Milestone 0: import zappier billing, Verae middleware, and Zapier research

Compose-ready workspace: packages/zappier (rate card, portal, Stripe),
packages/verae-zapier-middleware (timestamp + NATS), packages/verae-zapier
(CLI app), vendor/zapier-platform, and research/zapier vendor corpus.

Gate 0 structure checks pass. Product code and research are not yet wired.

vendor/zapier-platform/example-apps/oauth2/.gitignore

@@ -0,0 +1,63 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/
+dist/
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# Typescript v1 declaration files
+typings/
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# environment variables file
+.env
+.environment
+
+# next.js build output
+.next

vendor/zapier-platform/example-apps/oauth2/README.md

@@ -0,0 +1,34 @@
+# oauth2
+
+This Zapier integration project is generated by the `zapier-platform init` CLI command.
+
+These are what you normally do next:
+
+```bash
+# Install dependencies
+npm install  # or you can use yarn
+
+# Run tests
+zapier-platform test
+
+# Register the integration on Zapier if you haven't
+zapier-platform register "App Title"
+
+# Or you can link to an existing integration on Zapier
+zapier-platform link
+
+# Push it to Zapier
+zapier-platform push
+```
+
+Then, to add more features, you can use the `zapier-platform scaffold` command, for example:
+
+```bash
+# Add a trigger
+zapier-platform scaffold trigger contact
+
+# Add an action
+zapier-platform scaffold create contact
+``` 
+
+Find out more on the latest docs: https://github.com/zapier/zapier-platform/blob/main/packages/cli/README.md.

vendor/zapier-platform/example-apps/oauth2/authentication.js

@@ -0,0 +1,100 @@
+'use strict';
+
+const getAccessToken = async (z, bundle) => {
+  const response = await z.request({
+    url: 'https://auth-json-server.zapier-staging.com/oauth/access-token',
+    method: 'POST',
+    body: {
+      client_id: process.env.CLIENT_ID,
+      client_secret: process.env.CLIENT_SECRET,
+      grant_type: 'authorization_code',
+      code: bundle.inputData.code,
+
+      // Extra data can be pulled from the querystring. For instance:
+      // 'accountDomain': bundle.cleanedRequest.querystring.accountDomain
+    },
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+  });
+
+  // If you're using core v9.x or older, you should call response.throwForStatus()
+  // or verify response.status === 200 before you continue.
+
+  // This function should return `access_token`.
+  // If your app does an app refresh, then `refresh_token` should be returned here
+  // as well
+  return {
+    access_token: response.data.access_token,
+    refresh_token: response.data.refresh_token,
+  };
+};
+
+const refreshAccessToken = async (z, bundle) => {
+  const response = await z.request({
+    url: 'https://auth-json-server.zapier-staging.com/oauth/refresh-token',
+    method: 'POST',
+    body: {
+      client_id: process.env.CLIENT_ID,
+      client_secret: process.env.CLIENT_SECRET,
+      grant_type: 'refresh_token',
+      refresh_token: bundle.authData.refresh_token,
+    },
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+  });
+
+  // If you're using core v9.x or older, you should call response.throwForStatus()
+  // or verify response.status === 200 before you continue.
+
+  // This function should return `access_token`.
+  // If the refresh token stays constant, no need to return it.
+  // If the refresh token does change, return it here to update the stored value in
+  // Zapier
+  return {
+    access_token: response.data.access_token,
+    refresh_token: response.data.refresh_token,
+  };
+};
+
+// You want to make a request to an endpoint that is either specifically designed
+// to test auth, or one that every user will have access to. eg: `/me`.
+// By returning the entire request object, you have access to the request and
+// response data for testing purposes. Your connection label can access any data
+// from the returned response using the `json.` prefix. eg: `{{json.username}}`.
+const test = (z, bundle) =>
+  z.request({ url: 'https://auth-json-server.zapier-staging.com/me' });
+
+module.exports = {
+  // OAuth2 is a web authentication standard. There are a lot of configuration
+  // options that will fit most any situation.
+  type: 'oauth2',
+  oauth2Config: {
+    authorizeUrl: {
+      url: 'https://auth-json-server.zapier-staging.com/oauth/authorize',
+      params: {
+        client_id: '{{process.env.CLIENT_ID}}',
+        state: '{{bundle.inputData.state}}',
+        redirect_uri: '{{bundle.inputData.redirect_uri}}',
+        response_type: 'code',
+      },
+    },
+    getAccessToken,
+    refreshAccessToken,
+    autoRefresh: true,
+  },
+
+  // Define any input app's auth requires here. The user will be prompted to enter
+  // this info when they connect their account.
+  fields: [],
+
+  // The test method allows Zapier to verify that the credentials a user provides
+  // are valid. We'll execute this method whenever a user connects their account for
+  // the first time.
+  test,
+
+  // This template string can access all the data returned from the auth test. If
+  // you return the test object, you'll access the returned data with a label like
+  // `{{json.X}}`. If you return `response.data` from your test, then your label can
+  // be `{{X}}`. This can also be a function that returns a label. That function has
+  // the standard args `(z, bundle)` and data returned from the test can be accessed
+  // in `bundle.inputData.X`.
+  connectionLabel: '{{json.username}}',
+};

