@aamp/protocol 1.1.4 → 1.1.5

package/dist/crypto.js

@@ -23,7 +23,10 @@ async function verifySignature(publicKey, data, signatureHex) {
     const encoder = new TextEncoder();
     const encodedData = encoder.encode(data);
     const signatureBytes = hexToBuf(signatureHex);
-    return await crypto.subtle.verify({ name: "ECDSA", hash: { name: "SHA-256" } }, publicKey, signatureBytes, encodedData);
+    console.log("   🔐 [AAMP Crypto] Verifying ECDSA P-256 Signature...");
+    const isValid = await crypto.subtle.verify({ name: "ECDSA", hash: { name: "SHA-256" } }, publicKey, signatureBytes, encodedData);
+    console.log(`   ${isValid ? "✅" : "❌"} [AAMP Crypto] Signature Result: ${isValid ? "VALID" : "INVALID"}`);
+    return isValid;
 }
 async function exportPublicKey(key) {
     const exported = await crypto.subtle.exportKey("spki", key);

package/dist/publisher.js

@@ -55,6 +55,7 @@ class AAMPPublisher {
         // 1. Check for AAMP Headers
         const hasAamp = reqHeaders[constants_1.HEADERS.PAYLOAD] && reqHeaders[constants_1.HEADERS.SIGNATURE] && reqHeaders[constants_1.HEADERS.PUBLIC_KEY];
         if (hasAamp) {
+            console.log("\n🔎 [AAMP Middleware] Detected Agent Headers. Starting Verification...");
             // It claims to be an Agent. Verify it.
             return await this.handleAgent(reqHeaders, rawPayload);
         }
@@ -104,32 +105,23 @@ class AAMPPublisher {
         const userAgent = headers['user-agent'] || '';
         // A. The "Obvious Bot" Blocklist (Fast Fail)
         const botSignatures = ['python-requests', 'curl', 'wget', 'scrapy', 'bot', 'crawler', 'spider'];
-        // Exception: Googlebot (if you want SEO). We'll treat Googlebot as a bot, 
-        // real implementations might white-list it via IP verification (not possible in just JS headers).
         if (botSignatures.some(sig => userAgent.toLowerCase().includes(sig))) {
             return false;
         }
         // B. Trusted Infrastructure Signals (The Real World Solution)
-        // If Cloudflare or Vercel says "This is a real user", we trust them.
-        // Cloudflare: 'cf-visitor' exists. 'cf-ipcountry' exists.
         if (headers['cf-visitor'] || headers['cf-ray'])
             return true;
-        // Vercel: 'x-vercel-id'
         if (headers['x-vercel-id'])
             return true;
-        // AWS CloudFront: 'cloudfront-viewer-address'
         if (headers['cloudfront-viewer-address'])
             return true;
         // C. The "Browser Fingerprint" (Fallback for direct connections)
-        // Real browsers almost always send these headers
         const hasAcceptLanguage = !!headers['accept-language'];
         const hasSecFetchDest = !!headers['sec-fetch-dest'];
         const hasUpgradeInsecure = !!headers['upgrade-insecure-requests'];
-        // If it has typical browser headers, we allow it.
         if (hasAcceptLanguage && (hasSecFetchDest || hasUpgradeInsecure)) {
             return true;
         }
-        // If it has no browser headers and no trusted proxy headers -> It's likely a script.
         return false;
     }
     /**
@@ -151,6 +143,7 @@ class AAMPPublisher {
             // Verify Core Logic
             const result = await this.verifyRequestLogic(signedRequest, agentKey, headerJson);
             if (!result.allowed) {
+                console.log(`⛔ [AAMP Deny] Reason: ${result.reason}`);
                 return {
                     allowed: false,
                     status: 403,
@@ -158,6 +151,7 @@ class AAMPPublisher {
                     visitorType: 'VERIFIED_AGENT'
                 };
             }
+            console.log(`✅ [AAMP Allow] Verified Agent: ${requestHeader.agent_id}`);
             return {
                 allowed: true,
                 status: 200,
@@ -167,6 +161,7 @@ class AAMPPublisher {
             };
         }
         catch (e) {
+            console.error(e);
             return { allowed: false, status: 400, reason: "INVALID_SIGNATURE", visitorType: 'UNIDENTIFIED_BOT' };
         }
     }
@@ -185,9 +180,11 @@ class AAMPPublisher {
         let identityVerified = false;
         const claimedDomain = request.header.agent_id;
         const pubKeyString = await (0, crypto_1.exportPublicKey)(requestPublicKey);
+        console.log(`   🆔 [AAMP Identity] Verifying DNS Binding for: ${claimedDomain}`);
         // Check Cache First
         const cachedKey = await this.cache.get(claimedDomain);
         if (cachedKey === pubKeyString) {
+            console.log("   ⚡ [AAMP Cache] Identity found in cache.");
             identityVerified = true;
         }
         else if (this.isDomain(claimedDomain)) {
@@ -221,17 +218,33 @@ class AAMPPublisher {
             // Allow HTTP for localhost testing
             const protocol = (domain.includes('localhost') || domain.match(/:\d+$/)) ? 'http' : 'https';
             const url = `${protocol}://${domain}${constants_1.WELL_KNOWN_AGENT_PATH}`;
+            console.log(`   🌍 [AAMP DNS] Fetching Manifest: ${url} ...`);
             // In production, we need a short timeout to prevent hanging
             const controller = new AbortController();
             const timeoutId = setTimeout(() => controller.abort(), 1500); // 1.5s max for DNS check
             const response = await fetch(url, { signal: controller.signal });
             clearTimeout(timeoutId);
-            if (!response.ok)
+            if (!response.ok) {
+                console.log(`   ❌ [AAMP DNS] Fetch Failed: ${response.status}`);
                 return false;
+            }
             const manifest = await response.json();
-            return manifest.agent_id === domain && manifest.public_key === requestKeySpki;
+            console.log(`   📄 [AAMP DNS] Manifest received. Agent ID: ${manifest.agent_id}`);
+            // CHECK 1: Does the manifest actually belong to the domain?
+            if (manifest.agent_id !== domain) {
+                console.log(`   ❌ [AAMP DNS] Mismatch: Manifest ID ${manifest.agent_id} != Claimed ${domain}`);
+                return false;
+            }
+            // CHECK 2: Does the key match?
+            if (manifest.public_key !== requestKeySpki) {
+                console.log(`   ❌ [AAMP DNS] Key Mismatch: DNS Key != Request Key`);
+                return false;
+            }
+            console.log(`   ✅ [AAMP DNS] Identity Confirmed.`);
+            return true;
         }
-        catch {
+        catch (e) {
+            console.log(`   ❌ [AAMP DNS] Error: ${e.message}`);
             return false;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aamp/protocol",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "TypeScript reference implementation of AAMP v1.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/crypto.ts

