listWebhooksForTenant('w').length, 0);
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
/**
|
||||
* GATE 4 — Token tests
|
||||
*/
|
||||
|
||||
import { describe, it } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import {
|
||||
issueSessionToken,
|
||||
parseSessionToken,
|
||||
generateApiKey,
|
||||
isApiKey,
|
||||
extractBearerToken,
|
||||
} from '../../src/lib/tokens.js';
|
||||
import { config } from '../../src/config.js';
|
||||
|
||||
describe('tokens', () => {
|
||||
it('issues and parses session tokens', () => {
|
||||
const token = issueSessionToken({
|
||||
tenantId: 't1',
|
||||
veraeToken: 'mock-jwt-user',
|
||||
expiresAt: '2099-01-01T00:00:00Z',
|
||||
});
|
||||
assert.ok(token.startsWith('zmt_'));
|
||||
const parsed = parseSessionToken(token);
|
||||
assert.equal(parsed.tenantId, 't1');
|
||||
assert.equal(parsed.veraeToken, 'mock-jwt-user');
|
||||
});
|
||||
|
||||
it('rejects forged session tokens', () => {
|
||||
const token = issueSessionToken({
|
||||
tenantId: 't1',
|
||||
veraeToken: 'secret',
|
||||
});
|
||||
const forged = token.slice(0, -4) + 'xxxx';
|
||||
assert.equal(parseSessionToken(forged), null);
|
||||
});
|
||||
|
||||
it('rejects tokens signed with wrong secret', () => {
|
||||
const token = issueSessionToken({
|
||||
tenantId: 't1',
|
||||
veraeToken: 'secret',
|
||||
});
|
||||
const original = config.tokenSecret;
|
||||
config.tokenSecret = 'other-secret';
|
||||
assert.equal(parseSessionToken(token), null);
|
||||
config.tokenSecret = original;
|
||||
});
|
||||
|
||||
it('generates api keys and extracts bearer', () => {
|
||||
const key = generateApiKey();
|
||||
assert.ok(isApiKey(key));
|
||||
assert.equal(extractBearerToken(`Bearer ${key}`), key);
|
||||
assert.equal(extractBearerToken(undefined), null);
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
/**
|
||||
* GATE 4 — Mock Verae client lifecycle
|
||||
*/
|
||||
|
||||
import { describe, it, beforeEach } from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { veraeClient, clearMockJobs } from '../../src/clients/veraeClient.js';
|
||||
import { config } from '../../src/config.js';
|
||||
import { setDebugTestSink, createDebugger } from '../../src/debug/index.js';
|
||||
|
||||
describe('veraeClient mock', () => {
|
||||
beforeEach(() => {
|
||||
clearMockJobs();
|
||||
// ensure mock mode (set at process start via env in gate script)
|
||||
assert.equal(config.mockVerae, true, 'MOCK_VERAE must be true for unit tests');
|
||||
});
|
||||
|
||||
it('create → wait → completed', async () => {
|
||||
const login = await veraeClient.login({ username: 'u', password: 'p' });
|
||||
assert.ok(login.token.startsWith('mock-jwt-'));
|
||||
|
||||
const { jobId } = await veraeClient.createTimestamp(login.token, {
|
||||
data: 'hello',
|
||||
hashAlg: 'SHA256',
|
||||
});
|
||||
assert.ok(jobId);
|
||||
|
||||
const status = await veraeClient.waitForJob(login.token, jobId, {
|
||||
maxAttempts: 40,
|
||||
intervalMs: 20,
|
||||
});
|
||||
assert.equal(status.status, 'completed');
|
||||
assert.ok(status.result.startsWith('mock-cert-'));
|
||||
});
|
||||
|
||||
it('verify accepts mock certificates', async () => {
|
||||
const login = await veraeClient.login({ username: 'u', password: 'p' });
|
||||
const { jobId } = await veraeClient.createTimestamp(login.token, { data: 'x' });
|
||||
const status = await veraeClient.waitForJob(login.token, jobId, {
|
||||
maxAttempts: 40,
|
||||
intervalMs: 20,
|
||||
});
|
||||
const result = await veraeClient.verify(login.token, { certificate: status.result });
|
||||
assert.equal(result.valid, true);
|
||||
});
|
||||
|
||||
it('debug http logs do not include Authorization values', () => {
|
||||
const lines = [];
|
||||
setDebugTestSink((line) => lines.push(line));
|
||||
process.env.DEBUG_VERAE = 'http';
|
||||
const log = createDebugger('http');
|
||||
log.debug('verae request', {
|
||||
method: 'POST',
|
||||
path: '/api/timestamp',
|
||||
authorization: 'Bearer super-secret-token-value',
|
||||
hasToken: true,
|
||||
});
|
||||
setDebugTestSink(null);
|
||||
delete process.env.DEBUG_VERAE;
|
||||
assert.equal(lines.length, 1);
|
||||
assert.doesNotMatch(lines[0], /super-secret-token-value/);
|
||||
assert.match(lines[0], /REDACTED|hasToken/);
|
||||
});
|
||||
});
|
||||
34
research/zapier/verae-zapier-api/verae-zapier/README.md
Normal file
34
research/zapier/verae-zapier-api/verae-zapier/README.md
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# verae-zapier
|
||||
|
||||
Zapier Platform CLI app for Verae. **Phase 11** in [../TODO.md](../TODO.md).
