@astrasyncai/verification-gateway 1.0.0 → 2.0.0

package/dist/index.js

@@ -49,7 +49,7 @@ __export(src_exports, {
   hasMinimumAccess: () => hasMinimumAccess,
   nextjs: () => nextjs_exports,
   quickVerify: () => quickVerify,
-  recordDecision: () => recordDecision,
+  recordDecision: () => recordDecision2,
   sdk: () => sdk_exports,
   transport: () => transport_exports,
   verify: () => verify
@@ -281,6 +281,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.enableRuntimeChallenge) body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
+  if (requestData.counterpartyUrl) body.counterpartyUrl = requestData.counterpartyUrl;
   if (requestData.runtimeChallengeOptions) body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   const headers = {
     "Content-Type": "application/json",
@@ -328,10 +329,17 @@ async function verify(config, request) {
       return cached;
     }
   }
+  const enrichedRequest = { ...request };
+  if (!enrichedRequest.counterpartyUrl && mergedConfig.counterpartyUrl) {
+    enrichedRequest.counterpartyUrl = mergedConfig.counterpartyUrl;
+  }
+  if (!enrichedRequest.counterpartyType && mergedConfig.counterpartyType) {
+    enrichedRequest.counterpartyType = mergedConfig.counterpartyType;
+  }
   if (mergedConfig.debug) {
     console.log("[VerificationGateway] Calling verify-access API");
   }
-  const apiResponse = await callVerifyAccessAPI(mergedConfig, request);
+  const apiResponse = await callVerifyAccessAPI(mergedConfig, enrichedRequest);
   if (!apiResponse.success) {
     return createGuidanceResponse(mergedConfig, apiResponse.error);
   }
@@ -347,7 +355,11 @@ async function verify(config, request) {
         registrationUrl: `${mergedConfig.apiBaseUrl?.replace("/api", "")}/register`,
         documentationUrl: `${mergedConfig.apiBaseUrl?.replace("/api", "")}/docs/pdlss`
       },
-      verifiedAt: /* @__PURE__ */ new Date()
+      verifiedAt: /* @__PURE__ */ new Date(),
+      // Extract sessionId so decisions can be recorded for denials too
+      sessionId: apiResponse.sessionId,
+      recommendation: apiResponse.recommendation,
+      recommendationReasons: apiResponse.recommendationReasons
     };
     return result2;
   }
@@ -431,6 +443,16 @@ async function verify(config, request) {
   }
   return result;
 }
+async function recordDecision(config, sessionId, decision, reason) {
+  const headers = { "Content-Type": "application/json" };
+  if (config.apiKey) headers["X-API-Key"] = config.apiKey;
+  await fetch(`${config.apiBaseUrl}/agents/verify-access/${sessionId}/decision`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ decision, reason })
+  }).catch(() => {
+  });
+}
 async function quickVerify(config, credentials) {
   const result = await verify(config, {
     credentials,
@@ -575,6 +597,7 @@ function createMiddleware(options) {
     extractPurpose: customExtractPurpose,
     skipPaths = [],
     onDenied = defaultOnDenied,
+    recordDecisions,
     ...config
   } = options;
   return async (req, res, next) => {
@@ -608,16 +631,26 @@ function createMiddleware(options) {
         return;
       }
       const purpose = customExtractPurpose ? customExtractPurpose(req) : defaultExtractPurpose(req);
+      const counterpartyUrl = config.counterpartyUrl || `${req.protocol}://${req.get("host")}`;
+      const shouldRecordDecisions = recordDecisions !== false;
       const result = await verify(config, {
         credentials,
         purpose,
         action: req.method.toLowerCase(),
         resource: req.path,
         clientIp: req.ip,
-        userAgent: req.headers["user-agent"]
+        userAgent: req.headers["user-agent"],
+        createSession: shouldRecordDecisions,
+        counterpartyUrl,
+        counterpartyType: config.counterpartyType || "api"
       });
       req.agentVerification = result;
+      const sessionId = result.sessionId;
       if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {
+        if (shouldRecordDecisions && sessionId) {
+          recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
+          });
+        }
         onDenied(result, req, res);
         return;
       }
@@ -626,10 +659,18 @@ function createMiddleware(options) {
           result.denialReasons = [
             `Trust score ${result.agent.trustScore} is below required ${routeConfig.minTrustScore}`
           ];
+          if (shouldRecordDecisions && sessionId) {
+            recordDecision(config, sessionId, "denied", result.denialReasons[0]).catch(() => {
+            });
+          }
           onDenied(result, req, res);
           return;
         }
       }
+      if (shouldRecordDecisions && sessionId) {
+        recordDecision(config, sessionId, "granted").catch(() => {
+        });
+      }
       next();
     } catch (error) {
       console.error("[VerificationGateway] Middleware error:", error);
@@ -640,17 +681,13 @@ function createMiddleware(options) {
 function requireAccess(minAccessLevel, options) {
   return createMiddleware({
     ...options,
-    routes: [
-      { pattern: "*", method: "*", minAccessLevel }
-    ]
+    routes: [{ pattern: "*", method: "*", minAccessLevel }]
   });
 }
 function verifyOnly(options) {
   return createMiddleware({
     ...options,
-    routes: [
-      { pattern: "*", method: "*", minAccessLevel: "none" }
-    ]
+    routes: [{ pattern: "*", method: "*", minAccessLevel: "none" }]
   });
 }
 
