@authorizedretailers/spec 0.1.0

package/fixtures/manifest.json

@@ -0,0 +1,434 @@
+[
+  {
+    "path": "file/valid/full-signed.json",
+    "kind": "file",
+    "valid": true,
+    "note": "Section 5 example"
+  },
+  {
+    "path": "file/valid/full-unsigned-handwritten.json",
+    "kind": "file",
+    "valid": true,
+    "note": "Section 5: hand-written unsigned files are accepted"
+  },
+  {
+    "path": "file/valid/full-no-authorizations.json",
+    "kind": "file",
+    "valid": true,
+    "note": "A brand with nothing authorized"
+  },
+  {
+    "path": "file/valid/full-worldwide-physical-proposed.json",
+    "kind": "file",
+    "valid": true,
+    "note": "Worldwide scope, named product lines, eBay + physical, distributor-proposed"
+  },
+  {
+    "path": "file/valid/full-max-expiry.json",
+    "kind": "file",
+    "valid": true,
+    "note": "Exactly 180 days after issued (section 10)"
+  },
+  {
+    "path": "file/valid/full-fractional-seconds.json",
+    "kind": "file",
+    "valid": true,
+    "note": "Fractional seconds are allowed"
+  },
+  {
+    "path": "file/valid/pointer.json",
+    "kind": "file",
+    "valid": true,
+    "note": "Section 5 pointer form"
+  },
+  {
+    "path": "file/valid/private.json",
+    "kind": "file",
+    "valid": true,
+    "note": "Section 5 private form"
+  },
+  {
+    "path": "file/invalid/full-no-channels.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: at least one channel identifier"
+  },
+  {
+    "path": "file/invalid/full-name-only-retailer.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: a name alone is not verifiable"
+  },
+  {
+    "path": "file/invalid/full-missing-scope.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 3: every authorization MUST carry a scope"
+  },
+  {
+    "path": "file/invalid/full-missing-territories.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 3: scope needs territories"
+  },
+  {
+    "path": "file/invalid/full-missing-product-lines.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 3: scope needs product lines"
+  },
+  {
+    "path": "file/invalid/full-missing-authorization-expires.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 3: scope needs an expiry"
+  },
+  {
+    "path": "file/invalid/full-empty-territories.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Territories cannot be empty"
+  },
+  {
+    "path": "file/invalid/full-wildcard-mixed.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "'*' must stand alone"
+  },
+  {
+    "path": "file/invalid/full-lowercase-territory.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Country codes are uppercase alpha-2"
+  },
+  {
+    "path": "file/invalid/full-all-mixed.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "'all' must stand alone"
+  },
+  {
+    "path": "file/invalid/full-unknown-channel-type.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: unlisted channel type"
+  },
+  {
+    "path": "file/invalid/full-amazon-missing-seller-id.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: amazon needs seller_id"
+  },
+  {
+    "path": "file/invalid/full-web-missing-domain.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: web needs domain"
+  },
+  {
+    "path": "file/invalid/full-web-domain-is-url.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Domains are bare hostnames"
+  },
+  {
+    "path": "file/invalid/full-physical-missing-country.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: physical needs country"
+  },
+  {
+    "path": "file/invalid/full-wrong-spec.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Unknown spec version"
+  },
+  {
+    "path": "file/invalid/full-missing-file-expires.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "File needs expires"
+  },
+  {
+    "path": "file/invalid/full-non-utc-timestamp.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Timestamps are UTC with Z"
+  },
+  {
+    "path": "file/invalid/full-extra-property.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 1: no pricing; unknown properties rejected"
+  },
+  {
+    "path": "file/invalid/full-attached-jws.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 8: JWS must be detached"
+  },
+  {
+    "path": "file/invalid/full-signature-missing-kid.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 8: every signature names its kid"
+  },
+  {
+    "path": "file/invalid/pointer-http-url.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Pointer must be HTTPS"
+  },
+  {
+    "path": "file/invalid/private-missing-verify.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Private form needs a verify endpoint"
+  },
+  {
+    "path": "file/invalid/private-with-authorizations.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 5: private form carries no retailers"
+  },
+  {
+    "path": "file/invalid/unknown-form.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Only full, pointer, private"
+  },
+  {
+    "path": "file/invalid/full-authorization-expires-after-file.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "authorization_expires_after_file",
+    "note": "Section 5 MUST"
+  },
+  {