|
||||
|
||||
## Role
|
||||
|
||||
Runs on **Zapier’s servers**. Calls only the middleware HTTPS API (`MIDDLEWARE_BASE_URL`), never NATS and never `api.veraetime.net` directly.
|
||||
|
||||
## Planned modules
|
||||
|
||||
| File | Purpose |
|
||||
|------|---------|
|
||||
| `authentication.js` | Custom API key auth → `GET /zapier/v1/auth/me` |
|
||||
| `index.js` | App definition, beforeRequest, afterResponse error mapping |
|
||||
| `creates/timestamp_and_wait.js` | Primary action |
|
||||
| `creates/create_timestamp.js` | Async jobId action |
|
||||
| `creates/verify_timestamp.js` | Verify certificate |
|
||||
| `creates/batch_timestamp.js` | Batch create |
|
||||
| `searches/job_status.js` | Lookup by jobId |
|
||||
| `triggers/timestamp_completed.js` | REST Hook |
|
||||
|
||||
See [../docs/developer/modules/function-reference.md](../docs/developer/modules/function-reference.md) for I/O contracts.
|
||||
|
||||
## Env
|
||||
|
||||
```bash
|
||||
export MIDDLEWARE_BASE_URL=https://your-middleware.example.com
|
||||
```
|
||||
|
||||
## Gate
|
||||
|
||||
```bash
|
||||
npm run gate:11 # from monorepo root, after Phase 11 implementation
|
||||
```
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
/**
|
||||
* Custom API key auth against Verae middleware.
|
||||
* @module authentication
|
||||
*/
|
||||
|
||||
const middlewareBase = () =>
|
||||
process.env.MIDDLEWARE_BASE_URL || 'http://127.0.0.1:3100';
|
||||
|
||||
/**
|
||||
* Zapier connection test — validates API key.
|
||||
* @param {object} z
|
||||
* @param {object} bundle
|
||||
*/
|
||||
const testAuth = async (z, bundle) => {
|
||||
const response = await z.request({
|
||||
url: `${middlewareBase()}/zapier/v1/auth/me`,
|
||||
headers: {
|
||||
Authorization: `Bearer ${bundle.authData.api_key}`,
|
||||
},
|
||||
});
|
||||
return response.data;
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
type: 'custom',
|
||||
fields: [
|
||||
{
|
||||
key: 'api_key',
|
||||
type: 'string',
|
||||
required: true,
|
||||
label: 'API Key',
|
||||
helpText:
|
||||
'Your Verae API key (zmw_…) from signup or admin provisioning.',
|
||||
},
|
||||
],
|
||||
test: testAuth,
|
||||
connectionLabel: '{{tenantId}} ({{plan}})',
|
||||
};
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
const base = () => process.env.MIDDLEWARE_BASE_URL || 'http://127.0.0.1:3100';
|
||||
|
||||
const perform = async (z, bundle) => {
|
||||
const items = (bundle.inputData.items || '')
|
||||
.split('\n')
|
||||
.map((s) => s.trim())
|
||||
.filter(Boolean)
|
||||
.map((data) => ({ data }));
|
||||
|
||||
const response = await z.request({
|
||||
method: 'POST',
|
||||
url: `${base()}/zapier/v1/timestamp/batch`,
|
||||
body: { items },
|
||||
});
|
||||
return response.data;
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
key: 'batch_timestamp',
|
||||
noun: 'Timestamp',
|
||||
display: {
|
||||
label: 'Create Batch Timestamps',
|
||||
description: 'Submit multiple data lines for timestamping (paid plans).',
|
||||
},
|
||||
operation: {
|
||||
inputFields: [
|
||||
{
|
||||
key: 'items',
|
||||
label: 'Data Lines',
|
||||
type: 'text',
|
||||
required: true,
|
||||
helpText: 'One payload per line.',
|
||||
},
|
||||
],
|
||||
perform,
|
||||
sample: { jobIds: ['id-1', 'id-2'] },
|
||||
outputFields: [{ key: 'jobIds', label: 'Job IDs' }],
|
||||
},
|
||||
};
