@astrasyncai/verification-gateway 3.0.0 → 3.1.0

package/dist/adapters/express.mjs

@@ -18,7 +18,7 @@ function hasMinimumAccess(actual, required) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.0.0";
+var SDK_VERSION = "3.1.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -576,6 +576,13 @@ function extractHttpCredentials(headers) {
       purpose: { category, action }
     };
   }
+  const astraAction = getValue(`${HEADER_PREFIX}Action`) ?? getValue("x-astra-action");
+  if (astraAction) {
+    credentials.pdlss = {
+      ...credentials.pdlss,
+      purpose: { category: credentials.pdlss?.purpose?.category ?? "", action: astraAction }
+    };
+  }
   const duration = getValue(`${HEADER_PREFIX}Duration`) ?? getValue("x-astra-duration");
   if (duration) {
     credentials.pdlss = {
@@ -593,6 +600,85 @@ function extractHttpCredentials(headers) {
   return credentials;
 }
 
+// src/adapters/http-pdlss.ts
+var HTTP_METHOD_ACTION_TABLE = {
+  GET: "data.read",
+  HEAD: "data.read",
+  OPTIONS: "data.read",
+  POST: "data.write",
+  PUT: "data.write",
+  PATCH: "data.write",
+  DELETE: "data.delete"
+};
+var DEFAULT_HTTP_ACTION = "data.write";
+var DEFAULT_HTTP_PURPOSE = "data";
+function actionForHttpMethod(method) {
+  return HTTP_METHOD_ACTION_TABLE[method.toUpperCase()] ?? DEFAULT_HTTP_ACTION;
+}
+function normalizePurposeHeader(value) {
+  const colon = value.indexOf(":");
+  if (colon >= 0) {
+    return { purpose: value.slice(0, colon) };
+  }
+  const dot = value.indexOf(".");
+  if (dot > 0 && dot < value.length - 1) {
+    return { purpose: value.slice(0, dot), actionCandidate: value };
+  }
+  return { purpose: value };
+}
+function resolveHttpPdlss(input) {
+  const fromHeader = input.astraPurpose ? normalizePurposeHeader(input.astraPurpose) : void 0;
+  let action;
+  let actionSource;
+  if (input.routeAction) {
+    action = input.routeAction;
+    actionSource = "route_config";
+  } else if (input.hasCustomActionExtractor && input.customAction) {
+    action = input.customAction;
+    actionSource = "custom_extractor";
+  } else if (!input.hasCustomActionExtractor && input.astraAction) {
+    action = input.astraAction;
+    actionSource = "header";
+  } else if (!input.hasCustomActionExtractor && fromHeader?.actionCandidate) {
+    action = fromHeader.actionCandidate;
+    actionSource = "purpose_header_derived";
+  } else {
+    action = actionForHttpMethod(input.method);
+    actionSource = "method_table";
+  }
+  let purpose;
+  let purposeSource;
+  if (input.routePurpose) {
+    purpose = input.routePurpose;
+    purposeSource = "route_config";
+  } else if (input.hasCustomPurposeExtractor) {
+    if (input.customPurpose) {
+      purpose = input.customPurpose;
+      purposeSource = "custom_extractor";
+    }
+  } else if (fromHeader) {
+    purpose = fromHeader.purpose;
+    purposeSource = "header";
+  } else if (input.legacyPurpose) {
+    purpose = input.legacyPurpose;
+    purposeSource = "legacy_header";
+  } else if (input.queryPurpose) {
+    purpose = input.queryPurpose;
+    purposeSource = "query";
+  }
+  if (!purpose) {
+    const dot = action.indexOf(".");
+    if (dot > 0) {
+      purpose = action.slice(0, dot);
+      purposeSource = "action_derived";
+    } else {
+      purpose = DEFAULT_HTTP_PURPOSE;
+      purposeSource = "transport_default";
+    }
+  }
+  return { purpose, action, purposeSource, actionSource };
+}
+
 // src/pdlss-pre-check.ts
 function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   const failures = [];
@@ -651,33 +737,25 @@ function defaultExtractCredentials(req) {
 function extractAstraSyncCredentials(req) {
