mpp-rb 0.1.4 → 0.1.6

data/lib/mpp/methods/evm/authorization.rb

@@ -0,0 +1,140 @@
+# typed: false
+# frozen_string_literal: true
+
+module Mpp
+  module Methods
+    module Evm
+      # EIP-712 TransferWithAuthorization hashing and recovery.
+      module Authorization
+        DOMAIN_TYPE_HASH = "EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"
+        TRANSFER_TYPE_HASH = "TransferWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce)"
+
+        module_function
+
+        def keccak256(data)
+          Kernel.require "eth"
+          Eth::Util.keccak256(data)
+        rescue Gem::LoadError
+          raise LoadError, "eth gem is not available"
+        end
+
+        def challenge_hash(challenge)
+          digest = keccak256("#{challenge.id}#{challenge.realm}")
+          "0x#{digest.unpack1("H*")}"
+        end
+
+        def checksum_address(address)
+          raw = address.to_s
+          hex = raw.delete_prefix("0x")
+          raise ArgumentError, "invalid address: #{address}" unless hex.match?(/\A[a-fA-F0-9]{40}\z/)
+
+          begin
+            hash = keccak256(hex.downcase).unpack1("H*")
+          rescue LoadError
+            return raw.start_with?("0x") ? raw : "0x#{hex}"
+          end
+
+          checksummed = hex.downcase.chars.each_with_index.map { |char, index|
+            (char.match?(/[a-f]/) && hash[index].to_i(16) >= 8) ? char.upcase : char
+          }.join
+          "0x#{checksummed}"
+        end
+
+        def signing_hash(authorization:, chain_id:, currency:, from:, to:, value:, valid_after:, valid_before:, nonce:)
+          domain = domain_separator(
+            name: authorization["name"] || authorization[:name],
+            version: authorization["version"] || authorization[:version],
+            chain_id: chain_id,
+            verifying_contract: currency
+          )
+          struct = struct_hash(
+            from: from,
+            to: to,
+            value: value,
+            valid_after: valid_after,
+            valid_before: valid_before,
+            nonce: nonce
+          )
+          keccak256("\x19\x01".b + domain + struct)
+        end
+
+        def recover(authorization:, chain_id:, currency:, payload:)
+          hash = signing_hash(
+            authorization: authorization,
+            chain_id: chain_id,
+            currency: currency,
+            from: payload["from"],
+            to: payload["to"],
+            value: payload["value"],
+            valid_after: payload["validAfter"],
+            valid_before: payload["validBefore"],
+            nonce: payload["nonce"]
+          )
+          recover_address(hash, payload["signature"])
+        end
+
+        def domain_separator(name:, version:, chain_id:, verifying_contract:)
+          keccak256(
+            abi_encode(
+              keccak256(DOMAIN_TYPE_HASH),
+              keccak256(name),
+              keccak256(version),
+              uint256(chain_id),
+              address_word(verifying_contract)
+            )
+          )
+        end
+
+        def struct_hash(from:, to:, value:, valid_after:, valid_before:, nonce:)
+          keccak256(
+            abi_encode(
+              keccak256(TRANSFER_TYPE_HASH),
+              address_word(from),
+              address_word(to),
+              uint256(value),
+              uint256(valid_after),
+              uint256(valid_before),
+              bytes32_word(nonce)
+            )
+          )
+        end
+
+        def abi_encode(*values)
+          values.join
+        end
+
+        def uint256(value)
+          value = Integer(value)
+          raise ArgumentError, "uint256 out of range" if value.negative? || value >= (1 << 256)
+
+          [value.to_s(16).rjust(64, "0")].pack("H*")
+        end
+
+        def address_word(value)
+          hex = value.to_s.delete_prefix("0x")
+          raise ArgumentError, "invalid address: #{value}" unless hex.match?(/\A[a-fA-F0-9]{40}\z/)
+
+          [hex].pack("H*").rjust(32, "\x00".b)
+        end
+
+        def bytes32_word(value)
+          hex = value.to_s.delete_prefix("0x")
+          raise ArgumentError, "invalid bytes32: #{value}" unless hex.match?(/\A[a-fA-F0-9]{64}\z/)
+
+          [hex].pack("H*")
+        end
+
+        def recover_address(hash, signature)
+          Kernel.require "eth"
+
+          sig = signature.to_s
+          sig = "0x#{sig}" unless sig.start_with?("0x")
+          recovered_key = Eth::Signature.recover(hash, sig)
+          Eth::Util.public_key_to_address(recovered_key).to_s
+        rescue
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/mpp/methods/evm/charge_intent.rb

