@aamp/protocol 1.1.3 → 1.1.5

package/dist/crypto.js

@@ -23,7 +23,10 @@ async function verifySignature(publicKey, data, signatureHex) {
     const encoder = new TextEncoder();
     const encodedData = encoder.encode(data);
     const signatureBytes = hexToBuf(signatureHex);
-    return await crypto.subtle.verify({ name: "ECDSA", hash: { name: "SHA-256" } }, publicKey, signatureBytes, encodedData);
+    console.log("   🔐 [AAMP Crypto] Verifying ECDSA P-256 Signature...");
+    const isValid = await crypto.subtle.verify({ name: "ECDSA", hash: { name: "SHA-256" } }, publicKey, signatureBytes, encodedData);
+    console.log(`   ${isValid ? "✅" : "❌"} [AAMP Crypto] Signature Result: ${isValid ? "VALID" : "INVALID"}`);
+    return isValid;
 }
 async function exportPublicKey(key) {
     const exported = await crypto.subtle.exportKey("spki", key);

package/dist/publisher.d.ts

@@ -1,8 +1,4 @@
-/**
- * Layer 2: Publisher Middleware
- * Used by content owners to enforce policy, log access, and filter bots.
- */
-import { AccessPolicy, ContentOrigin, EvaluationResult, UnauthenticatedStrategy, IdentityCache } from './types';
+import { AccessPolicy, ContentOrigin, EvaluationResult, IdentityCache, UnauthenticatedStrategy } from './types';
 export declare class AAMPPublisher {
     private policy;
     private keyPair;