vendor/zapier-platform/example-apps/oauth2/index.js

@@ -0,0 +1,26 @@
+const authentication = require('./authentication');
+const { befores = [], afters = [] } = require('./middleware');
+
+module.exports = {
+  // This is just shorthand to reference the installed dependencies you have.
+  // Zapier will need to know these before we can upload.
+  version: require('./package.json').version,
+  platformVersion: require('zapier-platform-core').version,
+
+  authentication,
+
+  beforeRequest: [...befores],
+
+  afterResponse: [...afters],
+
+  // If you want your trigger to show up, you better include it here!
+  triggers: {},
+
+  // If you want your searches to show up, you better include it here!
+  searches: {},
+
+  // If you want your creates to show up, you better include it here!
+  creates: {},
+
+  resources: {},
+};

vendor/zapier-platform/example-apps/oauth2/middleware.js

@@ -0,0 +1,13 @@
+'use strict';
+
+// This function runs before every outbound request. You can have as many as you
+// need. They'll need to each be registered in your index.js file.
+const includeBearerToken = (request, z, bundle) => {
+  if (bundle.authData.access_token) {
+    request.headers.Authorization = `Bearer ${bundle.authData.access_token}`;
+  }
+
+  return request;
+};
+
+module.exports = { befores: [includeBearerToken], afters: [] };

vendor/zapier-platform/example-apps/oauth2/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "oauth2",
+  "version": "1.0.0",
+  "description": "",
+  "scripts": {
+    "test": "jest --testTimeout 10000"
+  },
+  "dependencies": {
+    "zapier-platform-core": "19.1.0"
+  },
+  "devDependencies": {
+    "jest": "^29.6.0"
+  },
+  "private": true,
+  "main": "index.js"
+}

vendor/zapier-platform/example-apps/oauth2/test/authentication.test.js

@@ -0,0 +1,118 @@
+/* globals describe, it, expect, beforeAll */
+
+const zapier = require('zapier-platform-core');
+
+zapier.tools.env.inject(); // read from the .env file
+
+const App = require('../index');
+const appTester = zapier.createAppTester(App);
+
+// Only here so the tests out of the box.
+// You should create a `.env` file and populate it with the necessarily configuration
+// it should look like:
+/*
+    CLIENT_ID=1234
+    CLIENT_SECRET=asdf
+*/
+// then you can delete the following 2 lines
+process.env.CLIENT_ID = process.env.CLIENT_ID || '1234';
+process.env.CLIENT_SECRET = process.env.CLIENT_SECRET || 'asdf';
+
+describe('oauth2 app', () => {
+  beforeAll(() => {
+    // It's a good idea to store your Client ID and Secret in the environment rather than in code.
+    if (!(process.env.CLIENT_ID && process.env.CLIENT_SECRET)) {
+      throw new Error(
+        `Before running the tests, make sure CLIENT_ID and CLIENT_SECRET are available in the environment.`,
+      );
+    }
+  });
+
+  it('generates an authorize URL', async () => {
+    const bundle = {
+      // In production, these will be generated by Zapier and set automatically
+      inputData: {
+        state: '4444',
+        redirect_uri: 'https://zapier.com/',
+      },
+      environment: {
+        CLIENT_ID: process.env.CLIENT_ID,
+        CLIENT_SECRET: process.env.CLIENT_SECRET,
+      },
+    };
+
+    const authorizeUrl = await appTester(
+      App.authentication.oauth2Config.authorizeUrl,
+      bundle,
+    );
+
+    expect(authorizeUrl).toBe(
+      'https://auth-json-server.zapier-staging.com/oauth/authorize?client_id=1234&state=4444&redirect_uri=https%3A%2F%2Fzapier.com%2F&response_type=code',
+    );
+  });
+
+  it('can fetch an access token', async () => {
+    const bundle = {
+      inputData: {
+        // In production, Zapier passes along whatever code your API set in the query params when it redirects
+        // the user's browser to the `redirect_uri`
+        code: 'one_time_code',
+      },
+      environment: {
+        CLIENT_ID: process.env.CLIENT_ID,
+        CLIENT_SECRET: process.env.CLIENT_SECRET,
+      },
+      cleanedRequest: {
+        querystring: {
+          accountDomain: 'test-account',
+          code: 'one_time_code',
+        },
+      },
+      rawRequest: {
+        querystring: '?accountDomain=test-account&code=one_time_code',
+      },
+    };
+
+    const result = await appTester(
+      App.authentication.oauth2Config.getAccessToken,
+      bundle,
+    );
+
+    expect(result.access_token).toBe('a_token');
+    expect(result.refresh_token).toBe('a_refresh_token');
+  });
+
+  it('can refresh the access token', async () => {
+    const bundle = {
+      // In production, Zapier provides these. For testing, we have hard-coded them.
+      // When writing tests for your own app, you should consider exporting them and doing process.env.MY_ACCESS_TOKEN
+      authData: {
+        access_token: 'a_token',
+        refresh_token: 'a_refresh_token',
+      },
+      environment: {
+        CLIENT_ID: process.env.CLIENT_ID,
+        CLIENT_SECRET: process.env.CLIENT_SECRET,
+      },
+    };
+
+    const result = await appTester(
+      App.authentication.oauth2Config.refreshAccessToken,
+      bundle,
+    );
+    expect(result.access_token).toBe('a_token');
+  });
+
+  it('includes the access token in future requests', async () => {
+    const bundle = {
+      authData: {
+        access_token: 'a_token',
+        refresh_token: 'a_refresh_token',
+      },
+    };
+
+    const response = await appTester(App.authentication.test, bundle);
+    expect(response.data).toHaveProperty('username');
+    expect(response.data.username).toBe('Bret');
+  });
+});