@mpgd/adapter-ait 0.12.6 → 0.12.7

package/dist/authority-fetch.d.ts

@@ -8,6 +8,19 @@
 * response validation in its authority client. This helper only owns the
 * WebView transport invocation, so all game-owned authority endpoints can use
 * the same safe call shape.
+*
+* Authority calls carry grant evidence and idempotency headers, so the
+* resource must resolve to an `https:` origin. Plain `http:` is accepted only
+* for a loopback development authority (`localhost` or `127.0.0.1`).
+*
+* The transport receives exactly the representation that passed the policy
+* check. A string, or a URL-like object (a string `href` and no `url`, which
+* also covers a `URL` created in another realm such as an iframe), is
+* forwarded as its validated absolute `href`. A same-realm `Request` is
+* forwarded unchanged after its immutable `url` validated. Anything else is
+* rejected: a Request-like object that is not a same-realm `Request` would be
+* stringified by native fetch through `toString`, not `url`, so validating its
+* `url` would not cover what is actually fetched.
 */
 export declare function fetchAitAuthority(input: {
   readonly resource: RequestInfo | URL;

package/dist/authority-fetch.js

@@ -8,11 +8,91 @@
  * response validation in its authority client. This helper only owns the
  * WebView transport invocation, so all game-owned authority endpoints can use
  * the same safe call shape.
+ *
+ * Authority calls carry grant evidence and idempotency headers, so the
+ * resource must resolve to an `https:` origin. Plain `http:` is accepted only
+ * for a loopback development authority (`localhost` or `127.0.0.1`).
+ *
+ * The transport receives exactly the representation that passed the policy
+ * check. A string, or a URL-like object (a string `href` and no `url`, which
+ * also covers a `URL` created in another realm such as an iframe), is
+ * forwarded as its validated absolute `href`. A same-realm `Request` is
+ * forwarded unchanged after its immutable `url` validated. Anything else is
+ * rejected: a Request-like object that is not a same-realm `Request` would be
+ * stringified by native fetch through `toString`, not `url`, so validating its
+ * `url` would not cover what is actually fetched.
  */
 export function fetchAitAuthority(input) {
     const fetchImplementation = input.fetch ?? globalThis.fetch;
     if (typeof fetchImplementation !== 'function') {
         return Promise.reject(new TypeError('AIT authority fetch is unavailable.'));
     }
-    return fetchImplementation(input.resource, input.init);
+    const resolution = resolveAitAuthorityResource(input.resource);
+    if (!resolution.ok) {
+        return Promise.reject(resolution.error);
+    }
+    return fetchImplementation(resolution.resource, input.init);
+}
+const loopbackHostnames = new Set(['localhost', '127.0.0.1']);
+function resolveAitAuthorityResource(resource) {
+    const candidate = readAitAuthorityResourceCandidate(resource);
+    if (candidate === undefined) {
+        return {
+            ok: false,
+            error: new TypeError('AIT authority resource must be a string, URL, or same-realm Request.'),
+        };
+    }
+    let url;
+    try {
+        url = new URL(candidate.href, globalThis.location?.href);
+    }
+    catch {
+        return {
+            ok: false,
+            error: new TypeError('AIT authority resource must be an absolute https: URL.'),
+        };
+    }
+    const policyError = checkAitAuthorityUrl(url);
+    if (policyError !== undefined) {
+        return { ok: false, error: policyError };
+    }
+    return {
+        ok: true,
+        resource: candidate.kind === 'request' ? candidate.request : url.href,
+    };
+}
+function checkAitAuthorityUrl(url) {
+    if (url.protocol === 'https:') {
+        return undefined;
+    }
+    if (url.protocol === 'http:' && loopbackHostnames.has(url.hostname)) {
+        return undefined;
+    }
+    return new TypeError(`AIT authority resource must use https: (http: is allowed only for localhost); received ${url.protocol}//${url.host}.`);
+}
+/**
+ * Reads the URL text once so the same value is both validated and forwarded.
+ *
+ * URL-like objects are recognized by shape (`instanceof URL` is false for a
+ * URL from another realm) and forwarded as their href string, so the object
+ * itself never reaches the transport. Requests are only accepted via a
+ * same-realm `instanceof Request`: the instance must be forwarded as-is, and
+ * native fetch stringifies any non-Request object through `toString` rather
+ * than reading `url`, so a duck-typed `{ url }` cannot be trusted.
+ */
+function readAitAuthorityResourceCandidate(resource) {
+    if (typeof resource === 'string') {
+        return { kind: 'href', href: resource };
+    }
+    if (typeof resource !== 'object' || resource === null) {
+        return undefined;
+    }
+    if (typeof Request === 'function' && resource instanceof Request) {
+        return { kind: 'request', href: resource.url, request: resource };
+    }
+    const { href, url } = resource;
+    if (typeof href === 'string' && url === undefined) {
+        return { kind: 'href', href };
+    }
+    return undefined;
 }

