@sekyuriti/attest 0.2.2 → 0.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +38 -93
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -2,52 +2,39 @@
2
2
 
3
3
  API protection for Next.js applications. Verify that requests come from real browsers, not bots or scripts.
4
4
 
5
- ## Installation
5
+ ## Quick Start
6
+
7
+ One command setup:
6
8
 
7
9
  ```bash
8
- npm install @sekyuriti/attest
10
+ npx @sekyuriti/attest login
9
11
  ```
10
12
 
11
- ## Quick Start
13
+ This will:
14
+ 1. Open browser for authentication
15
+ 2. Let you select your project
16
+ 3. Auto-add environment variables to `.env.local`
17
+ 4. Auto-inject the ATTEST script into `layout.tsx`
12
18
 
13
- ### 1. Add the script to your frontend
19
+ Done. Your API is protected.
14
20
 
15
- ```html
16
- <script src="https://sekyuriti.build/api/v2/attest/script/YOUR_PROJECT_ID" defer></script>
17
- ```
21
+ ## What It Does
18
22
 
19
- Or in Next.js:
20
-
21
- ```tsx
22
- // app/layout.tsx
23
- export default function RootLayout({ children }) {
24
- return (
25
- <html>
26
- <head>
27
- <script
28
- src={`https://sekyuriti.build/api/v2/attest/script/${process.env.NEXT_PUBLIC_ATTEST_PROJECT_ID}`}
29
- defer
30
- />
31
- </head>
32
- <body>{children}</body>
33
- </html>
34
- );
35
- }
36
- ```
37
-
38
- ### 2. Protect your API routes
23
+ - **Frontend script** automatically signs all `fetch()` and `XMLHttpRequest` calls
24
+ - **Backend verification** validates signatures with SEKYURITI's API
25
+ - **Bots and scripts** can't generate valid signatures without running in a real browser
39
26
 
40
- **Option A: Middleware (recommended)**
27
+ ## Optional: Middleware
41
28
 
42
- Protects all `/api/*` routes automatically:
29
+ Add server-side verification for all API routes:
43
30
 
44
31
  ```ts
45
32
  // middleware.ts
46
33
  import { createAttestMiddleware } from "@sekyuriti/attest/middleware";
47
34
 
48
35
  export const middleware = createAttestMiddleware({
49
- projectId: process.env.ATTEST_PROJECT_ID!,
50
- apiKey: process.env.ATTEST_API_KEY!,
36
+ projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
37
+ apiKey: process.env.ATTEST_SECRET_KEY!,
51
38
  });
52
39
 
53
40
  export const config = {
@@ -55,7 +42,7 @@ export const config = {
55
42
  };
56
43
  ```
57
44
 
58
- **Option B: Per-route verification**
45
+ ## Optional: Per-Route Verification
59
46
 
60
47
  ```ts
61
48
  // app/api/protected/route.ts
@@ -63,8 +50,8 @@ import { verifyAttest } from "@sekyuriti/attest";
63
50
 
64
51
  export async function POST(request: Request) {
65
52
  const result = await verifyAttest(request, {
66
- projectId: process.env.ATTEST_PROJECT_ID!,
67
- apiKey: process.env.ATTEST_API_KEY!,
53
+ projectId: process.env.NEXT_PUBLIC_ATTEST_KEY!,
54
+ apiKey: process.env.ATTEST_SECRET_KEY!,
68
55
  });
69
56
 
70
57
  if (!result.attested) {
@@ -75,72 +62,26 @@ export async function POST(request: Request) {
75
62
  }
76
63
  ```
77
64
 
78
- ## Environment Variables
79
-
80
- ```env
81
- ATTEST_PROJECT_ID=ATST_xxxxxxxxxxxx
82
- ATTEST_API_KEY=sk_xxxxxxxxxxxx
83
- NEXT_PUBLIC_ATTEST_PROJECT_ID=ATST_xxxxxxxxxxxx
84
- ```
85
-
86
- ## API Reference
87
-
88
- ### `verifyAttest(request, config)`
89
-
90
- Verify a single request.
91
-
92
- ```ts
93
- const result = await verifyAttest(request, {
94
- projectId: "ATST_xxx",
95
- apiKey: "sk_xxx",
96
- });
65
+ ## CLI Commands
97
66
 
98
- // result.attested: boolean
99
- // result.fingerprint: string (if attested)
100
- // result.reason: string (if not attested)
101
- ```
102
-
103
- ### `createAttestMiddleware(config)`
104
-
105
- Create middleware for automatic verification.
106
-
107
- ```ts
108
- const middleware = createAttestMiddleware({
109
- projectId: "ATST_xxx",
110
- apiKey: "sk_xxx",
111
-
112
- // Optional settings
113
- protectedRoutes: ["/api/*"], // Routes to protect
114
- excludeRoutes: ["/api/health"], // Routes to skip
115
- allowUnauthenticated: false, // Allow requests without headers
116
-
117
- // Custom handlers
118
- onBlocked: (req, result) => Response.json({ error: result.reason }, { status: 403 }),
119
- onAllowed: (req, result) => console.log("Verified:", result.fingerprint),
120
- });
67
+ ```bash
68
+ attest login # Authenticate and setup project
69
+ attest logout # Sign out
70
+ attest status # Show account and usage info
71
+ attest init # Re-run setup in current project
72
+ attest whoami # Print current user email
73
+ attest help # Show help
121
74
  ```
122
75
 
123
- ### `createAttestVerifier(config)`
124
-
125
- Create a reusable verifier function.
76
+ ## Environment Variables
126
77
 
127
- ```ts
128
- const verify = createAttestVerifier({
129
- projectId: process.env.ATTEST_PROJECT_ID!,
130
- apiKey: process.env.ATTEST_API_KEY!,
131
- });
78
+ Auto-generated by `attest login`:
132
79
 
133
- // Use in multiple routes
134
- const result = await verify(request);
80
+ ```env
81
+ NEXT_PUBLIC_ATTEST_KEY=your_public_key
82
+ ATTEST_SECRET_KEY=your_secret_key
135
83
  ```
136
84
 
137
- ## How It Works
138
-
139
- 1. **Frontend script** automatically signs all `fetch()` and `XMLHttpRequest` calls
140
- 2. **Signatures** are added as headers: `X-Attest-Timestamp`, `X-Attest-Signature`, `X-Attest-Fingerprint`
141
- 3. **Backend verification** validates signatures with SEKYURITI's API
142
- 4. **Bots and scripts** can't generate valid signatures without running in a real browser
143
-
144
85
  ## Protection Features
145
86
 
146
87
  - DevTools detection
@@ -149,6 +90,10 @@ const result = await verify(request);
149
90
  - Browser fingerprinting
150
91
  - Timestamp validation
151
92
 
93
+ ## Documentation
94
+
95
+ https://sekyuriti.build/docs/attest
96
+
152
97
  ## License
153
98
 
154
99
  MIT
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sekyuriti/attest",
3
- "version": "0.2.2",
3
+ "version": "0.2.3",
4
4
  "description": "API protection middleware for Next.js - verify requests with ATTEST",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.mjs",