   return extractHttpCredentials(req.headers);
 }
-function defaultExtractPurpose(req) {
-  const astraPurpose = req.headers["x-astra-purpose"];
-  if (astraPurpose) {
-    const value = Array.isArray(astraPurpose) ? astraPurpose[0] : astraPurpose;
-    const category = value.split(":")[0];
-    return category;
-  }
-  const purposeHeader = req.headers["x-purpose"] || req.headers["X-Purpose"];
-  if (purposeHeader) {
-    return Array.isArray(purposeHeader) ? purposeHeader[0] : purposeHeader;
-  }
-  if (req.query.purpose && typeof req.query.purpose === "string") {
-    return req.query.purpose;
-  }
-  switch (req.method) {
-    case "GET":
-      return "read_data";
-    case "POST":
-      return "write_data";
-    case "PUT":
-    case "PATCH":
-      return "write_data";
-    case "DELETE":
-      return "delete_data";
-    default:
-      return "general";
-  }
+function headerValue(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[0];
+  return void 0;
+}
+function resolveRequestPdlss(req, routeConfig, customExtractPurpose, customExtractAction) {
+  return resolveHttpPdlss({
+    method: req.method,
+    astraPurpose: headerValue(req.headers["x-astra-purpose"]),
+    astraAction: headerValue(req.headers["x-astra-action"]),
+    legacyPurpose: headerValue(req.headers["x-purpose"] ?? req.headers["X-Purpose"]),
+    queryPurpose: typeof req.query.purpose === "string" ? req.query.purpose : void 0,
+    routePurpose: routeConfig?.purpose,
+    routeAction: routeConfig?.action,
+    hasCustomPurposeExtractor: !!customExtractPurpose,
+    customPurpose: customExtractPurpose?.(req),
+    hasCustomActionExtractor: !!customExtractAction,
+    customAction: customExtractAction?.(req)
+  });
 }
 function matchRoute(pattern, path, opts) {
   const regexPattern = pattern.replace(/\*/g, ".*").replace(/\//g, "\\/");
@@ -737,6 +815,7 @@ function createMiddleware(options) {
   const {
     extractCredentials: customExtractCredentials,
     extractPurpose: customExtractPurpose,
+    extractAction: customExtractAction,
     skipPaths = [],
     onDenied = defaultOnDenied,
     recordDecisions,
@@ -822,7 +901,21 @@ function createMiddleware(options) {
         }
         return next();
       }
-      const purpose = customExtractPurpose ? customExtractPurpose(req) : defaultExtractPurpose(req);
+      const pdlssPair = resolveRequestPdlss(
+        req,
+        routeConfig,
+        customExtractPurpose,
+        customExtractAction
+      );
+      const purpose = pdlssPair.purpose;
+      if (config.debug) {
+        console.debug("[express-middleware] pdlss resolved", {
+          purpose_source: pdlssPair.purposeSource,
+          resolved_purpose: pdlssPair.purpose,
+          action_source: pdlssPair.actionSource,
+          resolved_action: pdlssPair.action
+        });
+      }
       const astraCreds = extractAstraSyncCredentials(req);
       const counterpartyUrl = config.counterpartyUrl || `${req.protocol}://${req.get("host")}`;
       const preCheckFailures = performCounterpartyPreCheck(routeConfig, astraCreds, purpose);
@@ -866,10 +959,7 @@ function createMiddleware(options) {
       const result = await verify(config, {
         credentials,
         purpose,
-        // RFC 7230 § 3.1.1 — HTTP method tokens uppercase by IANA convention.
-        // Backend evaluator tolerates either case as defense-in-depth
-        // (round-18.6 batch 2); SDK emits canonical form.
-        action: req.method.toUpperCase(),
+        action: pdlssPair.action,
         resource: req.path,
         createSession: shouldRecordDecisions,
         counterpartyUrl,