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
const base = () => process.env.MIDDLEWARE_BASE_URL || 'http://127.0.0.1:3100';
|
||||
|
||||
const perform = async (z, bundle) => {
|
||||
const response = await z.request({
|
||||
method: 'POST',
|
||||
url: `${base()}/zapier/v1/timestamp`,
|
||||
body: {
|
||||
data: bundle.inputData.data,
|
||||
hashAlg: bundle.inputData.hashAlg || undefined,
|
||||
},
|
||||
});
|
||||
return response.data;
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
key: 'create_timestamp',
|
||||
noun: 'Timestamp',
|
||||
display: {
|
||||
label: 'Create Timestamp (Async)',
|
||||
description: 'Submits data for timestamping and returns a job ID.',
|
||||
},
|
||||
operation: {
|
||||
inputFields: [
|
||||
{ key: 'data', label: 'Data', type: 'string', required: true },
|
||||
{
|
||||
key: 'hashAlg',
|
||||
label: 'Hash Algorithm',
|
||||
type: 'string',
|
||||
required: false,
|
||||
default: 'SHA256',
|
||||
},
|
||||
],
|
||||
perform,
|
||||
sample: { jobId: '550e8400-e29b-41d4-a716-446655440000' },
|
||||
outputFields: [{ key: 'jobId', label: 'Job ID' }],
|
||||
},
|
||||
};
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
const base = () => process.env.MIDDLEWARE_BASE_URL || 'http://127.0.0.1:3100';
|
||||
|
||||
const perform = async (z, bundle) => {
|
||||
const response = await z.request({
|
||||
method: 'POST',
|
||||
url: `${base()}/zapier/v1/timestamp/wait`,
|
||||
body: {
|
||||
data: bundle.inputData.data,
|
||||
hashAlg: bundle.inputData.hashAlg || undefined,
|
||||
},
|
||||
});
|
||||
return response.data;
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
key: 'timestamp_and_wait',
|
||||
noun: 'Timestamp',
|
||||
display: {
|
||||
label: 'Create Timestamp and Wait',
|
||||
description:
|
||||
'Submits data for blockchain timestamping and waits for the certificate.',
|
||||
},
|
||||
operation: {
|
||||
inputFields: [
|
||||
{
|
||||
key: 'data',
|
||||
label: 'Data',
|
||||
type: 'string',
|
||||
required: true,
|
||||
helpText: 'Content to timestamp on the blockchain.',
|
||||
},
|
||||
{
|
||||
key: 'hashAlg',
|
||||
label: 'Hash Algorithm',
|
||||
type: 'string',
|
||||
required: false,
|
||||
default: 'SHA256',
|
||||
},
|
||||
],
|
||||
perform,
|
||||
sample: {
|
||||
id: '550e8400-e29b-41d4-a716-446655440000',
|
||||
status: 'completed',
|
||||
result: 'mock-cert-example',
|
||||
completedAt: '2023-01-01T12:05:00Z',
|
||||
},
|
||||
outputFields: [
|
||||
{ key: 'id', label: 'Job ID' },
|
||||
{ key: 'status', label: 'Status' },
|
||||
{ key: 'result', label: 'Certificate' },
|
||||
{ key: 'completedAt', label: 'Completed At', type: 'datetime' },
|
||||
],
|
||||
},
|
||||
};
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
const base = () => process.env.MIDDLEWARE_BASE_URL || 'http://127.0.0.1:3100';
|
||||
|
||||
const perform = async (z, bundle) => {
|
||||
const response = await z.request({
|
||||
method: 'POST',
|
||||
url: `${base()}/zapier/v1/verify`,
|
||||
body: { certificate: bundle.inputData.certificate },
|
||||
});
|
||||
return response.data;
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
key: 'verify_timestamp',
|
||||
noun: 'Verification',
|
||||
display: {
|
||||
label: 'Verify Timestamp',
|
||||
description: 'Verify a timestamp certificate.',
|
||||
},
|
||||
operation: {
|
||||
inputFields: [
|
||||
{
|
||||
key: 'certificate',
|
||||
label: 'Certificate',
