weft-sdk 0.24.0 → 0.32.2

data/lib/weft/facilitator/extensions.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require_relative 'json_wire'
+require_relative 'product'
+
+module Weft
+  module Facilitator
+    WEFT_REQUEST_EXTENSION_KEY = 'weft.request'
+    MAX_EXTENSION_BYTES = 16 * 1024
+    WEFT_REQUEST_INFO_SCHEMA = {
+      '$schema' => 'https://json-schema.org/draft/2020-12/schema',
+      'title' => 'Weft per-request context',
+      'description' => 'Seller-authored context for one paid request, for display only. ' \
+                       'Unauthenticated buyer input by the time it is read; key nothing on it.',
+      'type' => 'object',
+      'additionalProperties' => true
+    }.freeze
+
+    module Extensions
+      module_function
+
+      def dynamic_extension(key, sink = nil)
+        sink ||= Product.create_warn
+        Hook.new(key, sink)
+      end
+
+      def register_dynamic_extensions(server, routes)
+        keys = dynamic_keys(routes)
+        return if keys.empty?
+
+        sink = Product.create_warn
+        unless server.respond_to?(:register_extension)
+          sink.call(
+            'this @x402/core build has no registerExtension, so per-request route ' \
+            "extensions (#{keys.join(', ')}) cannot be resolved and will not ship"
+          )
+          return
+        end
+
+        keys.each { |key| server.register_extension(dynamic_extension(key, sink)) }
+      end
+
+      def dynamic_keys(routes)
+        keys = []
+        route_configs(routes).each do |config|
+          extensions = Product.read(config, 'extensions')
+          next unless extensions.is_a?(Hash)
+
+          extensions.each do |key, value|
+            keys << key.to_s if value.respond_to?(:call)
+          end
+        end
+        keys.uniq
+      end
+
+      def route_configs(routes)
+        return [] unless routes.is_a?(Hash)
+
+        configs = Product.single_route?(routes) ? [routes] : routes.values
+        configs.select { |config| config.is_a?(Hash) }
+      end
+    end
+
+    class Hook
+      attr_reader :key
+
+      def initialize(key, sink)
+        @key = key
+        @sink = sink
+      end
+
+      def enrich_payment_required_response(declaration, context)
+        return nil unless declaration.respond_to?(:call)
+
+        request = request_of(context)
+        unless request
+          @sink.call(
+            "extensions[#{@key}] is a callback but no HTTP request context " \
+            'reached it; dropping the key from the challenge',
+            "#{@key}:no-request"
+          )
+          return drop_key(context)
+        end
+
+        begin
+          resolved = declaration.call(request)
+        rescue StandardError => e
+          @sink.call(
+            "extensions[#{@key}] callback failed; dropping the key from the " \
+            "challenge: #{e.message}",
+            "#{@key}:threw"
+          )
+          return drop_key(context)
+        end
+
+        return drop_key(context) if resolved.nil?
+
+        json = JsonWire.generate(resolved)
+        if json.nil?
+          @sink.call(
+            "extensions[#{@key}] callback returned a value JSON cannot carry (a " \
+            'function, a circular reference, a BigInt or similar); dropping ' \
+            'the key from the challenge',
+            "#{@key}:unserializable"
+          )
+          return drop_key(context)
+        end
+
+        wire = JSON.parse(json)
+        unless wire.is_a?(Hash)
+          @sink.call(
+            "extensions[#{@key}] callback returned #{wire.is_a?(Array) ? 'an array' : "a #{js_type(wire)}"}; " \
+            'the x402 extensions channel carries objects, so the key is ' \
+            'dropped from the challenge',
+            "#{@key}:not-an-object"
+          )
+          return drop_key(context)
+        end
+
+        value = if @key == WEFT_REQUEST_EXTENSION_KEY
+                  { 'info' => wire, 'schema' => WEFT_REQUEST_INFO_SCHEMA }
+                else
+                  wire
+                end
+        bytes = projected_bytes(context, value) || json.bytesize
+        if bytes > MAX_EXTENSION_BYTES
+          @sink.call(
+            "extensions[#{@key}] takes the challenge's extensions to #{bytes} " \
+            "bytes, over the #{MAX_EXTENSION_BYTES}-byte facilitator relay " \
+            'cap; dropping the key so the rest of the declaration still ' \
+            'reaches settlement',
+            "#{@key}:over-cap"
+          )
+          return drop_key(context)
+        end
+
+        value
+      end
+
+      private
+
+      def request_of(context)
+        transport = read_context(context, 'transportContext')
+        return nil unless transport.is_a?(Hash)
+
+        Product.read(transport, 'request')
+      end
+
+      def drop_key(context)
+        response = read_context(context, 'paymentRequiredResponse')
+        extensions = response.is_a?(Hash) ? Product.read(response, 'extensions') : nil
+        if extensions.is_a?(Hash)
+          extensions.delete(@key)
+          extensions.delete(@key.to_sym)
+        end
+        nil
+      end
+
+      def projected_bytes(context, value)
+        response = read_context(context, 'paymentRequiredResponse')
+        extensions = response.is_a?(Hash) ? Product.read(response, 'extensions') : nil
+        projected = Product.stringify_hash(extensions || {})
+        projected[@key] = value
+        json = JsonWire.generate(projected)
+        json&.bytesize
+      end
+
+      def read_context(context, key)
+        Product.read(context, key)
+      end
+
+      def js_type(value)
+        case value
+        when String then 'string'
+        when Integer, Float then 'number'
+        when TrueClass, FalseClass then 'boolean'
+        when nil then 'object'
+        else 'object'
+        end
+      end
+    end
+  end
+end