@@ -0,0 +1,129 @@
+# typed: false
+# frozen_string_literal: true
+
+require "time"
+
+module Mpp
+  module Methods
+    module Evm
+      # Server-side EVM charge intent: recover EIP-3009, then settle via facilitator.
+      class ChargeIntent
+        attr_reader :name, :facilitator, :authorization, :max_timeout_seconds, :route_binding
+
+        def initialize(authorization:, facilitator:, max_timeout_seconds: 300, route_binding: :resource)
+          @name = "charge"
+          @authorization = authorization
+          @facilitator = facilitator
+          @max_timeout_seconds = max_timeout_seconds
+          @route_binding = route_binding
+        end
+
+        def verify(credential, request)
+          payload = credential.payload
+          unless payload.is_a?(Hash) && payload["type"] == "authorization"
+            raise Mpp::VerificationError, "EVM authorization credentials are not supported for this challenge"
+          end
+
+          if request.dig("methodDetails", "splits")
+            raise Mpp::VerificationFailedError.new(reason: "EVM authorization credentials do not support splits")
+          end
+
+          unless addresses_equal?(payload["to"], request["recipient"])
+            raise Mpp::VerificationFailedError.new(reason: "EVM authorization recipient mismatch")
+          end
+          unless payload["value"].to_s == request["amount"].to_s
+            raise Mpp::VerificationFailedError.new(reason: "EVM authorization amount mismatch")
+          end
+
+          unless x402_credential?(credential)
+            expected_nonce = Authorization.challenge_hash(credential.challenge)
+            unless payload["nonce"].to_s.downcase == expected_nonce.downcase
+              raise Mpp::VerificationFailedError.new(reason: "EVM authorization challenge hash mismatch")
+            end
+          end
+
+          now = Time.now.to_i
+          raise Mpp::VerificationFailedError.new(reason: "EVM authorization is not valid yet") if Integer(payload["validAfter"]) > now
+          raise Mpp::VerificationFailedError.new(reason: "EVM authorization has expired") if Integer(payload["validBefore"]) <= now
+
+          chain_id = request.dig("methodDetails", "chainId")
+          raise Mpp::VerificationFailedError.new(reason: "EVM authorization requires chainId") if chain_id.nil?
+
+          signer = Authorization.recover(
+            authorization: @authorization,
+            chain_id: chain_id,
+            currency: request["currency"],
+            payload: payload
+          )
+          unless signer && addresses_equal?(signer, payload["from"])
+            raise Mpp::VerificationFailedError.new(reason: "EVM authorization signature mismatch")
+          end
+
+          checksummed_from = Authorization.checksum_address(payload["from"])
+          source = "did:pkh:eip155:#{chain_id}:#{checksummed_from}"
+          if credential.source && credential.source != source
+            raise Mpp::VerificationFailedError.new(reason: "EVM authorization source mismatch")
+          end
+
+          settled = settle(payload, request)
+          Mpp::Receipt.success(settled.fetch("transaction"), method: "evm")
+        end
+
+        def payment_requirements(request)
+          Mpp::X402::Server.to_payment_requirements(
+            request,
+            authorization: @authorization,
+            max_timeout_seconds: @max_timeout_seconds
+          )
+        end
+
+        private
+
+        def settle(payload, request)
+          requirements = payment_requirements(request)
+          payment_payload = {
+            "accepted" => requirements,
+            "payload" => {
+              "authorization" => {
+                "from" => payload["from"],
+                "nonce" => payload["nonce"],
+                "to" => payload["to"],
+                "validAfter" => payload["validAfter"].to_s,
+                "validBefore" => payload["validBefore"].to_s,
+                "value" => payload["value"].to_s
+              },
+              "signature" => payload["signature"]
+            },
+            "x402Version" => Mpp::X402::VERSION
+          }
+
+          verified = @facilitator.verify(payment_payload, requirements)
+          unless verified["isValid"]
+            raise Mpp::VerificationFailedError.new(
+              reason: verified["invalidMessage"] || verified["invalidReason"] || "EVM facilitator verify failed"
+            )
+          end
+
+          settled = @facilitator.settle(payment_payload, requirements)
+          unless settled["success"]
+            raise Mpp::VerificationFailedError.new(
+              reason: settled["errorMessage"] || settled["errorReason"] || "EVM facilitator settlement failed"
+            )
+          end
+
+          settled
+        end
+
+        def x402_credential?(credential)
+          credential.payload.is_a?(Hash) && credential.payload["_x402"] == true
+        end
+
+        def addresses_equal?(left, right)
+          return false if left.nil? || right.nil?
+
+          left.to_s.delete_prefix("0x").downcase == right.to_s.delete_prefix("0x").downcase
+        end
+      end
+    end
+  end
+end

