@ainra/middleware 0.7.0 → 0.8.1

package/README.md

@@ -75,7 +75,7 @@ depends on the lenient path.
 ## Underneath
 
 Verification is [`@ainra/sdk`](https://www.npmjs.com/package/@ainra/sdk) — one of the three implementations that
-agree on all 1153 conformance vectors, on verdict and reason. This package adds only the request plumbing: header decoding, the 403, the
+agree on all 1169 conformance vectors, on verdict and reason. This package adds only the request plumbing: header decoding, the 403, the
 verdict event, and `req.ainra`.
 
 Licensed Apache-2.0 OR MIT.

package/dist/index.d.ts

@@ -1,4 +1,10 @@
 import { Verifier, type LinkIndex, type StatusPublication, type LinkVerdict, type Verdict, type VerdictEvent, type DecisionLog } from "@ainra/sdk";
+/** The verdict event as an HTTP header value (2026-11-12). The event's `name` comes from the presenter's own claims,
+ *  also when the bundle is refused, and `serializeVerdictEvent` keeps non-ASCII as it is (it must byte-match the Rust
+ *  emitter). A header cannot hold most of those characters: Node's `setHeader` throws on them, which turned a refusal
+ *  into a 500 in a framework that catches, and stopped a server whose handler did not. So every character outside
+ *  printable ASCII is written as its JSON `\uXXXX` escape: still valid JSON, and it parses to exactly the same event. */
+export declare function verdictHeaderValue(e: VerdictEvent): string;
 /** Where the gate keeps bundles a running copy has sent once. Only bundles that verified VALID when they arrived
  *  are ever stored, the key is the SHA-256 of the content, and every request re-verifies what it names — so the
  *  store can lose entries (the client just sends again) but cannot make anything pass that would not. */

package/dist/index.js

@@ -9,6 +9,14 @@
 //!   * `checkRequest(verifier, bundle, opts)` → framework-agnostic `{ allow, reason?, verdict }` (edge/fetch).
 import { verdictEvent, serializeVerdictEvent, decodeInstance, verifyPresentation, isPresentationRef, splitPresentation, joinPresentation, presentationRef, POP_HEADER, PRIME_PATH, decisionRequestDigest, linkFromIndex, presentedKeyThumbprint, } from "@ainra/sdk";
 import { createHash } from "node:crypto";
+/** The verdict event as an HTTP header value (2026-11-12). The event's `name` comes from the presenter's own claims,
+ *  also when the bundle is refused, and `serializeVerdictEvent` keeps non-ASCII as it is (it must byte-match the Rust
+ *  emitter). A header cannot hold most of those characters: Node's `setHeader` throws on them, which turned a refusal
+ *  into a 500 in a framework that catches, and stopped a server whose handler did not. So every character outside
+ *  printable ASCII is written as its JSON `\uXXXX` escape: still valid JSON, and it parses to exactly the same event. */
+export function verdictHeaderValue(e) {
+    return serializeVerdictEvent(e).replace(/[^\x20-\x7e]/g, (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0"));
+}
 /** The default store: in memory, bounded, oldest-first eviction, and nothing outlives the credential it holds.
  *  Bounded because whoever can mint valid bundles can otherwise fill it; eviction costs them nothing but costs an
  *  honest client one re-send, which is the right way round. One process only — behind several, share a store. */
@@ -120,6 +128,22 @@ export function checkRequest(verifier, bundle, opts = {}) {
     }
     return { allow, reason, verdict, event: verdictEvent(parsed, verdict, now) };
 }
+/** Does the request carry a body the gate was not given the raw bytes of? */
+function bodyUnseen(req) {
+    if (req.rawBody !== undefined)
+        return false;
+    const h = (k) => { const v = req.headers[k]; return Array.isArray(v) ? v[0] : v; };
+    if (Number(h("content-length") ?? 0) > 0 || h("transfer-encoding") !== undefined || h("content-digest") !== undefined)
+        return true;
+    const b = req.body;
+    if (typeof b === "string")
+        return b.length > 0;
+    if (b && typeof b === "object") {
+        const keys = Object.keys(b).filter((k) => k !== "ainra_passport");
+        return keys.length > 0;
+    }
+    return false;
+}
 /** Build the signed-over view of an Express/Node request. `authority` comes from the Host header, which is what
  *  the client addressed and therefore what it signed. */
 function bindingFromReq(req) {
@@ -188,7 +212,10 @@ export function ainraGate(verifier, opts = {}) {
     return (req, res, next) => {
         const raw = req.headers[header] ?? req.body?.ainra_passport;
         const popRaw = req.headers[popHeader];
-        const result = raw === undefined
+        // A signed request whose body the gate cannot see is refused, not checked as if it had none: a signature captured
+        // on a bodyless request would otherwise pass with any body attached (2026-11-07 review).
+        const blind = opts.requireSignature === true && bodyUnseen(req);
+        const result = raw === undefined || blind
             ? { allow: false, reason: "schema_violation", verdict: DENY_SCHEMA, event: verdictEvent({}, DENY_SCHEMA, (opts.now ?? (() => Math.floor(Date.now() / 1000)))()) }
             : checkRequest(verifier, Array.isArray(raw) ? raw[0] : raw, {
                 ...opts,
@@ -199,7 +226,7 @@ export function ainraGate(verifier, opts = {}) {
         if (opts.decisions)
             recordDecision(opts.decisions, raw, result, req, opts);
         // Emit the canonical verdict event on every request (allow or deny) — one event shape everywhere (PRESENTATION.md).
-        res.setHeader("x-ainra-verdict", serializeVerdictEvent(result.event));
+        res.setHeader("x-ainra-verdict", verdictHeaderValue(result.event));
         if (result.allow) {
             next();
             return;
@@ -252,7 +279,7 @@ export function ainraPrime(verifier, opts) {
         if ((req.method ?? "POST").toUpperCase() !== "POST")
             return deny("schema_violation");
         const result = checkRequest(verifier, body, { now: () => now });
-        res.setHeader("x-ainra-verdict", serializeVerdictEvent(result.event));
+        res.setHeader("x-ainra-verdict", verdictHeaderValue(result.event));
         if (!result.allow)
             return deny(result.reason ?? "schema_violation");
         const bundle = body;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainra/middleware",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "AINRA verifier middleware — a fail-closed gate (Connect/Express + framework-agnostic) that verifies an AINRA passport on a request, over @ainra/sdk. The verification wedge: local, offline, ~5-line integration.",
   "license": "Apache-2.0 OR MIT",
   "type": "module",
@@ -14,7 +14,7 @@
     "test": "node --test"
   },
   "dependencies": {
-    "@ainra/sdk": "^0.7.0"
+    "@ainra/sdk": "^0.8.1"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",