aipp-node 1.0.2 → 1.1.0

package/dist/index.d.mts

@@ -45,4 +45,14 @@ declare class Aipp {
     payout(): Promise<PayoutResponse>;
 }
 
-export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type PayoutResponse };
+interface L402Options {
+    client: Aipp;
+    jwtSecret: string;
+    resourceId: string;
+    amountSats?: number;
+    amountUsd?: number;
+    expiresInSeconds?: number;
+}
+declare function l402Paywall(options: L402Options): (req: any, res: any, next: any) => Promise<any>;
+
+export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type L402Options, type PayoutResponse, l402Paywall };

package/dist/index.d.ts

@@ -45,4 +45,14 @@ declare class Aipp {
     payout(): Promise<PayoutResponse>;
 }
 
-export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type PayoutResponse };
+interface L402Options {
+    client: Aipp;
+    jwtSecret: string;
+    resourceId: string;
+    amountSats?: number;
+    amountUsd?: number;
+    expiresInSeconds?: number;
+}
+declare function l402Paywall(options: L402Options): (req: any, res: any, next: any) => Promise<any>;
+
+export { Aipp, type AippConfig, type AippErrorResponse, type ChargeParams, type ChargeResponse, type ChargeStatus, type L402Options, type PayoutResponse, l402Paywall };

package/dist/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,12 +17,21 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  Aipp: () => Aipp
+  Aipp: () => Aipp,
+  l402Paywall: () => l402Paywall
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -89,7 +100,104 @@ var Aipp = class {
     });
   }
 };
+
+// src/middleware.ts
+var import_crypto2 = __toESM(require("crypto"));
+
+// src/jwt.ts
+var import_crypto = __toESM(require("crypto"));
+function base64urlEncode(str) {
+  const buf = Buffer.isBuffer(str) ? str : Buffer.from(str);
+  return buf.toString("base64url");
+}
+function base64urlDecode(str) {
+  return Buffer.from(str, "base64url").toString("utf8");
+}
+function signJwt(payload, secret) {
+  const header = { alg: "HS256", typ: "JWT" };
+  const encodedHeader = base64urlEncode(JSON.stringify(header));
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const signature = import_crypto.default.createHmac("sha256", secret).update(data).digest("base64url");
+  return `${data}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT format");
+  }
+  const [encodedHeader, encodedPayload, signature] = parts;
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const expectedSignature = import_crypto.default.createHmac("sha256", secret).update(data).digest("base64url");
+  const signatureBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  if (signatureBuffer.length !== expectedBuffer.length || !import_crypto.default.timingSafeEqual(signatureBuffer, expectedBuffer)) {
+    throw new Error("Invalid JWT signature");
+  }
+  const payload = JSON.parse(base64urlDecode(encodedPayload));
+  if (payload.exp && Date.now() >= payload.exp * 1e3) {
+    throw new Error("JWT expired");
+  }
+  return payload;
+}
+
+// src/middleware.ts
+function l402Paywall(options) {
+  if (!options.amountSats && !options.amountUsd) {
+    throw new Error("Either amountSats or amountUsd must be provided for l402Paywall");
+  }
+  return async (req, res, next) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let valid = false;
+    if (authHeader && typeof authHeader === "string" && authHeader.startsWith("L402 ")) {
+      const parts = authHeader.substring(5).split(":");
+      if (parts.length === 2) {
+        const [macaroonStr, preimage] = parts;
+        try {
+          const payload = verifyJwt(macaroonStr, options.jwtSecret);
+          if (payload.resource_id !== options.resourceId) {
+            throw new Error("Invalid resource");
+          }
+          const preimageHash = import_crypto2.default.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
+          const expectedHash = payload.payment_hash;
+          if (typeof expectedHash === "string" && expectedHash.length === preimageHash.length && import_crypto2.default.timingSafeEqual(Buffer.from(preimageHash, "hex"), Buffer.from(expectedHash, "hex"))) {
+            valid = true;
+          }
+        } catch (e) {
+        }
+      }
+    }
+    if (valid) {
+      return next();
+    }
+    try {
+      const charge = await options.client.createCharge({
+        amountSats: options.amountSats,
+        amountUsd: options.amountUsd,
+        memo: `L402 Payment for ${options.resourceId}`
+      });
+      const expiresIn = options.expiresInSeconds || 3600;
+      const payload = {
+        payment_hash: charge.payment_hash,
+        resource_id: options.resourceId,
+        exp: Math.floor(Date.now() / 1e3) + expiresIn
+      };
+      const jwtToken = signJwt(payload, options.jwtSecret);
+      res.status(402);
+      res.setHeader("Www-Authenticate", `L402 macaroon="${jwtToken}" invoice="${charge.payment_request}"`);
+      res.json({
+        error: "Payment Required",
+        code: "L402",
+        payment_request: charge.payment_request,
+        macaroon: jwtToken
+      });
+    } catch (err) {
+      res.status(500).json({ error: "Failed to generate L402 challenge", details: err.message || err });
+    }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  Aipp
+  Aipp,
+  l402Paywall
 });

