@algovoi/rfc9421-verifier 0.1.1 → 0.2.1

package/dist/parse.d.ts

@@ -11,6 +11,14 @@ export interface ParsedSignatureInput {
     covered_components: string[];
     parameters: Record<string, string | number>;
     raw: string;
+    /**
+     * The post-label portion of the Signature-Input header value, i.e.
+     * the Inner List + parameters block exactly as it appeared on the
+     * wire. This is the value that the @signature-params line in the
+     * RFC 9421 §2.5 signing base must carry. Empty string if the input
+     * was the unlabelled form.
+     */
+    params_block: string;
 }
 export declare function parseSignatureInput(headerValue: string): ParsedSignatureInput;
 export declare function parseSignatureValue(headerValue: string): {

package/dist/parse.js

@@ -35,6 +35,9 @@ export function parseSignatureInput(headerValue) {
     else {
         throw new SignatureInputParseError(`no label or covered-components list found at start: ${JSON.stringify(trimmed.slice(0, 40))}`);
     }
+    // Capture the post-label portion verbatim. This is what the
+    // @signature-params line of the RFC 9421 signing base must contain.
+    const paramsBlock = rest;
     const coveredMatch = COVERED_RE.exec(rest);
     if (!coveredMatch) {
         throw new SignatureInputParseError("no covered-components list found");
@@ -68,6 +71,7 @@ export function parseSignatureInput(headerValue) {
         covered_components: covered,
         parameters,
         raw: trimmed,
+        params_block: paramsBlock,
     };
 }
 export function parseSignatureValue(headerValue) {

package/dist/signing-base.d.ts

@@ -6,6 +6,7 @@
 export declare class SigningBaseError extends Error {
     constructor(message: string);
 }
+export type SigningBaseMode = "algovoi-v0" | "rfc9421";
 export interface SigningBaseInput {
     coveredComponents: string[];
     method?: string;
@@ -16,5 +17,26 @@ export interface SigningBaseInput {
     status?: number;
     headers?: Record<string, string>;
     parameters?: Record<string, string | number>;
+    /**
+     * Signing-base mode.
+     * - "algovoi-v0" (default): preserves the v0.1.0 behaviour for
+     *   backward compatibility with the AlgoVoi internal fixture and
+     *   the rfc9421_proxy_chain_v0 conformance set. @method is
+     *   lowercased and no @signature-params line is appended.
+     * - "rfc9421": full RFC 9421 §2.5 compliance. @method is preserved
+     *   as-supplied (HTTP convention is uppercase), and a final
+     *   "@signature-params" line is appended carrying
+     *   signatureParamsRaw verbatim. This is the shape required to
+     *   verify external fixtures (Envoys envoys-rfc9421, Hippo
+     *   hippo-rfc9421, RFC 9421 §B test vectors, and any other
+     *   RFC-compliant implementation).
+     */
+    mode?: SigningBaseMode;
+    /**
+     * The post-label portion of the Signature-Input header value, i.e.
+     * the Inner List + parameters block exactly as it appeared on the
+     * wire. Required when mode is "rfc9421".
+     */
+    signatureParamsRaw?: string;
 }
 export declare function buildSigningBase(input: SigningBaseInput): string;

