marchon/verae-access-authz
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
verae-access-authz/README.md

1.6 KiB
Raw Blame History

verae-access-authz

Authorization step on the NATS address path. Zapier is only one access plane. Direct web, customer API, and server-to-server leaf nodes are separate, and each is default-deny against internal subjects.

Forgejo: https://git.georgelambert.org/marchon/verae-access-authz
Catalog: https://zapier.georgelambert.org/packages/verae-access-authz/README.pdf

Address path

client
  → verae.access.<plane>.<area>.<resource>.<action>     (ingress, that plane only)
  → verae.access.authz.check                            (allow / deny)
  → verae.<area>.<resource>.<action>                    (internal bus)

Internal subjects (verae.billing.*, verae.archive.*, verae.zapier.jobs.*) stay stable. Planes never publish them until authz.check returns allow.

Plane Who May reach
zapier Zapier Platform HTTPS jobs.*, webhooks.deliver, billing.usage.recorded
web Customer browser portal statement.get, balance.adjust kind=reload|payment
api Customer x-api-key (not Zapier) statement.get, usage.recorded, jobs.watch
leaf S2S NATS leaf / mTLS archive., jobs., webhooks — not billing
staff CS / sales / admin statement, balance.adjust (credits)

A leaf node cannot credit an account. A Zapier hop cannot read a customer statement. A browser cannot archive.put.

NATS_URL=nats://127.0.0.1:4222 PORT=3020 npm start
curl -s http://127.0.0.1:3020/policy
curl -s -X POST http://127.0.0.1:3020/check -H 'content-type: application/json' \
  -d '{"plane":"leaf","subject":"verae.billing.balance.adjust"}'