@astrasyncai/verification-gateway 2.4.10 → 2.4.12

package/dist/index.mjs

@@ -126,7 +126,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "2.4.10";
+var SDK_VERSION = "2.4.12";
 
 // src/verify.ts
 var DEFAULT_CONFIG = {
@@ -679,15 +679,8 @@ function extractHttpCredentials(headers) {
 // src/pdlss-pre-check.ts
 function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   const failures = [];
-  if (purpose) {
-    if (!routeConfig.allowedPurposes || routeConfig.allowedPurposes.length === 0) {
-      failures.push({
-        field: "purpose",
-        requested: purpose,
-        limit: [],
-        message: `Purpose "${purpose}" not allowed: route declares no allowedPurposes. The endpoint owner must enumerate allowedPurposes on the route config to authorise specific purposes.`
-      });
-    } else if (!routeConfig.allowedPurposes.includes(purpose)) {
+  if (routeConfig.allowedPurposes && routeConfig.allowedPurposes.length > 0 && purpose) {
+    if (!routeConfig.allowedPurposes.includes(purpose)) {
       failures.push({
         field: "purpose",
         requested: purpose,
@@ -717,16 +710,9 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
       });
     }
   }
-  if (astraCreds?.pdlss?.scope?.jurisdiction) {
+  if (routeConfig.allowedJurisdictions && routeConfig.allowedJurisdictions.length > 0 && astraCreds?.pdlss?.scope?.jurisdiction) {
     const requested = astraCreds.pdlss.scope.jurisdiction;
-    if (!routeConfig.allowedJurisdictions || routeConfig.allowedJurisdictions.length === 0) {
-      failures.push({
-        field: "jurisdiction",
-        requested,
-        limit: [],
-        message: `Jurisdiction "${requested}" not allowed: route declares no allowedJurisdictions. The endpoint owner must enumerate allowedJurisdictions on the route config to authorise specific jurisdictions.`
-      });
-    } else if (!routeConfig.allowedJurisdictions.includes(requested)) {
+    if (!routeConfig.allowedJurisdictions.includes(requested)) {
       failures.push({
         field: "jurisdiction",
         requested,
@@ -920,7 +906,10 @@ function createMiddleware(options) {
       const result = await verify(config, {
         credentials,
         purpose,
-        action: req.method.toLowerCase(),
+        // RFC 7230 § 3.1.1 — HTTP method tokens uppercase by IANA convention.
+        // Backend evaluator tolerates either case as defense-in-depth
+        // (round-18.6 batch 2); SDK emits canonical form.
+        action: req.method.toUpperCase(),
         resource: req.path,
         createSession: shouldRecordDecisions,
         counterpartyUrl,
@@ -1338,7 +1327,10 @@ function createMiddleware2(options) {
     const result = await verify(config, {
       credentials,
       purpose,
-      action: request.method.toLowerCase(),
+      // RFC 7230 § 3.1.1 — HTTP method tokens uppercase by IANA convention.
+      // Backend evaluator tolerates either case as defense-in-depth
+      // (round-18.6 batch 2); SDK emits canonical form.
+      action: request.method.toUpperCase(),
       resource: pathname,
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",