package/dist/signing-base.js

@@ -10,6 +10,13 @@ export class SigningBaseError extends Error {
     }
 }
 export function buildSigningBase(input) {
+    const mode = input.mode ?? "algovoi-v0";
+    if (mode !== "algovoi-v0" && mode !== "rfc9421") {
+        throw new SigningBaseError(`mode must be "algovoi-v0" or "rfc9421", got ${JSON.stringify(mode)}`);
+    }
+    if (mode === "rfc9421" && input.signatureParamsRaw === undefined) {
+        throw new SigningBaseError("rfc9421 mode requires signatureParamsRaw (the post-label portion of the Signature-Input header)");
+    }
     const normHeaders = {};
     for (const [k, v] of Object.entries(input.headers ?? {})) {
         normHeaders[k.toLowerCase()] = v;
@@ -23,7 +30,7 @@ export function buildSigningBase(input) {
             case "@method":
                 if (input.method === undefined)
                     throw new SigningBaseError("@method covered but method not supplied");
-                value = input.method.toLowerCase();
+                value = mode === "rfc9421" ? input.method : input.method.toLowerCase();
                 break;
             case "@authority":
                 if (input.authority === undefined)
@@ -72,5 +79,8 @@ export function buildSigningBase(input) {
         }
         lines.push(`"${c}": ${value}`);
     }
+    if (mode === "rfc9421") {
+        lines.push(`"@signature-params": ${input.signatureParamsRaw}`);
+    }
     return lines.join("\n");
 }

package/dist/verify.d.ts

@@ -4,6 +4,7 @@
  * Mirror of the Python algovoi_rfc9421_verifier.verify module.
  * Uses @noble/ed25519 for Ed25519 verification.
  */
+import { type SigningBaseMode } from "./signing-base.js";
 export declare class VerifyError extends Error {
     constructor(message: string);
 }
@@ -27,7 +28,15 @@ export interface VerifyRequestInput {
     publicKey: PublicKey;
     scheme?: string;
     requireContentDigest?: boolean;
-    requireAlgorithm?: string;
+    requireAlgorithm?: string | null;
+    /**
+     * Signing-base mode. Default "algovoi-v0" preserves backward
+     * compatibility with the v0.1.0 internal fixture and the
+     * rfc9421_proxy_chain_v0 conformance set. Set to "rfc9421" to
+     * verify external RFC 9421-compliant fixtures (Envoys, Hippo,
+     * RFC 9421 §B test vectors).
+     */
+    mode?: SigningBaseMode;
 }
 export declare function verifySignature(signingBase: string, signatureBytes: Uint8Array, publicKey: PublicKey, algorithm?: string): Promise<boolean>;
 export declare function verifyRequest(input: VerifyRequestInput): Promise<VerifyResult>;

package/dist/verify.js

@@ -111,7 +111,10 @@ export async function verifyRequest(input) {
         return fail(result, `Signature label ${sigParsed.label} does not match Signature-Input label ${parsedSi.label}`);
     }
     const requireCd = input.requireContentDigest ?? true;
-    const requireAlg = input.requireAlgorithm ?? "sha-256";
+    // string = enforce that specific algorithm; null or undefined = accept any
+    // supported algorithm present in the Content-Digest header (SHA-256 or
+    // SHA-512 in this v0.2.x). Default is permissive.
+    const requireAlg = input.requireAlgorithm == null ? undefined : input.requireAlgorithm;
     if (requireCd) {
         const cdHeader = normHeaders["content-digest"];
         if (!cdHeader)
@@ -130,6 +133,7 @@ export async function verifyRequest(input) {
     else {
         result.content_digest_valid = true;
     }
+    const mode = input.mode ?? "algovoi-v0";
     let signingBase;
     try {
         signingBase = buildSigningBase({
@@ -140,6 +144,8 @@ export async function verifyRequest(input) {
             scheme: input.scheme ?? "https",
             headers: normHeaders,
             parameters: parsedSi.parameters,
+            mode,
+            signatureParamsRaw: mode === "rfc9421" ? parsedSi.params_block : undefined,
         });
     }
     catch (e) {