data/lib/weft/facilitator/fee.rb

@@ -1,27 +1,35 @@
+require 'json'
+
+require_relative 'client'
+
 module Weft
   module Facilitator
     module Fee
-      DEFAULT_TTL = 300
+      DEFAULT_TTL_MS = 5 * 60 * 1000
 
       @cache = nil
 
       class << self
-        def get_fee_info(client: Client.new, ttl: DEFAULT_TTL)
+        def get_fee_info(client: Client.new, ttl: DEFAULT_TTL_MS)
           return @cache[:fee] if cache_valid?
 
           supported = client.supported
-          fee = supported['fee']
+          fee = supported['fee'] || supported[:fee]
           raise 'Fee information not found in /supported response' unless fee
 
           validate_fee!(fee)
+          normalized = {
+            'amount' => fee['amount'] || fee[:amount],
+            'asset' => fee['asset'] || fee[:asset],
+            'network' => fee['network'] || fee[:network]
+          }
 
           @cache = {
-            fee: fee,
-            fetched_at: Time.now.to_i,
+            fee: normalized,
+            fetched_at: now_ms,
             ttl: ttl
           }
-
-          fee
+          normalized
         end
 
         def invalidate_fee_cache
@@ -33,13 +41,20 @@ module Weft
         def cache_valid?
           return false unless @cache
 
-          Time.now.to_i - @cache[:fetched_at] < @cache[:ttl]
+          now_ms - @cache[:fetched_at] < @cache[:ttl]
+        end
+
+        def now_ms
+          Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
         end
 
         def validate_fee!(fee)
-          raise 'Invalid fee structure: amount must be a string' unless fee['amount'].is_a?(String)
-          raise 'Invalid fee structure: asset must be a string' unless fee['asset'].is_a?(String)
-          raise 'Invalid fee structure: network must be a string' unless fee['network'].is_a?(String)
+          amount = fee['amount'] || fee[:amount]
+          asset = fee['asset'] || fee[:asset]
+          network = fee['network'] || fee[:network]
+          raise 'Invalid fee structure: amount must be a string' unless amount.is_a?(String)
+          raise 'Invalid fee structure: asset must be a string' unless asset.is_a?(String)
+          raise 'Invalid fee structure: network must be a string' unless network.is_a?(String)
         end
       end
     end

