@web-ts-toolkit/express-request-attestation 0.51.0 → 0.53.0

package/index.js

@@ -295,6 +295,13 @@ var NONCE_HEX_PATTERN = /^[0-9a-f]{32}$/;
 var BODY_HASH_HEX_PATTERN = /^[0-9a-f]{64}$/;
 var HTTP_TOKEN_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
 var HEX_BYTE_PATTERN = /^[0-9a-fA-F]{2}$/;
+function assertEncodedTransactionIdBound(value) {
+  if (value.length > MAX_ENCODED_TRANSACTION_ID_BYTES) {
+    throw new AttestationProtocolError(
+      `encoded transactionId must be at most ${MAX_ENCODED_TRANSACTION_ID_BYTES} bytes`
+    );
+  }
+}
 var RESERVED_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authenticate",
@@ -490,6 +497,7 @@ function extractSingleHeaderValue(raw) {
   if (typeof value !== "string" || value.length === 0) {
     return null;
   }
+  assertEncodedTransactionIdBound(value);
   if (value.includes(",")) {
     throw new AttestationProtocolError("comma-joined signature headers are not allowed");
   }
@@ -549,23 +557,18 @@ function encodeTransactionId(fields) {
   const encoded = base64urlEncode(
     canonicalJsonBytes([PROTOCOL_VERSION, fields.keyId, fields.timestampMs, fields.nonceHex, fields.mac])
   );
-  if (utf8ByteLength(encoded) > MAX_ENCODED_TRANSACTION_ID_BYTES) {
-    throw new AttestationProtocolError(
-      `encoded transactionId must be at most ${MAX_ENCODED_TRANSACTION_ID_BYTES} bytes`
-    );
-  }
+  assertEncodedTransactionIdBound(encoded);
   return encoded;
 }
 function decodeTransactionId(headerValue) {
   if (typeof headerValue !== "string" || headerValue.length === 0) {
     throw new AttestationProtocolError("transactionId must be a non-empty string");
   }
-  if (utf8ByteLength(headerValue) > MAX_ENCODED_TRANSACTION_ID_BYTES) {
-    throw new AttestationProtocolError(
-      `encoded transactionId must be at most ${MAX_ENCODED_TRANSACTION_ID_BYTES} bytes`
-    );
-  }
+  assertEncodedTransactionIdBound(headerValue);
   const bytes = base64urlDecode(headerValue);
+  if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+    throw new AttestationProtocolError("transactionId must not contain a UTF-8 BOM");
+  }
   const text = utf8Decode(bytes);
   const envelope = parseCanonicalJsonArray(text, 5);
   const [version, keyId, timestampMs, nonceHex, mac] = envelope;
@@ -897,10 +900,7 @@ function copyAttestationSnapshot(snapshot) {
     }
     const currentKeyId = record.currentKeyId;
     return Object.freeze({ currentKeyId, keys: Object.freeze(copied) });
-  } catch (error) {
-    if (error instanceof AttestationError) {
-      throw error;
-    }
+  } catch {
     fail("ATTESTATION_KEYS_UNAVAILABLE");
   }
 }
@@ -1009,9 +1009,12 @@ function deriveReplayKey(input) {
   return `${REPLAY_KEY_PREFIX}${digest}`;
 }
 function verifyAttestationProof(input) {
+  return preflightAttestationProof(input.headerValue)(input);
+}
+function preflightAttestationProof(rawHeader) {
   let headerValue;
   try {
-    headerValue = extractSingleHeaderValue(input.headerValue);
+    headerValue = extractSingleHeaderValue(rawHeader);
   } catch {
     fail("ATTESTATION_MALFORMED");
   }
@@ -1024,6 +1027,9 @@ function verifyAttestationProof(input) {
   } catch {
     fail("ATTESTATION_MALFORMED");
   }
+  return (input) => verifyDecodedAttestationProof(input, envelope);
+}
+function verifyDecodedAttestationProof(input, envelope) {
   const snapshot = copyAttestationSnapshot(input.snapshot);
   const keyEntry = snapshot.keys.find((entry) => entry.keyId === envelope.keyId);
   if (keyEntry === void 0) {
@@ -1519,43 +1525,20 @@ function createRequestAttestationMiddleware(options) {
   const config = resolveConfig(options);
   const middleware = (req, res, next) => {
     void Promise.resolve().then(async () => {
