@astrasyncai/verification-gateway 3.0.0 → 3.2.0

package/dist/adapters/nextjs.mjs

@@ -1,24 +1,13 @@
 // src/access-levels.ts
-var ACCESS_LEVEL_HIERARCHY = {
-  none: 0,
-  restricted: 1,
-  "read-only": 2,
-  standard: 3,
-  full: 4,
-  internal: 5
-};
 function getTrustLevel(score) {
   if (score >= 80) return "PLATINUM";
   if (score >= 60) return "GOLD";
   if (score >= 40) return "SILVER";
   return "BRONZE";
 }
-function hasMinimumAccess(actual, required) {
-  return ACCESS_LEVEL_HIERARCHY[actual] >= ACCESS_LEVEL_HIERARCHY[required];
-}
 
 // src/version.ts
-var SDK_VERSION = "3.0.0";
+var SDK_VERSION = "3.2.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -71,7 +60,7 @@ async function performInitCheck(apiBaseUrl, debug, strictInit) {
   }
 }
 var verificationCache = /* @__PURE__ */ new Map();
-function getCacheKey(request) {
+function getCacheKey(request, counterpartyId) {
   const c = request.credentials;
   return [
     c.astraId || "",
@@ -84,6 +73,14 @@ function getCacheKey(request) {
     request.jurisdiction || "",
     request.transactionValue ?? "",
     request.currency || "",
+    // SECURITY (cross-merchant cache leak): the merchant identity is sent via
+    // `config.counterpartyId`, NOT on the request, so it was previously absent
+    // from the key — two verifies for the SAME agent/purpose/action/value but
+    // DIFFERENT merchants collided, and a grant at a permissive merchant (low
+    // trust floor) was served for a stricter one. Same bug class as the
+    // duration omission (F-A1-07). counterpartyId affects the backend verdict
+    // (trust floor / per-route policy), so it MUST key the cache.
+    counterpartyId || "",
     request.counterpartyUrl || "",
     request.counterpartyType || "",
     request.isSubAgentRequest ? "1" : "0",
@@ -107,8 +104,8 @@ function getCacheKey(request) {
     request.callerMetadata?.agentCardUrl || ""
   ].join("|");
 }
-function getCachedResult(request) {
-  const key = getCacheKey(request);
+function getCachedResult(request, counterpartyId) {
+  const key = getCacheKey(request, counterpartyId);
   const cached = verificationCache.get(key);
   if (cached && cached.expiresAt > Date.now()) {
     return cached.result;
@@ -120,9 +117,9 @@ function getCachedResult(request) {
 }
 var DEFAULT_AUTONOMOUS_TTL_SECONDS = 60;
 var DEFAULT_STEP_UP_TTL_SECONDS = 300;
-function cacheResult(request, result, configuredTtl) {
+function cacheResult(request, result, configuredTtl, counterpartyId) {
   const ttlSeconds = configuredTtl && configuredTtl > 0 ? configuredTtl : result.requiresStepUp ? DEFAULT_STEP_UP_TTL_SECONDS : DEFAULT_AUTONOMOUS_TTL_SECONDS;
-  const key = getCacheKey(request);
+  const key = getCacheKey(request, counterpartyId);
   verificationCache.set(key, {
     result,
     expiresAt: Date.now() + ttlSeconds * 1e3
@@ -280,7 +277,7 @@ async function verify(config, request) {
     );
   }
   if (mergedConfig.cacheTtl !== 0) {
-    const cached = getCachedResult(request);
+    const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
         console.log("[VerificationGateway] Returning cached result");
@@ -332,8 +329,8 @@ async function verify(config, request) {
       verifiedAt: /* @__PURE__ */ new Date(),
       // Extract sessionId so decisions can be recorded for denials too
       sessionId: apiResponse.sessionId,
-      // v2.3.10 (defect #34, round-4): anonymous traffic has no session →
-      // correlationId is the linking key for paired local_override events.