+    "path": "file/invalid/full-expiry-over-180-days.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "file_expiry_exceeds_max",
+    "note": "Section 10: max 180 days"
+  },
+  {
+    "path": "file/invalid/full-expires-before-issued.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "expires_not_after_issued",
+    "note": "Expiry must follow issue"
+  },
+  {
+    "path": "file/invalid/full-duplicate-authorization-id.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "duplicate_authorization_id",
+    "note": "Authorization ids are unique within a file"
+  },
+  {
+    "path": "file/invalid/full-impossible-date.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "schema",
+    "note": "Feb 30 does not exist (format date-time; parseTimestamp also rejects it)"
+  },
+  {
+    "path": "verify-request/valid/amazon.json",
+    "kind": "verify-request",
+    "valid": true,
+    "note": "Section 9 example"
+  },
+  {
+    "path": "verify-request/valid/web-no-product-line.json",
+    "kind": "verify-request",
+    "valid": true,
+    "note": "product_line defaults to all"
+  },
+  {
+    "path": "verify-request/invalid/physical-channel.json",
+    "kind": "verify-request",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: physical is not verifiable"
+  },
+  {
+    "path": "verify-request/invalid/wildcard-territory.json",
+    "kind": "verify-request",
+    "valid": false,
+    "expect": "schema",
+    "note": "A request names one territory"
+  },
+  {
+    "path": "verify-request/invalid/missing-channel.json",
+    "kind": "verify-request",
+    "valid": false,
+    "expect": "schema",
+    "note": "Channel is required"
+  },
+  {
+    "path": "verify-request/invalid/retailer-name-only.json",
+    "kind": "verify-request",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 6: agents match on identifiers, not names"
+  },
+  {
+    "path": "verify-request/invalid/domain-with-scheme.json",
+    "kind": "verify-request",
+    "valid": false,
+    "expect": "schema",
+    "note": "Bare hostname only"
+  },
+  {
+    "path": "verify-response/valid/authorized.json",
+    "kind": "verify-response",
+    "valid": true,
+    "note": "Section 9 example"
+  },
+  {
+    "path": "verify-response/valid/authorized-observed.json",
+    "kind": "verify-response",
+    "valid": true,
+    "note": "Section 7: seen selling within 30 days"
+  },
+  {
+    "path": "verify-response/valid/expired.json",
+    "kind": "verify-response",
+    "valid": true
+  },
+  {
+    "path": "verify-response/valid/disputed.json",
+    "kind": "verify-response",
+    "valid": true
+  },
+  {
+    "path": "verify-response/valid/unlisted.json",
+    "kind": "verify-response",
+    "valid": true
+  },
+  {
+    "path": "verify-response/valid/brand-unverified-reason.json",
+    "kind": "verify-response",
+    "valid": true,
+    "note": "Section 9 reason"
+  },
+  {
+    "path": "verify-response/valid/brand-unverified-no-reason.json",
+    "kind": "verify-response",
+    "valid": true,
+    "note": "reason is optional"
+  },
+  {
+    "path": "verify-response/valid/with-signal.json",
+    "kind": "verify-response",
+    "valid": true,
+    "note": "Section 7 signals"
+  },
+  {
+    "path": "verify-response/invalid/missing-observed.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 7: every answer MUST carry observed"
+  },
+  {
+    "path": "verify-response/invalid/unlisted-observed.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 7: observed is null unless authorized"
+  },
+  {
+    "path": "verify-response/invalid/observed-without-last-seen.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 7: observed carries last_seen"
+  },
+  {
+    "path": "verify-response/invalid/with-tier.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Evidence tiers were removed (section 7)"
+  },
+  {
+    "path": "verify-response/invalid/unlisted-with-reason.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 9: reason only on brand_unverified"
+  },
+  {
+    "path": "verify-response/invalid/unlisted-with-authorization-id.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Unlisted answers leak nothing about other authorizations"
+  },
+  {
+    "path": "verify-response/invalid/authorized-missing-authorization-id.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema"
+  },
+  {
+    "path": "verify-response/invalid/missing-valid-until.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 9: valid_until is required"
+  },
+  {
+    "path": "verify-response/invalid/missing-signature.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Answers are signed"
+  },
+  {
+    "path": "verify-response/invalid/unknown-status.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "schema",
+    "note": "Section 1: unlisted is not unlawful"
+  },
+  {
+    "path": "verify-response/invalid/valid-until-over-24h.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "valid_until_exceeds_max",
+    "note": "Section 9 MUST"
+  },
+  {
+    "path": "verify-response/invalid/valid-until-before-checked.json",
+    "kind": "verify-response",
+    "valid": false,
+    "expect": "valid_until_not_after_checked"
+  }
+]