package/package.json

@@ -1,62 +1,62 @@
-{
-  "name": "@algovoi/rfc9421-verifier",
-  "version": "0.1.1",
-  "description": "AlgoVoi RFC 9421 HTTP Message Signatures + RFC 9530 Content-Digest reference verifier",
-  "keywords": [
-    "rfc9421",
-    "rfc9530",
-    "http-signatures",
-    "ed25519",
-    "agentic-payments",
-    "compliance"
-  ],
-  "homepage": "https://github.com/chopmob-cloud/algovoi-rfc9421-verifier",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/chopmob-cloud/algovoi-rfc9421-verifier.git",
-    "directory": "typescript"
-  },
-  "bugs": {
-    "url": "https://github.com/chopmob-cloud/algovoi-rfc9421-verifier/issues"
-  },
-  "license": "Apache-2.0",
-  "author": "AlgoVoi <chopmob@gmail.com>",
-  "type": "module",
-  "main": "./dist/index.js",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
-  },
-  "files": [
-    "dist/**/*",
-    "src/**/*",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "clean": "rimraf dist",
-    "prepublishOnly": "npm run clean && npm run build && npm test"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "dependencies": {
-    "@noble/ed25519": "^2.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0",
-    "rimraf": "^5.0.0",
-    "typescript": "^5.4.0",
-    "vitest": "^1.6.0"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@algovoi/rfc9421-verifier",
+  "version": "0.2.1",
+  "description": "AlgoVoi RFC 9421 HTTP Message Signatures + RFC 9530 Content-Digest reference verifier",
+  "keywords": [
+    "rfc9421",
+    "rfc9530",
+    "http-signatures",
+    "ed25519",
+    "agentic-payments",
+    "compliance"
+  ],
+  "homepage": "https://github.com/chopmob-cloud/algovoi-rfc9421-verifier",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/chopmob-cloud/algovoi-rfc9421-verifier.git",
+    "directory": "typescript"
+  },
+  "bugs": {
+    "url": "https://github.com/chopmob-cloud/algovoi-rfc9421-verifier/issues"
+  },
+  "license": "Apache-2.0",
+  "author": "AlgoVoi <chopmob@gmail.com>",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist/**/*",
+    "src/**/*",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rimraf dist",
+    "prepublishOnly": "npm run clean && npm run build && npm test"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@noble/ed25519": "^2.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "rimraf": "^5.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^1.6.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/parse.ts