+      const verifyProof = preflightAttestationProof(extractRawHeader(req, config.headerNameLower));
+      const contentTypeHeader = extractRawHeader(req, "content-type");
       let nowMs = checkedNow(config.now);
-      let headerValue;
-      try {
-        headerValue = extractRawHeader(req, config.headerNameLower);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendControlledError(res, error, config);
-          return;
-        }
-        throw error;
-      }
-      let snapshotRaw;
-      try {
-        const pending = config.keyProvider.getSnapshot();
-        snapshotRaw = await withOperationTimeout(Promise.resolve(pending), config.operationTimeoutMs);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendControlledError(res, error, config);
-          return;
-        }
-        sendControlledError(res, new AttestationError("ATTESTATION_KEYS_UNAVAILABLE"), config);
-        return;
-      }
       let snapshot;
       try {
+        const pending = config.keyProvider.getSnapshot();
+        const snapshotRaw = await withOperationTimeout(Promise.resolve(pending), config.operationTimeoutMs);
         snapshot = copyAttestationSnapshot(snapshotRaw);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendControlledError(res, error, config);
-          return;
-        }
+      } catch {
         sendControlledError(res, new AttestationError("ATTESTATION_KEYS_UNAVAILABLE"), config);
         return;
       }
       const record = req;
       const originalUrl = typeof record.originalUrl === "string" ? record.originalUrl : record.url;
-      const contentTypeHeader = record.headers?.["content-type"] ?? void 0;
       const contentEncodingHeader = record.headers?.["content-encoding"] ?? void 0;
       let bodyDigestHex;
       try {
@@ -1569,8 +1552,7 @@ function createRequestAttestationMiddleware(options) {
       }
       let verified;
       try {
-        verified = verifyAttestationProof({
-          headerValue,
+        verified = verifyProof({
           method: record.method,
           originalUrl,
           publicPathPrefix: config.publicPathPrefix,
@@ -2677,16 +2659,7 @@ function createSignerBundleRouter(options) {
   const router = (0, import_express.Router)();
   router.get("/signer-meta", (req, res) => {
     void Promise.resolve().then(async () => {
-      let nowMs;
-      try {
-        nowMs = checkedNow2(config.now);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendInternalError(res);
-          return;
-        }
-        throw error;
-      }
+      checkedNow2(config.now);
       let snapshotRaw;
       try {
         const pending = config.keyProvider.getSnapshot();
@@ -2702,6 +2675,7 @@ function createSignerBundleRouter(options) {
         sendKeysUnavailable(res);
         return;
       }
+      const nowMs = checkedNow2(config.now);
       const current = snapshot.keys.find((entry) => entry.keyId === snapshot.currentKeyId);
       if (current === void 0) {
         sendKeysUnavailable(res);
@@ -2731,7 +2705,8 @@ function createSignerBundleRouter(options) {
         sendInternalError(res);
         return;
       }
-      const signerUrl = `${config.publicOrigin}${config.publicPathPrefix}${config.basePath}/signer.${keyAsset.contentHash}.mjs`;
+      const assetBasePath = config.basePath === "/" ? "" : config.basePath;
+      const signerUrl = `${config.publicOrigin}${config.publicPathPrefix}${assetBasePath}/${keyAsset.fileName}`;
       const document = {
         version: PROTOCOL_VERSION,
         keyId: current.keyId,

package/index.mjs

@@ -171,6 +171,13 @@ var NONCE_HEX_PATTERN = /^[0-9a-f]{32}$/;
 var BODY_HASH_HEX_PATTERN = /^[0-9a-f]{64}$/;
 var HTTP_TOKEN_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
