@tanakayuto/intmax402-express 0.1.0

package/README.md

@@ -0,0 +1,5 @@
+# @intmax402/express
+
+Part of [intmax402](https://github.com/zaq2989/intmax402) — HTTP 402, reimagined for AI agents.
+
+See [main README](https://github.com/zaq2989/intmax402) for full documentation.

package/dist/crypto.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Verify an Ethereum personal_sign signature.
+ * Recovers the signer address from the signature and compares with claimed address.
+ */
+export declare function verifySignature(signature: string, message: string, claimedAddress: string): boolean;

package/dist/crypto.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = verifySignature;
+const ethers_1 = require("ethers");
+/**
+ * Verify an Ethereum personal_sign signature.
+ * Recovers the signer address from the signature and compares with claimed address.
+ */
+function verifySignature(signature, message, claimedAddress) {
+    try {
+        // Recover signer address using ethers.verifyMessage (Ethereum personal_sign)
+        const recoveredAddress = ethers_1.ethers.verifyMessage(message, signature);
+        return recoveredAddress.toLowerCase() === claimedAddress.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { intmax402 } from "./middleware";
+export { verifySignature } from "./crypto";

package/dist/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = exports.intmax402 = void 0;
+var middleware_1 = require("./middleware");
+Object.defineProperty(exports, "intmax402", { enumerable: true, get: function () { return middleware_1.intmax402; } });
+var crypto_1 = require("./crypto");
+Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return crypto_1.verifySignature; } });

package/dist/middleware.d.ts

@@ -0,0 +1,13 @@
+import { RequestHandler } from "express";
+import { INTMAX402Config } from "@tanakayuto/intmax402-core";
+declare global {
+    namespace Express {
+        interface Request {
+            intmax402?: {
+                address: string;
+                verified: boolean;
+            };
+        }
+    }
+}
+export declare function intmax402(config: INTMAX402Config): RequestHandler;

package/dist/middleware.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.intmax402 = intmax402;
+const core_1 = require("@intmax402/core");
+const crypto_1 = require("./crypto");
+function buildWWWAuthenticate(nonce, config) {
+    let header = `INTMAX402 realm="intmax402", nonce="${nonce}", mode="${config.mode}"`;
+    if (config.serverAddress) {
+        header += `, serverAddress="${config.serverAddress}"`;
+    }
+    if (config.amount) {
+        header += `, amount="${config.amount}"`;
+    }
+    if (config.tokenAddress) {
+        header += `, tokenAddress="${config.tokenAddress}"`;
+    }
+    if (config.chainId) {
+        header += `, chainId="${config.chainId}"`;
+    }
+    return header;
+}
+function intmax402(config) {
+    return async (req, res, next) => {
+        const authHeader = req.headers.authorization;
+        if (!authHeader) {
+            const ip = req.ip || req.socket.remoteAddress || "unknown";
+            const nonce = (0, core_1.generateNonce)(config.secret, ip, req.path, config.bindIp ?? false);
+            const statusCode = config.mode === "payment" ? 402 : 401;
+            res.setHeader("WWW-Authenticate", buildWWWAuthenticate(nonce, config));
+            res.status(statusCode).json({
+                error: config.mode === "payment" ? "Payment Required" : "Unauthorized",
+                protocol: "INTMAX402",
+                mode: config.mode,
+            });
+            return;
+        }
+        const credential = (0, core_1.parseAuthorization)(authHeader);
+        if (!credential) {
+            res.status(401).json({ error: "Invalid authorization header" });
+            return;
+        }
+        const ip = req.ip || req.socket.remoteAddress || "unknown";
+        if (!(0, core_1.verifyNonce)(credential.nonce, config.secret, ip, req.path, config.bindIp ?? false)) {
+            res.status(401).json({ error: "Invalid or expired nonce" });
+            return;
+        }
+        if (config.allowList && config.allowList.length > 0) {
+            if (!config.allowList.includes(credential.address.toLowerCase())) {
+                res.status(403).json({ error: "Address not in allow list" });
+                return;
+            }
+        }
+        const isValidSig = (0, crypto_1.verifySignature)(credential.signature, credential.nonce, credential.address);
+        if (!isValidSig) {
+            res.status(401).json({ error: "Invalid signature" });
+            return;
+        }
+        if (config.mode === "payment") {
+            if (!credential.txHash) {
+                res.status(402).json({ error: "Payment transaction hash required" });
+                return;
+            }
+            // In production, verify payment via intmax2-server-sdk fetchTransfers()
+            // For now, trust the txHash presence as proof-of-payment placeholder
+        }
+        req.intmax402 = {
+            address: credential.address,
+            verified: true,
+        };
+        next();
+    };
+}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@tanakayuto/intmax402-express",
+  "version": "0.1.0",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "dependencies": {
+    "@tanakayuto/intmax402-core": "0.1.0",
+    "ethers": "^6.16.0"
+  },
+  "peerDependencies": {
+    "express": "^4.18.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.0",
+    "@types/node": "^20.0.0",
+    "express": "^4.18.0",
+    "typescript": "^5.4.0"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/zaq2989/intmax402"
+  },
+  "keywords": [
+    "intmax",
+    "http-402",
+    "payment",
+    "ai-agent",
+    "express",
+    "web3",
+    "zk"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit"
+  }
+}