@@ -1,135 +1,148 @@
-/**
- * RFC 9421 Signature-Input and Signature header parsers.
- *
- * Mirror of the Python algovoi_rfc9421_verifier.parse module.
- */
-
-export class SignatureInputParseError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "SignatureInputParseError";
-  }
-}
-
-export interface ParsedSignatureInput {
-  label: string;
-  covered_components: string[];
-  parameters: Record<string, string | number>;
-  raw: string;
-}
-
-const LABEL_RE = /^\s*([A-Za-z][A-Za-z0-9_-]*)\s*=\s*/;
-const COVERED_RE = /\(\s*(?:"[^"]*"\s*)*\)/;
-const QUOTED_RE = /"([^"]*)"/g;
-const PARAM_RE = /([A-Za-z][A-Za-z0-9_-]*)=([^;,\s]+|"[^"]*")/g;
-
-export function parseSignatureInput(headerValue: string): ParsedSignatureInput {
-  if (typeof headerValue !== "string") {
-    throw new SignatureInputParseError(
-      `header must be string, got ${typeof headerValue}`,
-    );
-  }
-  const trimmed = headerValue.trim();
-  if (trimmed.length === 0) {
-    throw new SignatureInputParseError("empty header value");
-  }
-
-  let label: string;
-  let rest: string;
-
-  const labelMatch = LABEL_RE.exec(trimmed);
-  if (labelMatch) {
-    label = labelMatch[1];
-    rest = trimmed.slice(labelMatch[0].length);
-  } else if (trimmed.startsWith("(")) {
-    label = "";
-    rest = trimmed;
-  } else {
-    throw new SignatureInputParseError(
-      `no label or covered-components list found at start: ${JSON.stringify(trimmed.slice(0, 40))}`,
-    );
-  }
-
-  const coveredMatch = COVERED_RE.exec(rest);
-  if (!coveredMatch) {
-    throw new SignatureInputParseError("no covered-components list found");
-  }
-  const coveredRaw = coveredMatch[0];
-  const covered: string[] = [];
-  let qm: RegExpExecArray | null;
-  const localQuoted = /"([^"]*)"/g;
-  while ((qm = localQuoted.exec(coveredRaw)) !== null) {
-    covered.push(qm[1]);
-  }
-  rest = rest.slice(coveredMatch.index + coveredRaw.length);
-
-  const parameters: Record<string, string | number> = {};
-  const localParam = new RegExp(PARAM_RE.source, "g");
-  let pm: RegExpExecArray | null;
-  while ((pm = localParam.exec(rest)) !== null) {
-    const key = pm[1];
-    const raw = pm[2];
-    if (raw.startsWith('"') && raw.endsWith('"')) {
-      parameters[key] = raw.slice(1, -1);
-    } else if (/^-?\d+$/.test(raw)) {
-      parameters[key] = parseInt(raw, 10);
-    } else {
-      parameters[key] = raw;
-    }
-  }
-
-  return {
-    label,
-    covered_components: covered,
-    parameters,
-    raw: trimmed,
-  };
-}
-
-export function parseSignatureValue(headerValue: string): {
-  label: string;
-  signature: Uint8Array;
-} {
-  if (typeof headerValue !== "string") {
-    throw new SignatureInputParseError(
-      `header must be string, got ${typeof headerValue}`,
-    );
-  }
-  const trimmed = headerValue.trim();
-  if (trimmed.length === 0) {
-    throw new SignatureInputParseError("empty Signature header value");
-  }
-
-  let label: string;
-  let rest: string;
-
-  const labelMatch = LABEL_RE.exec(trimmed);
-  if (labelMatch) {
-    label = labelMatch[1];
-    rest = trimmed.slice(labelMatch[0].length).trim();
-  } else if (trimmed.startsWith(":")) {
-    label = "";
-    rest = trimmed;
-  } else {
-    throw new SignatureInputParseError(
-      `no label or signature-value prefix found at start: ${JSON.stringify(trimmed.slice(0, 40))}`,
-    );
-  }
-
-  if (!rest.startsWith(":") || !rest.endsWith(":")) {
-    throw new SignatureInputParseError(
-      "signature value must be wrapped in colons (RFC 8941 byte-sequence form)",
-    );
-  }
-
-  const sigB64 = rest.slice(1, -1);
-  let sigBytes: Uint8Array;
-  try {
-    sigBytes = new Uint8Array(Buffer.from(sigB64, "base64"));
-  } catch (e) {
-    throw new SignatureInputParseError(
-      `signature value is not valid base64: ${(e as Error).message}`,
-    );
-  }
-  return { label, signature: sigBytes };
-}
+/**
+ * RFC 9421 Signature-Input and Signature header parsers.
+ *
+ * Mirror of the Python algovoi_rfc9421_verifier.parse module.
+ */
+
+export class SignatureInputParseError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "SignatureInputParseError";
+  }