@@ -28,12 +28,17 @@ export async function verifySignature(publicKey: CryptoKey, data: string, signat
   const encodedData = encoder.encode(data);
   const signatureBytes = hexToBuf(signatureHex);
 
-  return await crypto.subtle.verify(
+  console.log("   🔐 [AAMP Crypto] Verifying ECDSA P-256 Signature...");
+  
+  const isValid = await crypto.subtle.verify(
     { name: "ECDSA", hash: { name: "SHA-256" } },
     publicKey,
     signatureBytes as any,
     encodedData as any
   );
+
+  console.log(`   ${isValid ? "✅" : "❌"} [AAMP Crypto] Signature Result: ${isValid ? "VALID" : "INVALID"}`);
+  return isValid;
 }
 
 export async function exportPublicKey(key: CryptoKey): Promise<string> {

package/src/publisher.ts

@@ -76,6 +76,7 @@ export class AAMPPublisher {
     const hasAamp = reqHeaders[HEADERS.PAYLOAD] && reqHeaders[HEADERS.SIGNATURE] && reqHeaders[HEADERS.PUBLIC_KEY];
 
     if (hasAamp) {
+      console.log("\n🔎 [AAMP Middleware] Detected Agent Headers. Starting Verification...");
       // It claims to be an Agent. Verify it.
       return await this.handleAgent(reqHeaders, rawPayload);
     }
@@ -130,35 +131,24 @@ export class AAMPPublisher {
     
     // A. The "Obvious Bot" Blocklist (Fast Fail)
     const botSignatures = ['python-requests', 'curl', 'wget', 'scrapy', 'bot', 'crawler', 'spider'];
-    // Exception: Googlebot (if you want SEO). We'll treat Googlebot as a bot, 
-    // real implementations might white-list it via IP verification (not possible in just JS headers).
     if (botSignatures.some(sig => userAgent.toLowerCase().includes(sig))) {
        return false;
     }
 