package/dist/host.js

@@ -16,6 +16,13 @@ const invalidBridgeRequestId = 'ait-invalid-request';
 const rewardedAdEvidenceSchema = 'apps-in-toss.rewarded-ad.callback.v1';
 const iapEvidenceSchema = 'apps-in-toss.iap.callback.v1';
 const minimumPromotionTossAppVersion = '5.232.0';
+/**
+ * Every adapter-owned durable marker (purchase attempts, promotion grants,
+ * recovery cursors) lives under this prefix. Game code shares the same native
+ * storage, so `storage.save`/`storage.load` must never touch these keys: a
+ * forged `completed` marker would otherwise short-circuit purchase verification.
+ */
+const reservedStorageKeyPrefix = 'mpgd:ait:';
 const promotionGrantStoragePrefix = 'mpgd:ait:promotion-grant:v1:';
 /**
  * A client idempotency key must survive a bridge reload. The authoritative
@@ -372,6 +379,7 @@ export function createAitHostBridge(options = {}) {
             }
             case 'ads.showRewarded': {
                 const placementId = readPlacementId(request.payload);
+                const correlationId = readRewardedAdCorrelationId(request.payload, request.id);
                 const adGroupId = adGroupIds.get(placementId);
                 if (adGroupId === undefined
                     || adPlacementTypes.get(placementId) !== 'rewarded'
@@ -379,13 +387,15 @@ export function createAitHostBridge(options = {}) {
                     return ok(request, { status: 'unavailable', rewardGranted: false });
                 }
                 const shown = await withLoadedAdSlot(dependencies, adGroupId, loadedAdGroupIds, loadingAdGroups, adLoadCoordinator, activeAdGroupIds, adTimeoutMs, 'rewarded', async () => {
-                    const correlationId = readIdempotencyKey(request.payload, request.id);
                     const result = await showRewardedAd(dependencies, adGroupId, adTimeoutMs, adDisplayStartTimeoutMs, adMaximumDisplayMs);
                     return result.rewardGranted
                         ? {
                             ...result,
-                            // game-services forwards this as platformImpressionId and compares it
-                            // with the native callback correlationId during authority verification.
+                            // The correlationId is client-supplied evidence, not a native receipt:
+                            // the Apps in Toss show call only carries the adGroupId, so nothing
+                            // native echoes it back. game-services forwards it as
+                            // platformImpressionId; the backend rewardAuthority must verify it
+                            // (and the rest of this evidence) before granting any reward.
                             ledgerEntryId: correlationId,
                             evidence: {
                                 schema: rewardedAdEvidenceSchema,
@@ -1030,11 +1040,19 @@ function showAd(dependencies, adGroupId, timeoutMs, displayStartTimeoutMs, maxim
         }
     });
 }
+/**
+ * Launch and inbound-share parameters arrive from untrusted deep links. Bound
+ * each forwarded value and the nested `queryParams` JSON so a hostile link
+ * cannot push oversized or unbounded data into the game.
+ */
+const maximumLaunchParamLength = 256;
+const maximumNestedQueryParamsJsonLength = 4_096;
+const maximumNestedQueryParamCount = 32;
 function getLaunchIntent() {
     const params = inboundSearchParams();
-    const challengeToken = nonEmptyParam(params.get('challengeToken'));
-    const puzzleId = nonEmptyParam(params.get('puzzleId'));
-    const requestedEntry = nonEmptyParam(params.get('entry'));
+    const challengeToken = boundedParam(params.get('challengeToken'));
+    const puzzleId = boundedParam(params.get('puzzleId'));
+    const requestedEntry = boundedParam(params.get('entry'));
     let entry;
     if (requestedEntry !== undefined && launchEntries.has(requestedEntry)) {
         entry = requestedEntry;
@@ -1053,8 +1071,8 @@ function getLaunchIntent() {
 }
 function readInboundShare() {
     const params = inboundSearchParams();
