marchon/verae-access-authz
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
NATS authorization step for access planes
1 commit 2 branches 0 tags 39 KiB
Find a file
George Lambert 942139c7c2 Initial import of verae-access-authz from zapier monorepo
2026-09-11 18:38:25 -04:00
src Initial import of verae-access-authz from zapier monorepo 2026-09-11 18:38:25 -04:00
test Initial import of verae-access-authz from zapier monorepo 2026-09-11 18:38:25 -04:00
NATS.md Initial import of verae-access-authz from zapier monorepo 2026-09-11 18:38:25 -04:00
package-lock.json Initial import of verae-access-authz from zapier monorepo 2026-09-11 18:38:25 -04:00
package.json Initial import of verae-access-authz from zapier monorepo 2026-09-11 18:38:25 -04:00
README.md Initial import of verae-access-authz from zapier monorepo 2026-09-11 18:38:25 -04:00

README.md

verae-access-authz

Authorization step on the NATS address path. Zapier is only one access plane. Direct web, customer API, and server-to-server leaf nodes are separate, and each is default-deny against internal subjects.

Forgejo: https://git.georgelambert.org/marchon/verae-access-authz
Catalog: https://zapier.georgelambert.org/packages/verae-access-authz/README.pdf

Address path

client
  → verae.access.<plane>.<area>.<resource>.<action>     (ingress, that plane only)
  → verae.access.authz.check                            (allow / deny)
  → verae.<area>.<resource>.<action>                    (internal bus)

Internal subjects (verae.billing.*, verae.archive.*, verae.zapier.jobs.*) stay stable. Planes never publish them until authz.check returns allow.

Plane Who May reach
zapier Zapier Platform HTTPS jobs.*, webhooks.deliver, billing.usage.recorded
web Customer browser portal statement.get, balance.adjust kind=reload|payment
api Customer x-api-key (not Zapier) statement.get, usage.recorded, jobs.watch
leaf S2S NATS leaf / mTLS archive., jobs., webhooks — not billing
staff CS / sales / admin statement, balance.adjust (credits)

A leaf node cannot credit an account. A Zapier hop cannot read a customer statement. A browser cannot archive.put.

NATS_URL=nats://127.0.0.1:4222 PORT=3020 npm start
curl -s http://127.0.0.1:3020/policy
curl -s -X POST http://127.0.0.1:3020/check -H 'content-type: application/json' \
  -d '{"plane":"leaf","subject":"verae.billing.balance.adjust"}'