data/lib/mpp/methods/evm/evm_method.rb

@@ -0,0 +1,133 @@
+# typed: false
+# frozen_string_literal: true
+
+module Mpp
+  module Methods
+    module Evm
+      # EVM payment method. Speaks native Payment-auth and x402 exact.
+      class EvmMethod
+        attr_reader :name, :currency, :recipient, :decimals, :chain_id, :authorization, :x402,
+          :on_payment_success
+        attr_accessor :intents
+
+        def initialize(currency:, recipient:, decimals:, chain_id:, authorization:, x402:, on_payment_success: nil, can_offer: nil)
+          if !on_payment_success.nil? && !on_payment_success.respond_to?(:call)
+            raise ArgumentError, "on_payment_success must be callable"
+          end
+          if !can_offer.nil? && !can_offer.respond_to?(:call)
+            raise ArgumentError, "can_offer must be callable"
+          end
+
+          @name = "evm"
+          @currency = Authorization.checksum_address(currency)
+          @recipient = Authorization.checksum_address(recipient)
+          @decimals = decimals
+          @chain_id = chain_id
+          @authorization = authorization
+          @x402 = x402
+          @on_payment_success = on_payment_success
+          @can_offer = can_offer
+          @intents = {}
+        end
+
+        def can_offer?(request)
+          return true unless @can_offer
+
+          @can_offer.call(request)
+        end
+
+        def transform_request(request, _credential)
+          method_details = request.fetch("methodDetails", {})
+          method_details = {} unless method_details.is_a?(Hash)
+
+          method_details["chainId"] = @chain_id
+          method_details["credentialTypes"] = ["authorization"]
+          request.merge("methodDetails" => method_details, "currency" => @currency, "recipient" => @recipient)
+        end
+
+        def payment_requirements(request)
+          charge_intent.payment_requirements(request)
+        end
+
+        def x402_matches?(payload, request)
+          accepted = payload["accepted"]
+          return false unless accepted.is_a?(Hash)
+
+          Mpp::X402::Server.canonical_equal?(accepted, payment_requirements(request))
+        end
+
+        def decorate_challenge(headers, challenge, url: nil, http_method: nil, request: nil)
+          return headers if url.nil? || url.empty?
+
+          requirements = payment_requirements(request || challenge.request)
+          extensions = Mpp::X402::Server.route_extensions(challenge, http_method)
+          body = Mpp::X402::Server.payment_required_body(
+            requirements: requirements,
+            resource_url: url,
+            extensions: extensions,
+            error: "#{Mpp::X402::PAYMENT_SIGNATURE_HEADER} header is required"
+          )
+          headers["PAYMENT-REQUIRED"] = Mpp::X402::Header.encode_payment_required(body)
+          headers
+        end
+
+        def decorate_receipt(headers, receipt, credential, payment_signature: nil)
+          return headers if payment_signature.nil? || payment_signature.empty?
+
+          payload = credential.payload
+          request = decode_request(credential)
+          chain_id = request.dig("methodDetails", "chainId") || @chain_id
+          headers["PAYMENT-RESPONSE"] = Mpp::X402::Header.encode_payment_response({
+            "network" => "eip155:#{chain_id}",
+            "payer" => payload["from"],
+            "success" => true,
+            "transaction" => receipt.reference
+          })
+          headers
+        end
+
+        def bind_x402_credential(payment_signature, challenge:, request:, url:, body:, http_method: nil)
+          payment_payload = Mpp::X402::Header.decode_payment_signature(payment_signature)
+          requirements = payment_requirements(request)
+          authorization = Mpp::X402::Server.bind_credential(
+            payment_payload: payment_payload,
+            requirements: requirements,
+            resource_url: url,
+            challenge: challenge,
+            body: body,
+            route_binding: @x402[:route_binding],
+            http_method: http_method
+          )
+          echo = challenge.to_echo
+          Mpp::Credential.new(
+            challenge: echo,
+            payload: authorization.merge("_x402" => true),
+            source: source_for(authorization["from"])
+          )
+        end
+
+        private
+
+        def charge_intent
+          intent = @intents["charge"]
+          raise ArgumentError, "evm method is missing charge intent" unless intent
+
+          intent
+        end
+
+        def decode_request(credential)
+          echo = credential.challenge
+          return {} if echo.request.nil? || echo.request.empty?
+
+          Mpp::Parsing.b64_decode(echo.request)
+        rescue Mpp::ParseError
+          {}
+        end
+
+        def source_for(address)
+          "did:pkh:eip155:#{@chain_id}:#{Authorization.checksum_address(address)}"
+        end
+      end
+    end
+  end
+end

