@humanagencyp/hap-core 0.4.4 → 0.4.5

package/dist/index.js

@@ -439,10 +439,22 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   if (v4BoundsErrors.length > 0) {
     return { approved: false, errors: v4BoundsErrors };
   }
-  if (context && profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
-    const contextErrors = checkContextConstraints(context, request.execution, profile);
-    if (contextErrors.length > 0) {
-      return { approved: false, errors: contextErrors };
+  if (profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
+    const enforceableFields = Object.entries(profile.contextSchema.fields).filter(([, def]) => def.constraint?.enforceable?.length);
+    if (enforceableFields.length > 0 && !context) {
+      return {
+        approved: false,
+        errors: [{
+          code: "BOUND_EXCEEDED",
+          message: `Declared context required for constraint enforcement but not provided. Fields: ${enforceableFields.map(([n]) => n).join(", ")}`
+        }]
+      };
+    }
+    if (context) {
+      const contextErrors = checkContextConstraints(context, request.execution, profile);
+      if (contextErrors.length > 0) {
+        return { approved: false, errors: contextErrors };
+      }
     }
   }
   return { approved: true };

package/dist/index.mjs

@@ -377,10 +377,22 @@ async function verifyV4(request, profile, publicKeyHex, now, executionLog) {
   if (v4BoundsErrors.length > 0) {
     return { approved: false, errors: v4BoundsErrors };
   }
-  if (context && profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
-    const contextErrors = checkContextConstraints(context, request.execution, profile);
-    if (contextErrors.length > 0) {
-      return { approved: false, errors: contextErrors };
+  if (profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
+    const enforceableFields = Object.entries(profile.contextSchema.fields).filter(([, def]) => def.constraint?.enforceable?.length);
+    if (enforceableFields.length > 0 && !context) {
+      return {
+        approved: false,
+        errors: [{
+          code: "BOUND_EXCEEDED",
+          message: `Declared context required for constraint enforcement but not provided. Fields: ${enforceableFields.map(([n]) => n).join(", ")}`
+        }]
+      };
+    }
+    if (context) {
+      const contextErrors = checkContextConstraints(context, request.execution, profile);
+      if (contextErrors.length > 0) {
+        return { approved: false, errors: contextErrors };
+      }
     }
   }
   return { approved: true };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanagencyp/hap-core",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Core types, cryptographic primitives, and verification logic for the Human Agency Protocol",
   "license": "MIT",
   "repository": {
@@ -21,16 +21,6 @@
     "dist",
     "src"
   ],
-  "scripts": {
-    "build": "tsup src/index.ts --format cjs,esm --dts",
-    "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "prepublishOnly": "pnpm build",
-    "release:patch": "pnpm version patch && git push --follow-tags",
-    "release:minor": "pnpm version minor && git push --follow-tags",
-    "release:major": "pnpm version major && git push --follow-tags"
-  },
   "dependencies": {
     "@noble/ed25519": "^2.1.0"
   },
@@ -39,5 +29,14 @@
     "tsup": "^8.0.0",
     "typescript": "^5.3.0",
     "vitest": "^1.0.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts",
+    "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "release:patch": "pnpm version patch && git push --follow-tags",
+    "release:minor": "pnpm version minor && git push --follow-tags",
+    "release:major": "pnpm version major && git push --follow-tags"
   }
-}
+}

package/src/gatekeeper.ts

@@ -274,11 +274,30 @@ async function verifyV4(
     return { approved: false, errors: v4BoundsErrors };
   }
 
-  // Check context constraints using contextSchema
-  if (context && profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
-    const contextErrors = checkContextConstraints(context, request.execution, profile);
-    if (contextErrors.length > 0) {
-      return { approved: false, errors: contextErrors };
+  // Check context constraints using contextSchema.
+  // Fail closed: if the profile declares enforceable context constraints but
+  // no declared context was supplied, reject — the SP cannot enforce these
+  // (it only holds context_hash), so skipping the check would silently
+  // bypass scope restrictions like allowed_recipients / allowed_domains.
+  if (profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
+    const enforceableFields = Object.entries(profile.contextSchema.fields)
+      .filter(([, def]) => def.constraint?.enforceable?.length);
+
+    if (enforceableFields.length > 0 && !context) {
+      return {
+        approved: false,
+        errors: [{
+          code: 'BOUND_EXCEEDED',
+          message: `Declared context required for constraint enforcement but not provided. Fields: ${enforceableFields.map(([n]) => n).join(', ')}`,
+        }],
+      };
+    }
+
+    if (context) {
+      const contextErrors = checkContextConstraints(context, request.execution, profile);
+      if (contextErrors.length > 0) {
+        return { approved: false, errors: contextErrors };
+      }
     }
   }