package/fixtures/verify-request/invalid/domain-with-scheme.json

@@ -0,0 +1,10 @@
+{
+  "brand_domain": "https://brand.example",
+  "channel": {
+    "type": "amazon",
+    "marketplace": "US",
+    "seller_id": "A1B2C3D4E5F6G7"
+  },
+  "territory": "US",
+  "product_line": "all"
+}

package/fixtures/verify-request/invalid/missing-channel.json

@@ -0,0 +1,5 @@
+{
+  "brand_domain": "brand.example",
+  "territory": "US",
+  "product_line": "all"
+}

package/fixtures/verify-request/invalid/physical-channel.json

@@ -0,0 +1,10 @@
+{
+  "brand_domain": "brand.example",
+  "channel": {
+    "type": "physical",
+    "address": "1 Main St",
+    "country": "US"
+  },
+  "territory": "US",
+  "product_line": "all"
+}

package/fixtures/verify-request/invalid/retailer-name-only.json

@@ -0,0 +1,6 @@
+{
+  "brand_domain": "brand.example",
+  "territory": "US",
+  "product_line": "all",
+  "retailer": "Example Retail LLC"
+}

package/fixtures/verify-request/invalid/wildcard-territory.json

@@ -0,0 +1,10 @@
+{
+  "brand_domain": "brand.example",
+  "channel": {
+    "type": "amazon",
+    "marketplace": "US",
+    "seller_id": "A1B2C3D4E5F6G7"
+  },
+  "territory": "*",
+  "product_line": "all"
+}

package/fixtures/verify-request/valid/amazon.json

@@ -0,0 +1,10 @@
+{
+  "brand_domain": "brand.example",
+  "channel": {
+    "type": "amazon",
+    "marketplace": "US",
+    "seller_id": "A1B2C3D4E5F6G7"
+  },
+  "territory": "US",
+  "product_line": "all"
+}

package/fixtures/verify-request/valid/web-no-product-line.json

@@ -0,0 +1,8 @@
+{
+  "brand_domain": "brand.example",
+  "channel": {
+    "type": "web",
+    "domain": "retailer.example"
+  },
+  "territory": "CA"
+}

package/fixtures/verify-response/invalid/authorized-missing-authorization-id.json

@@ -0,0 +1,12 @@
+{
+  "status": "authorized",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/missing-observed.json

@@ -0,0 +1,12 @@
+{
+  "status": "authorized",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/missing-signature.json

@@ -0,0 +1,9 @@
+{
+  "status": "authorized",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": null,
+  "signals": []
+}

package/fixtures/verify-response/invalid/missing-valid-until.json

@@ -0,0 +1,12 @@
+{
+  "status": "authorized",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/observed-without-last-seen.json

@@ -0,0 +1,13 @@
+{
+  "status": "authorized",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": {},
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/unknown-status.json

@@ -0,0 +1,13 @@
+{
+  "status": "unlawful",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/unlisted-observed.json

@@ -0,0 +1,13 @@
+{
+  "status": "unlisted",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": {
+    "last_seen": "2026-09-20T00:00:00Z"
+  },
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/unlisted-with-authorization-id.json

@@ -0,0 +1,12 @@
+{
+  "status": "unlisted",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  },
+  "authorization_id": "auth_01J9X2"
+}

package/fixtures/verify-response/invalid/unlisted-with-reason.json

@@ -0,0 +1,12 @@
+{
+  "status": "unlisted",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  },
+  "reason": "domain_unlinked"
+}

package/fixtures/verify-response/invalid/valid-until-before-checked.json

@@ -0,0 +1,13 @@
+{
+  "status": "authorized",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-23T14:02:11Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/valid-until-over-24h.json

@@ -0,0 +1,13 @@
+{
+  "status": "authorized",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:12Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  }
+}

package/fixtures/verify-response/invalid/with-tier.json

@@ -0,0 +1,14 @@
+{
+  "status": "authorized",
+  "authorization_id": "auth_01J9X2",
+  "expires": "2026-12-22T00:00:00Z",
+  "checked": "2026-09-23T14:02:11Z",
+  "valid_until": "2026-09-24T14:02:11Z",
+  "observed": null,
+  "signals": [],
+  "signature": {
+    "kid": "ar-2026-09",
+    "jws": "eyJhbGciOiJFZERTQSIsImtpZCI6ImFyLTIwMjYtMDkifQ..c2lnbmF0dXJlLXBsYWNlaG9sZGVy"
+  },
+  "tier": "brand_attested"
+}