@aamp/protocol 1.1.2 → 1.1.3

package/src/express.ts

@@ -1,104 +1,95 @@
-/**
- * Layer 3: Framework Adapters
- * Zero-friction integration for Express/Node.js.
- */
-import { AAMPPublisher } from './publisher';
-import { AccessPolicy, ContentOrigin, SignedAccessRequest } from './types';
-import { generateKeyPair, verifySignature } from './crypto';
-import { HEADERS } from './constants';
-
-export interface AAMPConfig {
-  policy: Omit<AccessPolicy, 'version'>;
-  meta: {
-    origin: keyof typeof ContentOrigin;
-    paymentPointer?: string;
-  };
-}
-
-export class AAMP {
-  private publisher: AAMPPublisher;
-  private origin: ContentOrigin;
-  private ready: Promise<void>;
-
-  private constructor(config: AAMPConfig) {
-    this.publisher = new AAMPPublisher({
-      version: '1.1',
-      ...config.policy
-    } as AccessPolicy);
-    
-    this.origin = ContentOrigin[config.meta.origin];
-    
-    this.ready = generateKeyPair().then(keys => {
-      return this.publisher.initialize(keys);
-    });
-  }
-
-  static init(config: AAMPConfig): AAMP {
-    return new AAMP(config);
-  }
-
-  /**
-   * Express Middleware
-   */
-  middleware() {
-    return async (req: any, res: any, next: any) => {
-      await this.ready;
-
-      // 1. Inject Provenance Headers (Passive Protection)
-      const headers = await this.publisher.generateResponseHeaders(this.origin);
-      Object.entries(headers).forEach(([k, v]) => {
-        res.setHeader(k, v);
-      });
-
-      // 2. Active Verification (If Agent sends signed headers)
-      const payloadHeader = req.headers[HEADERS.PAYLOAD];
-      const sigHeader = req.headers[HEADERS.SIGNATURE];
-      const keyHeader = req.headers[HEADERS.PUBLIC_KEY];
-
-      if (payloadHeader && sigHeader && keyHeader) {
-        try {
-          const headerJson = atob(payloadHeader); // RAW STRING
-          const requestHeader = JSON.parse(headerJson);
-          
-          const signedRequest: SignedAccessRequest = {
-            header: requestHeader,
-            signature: sigHeader,
-            publicKey: keyHeader
-          };
-
-          const agentKey = await crypto.subtle.importKey(
-            "spki",
-            new Uint8Array(atob(keyHeader).split('').map(c => c.charCodeAt(0))),
-            { name: "ECDSA", namedCurve: "P-256" },
-            true,
-            ["verify"]
-          );
-
-          // Pass raw headerJson to ensure signature matches exactly what was signed
-          const result = await this.publisher.verifyRequest(signedRequest, agentKey, headerJson);
-
-          if (!result.allowed) {
-            res.status(403).json({ error: result.reason });
-            return;
-          }
-
-          // Verified!
-          req.aamp = { verified: true, ...requestHeader };
-
-        } catch (e) {
-          res.status(400).json({ error: "Invalid AAMP Signature" });
-          return;
-        }
-      }
-
-      next();
-    };
-  }
-
-  discoveryHandler() {
-    return (req: any, res: any) => {
-      res.setHeader('Content-Type', 'application/json');
-      res.send(JSON.stringify(this.publisher.getPolicy(), null, 2));
-    };
-  }
+/**
+ * Layer 3: Framework Adapters
+ * Zero-friction integration for Express/Node.js.
+ */
+import { AAMPPublisher } from './publisher';
+import { AccessPolicy, ContentOrigin, UnauthenticatedStrategy, IdentityCache } from './types';
+import { generateKeyPair } from './crypto';
+
+export interface AAMPConfig {
+  policy: Omit<AccessPolicy, 'version'>;
+  meta: {
+    origin: keyof typeof ContentOrigin;
+    paymentPointer?: string;
+  };
+  strategy?: UnauthenticatedStrategy;
+  // Optional: Provide a Redis/Memcached adapter here for production
+  cache?: IdentityCache;
+}
+
+export class AAMP {
+  private publisher: AAMPPublisher;
+  private origin: ContentOrigin;
+  private ready: Promise<void>;
+
+  private constructor(config: AAMPConfig) {
+    this.publisher = new AAMPPublisher(
+      { version: '1.1', ...config.policy } as AccessPolicy,
+      config.strategy || 'PASSIVE',
+      config.cache
+    );
+    
+    this.origin = ContentOrigin[config.meta.origin];
+    
+    this.ready = generateKeyPair().then(keys => {
+      return this.publisher.initialize(keys);
+    });
+  }
+
+  static init(config: AAMPConfig): AAMP {
+    return new AAMP(config);
+  }
+
+  /**
+   * Express Middleware
+   */
+  middleware() {
+    return async (req: any, res: any, next: any) => {
+      await this.ready;
+
+      // Normalize headers to lowercase dictionary
+      const headers: Record<string, string> = {};
+      Object.keys(req.headers).forEach(key => {
+        headers[key.toLowerCase()] = req.headers[key] as string;
+      });
+
+      // Retrieve Raw Payload if available (optional but good for crypto)
+      // Note: Express body parsing might interfere, so we usually rely on the header content.
+      const rawPayload = headers['x-aamp-payload'];
+
+      // Evaluate Visitor
+      const result = await this.publisher.evaluateVisitor(headers, rawPayload);
+
+      // Enforce Decision
+      if (!result.allowed) {
+        res.status(result.status).json({ 
+          error: result.reason,
+          visitor_type: result.visitorType
+        });
+        return;
+      }
+
+      // Inject Provenance Headers (For the humans/agents that got through)
+      const respHeaders = await this.publisher.generateResponseHeaders(this.origin);
+      Object.entries(respHeaders).forEach(([k, v]) => {
+        res.setHeader(k, v);
+      });
+
+      // Attach metadata to request for downstream use
+      req.aamp = {
+        verified: result.visitorType === 'VERIFIED_AGENT',
+        type: result.visitorType,
+        ...result.metadata
+      };
+
+      next();
+    };
+  }
+
+  discoveryHandler() {
+    return (req: any, res: any) => {
+      res.setHeader('Content-Type', 'application/json');
+      res.send(JSON.stringify(this.publisher.getPolicy(), null, 2));
+    };
+  }
 }