|
||||
type: 'text',
|
||||
required: true,
|
||||
},
|
||||
],
|
||||
perform,
|
||||
sample: { valid: true, timestamp: '2023-01-01T12:00:00Z', blockIndex: 42 },
|
||||
outputFields: [
|
||||
{ key: 'valid', label: 'Valid', type: 'boolean' },
|
||||
{ key: 'timestamp', label: 'Timestamp', type: 'datetime' },
|
||||
{ key: 'blockIndex', label: 'Block Index', type: 'integer' },
|
||||
],
|
||||
},
|
||||
};
|
||||
76
research/zapier/verae-zapier-api/verae-zapier/index.js
Normal file
76
research/zapier/verae-zapier-api/verae-zapier/index.js
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
/**
|
||||
* Verae Zapier Platform app definition.
|
||||
* @module index
|
||||
*/
|
||||
|
||||
const authentication = require('./authentication');
|
||||
const timestampAndWait = require('./creates/timestamp_and_wait');
|
||||
const createTimestamp = require('./creates/create_timestamp');
|
||||
const verifyTimestamp = require('./creates/verify_timestamp');
|
||||
const batchTimestamp = require('./creates/batch_timestamp');
|
||||
const jobStatus = require('./searches/job_status');
|
||||
const timestampCompleted = require('./triggers/timestamp_completed');
|
||||
|
||||
/**
|
||||
* Attach middleware API key to every outbound request.
|
||||
* @param {object} request
|
||||
* @param {object} _z
|
||||
* @param {object} bundle
|
||||
*/
|
||||
const addApiKey = (request, _z, bundle) => {
|
||||
request.headers = request.headers || {};
|
||||
request.headers.Authorization = `Bearer ${bundle.authData.api_key}`;
|
||||
return request;
|
||||
};
|
||||
|
||||
/**
|
||||
* Map middleware billing errors to Zapier errors.
|
||||
* @param {object} response
|
||||
* @param {object} z
|
||||
*/
|
||||
const mapMiddlewareErrors = (response, z) => {
|
||||
if (response.status === 402) {
|
||||
throw new z.errors.Error(
|
||||
`${response.data?.error ?? 'Quota exceeded'}. Upgrade at ${response.data?.details?.upgradeUrl ?? response.data?.upgradeUrl ?? 'your billing portal'}.`,
|
||||
'QuotaExceeded',
|
||||
402,
|
||||
);
|
||||
}
|
||||
|
||||
if (response.status === 403 && response.data?.code === 'PLAN_UPGRADE_REQUIRED') {
|
||||
throw new z.errors.Error(
|
||||
response.data?.error ?? 'This action requires a paid plan.',
|
||||
'PlanUpgradeRequired',
|
||||
403,
|
||||
);
|
||||
}
|
||||
|
||||
return response;
|
||||
};
|
||||
|
||||
let platformVersion = '15.19.0';
|
||||
try {
|
||||
platformVersion = require('zapier-platform-core').version;
|
||||
} catch {
|
||||
// optional for unit tests without full install
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
version: require('./package.json').version,
|
||||
platformVersion,
|
||||
authentication,
|
||||
beforeRequest: [addApiKey],
|
||||
afterResponse: [mapMiddlewareErrors],
|
||||
triggers: {
|
||||
[timestampCompleted.key]: timestampCompleted,
|
||||
},
|
||||
creates: {
|
||||
[timestampAndWait.key]: timestampAndWait,
|
||||
[createTimestamp.key]: createTimestamp,
|
||||
[verifyTimestamp.key]: verifyTimestamp,
|
||||
[batchTimestamp.key]: batchTimestamp,
|
||||
},
|
||||
searches: {
|
||||
[jobStatus.key]: jobStatus,
|
||||
},
|
||||
};
|
||||
17
research/zapier/verae-zapier-api/verae-zapier/package.json
Normal file
17
research/zapier/verae-zapier-api/verae-zapier/package.json
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"name": "verae-zapier",
|
||||
"version": "1.0.0",
