offline / test (push) Waiting to run

Details

Separate Zapier, web, API, and leaf access planes with NATS authz

Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).

2026-09-11 16:05:05 -04:00

1.6 KiB

Raw Blame History

verae-access-authz

Authorization step on the NATS address path. Zapier is only one access plane. Direct web, customer API, and server-to-server leaf nodes are separate, and each is default-deny against internal subjects.

Forgejo: https://git.georgelambert.org/marchon/verae-access-authz
Catalog: https://zapier.georgelambert.org/packages/verae-access-authz/README.pdf

Address path

client
  → verae.access.<plane>.<area>.<resource>.<action>     (ingress, that plane only)
  → verae.access.authz.check                            (allow / deny)
  → verae.<area>.<resource>.<action>                    (internal bus)

Internal subjects (verae.billing.*, verae.archive.*, verae.zapier.jobs.*) stay stable. Planes never publish them until authz.check returns allow.

Plane	Who	May reach
`zapier`	Zapier Platform HTTPS	jobs.*, webhooks.deliver, billing.usage.recorded
`web`	Customer browser portal	statement.get, balance.adjust kind=reload\|payment
`api`	Customer `x-api-key` (not Zapier)	statement.get, usage.recorded, jobs.watch
`leaf`	S2S NATS leaf / mTLS	archive., jobs., webhooks — not billing
`staff`	CS / sales / admin	statement, balance.adjust (credits)

A leaf node cannot credit an account. A Zapier hop cannot read a customer statement. A browser cannot archive.put.

NATS_URL=nats://127.0.0.1:4222 PORT=3020 npm start
curl -s http://127.0.0.1:3020/policy
curl -s -X POST http://127.0.0.1:3020/check -H 'content-type: application/json' \
  -d '{"plane":"leaf","subject":"verae.billing.balance.adjust"}'

1.6 KiB Raw Blame History

verae-access-authz

Address path

1.6 KiB

Raw Blame History