package/src/index.ts

@@ -1,13 +1,13 @@
-/**
- * AAMP SDK Public API
- * 
- * This is the main entry point for the library.
- */
-
-export * from './types';
-export * from './constants';
-export * from './agent';
-export * from './publisher';
-export * from './crypto';
-export * from './express'; // Node.js / Express Adapter
+/**
+ * AAMP SDK Public API
+ * 
+ * This is the main entry point for the library.
+ */
+
+export * from './types';
+export * from './constants';
+export * from './agent';
+export * from './publisher';
+export * from './crypto';
+export * from './express'; // Node.js / Express Adapter
 export { AAMPNext } from './nextjs';  // Serverless / Next.js Adapter

package/src/nextjs.ts

@@ -1,109 +1,92 @@
-/**
- * Layer 3: Framework Adapters
- * Serverless integration for Next.js (App Router & API Routes).
- */
-import { AAMPPublisher } from './publisher';
-import { AccessPolicy, ContentOrigin, SignedAccessRequest } from './types';
-import { generateKeyPair } from './crypto';
-import { HEADERS } from './constants';
-
-type NextRequest = any; 
-type NextResponse = any; 
-
-const createJsonResponse = (body: any, status = 200) => {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { 'Content-Type': 'application/json' }
-  });
-};
-
-export interface AAMPConfig {
-  policy: Omit<AccessPolicy, 'version'>;
-  meta: {
-    origin: keyof typeof ContentOrigin;
-    paymentPointer?: string;
-  };
-}
-
-export class AAMPNext {
-  private publisher: AAMPPublisher;
-  private origin: ContentOrigin;
-  private ready: Promise<void>;
-
-  private constructor(config: AAMPConfig) {
-    this.publisher = new AAMPPublisher({
-      version: '1.1',
-      ...config.policy
-    } as AccessPolicy);
-    this.origin = ContentOrigin[config.meta.origin];
-    
-    this.ready = generateKeyPair().then(keys => this.publisher.initialize(keys));
-  }
-
-  static init(config: AAMPConfig): AAMPNext {
-    return new AAMPNext(config);
-  }
-
-  /**
-   * Serverless Route Wrapper
-   */
-  withProtection(handler: (req: NextRequest) => Promise<NextResponse>) {
-    return async (req: NextRequest) => {
-      await this.ready;
-
-      // 1. Active Verification
-      const payloadHeader = req.headers.get(HEADERS.PAYLOAD);
-      const sigHeader = req.headers.get(HEADERS.SIGNATURE);
-      const keyHeader = req.headers.get(HEADERS.PUBLIC_KEY);
-
-      if (payloadHeader && sigHeader && keyHeader) {
-        try {
-          const headerJson = atob(payloadHeader); // RAW STRING
-          const requestHeader = JSON.parse(headerJson);
-          
-          const signedRequest: SignedAccessRequest = {
-            header: requestHeader,
-            signature: sigHeader,
-            publicKey: keyHeader
-          };
-
-          const agentKey = await crypto.subtle.importKey(
-            "spki",
-            new Uint8Array(atob(keyHeader).split('').map(c => c.charCodeAt(0))),
-            { name: "ECDSA", namedCurve: "P-256" },
-            true,
-            ["verify"]
-          );
-
-          // Pass raw headerJson to ensure signature matches exactly what was signed
-          const result = await this.publisher.verifyRequest(signedRequest, agentKey, headerJson);
-
-          if (!result.allowed) {