package/dist/publisher.js

@@ -5,9 +5,9 @@ exports.AAMPPublisher = void 0;
  * Layer 2: Publisher Middleware
  * Used by content owners to enforce policy, log access, and filter bots.
  */
-const types_1 = require("./types");
-const crypto_1 = require("./crypto");
 const constants_1 = require("./constants");
+const crypto_1 = require("./crypto");
+const types_1 = require("./types");
 /**
  * Default In-Memory Cache (Fallback only)
  * NOT recommended for high-traffic Serverless production.
@@ -55,6 +55,7 @@ class AAMPPublisher {
         // 1. Check for AAMP Headers
         const hasAamp = reqHeaders[constants_1.HEADERS.PAYLOAD] && reqHeaders[constants_1.HEADERS.SIGNATURE] && reqHeaders[constants_1.HEADERS.PUBLIC_KEY];
         if (hasAamp) {
+            console.log("\n🔎 [AAMP Middleware] Detected Agent Headers. Starting Verification...");
             // It claims to be an Agent. Verify it.
             return await this.handleAgent(reqHeaders, rawPayload);
         }
@@ -104,32 +105,23 @@ class AAMPPublisher {
         const userAgent = headers['user-agent'] || '';
         // A. The "Obvious Bot" Blocklist (Fast Fail)
         const botSignatures = ['python-requests', 'curl', 'wget', 'scrapy', 'bot', 'crawler', 'spider'];
-        // Exception: Googlebot (if you want SEO). We'll treat Googlebot as a bot, 
-        // real implementations might white-list it via IP verification (not possible in just JS headers).
         if (botSignatures.some(sig => userAgent.toLowerCase().includes(sig))) {
             return false;
         }
         // B. Trusted Infrastructure Signals (The Real World Solution)
-        // If Cloudflare or Vercel says "This is a real user", we trust them.
-        // Cloudflare: 'cf-visitor' exists. 'cf-ipcountry' exists.
         if (headers['cf-visitor'] || headers['cf-ray'])
             return true;
-        // Vercel: 'x-vercel-id'
         if (headers['x-vercel-id'])
             return true;
-        // AWS CloudFront: 'cloudfront-viewer-address'
         if (headers['cloudfront-viewer-address'])
             return true;
         // C. The "Browser Fingerprint" (Fallback for direct connections)
-        // Real browsers almost always send these headers
         const hasAcceptLanguage = !!headers['accept-language'];
         const hasSecFetchDest = !!headers['sec-fetch-dest'];
         const hasUpgradeInsecure = !!headers['upgrade-insecure-requests'];
-        // If it has typical browser headers, we allow it.
         if (hasAcceptLanguage && (hasSecFetchDest || hasUpgradeInsecure)) {
             return true;
         }
-        // If it has no browser headers and no trusted proxy headers -> It's likely a script.
         return false;
     }
     /**
@@ -151,6 +143,7 @@ class AAMPPublisher {
             // Verify Core Logic
             const result = await this.verifyRequestLogic(signedRequest, agentKey, headerJson);
             if (!result.allowed) {
+                console.log(`⛔ [AAMP Deny] Reason: ${result.reason}`);
                 return {
                     allowed: false,
                     status: 403,
@@ -158,6 +151,7 @@ class AAMPPublisher {
                     visitorType: 'VERIFIED_AGENT'
                 };
             }
+            console.log(`✅ [AAMP Allow] Verified Agent: ${requestHeader.agent_id}`);
             return {
                 allowed: true,
                 status: 200,
@@ -167,6 +161,7 @@ class AAMPPublisher {
             };
         }
         catch (e) {
+            console.error(e);
             return { allowed: false, status: 400, reason: "INVALID_SIGNATURE", visitorType: 'UNIDENTIFIED_BOT' };
         }
     }
@@ -185,9 +180,11 @@ class AAMPPublisher {
         let identityVerified = false;
         const claimedDomain = request.header.agent_id;
         const pubKeyString = await (0, crypto_1.exportPublicKey)(requestPublicKey);
+        console.log(`   🆔 [AAMP Identity] Verifying DNS Binding for: ${claimedDomain}`);
         // Check Cache First
         const cachedKey = await this.cache.get(claimedDomain);
         if (cachedKey === pubKeyString) {
+            console.log("   ⚡ [AAMP Cache] Identity found in cache.");
             identityVerified = true;
         }
         else if (this.isDomain(claimedDomain)) {
@@ -218,23 +215,42 @@ class AAMPPublisher {
     }
     async verifyDnsBinding(domain, requestKeySpki) {
         try {
-            const url = `https://${domain}${constants_1.WELL_KNOWN_AGENT_PATH}`;
+            // Allow HTTP for localhost testing
+            const protocol = (domain.includes('localhost') || domain.match(/:\d+$/)) ? 'http' : 'https';
+            const url = `${protocol}://${domain}${constants_1.WELL_KNOWN_AGENT_PATH}`;
+            console.log(`   🌍 [AAMP DNS] Fetching Manifest: ${url} ...`);
             // In production, we need a short timeout to prevent hanging
             const controller = new AbortController();
             const timeoutId = setTimeout(() => controller.abort(), 1500); // 1.5s max for DNS check
             const response = await fetch(url, { signal: controller.signal });
             clearTimeout(timeoutId);
-            if (!response.ok)
+            if (!response.ok) {
+                console.log(`   ❌ [AAMP DNS] Fetch Failed: ${response.status}`);
                 return false;
+            }
             const manifest = await response.json();
-            return manifest.agent_id === domain && manifest.public_key === requestKeySpki;
+            console.log(`   📄 [AAMP DNS] Manifest received. Agent ID: ${manifest.agent_id}`);
+            // CHECK 1: Does the manifest actually belong to the domain?
+            if (manifest.agent_id !== domain) {
+                console.log(`   ❌ [AAMP DNS] Mismatch: Manifest ID ${manifest.agent_id} != Claimed ${domain}`);
+                return false;
+            }
+            // CHECK 2: Does the key match?
+            if (manifest.public_key !== requestKeySpki) {
+                console.log(`   ❌ [AAMP DNS] Key Mismatch: DNS Key != Request Key`);
+                return false;
+            }
+            console.log(`   ✅ [AAMP DNS] Identity Confirmed.`);
+            return true;
         }
-        catch {
+        catch (e) {
+            console.log(`   ❌ [AAMP DNS] Error: ${e.message}`);
             return false;
         }
     }
     isDomain(s) {
-        return /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
+        // Basic regex, allows localhost with ports
+        return /^[a-zA-Z0-9.-]+(:\d+)?$/.test(s) || /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
     }
     async generateResponseHeaders(origin) {
         if (!this.keyPair)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aamp/protocol",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "TypeScript reference implementation of AAMP v1.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/crypto.ts