+      // Anonymous traffic has no session → correlationId is the per-attempt
+      // linking key (the sessionId-equivalent for anonymous callers).
       correlationId: apiResponse.correlationId,
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons
@@ -407,13 +404,10 @@ async function verify(config, request) {
     };
   } else if (result.recommendation === "step_up_required") {
     result.requiresStepUp = true;
-    if (ACCESS_LEVEL_HIERARCHY[result.accessLevel] > ACCESS_LEVEL_HIERARCHY["read-only"]) {
-      result.accessLevel = "read-only";
-    }
     result.denialReasons = result.recommendationReasons || ["Step-up verification required"];
   }
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny") {
-    cacheResult(request, result, mergedConfig.cacheTtl);
+    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
   }
   return result;
 }
@@ -468,6 +462,13 @@ function extractHttpCredentials(headers) {
       purpose: { category, action }
     };
   }
+  const astraAction = getValue(`${HEADER_PREFIX}Action`) ?? getValue("x-astra-action");
+  if (astraAction) {
+    credentials.pdlss = {
+      ...credentials.pdlss,
+      purpose: { category: credentials.pdlss?.purpose?.category ?? "", action: astraAction }
+    };
+  }
   const duration = getValue(`${HEADER_PREFIX}Duration`) ?? getValue("x-astra-duration");
   if (duration) {
     credentials.pdlss = {
@@ -533,6 +534,85 @@ function performCounterpartyPreCheck(routeConfig, astraCreds, purpose) {
   return failures;
 }
 
+// src/adapters/http-pdlss.ts
+var HTTP_METHOD_ACTION_TABLE = {
+  GET: "data.read",
+  HEAD: "data.read",
+  OPTIONS: "data.read",
+  POST: "data.write",
+  PUT: "data.write",
+  PATCH: "data.write",
+  DELETE: "data.delete"
+};
+var DEFAULT_HTTP_ACTION = "data.write";
+var DEFAULT_HTTP_PURPOSE = "data";
+function actionForHttpMethod(method) {
+  return HTTP_METHOD_ACTION_TABLE[method.toUpperCase()] ?? DEFAULT_HTTP_ACTION;
+}
+function normalizePurposeHeader(value) {
+  const colon = value.indexOf(":");
+  if (colon >= 0) {
+    return { purpose: value.slice(0, colon) };
+  }
+  const dot = value.indexOf(".");
+  if (dot > 0 && dot < value.length - 1) {
+    return { purpose: value.slice(0, dot), actionCandidate: value };
+  }
+  return { purpose: value };
+}
+function resolveHttpPdlss(input) {
+  const fromHeader = input.astraPurpose ? normalizePurposeHeader(input.astraPurpose) : void 0;
+  let action;
+  let actionSource;
+  if (input.routeAction) {
+    action = input.routeAction;
+    actionSource = "route_config";
+  } else if (input.hasCustomActionExtractor && input.customAction) {
+    action = input.customAction;
+    actionSource = "custom_extractor";
+  } else if (!input.hasCustomActionExtractor && input.astraAction) {
+    action = input.astraAction;
+    actionSource = "header";
+  } else if (!input.hasCustomActionExtractor && fromHeader?.actionCandidate) {
+    action = fromHeader.actionCandidate;
+    actionSource = "purpose_header_derived";
+  } else {
+    action = actionForHttpMethod(input.method);
+    actionSource = "method_table";
+  }
+  let purpose;
+  let purposeSource;
+  if (input.routePurpose) {
+    purpose = input.routePurpose;
+    purposeSource = "route_config";
+  } else if (input.hasCustomPurposeExtractor) {
+    if (input.customPurpose) {
+      purpose = input.customPurpose;
+      purposeSource = "custom_extractor";
+    }
+  } else if (fromHeader) {
+    purpose = fromHeader.purpose;
+    purposeSource = "header";
+  } else if (input.legacyPurpose) {
+    purpose = input.legacyPurpose;
+    purposeSource = "legacy_header";
+  } else if (input.queryPurpose) {
+    purpose = input.queryPurpose;
+    purposeSource = "query";
+  }
+  if (!purpose) {
+    const dot = action.indexOf(".");
+    if (dot > 0) {
+      purpose = action.slice(0, dot);
+      purposeSource = "action_derived";
+    } else {
+      purpose = DEFAULT_HTTP_PURPOSE;
+      purposeSource = "transport_default";
+    }
+  }
+  return { purpose, action, purposeSource, actionSource };
+}
+
 // src/adapters/nextjs.ts