     // B. Trusted Infrastructure Signals (The Real World Solution)
-    // If Cloudflare or Vercel says "This is a real user", we trust them.
-    // Cloudflare: 'cf-visitor' exists. 'cf-ipcountry' exists.
     if (headers['cf-visitor'] || headers['cf-ray']) return true;
-    
-    // Vercel: 'x-vercel-id'
     if (headers['x-vercel-id']) return true;
-    
-    // AWS CloudFront: 'cloudfront-viewer-address'
     if (headers['cloudfront-viewer-address']) return true;
 
     // C. The "Browser Fingerprint" (Fallback for direct connections)
-    // Real browsers almost always send these headers
     const hasAcceptLanguage = !!headers['accept-language'];
     const hasSecFetchDest = !!headers['sec-fetch-dest']; 
     const hasUpgradeInsecure = !!headers['upgrade-insecure-requests'];
 
-    // If it has typical browser headers, we allow it.
     if (hasAcceptLanguage && (hasSecFetchDest || hasUpgradeInsecure)) {
       return true;
     }
 
-    // If it has no browser headers and no trusted proxy headers -> It's likely a script.
     return false;
   }
 
@@ -192,6 +182,7 @@ export class AAMPPublisher {
       const result = await this.verifyRequestLogic(signedRequest, agentKey, headerJson);
 
       if (!result.allowed) {
+        console.log(`⛔ [AAMP Deny] Reason: ${result.reason}`);
         return {
           allowed: false,
           status: 403,
@@ -200,6 +191,7 @@ export class AAMPPublisher {
         };
       }
 
+      console.log(`✅ [AAMP Allow] Verified Agent: ${requestHeader.agent_id}`);
       return {
         allowed: true,
         status: 200,
@@ -209,6 +201,7 @@ export class AAMPPublisher {
       };
 
     } catch (e) {
+      console.error(e);
       return { allowed: false, status: 400, reason: "INVALID_SIGNATURE", visitorType: 'UNIDENTIFIED_BOT' };
     }
   }
@@ -235,10 +228,13 @@ export class AAMPPublisher {
     const claimedDomain = request.header.agent_id;
     const pubKeyString = await exportPublicKey(requestPublicKey);
     
+    console.log(`   🆔 [AAMP Identity] Verifying DNS Binding for: ${claimedDomain}`);
+
     // Check Cache First
     const cachedKey = await this.cache.get(claimedDomain);
     
     if (cachedKey === pubKeyString) {
+      console.log("   ⚡ [AAMP Cache] Identity found in cache.");
       identityVerified = true;
     } else if (this.isDomain(claimedDomain)) {
       // Cache Miss: Perform DNS Fetch
@@ -277,6 +273,8 @@ export class AAMPPublisher {
       const protocol = (domain.includes('localhost') || domain.match(/:\d+$/)) ? 'http' : 'https';
       const url = `${protocol}://${domain}${WELL_KNOWN_AGENT_PATH}`;
       
+      console.log(`   🌍 [AAMP DNS] Fetching Manifest: ${url} ...`);
+
       // In production, we need a short timeout to prevent hanging
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 1500); // 1.5s max for DNS check
@@ -284,10 +282,32 @@ export class AAMPPublisher {
       const response = await fetch(url, { signal: controller.signal });
       clearTimeout(timeoutId);
       
-      if (!response.ok) return false;
+      if (!response.ok) {
+        console.log(`   ❌ [AAMP DNS] Fetch Failed: ${response.status}`);
+        return false;
+      }
+
       const manifest = await response.json() as AgentIdentityManifest;
-      return manifest.agent_id === domain && manifest.public_key === requestKeySpki;
-    } catch { return false; }
+      console.log(`   📄 [AAMP DNS] Manifest received. Agent ID: ${manifest.agent_id}`);
+
+      // CHECK 1: Does the manifest actually belong to the domain?
+      if (manifest.agent_id !== domain) {
+        console.log(`   ❌ [AAMP DNS] Mismatch: Manifest ID ${manifest.agent_id} != Claimed ${domain}`);
+        return false;
+      }
+
+      // CHECK 2: Does the key match?
+      if (manifest.public_key !== requestKeySpki) {
+         console.log(`   ❌ [AAMP DNS] Key Mismatch: DNS Key != Request Key`);
+         return false;
+      }
+
+      console.log(`   ✅ [AAMP DNS] Identity Confirmed.`);
+      return true;
+    } catch (e: any) { 
+        console.log(`   ❌ [AAMP DNS] Error: ${e.message}`);
+        return false; 
+    }
   }
 
   private isDomain(s: string): boolean {