@astrasyncai/verification-gateway 2.4.9 → 2.4.10

package/dist/index.mjs

@@ -126,7 +126,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "2.4.9";
+var SDK_VERSION = "2.4.10";
 
 // src/verify.ts
 var DEFAULT_CONFIG = {
@@ -137,8 +137,10 @@ var DEFAULT_CONFIG = {
   // through (`hasMinimumAccess('guidance', 'guidance') === true`).
   defaultAccessLevel: "none",
   // minTrustScore + minTrustScoreForFull deprecated in v2.3.0 — server decides.
-  cacheTtl: 300,
-  // 5 minutes
+  // Round-18.5 F4: cacheTtl deliberately unset. When undefined, cacheResult
+  // applies the split default (60s autonomous / 300s step-up). When the
+  // caller sets cacheTtl explicitly, that value is honoured uniformly.
+  // Set cacheTtl: 0 to disable caching entirely.
   debug: false
 };
 var initCheckPerformed = false;
@@ -165,11 +167,28 @@ async function performInitCheck(apiBaseUrl, debug) {
   }
 }
 var verificationCache = /* @__PURE__ */ new Map();
-function getCacheKey(credentials) {
-  return `${credentials.astraId || ""}-${credentials.apiKey || ""}-${credentials.jwt || ""}`;
-}
-function getCachedResult(credentials) {
-  const key = getCacheKey(credentials);
+function getCacheKey(request) {
+  const c = request.credentials;
+  return [
+    c.astraId || "",
+    c.apiKey || "",
+    c.jwt || "",
+    request.purpose || "",
+    request.action || "",
+    request.resourceType || "",
+    request.resource || "",
+    request.jurisdiction || "",
+    request.transactionValue ?? "",
+    request.currency || "",
+    request.counterpartyUrl || "",
+    request.counterpartyType || "",
+    request.isSubAgentRequest ? "1" : "0",
+    request.parentAgentId || "",
+    request.subAgentDepth ?? ""
+  ].join("|");
+}
+function getCachedResult(request) {
+  const key = getCacheKey(request);
   const cached = verificationCache.get(key);
   if (cached && cached.expiresAt > Date.now()) {
     return cached.result;
@@ -179,8 +198,11 @@ function getCachedResult(credentials) {
   }
   return null;
 }
-function cacheResult(credentials, result, ttlSeconds) {
-  const key = getCacheKey(credentials);
+var DEFAULT_AUTONOMOUS_TTL_SECONDS = 60;
+var DEFAULT_STEP_UP_TTL_SECONDS = 300;
+function cacheResult(request, result, configuredTtl) {
+  const ttlSeconds = configuredTtl && configuredTtl > 0 ? configuredTtl : result.requiresStepUp ? DEFAULT_STEP_UP_TTL_SECONDS : DEFAULT_AUTONOMOUS_TTL_SECONDS;
+  const key = getCacheKey(request);
   verificationCache.set(key, {
     result,
     expiresAt: Date.now() + ttlSeconds * 1e3
@@ -369,8 +391,8 @@ async function verify(config, request) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access-level decisions (the SDK reads access.accessLevel from the verify-access response). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0) {
-    const cached = getCachedResult(request.credentials);
+  if (mergedConfig.cacheTtl !== 0) {
+    const cached = getCachedResult(request);
     if (cached) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
@@ -499,8 +521,8 @@ async function verify(config, request) {
     }
     result.denialReasons = result.recommendationReasons || ["Step-up verification required"];
   }
-  if (mergedConfig.cacheTtl && mergedConfig.cacheTtl > 0 && result.recommendation !== "deny") {
-    cacheResult(request.credentials, result, mergedConfig.cacheTtl);
+  if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny") {
+    cacheResult(request, result, mergedConfig.cacheTtl);
   }
   return result;
 }
@@ -657,8 +679,15 @@ function extractHttpCredentials(headers) {
 // src/pdlss-pre-check.ts
 function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   const failures = [];
-  if (routeConfig.allowedPurposes && routeConfig.allowedPurposes.length > 0 && purpose) {
-    if (!routeConfig.allowedPurposes.includes(purpose)) {
+  if (purpose) {
+    if (!routeConfig.allowedPurposes || routeConfig.allowedPurposes.length === 0) {
+      failures.push({
+        field: "purpose",
+        requested: purpose,
+        limit: [],
+        message: `Purpose "${purpose}" not allowed: route declares no allowedPurposes. The endpoint owner must enumerate allowedPurposes on the route config to authorise specific purposes.`
+      });
+    } else if (!routeConfig.allowedPurposes.includes(purpose)) {
       failures.push({
         field: "purpose",
         requested: purpose,
@@ -688,9 +717,16 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
       });
     }
   }
-  if (routeConfig.allowedJurisdictions && routeConfig.allowedJurisdictions.length > 0 && astraCreds?.pdlss?.scope?.jurisdiction) {
+  if (astraCreds?.pdlss?.scope?.jurisdiction) {
     const requested = astraCreds.pdlss.scope.jurisdiction;
-    if (!routeConfig.allowedJurisdictions.includes(requested)) {
+    if (!routeConfig.allowedJurisdictions || routeConfig.allowedJurisdictions.length === 0) {
+      failures.push({
+        field: "jurisdiction",
+        requested,
+        limit: [],
+        message: `Jurisdiction "${requested}" not allowed: route declares no allowedJurisdictions. The endpoint owner must enumerate allowedJurisdictions on the route config to authorise specific jurisdictions.`
+      });
+    } else if (!routeConfig.allowedJurisdictions.includes(requested)) {
       failures.push({
         field: "jurisdiction",
         requested,