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -593,28 +673,15 @@ function extractAstraSyncCredentialsFromNextRequest(request) {
   });
   return extractHttpCredentials(headers);
 }
-function extractPurpose(request) {
-  const astraPurpose = request.headers.get("x-astra-purpose");
-  if (astraPurpose) {
-    return astraPurpose.split(":")[0];
-  }
-  const purposeHeader = request.headers.get("x-purpose");
-  if (purposeHeader) {
-    return purposeHeader;
-  }
-  switch (request.method.toUpperCase()) {
-    case "GET":
-      return "read_data";
-    case "POST":
-      return "write_data";
-    case "PUT":
-    case "PATCH":
-      return "write_data";
-    case "DELETE":
-      return "delete_data";
-    default:
-      return "general";
-  }
+function resolveNextPdlss(request, routeConfig) {
+  return resolveHttpPdlss({
+    method: request.method,
+    astraPurpose: request.headers.get("x-astra-purpose") ?? void 0,
+    astraAction: request.headers.get("x-astra-action") ?? void 0,
+    legacyPurpose: request.headers.get("x-purpose") ?? void 0,
+    routePurpose: routeConfig?.purpose,
+    routeAction: routeConfig?.action
+  });
 }
 function generateCommerceShieldHtml(result, options) {
   const title = escapeHtml(options.commerceShield?.title || "AstraSync Agent Verification");
@@ -827,7 +894,16 @@ function createMiddleware(options) {
     }
     const credentials = extractCredentialsFromNextRequest(request);
     const counterpartyUrl = config.counterpartyUrl || request.nextUrl.origin;
-    const purpose = extractPurpose(request);
+    const pdlssPair = resolveNextPdlss(request, routeConfig);
+    const purpose = pdlssPair.purpose;
+    if (config.debug) {
+      console.debug("[nextjs-middleware] pdlss resolved", {
+        purpose_source: pdlssPair.purposeSource,
+        resolved_purpose: pdlssPair.purpose,
+        action_source: pdlssPair.actionSource,
+        resolved_action: pdlssPair.action
+      });
+    }
     const astraCreds = extractAstraSyncCredentialsFromNextRequest(request);
     const preCheckFailures = performCounterpartyPreCheck(routeConfig, astraCreds, purpose);
     if (preCheckFailures.length > 0) {
@@ -881,10 +957,7 @@ function createMiddleware(options) {
     const result = await verify(config, {
       credentials,
       purpose,
-      // RFC 7230 § 3.1.1 — HTTP method tokens uppercase by IANA convention.
-      // Backend evaluator tolerates either case as defense-in-depth
-      // (round-18.6 batch 2); SDK emits canonical form.
-      action: request.method.toUpperCase(),
+      action: pdlssPair.action,
       resource: pathname,
       counterpartyUrl,
       counterpartyType: config.counterpartyType || "website",
@@ -899,7 +972,7 @@ function createMiddleware(options) {
         agentCardUrl: request.headers.get("x-astrasync-agent-card") || void 0
       }
     });
-    if (!result.identityVerified || !result.policyAllowed || !hasMinimumAccess(result.accessLevel, routeConfig.minAccessLevel)) {
+    if (!result.identityVerified || !result.policyAllowed) {
       if (pathname.startsWith("/api/")) {
         return NextResponse.json(
           {
@@ -907,10 +980,8 @@ function createMiddleware(options) {
             error: {
               // Round-18 G4: 401 → identity missing (re-auth); 403 → identity
               // OK, policy denied (update PDLSS / step up).
-              code: !result.identityVerified ? "UNAUTHORIZED" : "INSUFFICIENT_ACCESS",
+              code: !result.identityVerified ? "UNAUTHORIZED" : "POLICY_DENIED",
               message: result.denialReasons?.[0] || "Access denied",
-              accessLevel: result.accessLevel,
-              required: routeConfig.minAccessLevel,
               guidance: result.guidance
             }
           },
@@ -938,7 +1009,6 @@ function createMiddleware(options) {
     response.headers.set("X-AstraSync-Access-Level", result.accessLevel);
     if (result.agent) {
       response.headers.set("X-AstraSync-Agent-Id", result.agent.astraId);
-      response.headers.set("X-AstraSync-Trust-Score", result.agent.trustScore.toString());
     }
     return response;
   };