George Lambert
1b199ca4d4
Some checks are pending
offline / test (push) Waiting to run
Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).
38 lines
1.5 KiB
JavaScript
38 lines
1.5 KiB
JavaScript
/** Call verae.access.authz.check then the internal subject. Fail closed. */
|
|
import { SUBJECTS } from './subjects.js';
|
|
|
|
export async function authorizeThenRequest(nc, sc, { plane, subject, principal, payload, timeout = 2000 }) {
|
|
const kind = payload?.kind;
|
|
const checkMsg = await nc.request(
|
|
SUBJECTS.AUTHZ_CHECK,
|
|
sc.encode(JSON.stringify({ plane, subject, principal, kind, payload })),
|
|
{ timeout },
|
|
);
|
|
const decision = JSON.parse(sc.decode(checkMsg.data) || '{}');
|
|
if (!decision.allow) {
|
|
const err = new Error(decision.reason || 'denied');
|
|
err.decision = decision;
|
|
throw err;
|
|
}
|
|
const internal = decision.subject;
|
|
const body = { ...payload, plane, principal, traceId: payload?.traceId };
|
|
const m = await nc.request(internal, sc.encode(JSON.stringify(body)), { timeout });
|
|
return { decision, body: JSON.parse(sc.decode(m.data) || '{}') };
|
|
}
|
|
|
|
export async function authorizeThenPublish(nc, sc, { plane, subject, principal, payload, timeout = 2000 }) {
|
|
const kind = payload?.kind;
|
|
const checkMsg = await nc.request(
|
|
SUBJECTS.AUTHZ_CHECK,
|
|
sc.encode(JSON.stringify({ plane, subject, principal, kind, payload })),
|
|
{ timeout },
|
|
);
|
|
const decision = JSON.parse(sc.decode(checkMsg.data) || '{}');
|
|
if (!decision.allow) {
|
|
const err = new Error(decision.reason || 'denied');
|
|
err.decision = decision;
|
|
throw err;
|
|
}
|
|
nc.publish(decision.subject, sc.encode(JSON.stringify({ ...payload, plane, principal })));
|
|
return { decision };
|
|
}
|