@@ -28,12 +28,17 @@ export async function verifySignature(publicKey: CryptoKey, data: string, signat
   const encodedData = encoder.encode(data);
   const signatureBytes = hexToBuf(signatureHex);
 
-  return await crypto.subtle.verify(
+  console.log("   🔐 [AAMP Crypto] Verifying ECDSA P-256 Signature...");
+  
+  const isValid = await crypto.subtle.verify(
     { name: "ECDSA", hash: { name: "SHA-256" } },
     publicKey,
     signatureBytes as any,
     encodedData as any
   );
+
+  console.log(`   ${isValid ? "✅" : "❌"} [AAMP Crypto] Signature Result: ${isValid ? "VALID" : "INVALID"}`);
+  return isValid;
 }
 
 export async function exportPublicKey(key: CryptoKey): Promise<string> {

package/src/publisher.ts

@@ -2,9 +2,9 @@
  * Layer 2: Publisher Middleware
  * Used by content owners to enforce policy, log access, and filter bots.
  */
-import { AccessPolicy, AccessPurpose, SignedAccessRequest, ContentOrigin, FeedbackSignal, AgentIdentityManifest, EvaluationResult, UnauthenticatedStrategy, IdentityCache } from './types';
-import { verifySignature, signData, exportPublicKey } from './crypto';
-import { MAX_CLOCK_SKEW_MS, HEADERS, WELL_KNOWN_AGENT_PATH } from './constants';
+import { HEADERS, MAX_CLOCK_SKEW_MS, WELL_KNOWN_AGENT_PATH } from './constants';
+import { exportPublicKey, signData, verifySignature } from './crypto';
+import { AccessPolicy, AccessPurpose, AgentIdentityManifest, ContentOrigin, EvaluationResult, IdentityCache, SignedAccessRequest, UnauthenticatedStrategy } from './types';
 
 interface VerificationResult {
   allowed: boolean;
@@ -76,6 +76,7 @@ export class AAMPPublisher {
     const hasAamp = reqHeaders[HEADERS.PAYLOAD] && reqHeaders[HEADERS.SIGNATURE] && reqHeaders[HEADERS.PUBLIC_KEY];
 
     if (hasAamp) {
+      console.log("\n🔎 [AAMP Middleware] Detected Agent Headers. Starting Verification...");
       // It claims to be an Agent. Verify it.
       return await this.handleAgent(reqHeaders, rawPayload);
     }
@@ -130,35 +131,24 @@ export class AAMPPublisher {
     
     // A. The "Obvious Bot" Blocklist (Fast Fail)
     const botSignatures = ['python-requests', 'curl', 'wget', 'scrapy', 'bot', 'crawler', 'spider'];
-    // Exception: Googlebot (if you want SEO). We'll treat Googlebot as a bot, 
-    // real implementations might white-list it via IP verification (not possible in just JS headers).
     if (botSignatures.some(sig => userAgent.toLowerCase().includes(sig))) {
        return false;
     }
 
     // B. Trusted Infrastructure Signals (The Real World Solution)
-    // If Cloudflare or Vercel says "This is a real user", we trust them.
-    // Cloudflare: 'cf-visitor' exists. 'cf-ipcountry' exists.
     if (headers['cf-visitor'] || headers['cf-ray']) return true;
-    
-    // Vercel: 'x-vercel-id'
     if (headers['x-vercel-id']) return true;
-    
-    // AWS CloudFront: 'cloudfront-viewer-address'
     if (headers['cloudfront-viewer-address']) return true;
 
     // C. The "Browser Fingerprint" (Fallback for direct connections)
-    // Real browsers almost always send these headers
     const hasAcceptLanguage = !!headers['accept-language'];
     const hasSecFetchDest = !!headers['sec-fetch-dest']; 
     const hasUpgradeInsecure = !!headers['upgrade-insecure-requests'];
 
-    // If it has typical browser headers, we allow it.
     if (hasAcceptLanguage && (hasSecFetchDest || hasUpgradeInsecure)) {
       return true;
     }
 
