Initial import of verae-access-authz from zapier monorepo

test/health.test.js

@@ -0,0 +1,35 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+test('authz health policy and check', async () => {
+  const port = 18020;
+  const child = spawn(process.execPath, ['src/server.js'], {
+    cwd: root,
+    env: { ...process.env, PORT: String(port) },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((r) => setTimeout(r, 400));
+  try {
+    const h = await (await fetch(`http://127.0.0.1:${port}/health`)).json();
+    assert.equal(h.role, 'verae-access-authz');
+    const ok = await fetch(`http://127.0.0.1:${port}/check`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ plane: 'web', subject: 'verae.billing.statement.get' }),
+    });
+    assert.equal(ok.status, 200);
+    const no = await fetch(`http://127.0.0.1:${port}/check`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ plane: 'leaf', subject: 'verae.billing.balance.adjust' }),
+    });
+    assert.equal(no.status, 403);
+  } finally {
+    child.kill('SIGTERM');
+  }
+});

test/policy.test.js

@@ -0,0 +1,79 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { authorize } from '../src/policy.js';
+import { accessAddress, parseAddress, PLANES } from '../src/subjects.js';
+
+test('five access planes', () => {
+  assert.deepEqual([...PLANES], ['zapier', 'web', 'api', 'leaf', 'staff']);
+});
+
+test('web may read statement and reload, not archive or jobs', () => {
+  assert.equal(authorize({ plane: 'web', subject: 'verae.billing.statement.get' }).allow, true);
+  assert.equal(
+    authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'reload' }).allow,
+    true,
+  );
+  assert.equal(
+    authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow,
+    false,
+  );
+  assert.equal(authorize({ plane: 'web', subject: 'verae.archive.put' }).allow, false);
+  assert.equal(authorize({ plane: 'web', subject: 'verae.zapier.jobs.watch' }).allow, false);
+});
+
+test('leaf may archive and jobs, not billing adjust', () => {
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.put' }).allow, true);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.reply.abc' }).allow, true);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.zapier.jobs.watch' }).allow, true);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.balance.adjust' }).allow, false);
+  assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.statement.get' }).allow, false);
+});
+
+test('zapier may meter and jobs, not customer statement or credits', () => {
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.zapier.jobs.watch' }).allow, true);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.usage.recorded' }).allow, true);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.statement.get' }).allow, false);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.balance.adjust' }).allow, false);
+  assert.equal(authorize({ plane: 'zapier', subject: 'verae.archive.put' }).allow, false);
+});
+
+test('api may statement and usage, not credits or archive', () => {
+  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.statement.get' }).allow, true);
+  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.usage.recorded' }).allow, true);
+  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.balance.adjust' }).allow, false);
+  assert.equal(authorize({ plane: 'api', subject: 'verae.archive.query' }).allow, false);
+});
+
+test('staff may credit and statement, not archive', () => {
+  assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow, true);
+  assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.statement.get' }).allow, true);
+  assert.equal(authorize({ plane: 'staff', subject: 'verae.archive.put' }).allow, false);
+});
+
+test('access-prefixed address is mapped to internal', () => {
+  const addr = accessAddress('leaf', 'verae.archive.put');
+  assert.equal(addr, 'verae.access.leaf.archive.put');
+  const parsed = parseAddress(addr);
+  assert.equal(parsed.plane, 'leaf');
+  assert.equal(parsed.internal, 'verae.archive.put');
+  assert.equal(authorize({ plane: 'leaf', subject: addr }).allow, true);
+  assert.equal(authorize({ plane: 'web', subject: addr }).allow, false);
+});
+
+test('allow echoes veraeUserId for hop tracing', () => {
+  const out = authorize({
+    plane: 'web',
+    subject: 'verae.billing.statement.get',
+    principal: 'cust_1',
+    veraeUserId: 'vu_deadbeefdeadbeef',
+    traceId: 'tr-1',
+  });
+  assert.equal(out.allow, true);
+  assert.equal(out.veraeUserId, 'vu_deadbeefdeadbeef');
+  assert.equal(out.traceId, 'tr-1');
+});
+
+test('unknown plane and authz subjects denied', () => {
+  assert.equal(authorize({ plane: 'partner', subject: 'verae.archive.put' }).allow, false);
+  assert.equal(authorize({ plane: 'web', subject: 'verae.access.authz.check' }).allow, false);
+});