+}
+
+export interface ParsedSignatureInput {
+  label: string;
+  covered_components: string[];
+  parameters: Record<string, string | number>;
+  raw: string;
+  /**
+   * The post-label portion of the Signature-Input header value, i.e.
+   * the Inner List + parameters block exactly as it appeared on the
+   * wire. This is the value that the @signature-params line in the
+   * RFC 9421 §2.5 signing base must carry. Empty string if the input
+   * was the unlabelled form.
+   */
+  params_block: string;
+}
+
+const LABEL_RE = /^\s*([A-Za-z][A-Za-z0-9_-]*)\s*=\s*/;
+const COVERED_RE = /\(\s*(?:"[^"]*"\s*)*\)/;
+const QUOTED_RE = /"([^"]*)"/g;
+const PARAM_RE = /([A-Za-z][A-Za-z0-9_-]*)=([^;,\s]+|"[^"]*")/g;
+
+export function parseSignatureInput(headerValue: string): ParsedSignatureInput {
+  if (typeof headerValue !== "string") {
+    throw new SignatureInputParseError(
+      `header must be string, got ${typeof headerValue}`,
+    );
+  }
+  const trimmed = headerValue.trim();
+  if (trimmed.length === 0) {
+    throw new SignatureInputParseError("empty header value");
+  }
+
+  let label: string;
+  let rest: string;
+
+  const labelMatch = LABEL_RE.exec(trimmed);
+  if (labelMatch) {
+    label = labelMatch[1];
+    rest = trimmed.slice(labelMatch[0].length);
+  } else if (trimmed.startsWith("(")) {
+    label = "";
+    rest = trimmed;
+  } else {
+    throw new SignatureInputParseError(
+      `no label or covered-components list found at start: ${JSON.stringify(trimmed.slice(0, 40))}`,
+    );
+  }
+
+  // Capture the post-label portion verbatim. This is what the
+  // @signature-params line of the RFC 9421 signing base must contain.
+  const paramsBlock = rest;
+
+  const coveredMatch = COVERED_RE.exec(rest);
+  if (!coveredMatch) {
+    throw new SignatureInputParseError("no covered-components list found");
+  }
+  const coveredRaw = coveredMatch[0];
+  const covered: string[] = [];
+  let qm: RegExpExecArray | null;
+  const localQuoted = /"([^"]*)"/g;
+  while ((qm = localQuoted.exec(coveredRaw)) !== null) {
+    covered.push(qm[1]);
+  }
+  rest = rest.slice(coveredMatch.index + coveredRaw.length);
+
+  const parameters: Record<string, string | number> = {};
+  const localParam = new RegExp(PARAM_RE.source, "g");
+  let pm: RegExpExecArray | null;
+  while ((pm = localParam.exec(rest)) !== null) {
+    const key = pm[1];
+    const raw = pm[2];
+    if (raw.startsWith('"') && raw.endsWith('"')) {
+      parameters[key] = raw.slice(1, -1);
+    } else if (/^-?\d+$/.test(raw)) {
+      parameters[key] = parseInt(raw, 10);
+    } else {
+      parameters[key] = raw;
+    }
+  }
+
+  return {
+    label,
+    covered_components: covered,
+    parameters,
+    raw: trimmed,
+    params_block: paramsBlock,
+  };
+}
+
+export function parseSignatureValue(headerValue: string): {
+  label: string;
+  signature: Uint8Array;
+} {
+  if (typeof headerValue !== "string") {
+    throw new SignatureInputParseError(
+      `header must be string, got ${typeof headerValue}`,
+    );
+  }
+  const trimmed = headerValue.trim();
+  if (trimmed.length === 0) {
+    throw new SignatureInputParseError("empty Signature header value");
+  }
+
+  let label: string;
+  let rest: string;
+
+  const labelMatch = LABEL_RE.exec(trimmed);
+  if (labelMatch) {
+    label = labelMatch[1];
+    rest = trimmed.slice(labelMatch[0].length).trim();
+  } else if (trimmed.startsWith(":")) {
+    label = "";
+    rest = trimmed;
+  } else {
+    throw new SignatureInputParseError(
+      `no label or signature-value prefix found at start: ${JSON.stringify(trimmed.slice(0, 40))}`,
+    );
+  }
+
+  if (!rest.startsWith(":") || !rest.endsWith(":")) {
+    throw new SignatureInputParseError(
+      "signature value must be wrapped in colons (RFC 8941 byte-sequence form)",
+    );
+  }
+
+  const sigB64 = rest.slice(1, -1);
+  let sigBytes: Uint8Array;
+  try {
+    sigBytes = new Uint8Array(Buffer.from(sigB64, "base64"));
+  } catch (e) {
+    throw new SignatureInputParseError(
+      `signature value is not valid base64: ${(e as Error).message}`,
+    );
+  }
+  return { label, signature: sigBytes };
+}