@tanakayuto/intmax402-fetch 0.1.0 → 0.1.1

package/README.md

@@ -119,3 +119,8 @@ interface Intmax402Context {
 ## ライセンス
 
 MIT
+
+## ⚠️ IP Binding Warning
+When using `bindIp: true`, ensure your server is behind a trusted reverse proxy (Nginx, Cloudflare, etc.).
+Direct exposure allows attackers to forge `X-Forwarded-For` headers, bypassing IP binding.
+Default (`bindIp: false`) is recommended for AI agent use cases.

package/dist/handler.js

@@ -2,81 +2,78 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleIntmax402 = handleIntmax402;
 const intmax402_core_1 = require("@tanakayuto/intmax402-core");
-const crypto_1 = require("@tanakayuto/intmax402-express/dist/crypto");
-const verify_payment_1 = require("@tanakayuto/intmax402-express/dist/verify-payment");
+const crypto_1 = require("@tanakayuto/intmax402-express/crypto");
+const verify_payment_1 = require("@tanakayuto/intmax402-express/verify-payment");
 /**
  * Handle INTMAX402 authentication for any Web Standard fetch-based framework.
  * Returns null if auth passes (proceed to next handler).
  * Returns Response if auth fails (return this response to client).
  */
 async function handleIntmax402(request, config) {
-    const url = new URL(request.url);
-    const authHeader = request.headers.get("authorization");
-    const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()
-        ?? request.headers.get("x-real-ip")
-        ?? "unknown";
-    if (!authHeader) {
-        const nonce = (0, intmax402_core_1.generateNonce)(config.secret, ip, url.pathname, config.bindIp ?? false);
-        const statusCode = config.mode === "payment" ? 402 : 401;
-        return {
-            response: new Response(JSON.stringify({
-                error: config.mode === "payment" ? "Payment Required" : "Unauthorized",
-                protocol: "INTMAX402",
-                mode: config.mode,
-            }), {
-                status: statusCode,
-                headers: {
-                    "Content-Type": "application/json",
-                    "WWW-Authenticate": buildWWWAuthenticate(nonce, config),
-                },
-            }),
-            context: null,
-        };
-    }
-    const credential = (0, intmax402_core_1.parseAuthorization)(authHeader);
-    if (!credential) {
-        return { response: errorResponse(401, "Invalid authorization header"), context: null };
-    }
-    if (!(0, intmax402_core_1.verifyNonce)(credential.nonce, config.secret, ip, url.pathname, config.bindIp ?? false)) {
-        return { response: errorResponse(401, "Invalid or expired nonce"), context: null };
-    }
-    if (config.allowList && config.allowList.length > 0) {
-        if (!config.allowList.includes(credential.address.toLowerCase())) {
-            return { response: errorResponse(403, "Address not in allow list"), context: null };
+    try {
+        const url = new URL(request.url);
+        const authHeader = request.headers.get("authorization");
+        const ip = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()
+            ?? request.headers.get("x-real-ip")
+            ?? "unknown";
+        if (!authHeader) {
+            const nonce = (0, intmax402_core_1.generateNonce)(config.secret, ip, url.pathname, config.bindIp ?? false);
+            const statusCode = config.mode === "payment" ? 402 : 401;
+            return {
+                response: new Response(JSON.stringify({
+                    error: config.mode === "payment" ? "Payment Required" : "Unauthorized",
+                    protocol: "INTMAX402",
+                    mode: config.mode,
+                }), {
+                    status: statusCode,
+                    headers: {
+                        "Content-Type": "application/json",
+                        "WWW-Authenticate": (0, intmax402_core_1.buildWWWAuthenticate)(nonce, config),
+                    },
+                }),
+                context: null,
+            };
         }
-    }
-    const isValidSig = (0, crypto_1.verifySignature)(credential.signature, credential.nonce, credential.address);
-    if (!isValidSig) {
-        return { response: errorResponse(401, "Invalid signature"), context: null };
-    }
-    if (config.mode === "payment") {
-        if (!credential.txHash) {
-            return { response: errorResponse(402, "Payment transaction hash required"), context: null };
+        const credential = (0, intmax402_core_1.parseAuthorization)(authHeader);
+        if (!credential) {
+            return { response: errorResponse(401, "Invalid authorization header"), context: null };
+        }
+        if (!(0, intmax402_core_1.verifyNonce)(credential.nonce, config.secret, ip, url.pathname, config.bindIp ?? false)) {
+            return { response: errorResponse(401, "Invalid or expired nonce"), context: null };
         }
-        if (!config.serverAddress || !config.amount) {
-            return { response: errorResponse(500, "Server misconfigured"), context: null };
+        if (config.allowList && config.allowList.length > 0) {
+            if (!config.allowList.includes(credential.address.toLowerCase())) {
+                return { response: errorResponse(403, "Address not in allow list"), context: null };
+            }
         }
-        const paymentResult = await (0, verify_payment_1.verifyPayment)(credential.txHash, config.amount, config.serverAddress);
-        if (!paymentResult.valid) {
-            return { response: errorResponse(402, paymentResult.error ?? "Payment verification failed"), context: null };
+        const isValidSig = (0, crypto_1.verifySignature)(credential.signature, credential.nonce, credential.address);
+        if (!isValidSig) {
+            return { response: errorResponse(401, "Invalid signature"), context: null };
         }
+        if (config.mode === "payment") {
+            if (!credential.txHash) {
+                return { response: errorResponse(402, "Payment transaction hash required"), context: null };
+            }
+            if (!config.serverAddress || !config.amount) {
+                return { response: errorResponse(500, "Server misconfigured"), context: null };
+            }
+            const paymentResult = await (0, verify_payment_1.verifyPayment)(credential.txHash, config.amount, config.serverAddress);
+            if (!paymentResult.valid) {
+                return { response: errorResponse(402, paymentResult.error ?? "Payment verification failed"), context: null };
+            }
+        }
+        return {
+            response: null,
+            context: { address: credential.address, verified: true, txHash: credential.txHash },
+        };
+    }
+    catch (err) {
+        // URL parse error or unexpected error
+        return {
+            response: errorResponse(400, "Bad Request"),
+            context: null,
+        };
     }
-    return {
-        response: null,
-        context: { address: credential.address, verified: true, txHash: credential.txHash },
-    };
-}
-function buildWWWAuthenticate(nonce, config) {
-    let header = `INTMAX402 realm="intmax402", nonce="${nonce}", mode="${config.mode}"`;
-    if (config.serverAddress)
-        header += `, serverAddress="${config.serverAddress}"`;
-    if (config.amount)
-        header += `, amount="${config.amount}"`;
-    if (config.tokenAddress)
-        header += `, tokenAddress="${config.tokenAddress}"`;
-    if (config.chainId)
-        header += `, chainId="${config.chainId}"`;
-    return header;
 }
 function errorResponse(status, message) {
     return new Response(JSON.stringify({ error: message }), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanakayuto/intmax402-fetch",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -25,9 +25,9 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@tanakayuto/intmax402-core": "0.2.2",
-    "@tanakayuto/intmax402-express": "0.2.2",
-    "ethers": "^6.0.0"
+    "ethers": "^6.0.0",
+    "@tanakayuto/intmax402-core": "0.2.3",
+    "@tanakayuto/intmax402-express": "0.2.3"
   },
   "devDependencies": {
     "typescript": "^5.4.0",