-            return createJsonResponse({ error: result.reason }, 403);
-          }
-        } catch (e) {
-          return createJsonResponse({ error: "Invalid AAMP Signature" }, 400);
-        }
-      }
-
-      // 2. Execute Handler
-      const response = await handler(req);
-
-      // 3. Inject Provenance Headers (Passive)
-      const aampHeaders = await this.publisher.generateResponseHeaders(this.origin);
-      if (response && response.headers) {
-         Object.entries(aampHeaders).forEach(([k, v]) => {
-           response.headers.set(k, v);
-         });
-      }
-
-      return response;
-    };
-  }
-
-  discoveryHandler() {
-    return async () => {
-      return createJsonResponse(this.publisher.getPolicy());
-    };
-  }
+/**
+ * Layer 3: Framework Adapters
+ * Serverless integration for Next.js (App Router & API Routes).
+ */
+import { AAMPPublisher } from './publisher';
+import { AccessPolicy, ContentOrigin, UnauthenticatedStrategy, IdentityCache } from './types';
+import { generateKeyPair } from './crypto';
+
+type NextRequest = any; 
+type NextResponse = any; 
+
+const createJsonResponse = (body: any, status = 200) => {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json' }
+  });
+};
+
+export interface AAMPConfig {
+  policy: Omit<AccessPolicy, 'version'>;
+  meta: {
+    origin: keyof typeof ContentOrigin;
+    paymentPointer?: string;
+  };
+  strategy?: UnauthenticatedStrategy;
+  // Optional: Provide a KV/Redis adapter here for production
+  cache?: IdentityCache;
+}
+
+export class AAMPNext {
+  private publisher: AAMPPublisher;
+  private origin: ContentOrigin;
+  private ready: Promise<void>;
+
+  private constructor(config: AAMPConfig) {
+    this.publisher = new AAMPPublisher(
+      { version: '1.1', ...config.policy } as AccessPolicy,
+      config.strategy || 'PASSIVE',
+      config.cache
+    );
+    this.origin = ContentOrigin[config.meta.origin];
+    this.ready = generateKeyPair().then(keys => this.publisher.initialize(keys));
+  }
+
+  static init(config: AAMPConfig): AAMPNext {
+    return new AAMPNext(config);
+  }
+
+  /**
+   * Serverless Route Wrapper
+   */
+  withProtection(handler: (req: NextRequest) => Promise<NextResponse>) {
+    return async (req: NextRequest) => {
+      await this.ready;
+
+      // Extract Headers map
+      const headers: Record<string, string> = {};
+      req.headers.forEach((value: string, key: string) => {
+        headers[key.toLowerCase()] = value;
+      });
+
+      // Evaluate
+      const result = await this.publisher.evaluateVisitor(headers, headers['x-aamp-payload']);
+
+      if (!result.allowed) {
+        return createJsonResponse({ 
+          error: result.reason,
+          visitor_type: result.visitorType
+        }, result.status);
+      }
+
+      // Execute Handler
+      const response = await handler(req);
+
+      // Inject Provenance
+      const aampHeaders = await this.publisher.generateResponseHeaders(this.origin);
+      if (response && response.headers) {
+         Object.entries(aampHeaders).forEach(([k, v]) => {
+           response.headers.set(k, v);
+         });
+      }
+
+      return response;
+    };
+  }
+
+  discoveryHandler() {
+    return async () => {
+      return createJsonResponse(this.publisher.getPolicy());
+    };
+  }
 }