@@ -862,12 +899,7 @@ function generateCommerceShieldHtml(result, options) {
   `.trim();
 }
 function createMiddleware2(options) {
-  const {
-    routes = [],
-    skipPaths = [],
-    showCommerceShield = true,
-    ...config
-  } = options;
+  const { routes = [], skipPaths = [], showCommerceShield = true, ...config } = options;
   return async function middleware(request) {
     const { NextResponse } = await import("next/server");
     const pathname = request.nextUrl.pathname;
@@ -920,6 +952,7 @@ function createMiddleware2(options) {
       const registerUrl = result2.guidance?.registrationUrl || "/register";
       return NextResponse.redirect(new URL(registerUrl, request.url));
     }
+    const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
     const purpose = request.headers.get("x-purpose") || inferPurpose(request.method);
     const result = await verify(config, {
       credentials,
@@ -927,7 +960,9 @@ function createMiddleware2(options) {
       action: request.method.toLowerCase(),
       resource: pathname,
       clientIp: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || void 0,
-      userAgent: request.headers.get("user-agent") || void 0
+      userAgent: request.headers.get("user-agent") || void 0,
+      counterpartyUrl,
+      counterpartyType: config.counterpartyType || "website"
     });
     if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {
       if (pathname.startsWith("/api/")) {
@@ -990,7 +1025,9 @@ var VerificationGatewayClient = class {
       minTrustScoreForFull: options.minTrustScoreForFull,
       cacheTtl: options.cacheTtl,
       debug: options.debug,
-      customHeaders: options.customHeaders
+      customHeaders: options.customHeaders,
+      counterpartyUrl: options.counterpartyUrl,
+      counterpartyType: options.counterpartyType
     };
     this.timeout = options.timeout || 1e4;
     this.retryConfig = options.retry || { maxRetries: 3, backoffMs: 1e3 };
@@ -1016,7 +1053,9 @@ var VerificationGatewayClient = class {
         currency: options.currency,
         isSubAgentRequest: options.isSubAgentRequest,
         parentAgentId: options.parentAgentId,
-        subAgentDepth: options.subAgentDepth
+        subAgentDepth: options.subAgentDepth,
+        counterpartyUrl: options.counterpartyUrl,
+        counterpartyType: options.counterpartyType
       })
     );
   }
@@ -1225,7 +1264,7 @@ __export(agent_exports, {
   ChallengeHandler: () => ChallengeHandler,
   formatPDLSSForTransport: () => formatPDLSSForTransport,
   parsePDLSSFromTransport: () => parsePDLSSFromTransport,
-  recordDecision: () => recordDecision
+  recordDecision: () => recordDecision2
 });
 
 // src/agent/client.ts
@@ -1437,7 +1476,7 @@ function parsePDLSSFromTransport(transport) {
 }
 
 // src/agent/decision-client.ts
-async function recordDecision(config, params) {
+async function recordDecision2(config, params) {
   const { sessionId, ...body } = params;
   const baseUrl = config.apiBaseUrl.replace(/\/$/, "");
   const url = `${baseUrl}/agents/verify-access/${encodeURIComponent(sessionId)}/decision`;