|
||||
"description": "Zapier CLI app for Verae Timestamping via middleware",
|
||||
"main": "index.js",
|
||||
"scripts": {
|
||||
"test": "node --test test/**/*.test.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=18",
|
||||
"npm": ">=5.6.0"
|
||||
},
|
||||
"dependencies": {
|
||||
"zapier-platform-core": "15.19.0"
|
||||
},
|
||||
"private": true
|
||||
}
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
const base = () => process.env.MIDDLEWARE_BASE_URL || 'http://127.0.0.1:3100';
|
||||
|
||||
const perform = async (z, bundle) => {
|
||||
const response = await z.request({
|
||||
url: `${base()}/zapier/v1/status/${encodeURIComponent(bundle.inputData.jobId)}`,
|
||||
});
|
||||
return [response.data];
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
key: 'job_status',
|
||||
noun: 'Job',
|
||||
display: {
|
||||
label: 'Find Job Status',
|
||||
description: 'Look up a timestamp job by ID.',
|
||||
},
|
||||
operation: {
|
||||
inputFields: [
|
||||
{ key: 'jobId', label: 'Job ID', type: 'string', required: true },
|
||||
],
|
||||
perform,
|
||||
sample: {
|
||||
id: '550e8400-e29b-41d4-a716-446655440000',
|
||||
status: 'completed',
|
||||
result: 'mock-cert',
|
||||
},
|
||||
outputFields: [
|
||||
{ key: 'id', label: 'Job ID' },
|
||||
{ key: 'status', label: 'Status' },
|
||||
{ key: 'result', label: 'Result' },
|
||||
],
|
||||
},
|
||||
};
|
||||
|
|
@ -0,0 +1,92 @@
|
|||
/**
|
||||
* GATE 11 — Zapier package shape tests (no live Zapier CLI required)
|
||||
*/
|
||||
|
||||
const { describe, it } = require('node:test');
|
||||
const assert = require('node:assert/strict');
|
||||
|
||||
const App = require('../index');
|
||||
const authentication = require('../authentication');
|
||||
const timestampAndWait = require('../creates/timestamp_and_wait');
|
||||
const createTimestamp = require('../creates/create_timestamp');
|
||||
const verifyTimestamp = require('../creates/verify_timestamp');
|
||||
const batchTimestamp = require('../creates/batch_timestamp');
|
||||
const jobStatus = require('../searches/job_status');
|
||||
const timestampCompleted = require('../triggers/timestamp_completed');
|
||||
|
||||
describe('verae-zapier app definition', () => {
|
||||
it('exports authentication with api_key field', () => {
|
||||
assert.equal(authentication.type, 'custom');
|
||||
assert.ok(authentication.fields.some((f) => f.key === 'api_key'));
|
||||
});
|
||||
|
||||
it('wires creates, searches, triggers', () => {
|
||||
assert.ok(App.creates.timestamp_and_wait);
|
||||
assert.ok(App.creates.create_timestamp);
|
||||
assert.ok(App.creates.verify_timestamp);
|
||||
assert.ok(App.creates.batch_timestamp);
|
||||
assert.ok(App.searches.job_status);
|
||||
assert.ok(App.triggers.timestamp_completed);
|
||||
});
|
||||
|
||||
it('create actions target middleware paths', () => {
|
||||
process.env.MIDDLEWARE_BASE_URL = 'https://mw.example.com';
|
||||
const urls = [];
|
||||
const z = {
|
||||
request: async (opts) => {
|
||||
urls.push(opts.url);
|
||||
return { data: { ok: true } };
|
||||
},
|
||||
};
|
||||
const bundle = {
|
||||
authData: { api_key: 'zmw_test' },
|
||||
inputData: { data: 'x', certificate: 'c', items: 'a\nb', jobId: 'j1' },
|
||||
};
|
||||
|
||||
return Promise.all([
|
||||
timestampAndWait.operation.perform(z, bundle),
|
||||
createTimestamp.operation.perform(z, bundle),
|
||||