 var HEX_BYTE_PATTERN = /^[0-9a-fA-F]{2}$/;
+function assertEncodedTransactionIdBound(value) {
+  if (value.length > MAX_ENCODED_TRANSACTION_ID_BYTES) {
+    throw new AttestationProtocolError(
+      `encoded transactionId must be at most ${MAX_ENCODED_TRANSACTION_ID_BYTES} bytes`
+    );
+  }
+}
 var RESERVED_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authenticate",
@@ -366,6 +373,7 @@ function extractSingleHeaderValue(raw) {
   if (typeof value !== "string" || value.length === 0) {
     return null;
   }
+  assertEncodedTransactionIdBound(value);
   if (value.includes(",")) {
     throw new AttestationProtocolError("comma-joined signature headers are not allowed");
   }
@@ -425,23 +433,18 @@ function encodeTransactionId(fields) {
   const encoded = base64urlEncode(
     canonicalJsonBytes([PROTOCOL_VERSION, fields.keyId, fields.timestampMs, fields.nonceHex, fields.mac])
   );
-  if (utf8ByteLength(encoded) > MAX_ENCODED_TRANSACTION_ID_BYTES) {
-    throw new AttestationProtocolError(
-      `encoded transactionId must be at most ${MAX_ENCODED_TRANSACTION_ID_BYTES} bytes`
-    );
-  }
+  assertEncodedTransactionIdBound(encoded);
   return encoded;
 }
 function decodeTransactionId(headerValue) {
   if (typeof headerValue !== "string" || headerValue.length === 0) {
     throw new AttestationProtocolError("transactionId must be a non-empty string");
   }
-  if (utf8ByteLength(headerValue) > MAX_ENCODED_TRANSACTION_ID_BYTES) {
-    throw new AttestationProtocolError(
-      `encoded transactionId must be at most ${MAX_ENCODED_TRANSACTION_ID_BYTES} bytes`
-    );
-  }
+  assertEncodedTransactionIdBound(headerValue);
   const bytes = base64urlDecode(headerValue);
+  if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+    throw new AttestationProtocolError("transactionId must not contain a UTF-8 BOM");
+  }
   const text = utf8Decode(bytes);
   const envelope = parseCanonicalJsonArray(text, 5);
   const [version, keyId, timestampMs, nonceHex, mac] = envelope;
@@ -773,10 +776,7 @@ function copyAttestationSnapshot(snapshot) {
     }
     const currentKeyId = record.currentKeyId;
     return Object.freeze({ currentKeyId, keys: Object.freeze(copied) });
-  } catch (error) {
-    if (error instanceof AttestationError) {
-      throw error;
-    }
+  } catch {
     fail("ATTESTATION_KEYS_UNAVAILABLE");
   }
 }
@@ -885,9 +885,12 @@ function deriveReplayKey(input) {
   return `${REPLAY_KEY_PREFIX}${digest}`;
 }
 function verifyAttestationProof(input) {
+  return preflightAttestationProof(input.headerValue)(input);
+}
+function preflightAttestationProof(rawHeader) {
   let headerValue;
   try {
-    headerValue = extractSingleHeaderValue(input.headerValue);
+    headerValue = extractSingleHeaderValue(rawHeader);
   } catch {
     fail("ATTESTATION_MALFORMED");
   }
@@ -900,6 +903,9 @@ function verifyAttestationProof(input) {
   } catch {
     fail("ATTESTATION_MALFORMED");
   }
+  return (input) => verifyDecodedAttestationProof(input, envelope);
+}
+function verifyDecodedAttestationProof(input, envelope) {
   const snapshot = copyAttestationSnapshot(input.snapshot);
   const keyEntry = snapshot.keys.find((entry) => entry.keyId === envelope.keyId);
   if (keyEntry === void 0) {
@@ -1395,43 +1401,20 @@ function createRequestAttestationMiddleware(options) {
   const config = resolveConfig(options);
   const middleware = (req, res, next) => {
     void Promise.resolve().then(async () => {
+      const verifyProof = preflightAttestationProof(extractRawHeader(req, config.headerNameLower));
+      const contentTypeHeader = extractRawHeader(req, "content-type");
       let nowMs = checkedNow(config.now);
