@astrasyncai/verification-gateway 2.4.2 → 2.4.4

package/dist/index.mjs

@@ -288,6 +288,7 @@ async function callVerifyAccessAPI(config, request) {
   if (config.counterpartyId) body.counterpartyId = config.counterpartyId;
   if (requestData.runtimeChallengeOptions)
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
+  if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
     const meta = {
       ...requestData.clientIp && { sourceIp: requestData.clientIp },
@@ -798,14 +799,15 @@ function createMiddleware(options) {
         }
         return next();
       }
-      if (routeConfig.minAccessLevel === "none") {
+      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
+      const shouldEnforce = routeConfig.minAccessLevel !== "none";
+      if (routeConfig.minAccessLevel === "none" && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
           res.setHeader("X-Astra-Gateway-Reason", "route-none");
         }
         return next();
       }
-      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
       const purpose = customExtractPurpose ? customExtractPurpose(req) : defaultExtractPurpose(req);
       const astraCreds = extractAstraSyncCredentials(req);
       const counterpartyUrl = config.counterpartyUrl || `${req.protocol}://${req.get("host")}`;
@@ -869,9 +871,27 @@ function createMiddleware(options) {
         onDenied(result, req, res);
         return;
       }
+      if (!shouldEnforce) {
+        if (config.setPassThroughHeader) {
+          res.setHeader("X-Astra-Gateway-Mode", "enforced");
+          res.setHeader("X-Astra-Gateway-Reason", "evaluated-not-enforced");
+        }
+        if (shouldRecordDecisions && sessionId) {
+          recordDecision(config, sessionId, "granted").catch(() => {
+          });
+        }
+        return next();
+      }
       if (!hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {
+        const insufficientFailure = {
+          dimension: "access_level.insufficient",
+          message: `Endpoint requires accessLevel '${routeConfig.minAccessLevel}'; agent has '${result.accessLevel}'.`,
+          guidance: "Request elevated access via step-up verification (coming soon \u2014 ships this month). Step-up lets the agent owner approve a one-time elevation for this specific counterparty + purpose without changing the agent's baseline trust score."
+        };
+        result.failures = [...result.failures ?? [], insufficientFailure];
+        result.denialReasons = [...result.denialReasons ?? [], insufficientFailure.message];
         if (shouldRecordDecisions && sessionId) {
-          recordDecision(config, sessionId, "denied", result.denialReasons?.[0]).catch(() => {
+          recordDecision(config, sessionId, "denied", insufficientFailure.message).catch(() => {
           });
         }
         onDenied(result, req, res);
@@ -879,11 +899,15 @@ function createMiddleware(options) {
       }
       if (routeConfig.minTrustScore && result.agent) {
         if (result.agent.trustScore < routeConfig.minTrustScore) {
-          result.denialReasons = [
-            `Trust score ${result.agent.trustScore} is below required ${routeConfig.minTrustScore}`
-          ];
+          const trustFailure = {
+            dimension: "access_level.insufficient",
+            message: `Trust score ${result.agent.trustScore} is below required ${routeConfig.minTrustScore} for this route.`,
+            guidance: "Request elevated access via step-up verification (coming soon \u2014 ships this month). Step-up lets the agent owner approve a one-time elevation for this specific counterparty + purpose without changing the agent's baseline trust score."
+          };
+          result.failures = [...result.failures ?? [], trustFailure];
+          result.denialReasons = [trustFailure.message];
           if (shouldRecordDecisions && sessionId) {
-            recordDecision(config, sessionId, "denied", result.denialReasons[0]).catch(() => {
+            recordDecision(config, sessionId, "denied", trustFailure.message).catch(() => {
             });
           }
           onDenied(result, req, res);