-    const puzzleId = nonEmptyParam(params.get('puzzleId'));
-    const challengeToken = nonEmptyParam(params.get('challengeToken'));
+    const puzzleId = boundedParam(params.get('puzzleId'));
+    const challengeToken = boundedParam(params.get('challengeToken'));
     return puzzleId === undefined && challengeToken === undefined
         ? null
         : {
@@ -1065,12 +1083,24 @@ function readInboundShare() {
 function inboundSearchParams() {
     const params = new URLSearchParams(globalThis.location?.search ?? '');
     const nested = params.get('queryParams');
-    if (nested !== null) {
+    if (nested !== null && nested.length <= maximumNestedQueryParamsJsonLength) {
         try {
             const parsed = JSON.parse(nested);
             if (isRecord(parsed)) {
+                let merged = 0;
                 for (const [key, value] of Object.entries(parsed)) {
-                    if (typeof value === 'string' && !params.has(key)) {
+                    if (merged >= maximumNestedQueryParamCount) {
+                        break;
+                    }
+                    // Direct search params win; nested values only fill missing keys and
+                    // must be bounded strings. Keys are counted whether or not they merge
+                    // so an attacker cannot pad past the cap with ignored entries.
+                    merged += 1;
+                    if (typeof value === 'string'
+                        && key.length > 0
+                        && key.length <= maximumLaunchParamLength
+                        && value.length <= maximumLaunchParamLength
+                        && !params.has(key)) {
                         params.set(key, value);
                     }
                 }
@@ -2170,6 +2200,9 @@ function readStorageKey(payload) {
     if (typeof key !== 'string' || key.length === 0) {
         throw new TypeError('AIT storage key must be a non-empty string.');
     }
+    if (key.startsWith(reservedStorageKeyPrefix)) {
+        throw new TypeError(`AIT storage keys starting with "${reservedStorageKeyPrefix}" are reserved for adapter-owned markers.`);
+    }
     return key;
 }
 function readPlacementId(payload) {
@@ -2186,9 +2219,24 @@ function readBannerSurfaceId(payload) {
     }
     return surfaceId;
 }
-function readIdempotencyKey(payload, fallback) {
+/**
+ * A rewarded-ad idempotencyKey becomes the client-supplied evidence
+ * correlationId. It is optional, but when present it must obey the same
+ * bounded visible-character rule as purchase keys so a game cannot push
+ * arbitrary blobs into reward evidence.
+ */
+function readRewardedAdCorrelationId(payload, fallback) {
     const value = readPayloadRecord(payload).idempotencyKey;
-    return typeof value === 'string' && value.length > 0 ? value : fallback;
+    if (value === undefined) {
+        return fallback;
+    }
+    if (typeof value !== 'string'
+        || value.length === 0
+        || value.length > 256
+        || /[\p{Cc}\p{Cf}]/u.test(value)) {
+        throw new TypeError('AIT rewarded ad idempotencyKey must contain 1 to 256 visible characters.');
+    }
+    return value;
 }
 function readCommercePurchase(payload) {
     const value = readPayloadRecord(payload);
@@ -2256,8 +2304,10 @@ function ok(request, data) {
 function createBridgeError(id, code, message, retryable = false) {
     return { id, ok: false, error: { code, message, retryable } };
 }
-function nonEmptyParam(value) {
-    return value === null || value.length === 0 ? undefined : value;
+function boundedParam(value) {
+    return value === null || value.length === 0 || value.length > maximumLaunchParamLength
+        ? undefined
+        : value;
 }
 function isAbortError(error) {
     return isRecord(error) && error.name === 'AbortError';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mpgd/adapter-ait",
-  "version": "0.12.6",
+  "version": "0.12.7",
   "description": "Apps in Toss WebView platform adapter for mpgd games.",
   "license": "MIT",
   "repository": {