-    // If it has no browser headers and no trusted proxy headers -> It's likely a script.
     return false;
   }
 
@@ -192,6 +182,7 @@ export class AAMPPublisher {
       const result = await this.verifyRequestLogic(signedRequest, agentKey, headerJson);
 
       if (!result.allowed) {
+        console.log(`⛔ [AAMP Deny] Reason: ${result.reason}`);
         return {
           allowed: false,
           status: 403,
@@ -200,6 +191,7 @@ export class AAMPPublisher {
         };
       }
 
+      console.log(`✅ [AAMP Allow] Verified Agent: ${requestHeader.agent_id}`);
       return {
         allowed: true,
         status: 200,
@@ -209,6 +201,7 @@ export class AAMPPublisher {
       };
 
     } catch (e) {
+      console.error(e);
       return { allowed: false, status: 400, reason: "INVALID_SIGNATURE", visitorType: 'UNIDENTIFIED_BOT' };
     }
   }
@@ -235,10 +228,13 @@ export class AAMPPublisher {
     const claimedDomain = request.header.agent_id;
     const pubKeyString = await exportPublicKey(requestPublicKey);
     
+    console.log(`   🆔 [AAMP Identity] Verifying DNS Binding for: ${claimedDomain}`);
+
     // Check Cache First
     const cachedKey = await this.cache.get(claimedDomain);
     
     if (cachedKey === pubKeyString) {
+      console.log("   ⚡ [AAMP Cache] Identity found in cache.");
       identityVerified = true;
     } else if (this.isDomain(claimedDomain)) {
       // Cache Miss: Perform DNS Fetch
@@ -273,7 +269,12 @@ export class AAMPPublisher {
 
   private async verifyDnsBinding(domain: string, requestKeySpki: string): Promise<boolean> {
     try {
-      const url = `https://${domain}${WELL_KNOWN_AGENT_PATH}`;
+      // Allow HTTP for localhost testing
+      const protocol = (domain.includes('localhost') || domain.match(/:\d+$/)) ? 'http' : 'https';
+      const url = `${protocol}://${domain}${WELL_KNOWN_AGENT_PATH}`;
+      
+      console.log(`   🌍 [AAMP DNS] Fetching Manifest: ${url} ...`);
+
       // In production, we need a short timeout to prevent hanging
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 1500); // 1.5s max for DNS check
@@ -281,14 +282,37 @@ export class AAMPPublisher {
       const response = await fetch(url, { signal: controller.signal });
       clearTimeout(timeoutId);
       
-      if (!response.ok) return false;
+      if (!response.ok) {
+        console.log(`   ❌ [AAMP DNS] Fetch Failed: ${response.status}`);
+        return false;
+      }
+
       const manifest = await response.json() as AgentIdentityManifest;
-      return manifest.agent_id === domain && manifest.public_key === requestKeySpki;
-    } catch { return false; }
+      console.log(`   📄 [AAMP DNS] Manifest received. Agent ID: ${manifest.agent_id}`);
+
+      // CHECK 1: Does the manifest actually belong to the domain?
+      if (manifest.agent_id !== domain) {
+        console.log(`   ❌ [AAMP DNS] Mismatch: Manifest ID ${manifest.agent_id} != Claimed ${domain}`);
+        return false;
+      }
+
+      // CHECK 2: Does the key match?
+      if (manifest.public_key !== requestKeySpki) {
+         console.log(`   ❌ [AAMP DNS] Key Mismatch: DNS Key != Request Key`);
+         return false;
+      }
+
+      console.log(`   ✅ [AAMP DNS] Identity Confirmed.`);
+      return true;
+    } catch (e: any) { 
+        console.log(`   ❌ [AAMP DNS] Error: ${e.message}`);
+        return false; 
+    }
   }
 
   private isDomain(s: string): boolean {
-    return /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
+    // Basic regex, allows localhost with ports
+    return /^[a-zA-Z0-9.-]+(:\d+)?$/.test(s) || /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
   }
 
   async generateResponseHeaders(origin: ContentOrigin): Promise<Record<string, string>> {