data/lib/mpp/methods/evm.rb

@@ -0,0 +1,67 @@
+# typed: true
+# frozen_string_literal: true
+
+module Mpp
+  module Methods
+    module Evm
+      autoload :Assets, "mpp/methods/evm/assets"
+      autoload :Authorization, "mpp/methods/evm/authorization"
+      autoload :ChargeIntent, "mpp/methods/evm/charge_intent"
+      autoload :EvmMethod, "mpp/methods/evm/evm_method"
+
+      # Factory for a server-side EVM charge method with inline x402 exact support.
+      def self.charge(currency:, recipient:, x402:, authorization: nil, chain_id: nil, decimals: nil,
+        on_payment_success: nil, can_offer: nil)
+        resolved = Assets.resolve(
+          currency,
+          authorization: authorization,
+          chain_id: chain_id,
+          decimals: decimals
+        )
+        x402_options = normalize_x402(x402)
+
+        charge_intent = ChargeIntent.new(
+          authorization: resolved.fetch(:authorization),
+          facilitator: X402::Facilitator.resolve(x402_options.fetch(:facilitator)),
+          max_timeout_seconds: x402_options.fetch(:max_timeout_seconds),
+          route_binding: x402_options.fetch(:route_binding)
+        )
+
+        method = EvmMethod.new(
+          currency: resolved.fetch(:address),
+          recipient: recipient,
+          decimals: resolved.fetch(:decimals),
+          chain_id: resolved.fetch(:chain_id),
+          authorization: resolved.fetch(:authorization),
+          x402: x402_options,
+          on_payment_success: on_payment_success,
+          can_offer: can_offer
+        )
+        method.intents = {"charge" => charge_intent}
+        method
+      end
+
+      def self.normalize_x402(x402)
+        options = x402.each_with_object({}) do |(key, value), acc|
+          acc[key.to_sym] = value
+        end
+        facilitator = options[:facilitator]
+        if facilitator.nil? || (facilitator.is_a?(String) && facilitator.empty?)
+          raise ArgumentError, "evm.charge requires x402: { facilitator: ... }"
+        end
+
+        route_binding = (options[:route_binding] || options[:routeBinding] || :resource).to_sym
+        unless [:resource, :required].include?(route_binding)
+          raise ArgumentError, "x402 route_binding must be :resource or :required"
+        end
+
+        {
+          facilitator: facilitator,
+          max_timeout_seconds: Integer(options[:max_timeout_seconds] || options[:maxTimeoutSeconds] || 300),
+          route_binding: route_binding
+        }
+      end
+      private_class_method :normalize_x402
+    end
+  end
+end

data/lib/mpp/methods/stripe/charge_intent.rb

@@ -61,10 +61,8 @@ module Mpp
             payment_method_types: payment_method_types
           }
 