-      let headerValue;
-      try {
-        headerValue = extractRawHeader(req, config.headerNameLower);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendControlledError(res, error, config);
-          return;
-        }
-        throw error;
-      }
-      let snapshotRaw;
-      try {
-        const pending = config.keyProvider.getSnapshot();
-        snapshotRaw = await withOperationTimeout(Promise.resolve(pending), config.operationTimeoutMs);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendControlledError(res, error, config);
-          return;
-        }
-        sendControlledError(res, new AttestationError("ATTESTATION_KEYS_UNAVAILABLE"), config);
-        return;
-      }
       let snapshot;
       try {
+        const pending = config.keyProvider.getSnapshot();
+        const snapshotRaw = await withOperationTimeout(Promise.resolve(pending), config.operationTimeoutMs);
         snapshot = copyAttestationSnapshot(snapshotRaw);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendControlledError(res, error, config);
-          return;
-        }
+      } catch {
         sendControlledError(res, new AttestationError("ATTESTATION_KEYS_UNAVAILABLE"), config);
         return;
       }
       const record = req;
       const originalUrl = typeof record.originalUrl === "string" ? record.originalUrl : record.url;
-      const contentTypeHeader = record.headers?.["content-type"] ?? void 0;
       const contentEncodingHeader = record.headers?.["content-encoding"] ?? void 0;
       let bodyDigestHex;
       try {
@@ -1445,8 +1428,7 @@ function createRequestAttestationMiddleware(options) {
       }
       let verified;
       try {
-        verified = verifyAttestationProof({
-          headerValue,
+        verified = verifyProof({
           method: record.method,
           originalUrl,
           publicPathPrefix: config.publicPathPrefix,
@@ -2553,16 +2535,7 @@ function createSignerBundleRouter(options) {
   const router = Router();
   router.get("/signer-meta", (req, res) => {
     void Promise.resolve().then(async () => {
-      let nowMs;
-      try {
-        nowMs = checkedNow2(config.now);
-      } catch (error) {
-        if (error instanceof AttestationError) {
-          sendInternalError(res);
-          return;
-        }
-        throw error;
-      }
+      checkedNow2(config.now);
       let snapshotRaw;
       try {
         const pending = config.keyProvider.getSnapshot();
@@ -2578,6 +2551,7 @@ function createSignerBundleRouter(options) {
         sendKeysUnavailable(res);
         return;
       }
+      const nowMs = checkedNow2(config.now);
       const current = snapshot.keys.find((entry) => entry.keyId === snapshot.currentKeyId);
       if (current === void 0) {
         sendKeysUnavailable(res);
@@ -2607,7 +2581,8 @@ function createSignerBundleRouter(options) {
         sendInternalError(res);
         return;
       }
-      const signerUrl = `${config.publicOrigin}${config.publicPathPrefix}${config.basePath}/signer.${keyAsset.contentHash}.mjs`;
+      const assetBasePath = config.basePath === "/" ? "" : config.basePath;
+      const signerUrl = `${config.publicOrigin}${config.publicPathPrefix}${assetBasePath}/${keyAsset.fileName}`;
       const document = {
         version: PROTOCOL_VERSION,
         keyId: current.keyId,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-request-attestation",
   "description": "Versioned per-request HMAC signing and replay detection for Express APIs with a browser-safe signer entry",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-request-attestation",
-  "version": "0.51.0",
+  "version": "0.53.0",
   "sideEffects": false,
   "keywords": [
     "express",