data/lib/weft/facilitator/handshake.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require_relative '../generated/version'
+require_relative 'json_wire'
+require_relative 'product'
+
+module Weft
+  module Facilitator
+    WEFT_DECLARED_HEADER = 'X-Weft-Declared'
+    WEFT_API_KEY_HEADER = 'X-API-Key'
+    HEADER_SAFE = /\A[\x21-\x7e]+\z/
+    ADAPTER_NAME = 'rack'
+
+    module Handshake
+      module_function
+
+      def build_auth_headers(adapter, api_key, declaration)
+        declaration = stringify_declaration(declaration)
+        key = resolve_api_key(api_key)
+        supported = {
+          'User-Agent' => "weft-sdk-#{adapter}/#{sdk_version}"
+        }
+        supported['Authorization'] = "Bearer #{key}" unless key.nil?
+
+        declared = declared_identity_value(declaration)
+        supported[WEFT_DECLARED_HEADER] = declared unless declared.nil?
+
+        headers = { 'supported' => supported }
+        unless key.nil?
+          headers['settle'] = { WEFT_API_KEY_HEADER => key }
+          headers['verify'] = { WEFT_API_KEY_HEADER => key }
+        end
+        headers
+      end
+
+      def declared_identity_value(declaration)
+        declared = Product.sanitize_product_identity(declaration)
+        dimensions = Product.resolve_dimensions(declaration['dimensions'], Product.create_warn)
+        payload = {}
+        payload['name'] = declared['name'] if declared.key?('name')
+        payload['type'] = declared['type'] if declared.key?('type')
+        payload['tags'] = declared['tags'] if declared.key?('tags')
+        payload['icon_url'] = declared['iconUrl'] if declared.key?('iconUrl')
+        payload['dimensions'] = dimensions unless dimensions.nil?
+        return nil if payload.empty?
+
+        JsonWire.base64url_encode(JsonWire.generate(payload))
+      end
+
+      def resolve_api_key(api_key)
+        return nil if api_key.nil?
+        unless api_key.is_a?(String)
+          warn "[weft] ignoring apiKey: expected a string, got #{js_type(api_key)}"
+          return nil
+        end
+
+        trimmed = api_key.strip
+        if trimmed.empty?
+          warn '[weft] ignoring empty apiKey'
+          return nil
+        end
+        unless HEADER_SAFE.match?(trimmed)
+          warn '[weft] ignoring apiKey: it contains whitespace or non-printable ' \
+               'characters that cannot travel in an HTTP header'
+          return nil
+        end
+
+        trimmed
+      end
+
+      def stringify_declaration(declaration)
+        return {} unless declaration.is_a?(Hash)
+
+        declaration.each_with_object({}) do |(key, value), out|
+          out[key.to_s] = value
+        end
+      end
+
+      def sdk_version
+        defined?(SDK) ? SDK::VERSION : VERSION
+      end
+
+      def js_type(value)
+        case value
+        when Integer, Float then 'number'
+        when TrueClass, FalseClass then 'boolean'
+        else 'object'
+        end
+      end
+    end
+  end
+end

data/lib/weft/facilitator/json_wire.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'json'
+
+module Weft
+  module Facilitator
+    # JSON.stringify and the two base64 forms @x402/core puts on the wire.
+    module JsonWire
+      module_function
+
+      def generate(value)
+        return nil if circular?(value)
+
+        JSON.generate(sanitize(value))
+      rescue JSON::GeneratorError, JSON::NestingError
+        nil
+      end
+
+      def circular?(value, seen = {})
+        case value
+        when Hash, Array
+          return true if seen[value.object_id]
+
+          seen[value.object_id] = true
+          children = value.is_a?(Hash) ? value.values : value
+          children.any? { |item| circular?(item, seen) }
+        else
+          false
+        end
+      end
+
+      def sanitize(value)
+        case value
+        when Hash
+          value.each_with_object({}) do |(key, item), out|
+            out[key.is_a?(Symbol) ? key.to_s : key] = sanitize(item)
+          end
+        when Array
+          value.map { |item| sanitize(item) }
+        when Float
+          value.finite? ? value : nil
+        else
+          value
+        end
+      end
+
+      def base64_encode(text)
+        Base64.strict_encode64(text.b)
+      end
+
+      def base64_decode(text)
+        Base64.strict_decode64(text).force_encoding(Encoding::UTF_8)
+      end
+
+      def base64url_encode(text)
+        Base64.urlsafe_encode64(text.b, padding: false)
+      end
+
+      def base64url_decode(text)
+        padded = text.tr('-_', '+/')
+        padded += '=' * ((4 - (padded.length % 4)) % 4)
+        Base64.decode64(padded).force_encoding(Encoding::UTF_8)
+      end
+
+      def encode_json(value)
+        json = generate(value)
+        raise ArgumentError, 'value is not JSON' if json.nil?
+
+        base64_encode(json)
+      end
+    end
+  end
+end