@ainra/middleware 0.6.0 → 0.8.0

package/README.md

@@ -75,7 +75,7 @@ depends on the lenient path.
 ## Underneath
 
 Verification is [`@ainra/sdk`](https://www.npmjs.com/package/@ainra/sdk) — one of the three implementations that
-agree on all 1153 conformance vectors, on verdict and reason. This package adds only the request plumbing: header decoding, the 403, the
+agree on all 1169 conformance vectors, on verdict and reason. This package adds only the request plumbing: header decoding, the 403, the
 verdict event, and `req.ainra`.
 
 Licensed Apache-2.0 OR MIT.

package/dist/index.js

@@ -120,6 +120,22 @@ export function checkRequest(verifier, bundle, opts = {}) {
     }
     return { allow, reason, verdict, event: verdictEvent(parsed, verdict, now) };
 }
+/** Does the request carry a body the gate was not given the raw bytes of? */
+function bodyUnseen(req) {
+    if (req.rawBody !== undefined)
+        return false;
+    const h = (k) => { const v = req.headers[k]; return Array.isArray(v) ? v[0] : v; };
+    if (Number(h("content-length") ?? 0) > 0 || h("transfer-encoding") !== undefined || h("content-digest") !== undefined)
+        return true;
+    const b = req.body;
+    if (typeof b === "string")
+        return b.length > 0;
+    if (b && typeof b === "object") {
+        const keys = Object.keys(b).filter((k) => k !== "ainra_passport");
+        return keys.length > 0;
+    }
+    return false;
+}
 /** Build the signed-over view of an Express/Node request. `authority` comes from the Host header, which is what
  *  the client addressed and therefore what it signed. */
 function bindingFromReq(req) {
@@ -188,7 +204,10 @@ export function ainraGate(verifier, opts = {}) {
     return (req, res, next) => {
         const raw = req.headers[header] ?? req.body?.ainra_passport;
         const popRaw = req.headers[popHeader];
-        const result = raw === undefined
+        // A signed request whose body the gate cannot see is refused, not checked as if it had none: a signature captured
+        // on a bodyless request would otherwise pass with any body attached (2026-11-07 review).
+        const blind = opts.requireSignature === true && bodyUnseen(req);
+        const result = raw === undefined || blind
             ? { allow: false, reason: "schema_violation", verdict: DENY_SCHEMA, event: verdictEvent({}, DENY_SCHEMA, (opts.now ?? (() => Math.floor(Date.now() / 1000)))()) }
             : checkRequest(verifier, Array.isArray(raw) ? raw[0] : raw, {
                 ...opts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainra/middleware",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "AINRA verifier middleware — a fail-closed gate (Connect/Express + framework-agnostic) that verifies an AINRA passport on a request, over @ainra/sdk. The verification wedge: local, offline, ~5-line integration.",
   "license": "Apache-2.0 OR MIT",
   "type": "module",
@@ -14,7 +14,7 @@
     "test": "node --test"
   },
   "dependencies": {
-    "@ainra/sdk": "^0.6.0"
+    "@ainra/sdk": "^0.8.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",