verifyTimestamp.operation.perform(z, bundle),
|
||||
batchTimestamp.operation.perform(z, bundle),
|
||||
jobStatus.operation.perform(z, bundle),
|
||||
]).then(() => {
|
||||
assert.ok(urls.some((u) => u.endsWith('/zapier/v1/timestamp/wait')));
|
||||
assert.ok(urls.some((u) => u.endsWith('/zapier/v1/timestamp')));
|
||||
assert.ok(urls.some((u) => u.endsWith('/zapier/v1/verify')));
|
||||
assert.ok(urls.some((u) => u.endsWith('/zapier/v1/timestamp/batch')));
|
||||
assert.ok(urls.some((u) => u.includes('/zapier/v1/status/')));
|
||||
});
|
||||
});
|
||||
|
||||
it('trigger subscribe/unsubscribe shapes', async () => {
|
||||
process.env.MIDDLEWARE_BASE_URL = 'https://mw.example.com';
|
||||
const calls = [];
|
||||
const z = {
|
||||
request: async (opts) => {
|
||||
calls.push(opts);
|
||||
return { data: { id: 'hook-1' } };
|
||||
},
|
||||
};
|
||||
|
||||
const id = await timestampCompleted.operation.performSubscribe(z, {
|
||||
targetUrl: 'https://hooks.zapier.com/x',
|
||||
authData: { api_key: 'k' },
|
||||
});
|
||||
assert.equal(id, 'hook-1');
|
||||
assert.equal(calls[0].method, 'POST');
|
||||
assert.match(calls[0].url, /webhooks\/subscribe$/);
|
||||
assert.equal(calls[0].body.event, 'timestamp.completed');
|
||||
|
||||
await timestampCompleted.operation.performUnsubscribe(z, {
|
||||
subscribeData: 'hook-1',
|
||||
authData: { api_key: 'k' },
|
||||
});
|
||||
assert.equal(calls[1].method, 'DELETE');
|
||||
assert.match(calls[1].url, /webhooks\/unsubscribe$/);
|
||||
});
|
||||
|
||||
it('beforeRequest adds Authorization bearer', () => {
|
||||
const req = App.beforeRequest[0]({}, null, { authData: { api_key: 'zmw_abc' } });
|
||||
assert.equal(req.headers.Authorization, 'Bearer zmw_abc');
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
const base = () => process.env.MIDDLEWARE_BASE_URL || 'http://127.0.0.1:3100';
|
||||
|
||||
const subscribeHook = async (z, bundle) => {
|
||||
const response = await z.request({
|
||||
method: 'POST',
|
||||
url: `${base()}/zapier/v1/webhooks/subscribe`,
|
||||
body: {
|
||||
targetUrl: bundle.targetUrl,
|
||||
event: 'timestamp.completed',
|
||||
},
|
||||
});
|
||||
return response.data.id;
|
||||
};
|
||||
|
||||
const unsubscribeHook = async (z, bundle) => {
|
||||
await z.request({
|
||||
method: 'DELETE',
|
||||
url: `${base()}/zapier/v1/webhooks/unsubscribe`,
|
||||
body: {
|
||||
hookId: bundle.subscribeData,
|
||||
},
|
||||
});
|
||||
return {};
|
||||
};
|
||||
|
||||
const perform = async (z, bundle) => [bundle.cleanedRequest];
|
||||
|
||||
const performList = async () => [];
|
||||
|
||||
module.exports = {
|
||||
key: 'timestamp_completed',
|
||||
noun: 'Timestamp',
|
||||
display: {
|
||||
label: 'Timestamp Completed',
|
||||
description: 'Triggers when a blockchain timestamp job completes.',
|
||||
},
|
||||
operation: {
|
||||
type: 'hook',
|
||||
perform,
|
||||
performList,
|
||||
performSubscribe: subscribeHook,
|
||||
performUnsubscribe: unsubscribeHook,
|
||||
sample: {
|
||||
event: 'timestamp.completed',
|
||||
jobId: '550e8400-e29b-41d4-a716-446655440000',
|
||||
status: { id: '550e8400-e29b-41d4-a716-446655440000', status: 'completed' },
|
||||
},
|
||||
outputFields: [
|
||||
{ key: 'event', label: 'Event' },
|
||||
{ key: 'jobId', label: 'Job ID' },
|
||||
],
|
||||
},
|
||||
};
|
||||
Loading…
Add table
Add a link
Reference in a new issue