-          # Include metadata from methodDetails if present
-          if method_details["metadata"].is_a?(Hash)
-            params[:metadata] = method_details["metadata"].transform_values(&:to_s)
-          end
+          metadata = method_details["metadata"].is_a?(Hash) ? method_details["metadata"].transform_values(&:to_s) : {}
+          params[:metadata] = metadata.merge("machine_payment" => "true")
 
           unless @client
             begin
@@ -78,15 +76,16 @@ module Mpp
             client = @client || ::Stripe::StripeClient.new(@secret_key)
             result = client.v1.payment_intents.create(
               params,
-              {idempotency_key: stripe_idempotency_key(credential)}
+              {stripe_version: Defaults::MACHINE_PAYMENTS_API_VERSION, idempotency_key: stripe_idempotency_key(credential)}
             )
           rescue => e
             raise Mpp::VerificationError, e.message
           end
 
           # https://docs.stripe.com/error-low-level#idempotency
-          if result.respond_to?(:last_response) &&
-              result.last_response&.headers&.[]("idempotent-replayed") == "true"
+          last_response = result.last_response if result.respond_to?(:last_response)
+          response_headers = last_response.respond_to?(:http_headers) ? last_response.http_headers : last_response&.headers
+          if response_headers&.[]("idempotent-replayed") == "true"
             raise Mpp::VerificationError, "Payment has already been processed."
           end
 
@@ -106,8 +105,11 @@ module Mpp
 
         private
 
+        # Include the SPT so a retry with a fresh token is a new PaymentIntent,
+        # matching mppx (`prefix_challengeId_spt`). Same challenge + same SPT
+        # still collapses via Stripe idempotency.
         def stripe_idempotency_key(credential)
-          "mpp-stripe-charge-#{credential.challenge.id}"
+          "mpp_#{credential.challenge.id}_#{credential.payload["spt"]}"
         end
       end
     end

data/lib/mpp/methods/stripe/crypto_payment_recorder.rb

@@ -0,0 +1,55 @@
+# typed: false
+# frozen_string_literal: true
+
+module Mpp
+  module Methods
+    module Stripe
+      # Records an already-verified crypto transfer as a Stripe PaymentIntent.
+      class CryptoPaymentRecorder
+        RAW_UNITS_PER_CENT = 10_000
+
+        def initialize(client:, network:, metadata: nil)
+          @client = client
+          @network = network
+          @metadata = metadata
+        end
+
+        def call(payload)
+          reference = payload[:receipt]&.reference
+          return unless reference.is_a?(String)
+
+          amount = Integer(payload.fetch(:request).fetch("amount"))
+          cents = (amount + (RAW_UNITS_PER_CENT / 2)) / RAW_UNITS_PER_CENT
+          return if cents < 1
+
+          params = {
+            amount: cents,
+            currency: "usd",
+            confirm: true,
+            payment_method_data: {type: "crypto"},
+            payment_method_types: ["crypto"],
+            payment_method_options: {
+              crypto: {
+                mode: "transaction_verification",
+                transaction_verification_options: {network: @network, transaction_hash: reference}
+              }
+            }
+          }
+          metadata = @metadata.is_a?(Hash) ? @metadata.transform_values(&:to_s) : {}
+          params[:metadata] = metadata.merge("machine_payment" => "true")
+
+          @client.v1.payment_intents.create(
+            params,
+            {stripe_version: Defaults::MACHINE_PAYMENTS_API_VERSION, idempotency_key: reference}
+          )
+        rescue => error
+          Kernel.warn(
+            "[stripe] failed to record crypto payment " \
+              "network=#{@network.inspect} transaction_hash=#{reference.inspect}: #{error.class}: #{error.message}"
+          )
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/mpp/methods/stripe/defaults.rb

@@ -6,6 +6,7 @@ module Mpp
     module Stripe
       module Defaults
         STRIPE_API_BASE = "https://api.stripe.com"
+        MACHINE_PAYMENTS_API_VERSION = "2026-07-29.preview"
         DEFAULT_CURRENCY = "usd"
         DEFAULT_DECIMALS = 2
       end