@peac/protocol 0.15.0 → 0.15.2

package/dist/index.mjs

@@ -2208,6 +2208,18 @@ async function resolveJWKS(issuerUrl, options) {
     revokedKeys
   };
 }
+var ED25519_SIGNATURE_BYTES = 64;
+function ed25519SignatureByteLength(jws) {
+  const parts = jws.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  try {
+    return base64urlDecode(parts[2]).length;
+  } catch {
+    return null;
+  }
+}
 
 // src/verify.ts
 function jwkToPublicKey(jwk) {
@@ -2305,6 +2317,23 @@ async function verifyReceipt(optionsOrJws) {
       };
     }
     const publicKey = jwkToPublicKey(jwk);
+    const signatureBytes = ed25519SignatureByteLength(receiptJws);
+    if (signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES) {
+      const durationMs = performance.now() - startTime;
+      fireTelemetryHook(telemetry?.onReceiptVerified, {
+        receiptHash: hashReceipt(receiptJws),
+        valid: false,
+        reasonCode: "invalid_signature",
+        issuer: payload.iss,
+        kid: header.kid,
+        durationMs
+      });
+      return {
+        ok: false,
+        reason: "invalid_signature",
+        details: "Ed25519 signature has invalid length"
+      };
+    }
     const result = await verify(receiptJws, publicKey);
     if (!result.valid) {
       const durationMs = performance.now() - startTime;
@@ -2340,7 +2369,7 @@ async function verifyReceipt(optionsOrJws) {
         ...jwksFetchTime && { jwks_fetch_ms: jwksFetchTime }
       }
     };
-  } catch (err) {
+  } catch {
     const durationMs = performance.now() - startTime;
     fireTelemetryHook(telemetry?.onReceiptVerified, {
       receiptHash: hashReceipt(receiptJws),
@@ -2351,7 +2380,7 @@ async function verifyReceipt(optionsOrJws) {
     return {
       ok: false,
       reason: "verification_error",
-      details: err instanceof Error ? err.message : String(err)
+      details: "Unexpected verification error."
     };
   }
 }
@@ -2664,11 +2693,18 @@ async function verifyLocal(jws, publicKey, options = {}) {
         message: `Invalid receipt payload: ${syntaxMessage}`
       };
     }
-    const message = err instanceof Error ? err.message : String(err);
+    const signatureBytes = ed25519SignatureByteLength(jws);
+    if (signatureBytes !== null && signatureBytes !== ED25519_SIGNATURE_BYTES) {
+      return {
+        valid: false,
+        code: "E_INVALID_SIGNATURE",
+        message: "Ed25519 signature has invalid length"
+      };
+    }
     return {
       valid: false,
       code: "E_INTERNAL",
-      message: `Unexpected verification error: ${message}`
+      message: "Unexpected verification error."
     };
   }
 }