@getalby/lightning-tools 8.1.1 → 8.2.0

package/dist/cjs/402.cjs

@@ -1259,6 +1259,28 @@ class Invoice {
     }
 }
 
+/** Apply a previously-obtained credential to the outgoing request headers. */
+const applyCredentials = (headers, credentials) => {
+    headers.set(credentials.header, credentials.value);
+};
+/** Attach payment metadata to a response and return it (typed). */
+const attachPayment = (response, payment) => {
+    if (payment) {
+        response.payment = payment;
+    }
+    return response;
+};
+/** Payment metadata describing a request authorized with a reused credential. */
+const reusedCredentialPayment = (credentials) => credentials ? { paid: false, amount: 0, credentials } : undefined;
+/** Satoshi amount of a BOLT11 invoice (0 when it cannot be decoded). */
+const getInvoiceAmount = (invoice) => {
+    try {
+        return new Invoice({ pr: invoice }).satoshi;
+    }
+    catch (_) {
+        return 0;
+    }
+};
 function createGuardedWallet(wallet, maxAmountSats) {
     return {
         payInvoice: async (args) => {
@@ -1310,6 +1332,9 @@ const handleL402Payment = async (l402Header, url, fetchArgs, headers, wallet) =>
     const details = parseL402(l402Header);
     const token = details.token || details.macaroon;
     const invoice = details.invoice;
+    // Preserve the scheme the server challenged with (L402 or LSAT) so the
+    // retry's Authorization header matches what the server expects.
+    const scheme = /^\s*LSAT\b/i.test(l402Header) ? "LSAT" : "L402";
     if (!token) {
         throw new Error("L402: missing token/macaroon in WWW-Authenticate header");
     }
@@ -1317,8 +1342,16 @@ const handleL402Payment = async (l402Header, url, fetchArgs, headers, wallet) =>
         throw new Error("L402: missing invoice in WWW-Authenticate header");
     }
     const invResp = await wallet.payInvoice({ invoice });
-    headers.set("Authorization", `L402 ${token}:${invResp.preimage}`);
-    return fetch(url, fetchArgs);
+    const value = `${scheme} ${token}:${invResp.preimage}`;
+    headers.set("Authorization", value);
+    const response = await fetch(url, fetchArgs);
+    return attachPayment(response, {
+        paid: true,
+        amount: getInvoiceAmount(invoice),
+        feesPaid: invResp.fees_paid,
+        preimage: invResp.preimage,
+        credentials: { header: "Authorization", value },
+    });
 };
 const fetchWithL402 = async (url, fetchArgs, options) => {
     const wallet = options.wallet;
@@ -1332,6 +1365,15 @@ const fetchWithL402 = async (url, fetchArgs, options) => {
     fetchArgs.mode = "cors";
     const headers = new Headers(fetchArgs.headers ?? undefined);
     fetchArgs.headers = headers;
+    // If the caller supplied a credential, we MUST use it and never pay again —
+    // even if the server still responds with a 402. Re-paying here is the exact
+    // double-charge this API exists to prevent; the caller decides what to do
+    // with a rejected credential (retry after settlement, top up, etc.).
+    if (options.credentials) {
+        applyCredentials(headers, options.credentials);
+        const reusedResp = await fetch(url, fetchArgs);
+        return attachPayment(reusedResp, reusedCredentialPayment(options.credentials));
+    }
     const initResp = await fetch(url, fetchArgs);
     const header = initResp.headers.get("www-authenticate");
     if (!header) {
@@ -1398,9 +1440,17 @@ const handleX402Payment = async (x402Header, url, fetchArgs, headers, wallet) =>
     if (invoice.amountRaw != requirements.amount) {
         throw new Error(`Invalid invoice amount: ${invoice.amountRaw}. expected ${requirements.amount}`);
     }
-    await wallet.payInvoice({ invoice: invoice.paymentRequest });
-    headers.set("payment-signature", buildX402PaymentSignature(requirements.scheme, requirements.network, invoice.paymentRequest, requirements));
-    return fetch(url, fetchArgs);
+    const invResp = await wallet.payInvoice({ invoice: invoice.paymentRequest });
+    const value = buildX402PaymentSignature(requirements.scheme, requirements.network, invoice.paymentRequest, requirements);
+    headers.set("payment-signature", value);
+    const response = await fetch(url, fetchArgs);
+    return attachPayment(response, {
+        paid: true,
+        amount: invoice.satoshi,
+        feesPaid: invResp.fees_paid,
+        preimage: invResp.preimage,
+        credentials: { header: "payment-signature", value },
+    });
 };
 const fetchWithX402 = async (url, fetchArgs, options) => {
     const wallet = options.wallet;
@@ -1411,6 +1461,15 @@ const fetchWithX402 = async (url, fetchArgs, options) => {
     fetchArgs.mode = "cors";
     const headers = new Headers(fetchArgs.headers ?? undefined);
     fetchArgs.headers = headers;
+    // If the caller supplied a credential, we MUST use it and never pay again —
+    // even if the server still responds with a 402. Re-paying here is the exact
+    // double-charge this API exists to prevent; the caller decides what to do
