@astrasyncai/verification-gateway 3.0.0 → 3.1.0

package/dist/adapters/nextjs.mjs

@@ -18,7 +18,7 @@ function hasMinimumAccess(actual, required) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.0.0";
+var SDK_VERSION = "3.1.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -468,6 +468,13 @@ function extractHttpCredentials(headers) {
       purpose: { category, action }
     };
   }
+  const astraAction = getValue(`${HEADER_PREFIX}Action`) ?? getValue("x-astra-action");
+  if (astraAction) {
+    credentials.pdlss = {
+      ...credentials.pdlss,
+      purpose: { category: credentials.pdlss?.purpose?.category ?? "", action: astraAction }
+    };
+  }
   const duration = getValue(`${HEADER_PREFIX}Duration`) ?? getValue("x-astra-duration");
   if (duration) {
     credentials.pdlss = {
@@ -533,6 +540,85 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   return failures;
 }
 
+// src/adapters/http-pdlss.ts
+var HTTP_METHOD_ACTION_TABLE = {
+  GET: "data.read",
+  HEAD: "data.read",
+  OPTIONS: "data.read",
+  POST: "data.write",
+  PUT: "data.write",
+  PATCH: "data.write",
+  DELETE: "data.delete"
+};
+var DEFAULT_HTTP_ACTION = "data.write";
+var DEFAULT_HTTP_PURPOSE = "data";
+function actionForHttpMethod(method) {
+  return HTTP_METHOD_ACTION_TABLE[method.toUpperCase()] ?? DEFAULT_HTTP_ACTION;
+}
+function normalizePurposeHeader(value) {
+  const colon = value.indexOf(":");
+  if (colon >= 0) {
+    return { purpose: value.slice(0, colon) };
+  }
+  const dot = value.indexOf(".");
+  if (dot > 0 && dot < value.length - 1) {
+    return { purpose: value.slice(0, dot), actionCandidate: value };
+  }
+  return { purpose: value };
+}
+function resolveHttpPdlss(input) {
+  const fromHeader = input.astraPurpose ? normalizePurposeHeader(input.astraPurpose) : void 0;
+  let action;
+  let actionSource;
+  if (input.routeAction) {
+    action = input.routeAction;
+    actionSource = "route_config";
+  } else if (input.hasCustomActionExtractor && input.customAction) {
+    action = input.customAction;
+    actionSource = "custom_extractor";
+  } else if (!input.hasCustomActionExtractor && input.astraAction) {
+    action = input.astraAction;
+    actionSource = "header";
+  } else if (!input.hasCustomActionExtractor && fromHeader?.actionCandidate) {
+    action = fromHeader.actionCandidate;
+    actionSource = "purpose_header_derived";
+  } else {
+    action = actionForHttpMethod(input.method);
+    actionSource = "method_table";
+  }
+  let purpose;
+  let purposeSource;
+  if (input.routePurpose) {
+    purpose = input.routePurpose;
+    purposeSource = "route_config";
+  } else if (input.hasCustomPurposeExtractor) {
+    if (input.customPurpose) {
+      purpose = input.customPurpose;
+      purposeSource = "custom_extractor";
+    }
+  } else if (fromHeader) {
+    purpose = fromHeader.purpose;
+    purposeSource = "header";
+  } else if (input.legacyPurpose) {
+    purpose = input.legacyPurpose;
+    purposeSource = "legacy_header";
+  } else if (input.queryPurpose) {
+    purpose = input.queryPurpose;
+    purposeSource = "query";
+  }
+  if (!purpose) {
+    const dot = action.indexOf(".");
+    if (dot > 0) {
+      purpose = action.slice(0, dot);
+      purposeSource = "action_derived";
+    } else {
+      purpose = DEFAULT_HTTP_PURPOSE;
+      purposeSource = "transport_default";
+    }
+  }
+  return { purpose, action, purposeSource, actionSource };
+}
+
 // src/adapters/nextjs.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -593,28 +679,15 @@ function extractAstraSyncCredentialsFromNextRequest(request) {
   });
   return extractHttpCredentials(headers);
 }
-function extractPurpose(request) {
-  const astraPurpose = request.headers.get("x-astra-purpose");
-  if (astraPurpose) {
-    return astraPurpose.split(":")[0];
-  }
-  const purposeHeader = request.headers.get("x-purpose");
-  if (purposeHeader) {
-    return purposeHeader;
-  }
-  switch (request.method.toUpperCase()) {
-    case "GET":
-      return "read_data";
-    case "POST":
-      return "write_data";
-    case "PUT":
-    case "PATCH":
-      return "write_data";
-    case "DELETE":
-      return "delete_data";
-    default:
-      return "general";
-  }
+function resolveNextPdlss(request, routeConfig) {
+  return resolveHttpPdlss({
+    method: request.method,
+    astraPurpose: request.headers.get("x-astra-purpose") ?? void 0,
+    astraAction: request.headers.get("x-astra-action") ?? void 0,
+    legacyPurpose: request.headers.get("x-purpose") ?? void 0,
+    routePurpose: routeConfig?.purpose,
+    routeAction: routeConfig?.action
+  });
 }
 function generateCommerceShieldHtml(result, options) {
   const title = escapeHtml(options.commerceShield?.title || "AstraSync Agent Verification");
@@ -827,7 +900,16 @@ function createMiddleware(options) {
     }
     const credentials = extractCredentialsFromNextRequest(request);
     const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
-    const purpose = extractPurpose(request);
+    const pdlssPair = resolveNextPdlss(request, routeConfig);
+    const purpose = pdlssPair.purpose;
+    if (config.debug) {
+      console.debug("[nextjs-middleware] pdlss resolved", {
+        purpose_source: pdlssPair.purposeSource,
+        resolved_purpose: pdlssPair.purpose,
+        action_source: pdlssPair.actionSource,
+        resolved_action: pdlssPair.action
+      });
+    }
     const astraCreds = extractAstraSyncCredentialsFromNextRequest(request);
     const preCheckFailures = performCounterpartyPreCheck(routeConfig, astraCreds, purpose);
     if (preCheckFailures.length > 0) {
@@ -881,10 +963,7 @@ function createMiddleware(options) {
     const result = await verify(config, {
       credentials,
       purpose,
-      // RFC 7230 § 3.1.1 — HTTP method tokens uppercase by IANA convention.
-      // Backend evaluator tolerates either case as defense-in-depth
-      // (round-18.6 batch 2); SDK emits canonical form.
-      action: request.method.toUpperCase(),
+      action: pdlssPair.action,
       resource: pathname,
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",