34 lines
1.6 KiB
Markdown
34 lines
1.6 KiB
Markdown
# verae-access-authz
|
|
|
|
Authorization step on the NATS **address path**. Zapier is only **one** access plane. Direct web, customer API, and server-to-server leaf nodes are separate, and each is default-deny against internal subjects.
|
|
|
|
**Forgejo:** https://git.georgelambert.org/marchon/verae-access-authz
|
|
**Catalog:** https://zapier.georgelambert.org/packages/verae-access-authz/README.pdf
|
|
|
|
## Address path
|
|
|
|
```text
|
|
client
|
|
→ verae.access.<plane>.<area>.<resource>.<action> (ingress, that plane only)
|
|
→ verae.access.authz.check (allow / deny)
|
|
→ verae.<area>.<resource>.<action> (internal bus)
|
|
```
|
|
|
|
Internal subjects (`verae.billing.*`, `verae.archive.*`, `verae.zapier.jobs.*`) stay stable. Planes never publish them until `authz.check` returns `allow`.
|
|
|
|
| Plane | Who | May reach |
|
|
|-------|-----|-----------|
|
|
| `zapier` | Zapier Platform HTTPS | jobs.*, webhooks.deliver, billing.usage.recorded |
|
|
| `web` | Customer browser portal | statement.get, balance.adjust kind=reload\|payment |
|
|
| `api` | Customer `x-api-key` (not Zapier) | statement.get, usage.recorded, jobs.watch |
|
|
| `leaf` | S2S NATS leaf / mTLS | archive.*, jobs.*, webhooks — **not billing** |
|
|
| `staff` | CS / sales / admin | statement, balance.adjust (credits) |
|
|
|
|
A leaf node cannot credit an account. A Zapier hop cannot read a customer statement. A browser cannot `archive.put`.
|
|
|
|
```bash
|
|
NATS_URL=nats://127.0.0.1:4222 PORT=3020 npm start
|
|
curl -s http://127.0.0.1:3020/policy
|
|
curl -s -X POST http://127.0.0.1:3020/check -H 'content-type: application/json' \
|
|
-d '{"plane":"leaf","subject":"verae.billing.balance.adjust"}'
|
|
```
|