+    // with a rejected credential (retry after settlement, top up, etc.).
+    if (options.credentials) {
+        applyCredentials(headers, options.credentials);
+        const reusedResp = await fetch(url, fetchArgs);
+        return attachPayment(reusedResp, reusedCredentialPayment(options.credentials));
+    }
     const initResp = await fetch(url, fetchArgs);
     const header = initResp.headers.get("PAYMENT-REQUIRED");
     if (!header) {
@@ -1557,8 +1616,16 @@ const handleMppChargePayment = async (wwwAuthHeader, url, fetchArgs, headers, wa
     const invResp = await wallet.payInvoice({ invoice });
     // Per spec: Authorization: Payment <base64url-token>  (single token, no wrapper)
     const credential = buildMppCredential(challenge, invResp.preimage);
-    headers.set("Authorization", `Payment ${credential}`);
-    return fetch(url, fetchArgs);
+    const value = `Payment ${credential}`;
+    headers.set("Authorization", value);
+    const response = await fetch(url, fetchArgs);
+    return attachPayment(response, {
+        paid: true,
+        amount: getInvoiceAmount(invoice),
+        feesPaid: invResp.fees_paid,
+        preimage: invResp.preimage,
+        credentials: { header: "Authorization", value },
+    });
 };
 /**
  * Fetch a resource protected by the draft-lightning-charge-00 payment
@@ -1569,9 +1636,11 @@ const handleMppChargePayment = async (wwwAuthHeader, url, fetchArgs, headers, wa
  * the function pays the embedded BOLT11 invoice and retries with the
  * resulting preimage as the credential.
  *
- * Note: lightning-charge uses consume-once challenge semantics – each
- * challenge embeds a fresh invoice, so paid credentials cannot be reused.
- * The `store` option is accepted for API consistency but is not used.
+ * Pass a previous credential via `options.credentials` to reuse it (e.g. when
+ * polling); the credential is applied and the function NEVER pays again, even
+ * if the server still responds with a 402 (that response is returned as-is).
+ * Note: lightning-charge typically uses consume-once challenge semantics, so a
+ * reused credential is only accepted by servers that explicitly support it.
  */
 const fetchWithMpp = async (url, fetchArgs, options) => {
     const wallet = options.wallet;
@@ -1585,6 +1654,15 @@ const fetchWithMpp = async (url, fetchArgs, options) => {
     fetchArgs.mode = "cors";
     const headers = new Headers(fetchArgs.headers ?? undefined);
     fetchArgs.headers = headers;
+    // If the caller supplied a credential, we MUST use it and never pay again —
+    // even if the server still responds with a 402. Re-paying here is the exact
+    // double-charge this API exists to prevent; the caller decides what to do
+    // with a rejected credential (retry after settlement, top up, etc.).
+    if (options.credentials) {
+        applyCredentials(headers, options.credentials);
+        const reusedResp = await fetch(url, fetchArgs);
+        return attachPayment(reusedResp, reusedCredentialPayment(options.credentials));
+    }
     const initResp = await fetch(url, fetchArgs);
     const wwwAuthHeader = initResp.headers.get("www-authenticate");
     if (!wwwAuthHeader ||
@@ -1605,6 +1683,15 @@ const fetch402 = async (url, fetchArgs, options) => {
     fetchArgs.mode = "cors";
     const headers = new Headers(fetchArgs.headers ?? undefined);
     fetchArgs.headers = headers;
+    // If the caller supplied a credential, we MUST use it and never pay again —
+    // even if the server still responds with a 402. Re-paying here is the exact
+    // double-charge this API exists to prevent; the caller decides what to do
+    // with a rejected credential (retry after settlement, top up, etc.).
+    if (options.credentials) {
+        applyCredentials(headers, options.credentials);
+        const reusedResp = await fetch(url, fetchArgs);
+        return attachPayment(reusedResp, reusedCredentialPayment(options.credentials));
+    }
     const initResp = await fetch(url, fetchArgs);
     // L402 / LSAT: dedicated scheme, dispatch directly.
     const wwwAuthHeader = initResp.headers.get("www-authenticate");
@@ -1712,15 +1799,19 @@ function parseL402Authorization(input) {
     };
 }
 
+exports.applyCredentials = applyCredentials;
+exports.attachPayment = attachPayment;
 exports.createGuardedWallet = createGuardedWallet;
 exports.fetch402 = fetch402;
 exports.fetchWithL402 = fetchWithL402;
 exports.fetchWithMpp = fetchWithMpp;
 exports.fetchWithX402 = fetchWithX402;
 exports.findX402LightningRequirements = findX402LightningRequirements;
+exports.getInvoiceAmount = getInvoiceAmount;
 exports.issueL402Macaroon = issueL402Macaroon;
 exports.makeL402AuthenticateHeader = makeL402AuthenticateHeader;
 exports.parseL402 = parseL402;
 exports.parseL402Authorization = parseL402Authorization;
+exports.reusedCredentialPayment = reusedCredentialPayment;
 exports.verifyL402Macaroon = verifyL402Macaroon;
 //# sourceMappingURL=402.cjs.map