package/dist/index.mjs

@@ -63,6 +63,103 @@ var Aipp = class {
     });
   }
 };
+
+// src/middleware.ts
+import crypto2 from "crypto";
+
+// src/jwt.ts
+import crypto from "crypto";
+function base64urlEncode(str) {
+  const buf = Buffer.isBuffer(str) ? str : Buffer.from(str);
+  return buf.toString("base64url");
+}
+function base64urlDecode(str) {
+  return Buffer.from(str, "base64url").toString("utf8");
+}
+function signJwt(payload, secret) {
+  const header = { alg: "HS256", typ: "JWT" };
+  const encodedHeader = base64urlEncode(JSON.stringify(header));
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const signature = crypto.createHmac("sha256", secret).update(data).digest("base64url");
+  return `${data}.${signature}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT format");
+  }
+  const [encodedHeader, encodedPayload, signature] = parts;
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const expectedSignature = crypto.createHmac("sha256", secret).update(data).digest("base64url");
+  const signatureBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  if (signatureBuffer.length !== expectedBuffer.length || !crypto.timingSafeEqual(signatureBuffer, expectedBuffer)) {
+    throw new Error("Invalid JWT signature");
+  }
+  const payload = JSON.parse(base64urlDecode(encodedPayload));
+  if (payload.exp && Date.now() >= payload.exp * 1e3) {
+    throw new Error("JWT expired");
+  }
+  return payload;
+}
+
+// src/middleware.ts
+function l402Paywall(options) {
+  if (!options.amountSats && !options.amountUsd) {
+    throw new Error("Either amountSats or amountUsd must be provided for l402Paywall");
+  }
+  return async (req, res, next) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let valid = false;
+    if (authHeader && typeof authHeader === "string" && authHeader.startsWith("L402 ")) {
+      const parts = authHeader.substring(5).split(":");
+      if (parts.length === 2) {
+        const [macaroonStr, preimage] = parts;
+        try {
+          const payload = verifyJwt(macaroonStr, options.jwtSecret);
+          if (payload.resource_id !== options.resourceId) {
+            throw new Error("Invalid resource");
+          }
+          const preimageHash = crypto2.createHash("sha256").update(Buffer.from(preimage, "hex")).digest("hex");
+          const expectedHash = payload.payment_hash;
+          if (typeof expectedHash === "string" && expectedHash.length === preimageHash.length && crypto2.timingSafeEqual(Buffer.from(preimageHash, "hex"), Buffer.from(expectedHash, "hex"))) {
+            valid = true;
+          }
+        } catch (e) {
+        }
+      }
+    }
+    if (valid) {
+      return next();
+    }
+    try {
+      const charge = await options.client.createCharge({
+        amountSats: options.amountSats,
+        amountUsd: options.amountUsd,
+        memo: `L402 Payment for ${options.resourceId}`
+      });
+      const expiresIn = options.expiresInSeconds || 3600;
+      const payload = {
+        payment_hash: charge.payment_hash,
+        resource_id: options.resourceId,
+        exp: Math.floor(Date.now() / 1e3) + expiresIn
+      };
+      const jwtToken = signJwt(payload, options.jwtSecret);
+      res.status(402);
+      res.setHeader("Www-Authenticate", `L402 macaroon="${jwtToken}" invoice="${charge.payment_request}"`);
+      res.json({
+        error: "Payment Required",
+        code: "L402",
+        payment_request: charge.payment_request,
+        macaroon: jwtToken
+      });
+    } catch (err) {
+      res.status(500).json({ error: "Failed to generate L402 challenge", details: err.message || err });
+    }
+  };
+}
 export {
-  Aipp
+  Aipp,
+  l402Paywall
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aipp-node",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Official Node.js SDK for AIPP - The Lightning Network Split-Payment Gateway",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/src/index.ts

@@ -1,2 +1,3 @@
 export * from './client';
 export * from './types';
+export * from './middleware';

package/src/jwt.ts

@@ -0,0 +1,48 @@
+import crypto from 'crypto';
+
+function base64urlEncode(str: string | Buffer): string {
+  const buf = Buffer.isBuffer(str) ? str : Buffer.from(str);
+  return buf.toString('base64url');
+}
+
+function base64urlDecode(str: string): string {
+  return Buffer.from(str, 'base64url').toString('utf8');
+}
+
+export function signJwt(payload: any, secret: string): string {
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const encodedHeader = base64urlEncode(JSON.stringify(header));
+  const encodedPayload = base64urlEncode(JSON.stringify(payload));
+  const data = `${encodedHeader}.${encodedPayload}`;
+  
+  const signature = crypto.createHmac('sha256', secret).update(data).digest('base64url');
+  return `${data}.${signature}`;
+}
+
+export function verifyJwt(token: string, secret: string): any {
+  const parts = token.split('.');
+  if (parts.length !== 3) {
+    throw new Error('Invalid JWT format');
+  }
+  
+  const [encodedHeader, encodedPayload, signature] = parts;
+  const data = `${encodedHeader}.${encodedPayload}`;
+  
+  const expectedSignature = crypto.createHmac('sha256', secret).update(data).digest('base64url');
+  
+  // Constant time comparison to prevent timing attacks
+  const signatureBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expectedSignature);
+  
+  if (signatureBuffer.length !== expectedBuffer.length || !crypto.timingSafeEqual(signatureBuffer, expectedBuffer)) {
+    throw new Error('Invalid JWT signature');
+  }
+  
+  const payload = JSON.parse(base64urlDecode(encodedPayload));
+  
+  if (payload.exp && Date.now() >= payload.exp * 1000) {
+    throw new Error('JWT expired');
+  }
+  
+  return payload;
+}

package/src/middleware.ts

@@ -0,0 +1,86 @@
+import crypto from 'crypto';
+import { Aipp } from './client';
+import { signJwt, verifyJwt } from './jwt';
+
+export interface L402Options {
+  client: Aipp;
+  jwtSecret: string;
+  resourceId: string;
+  amountSats?: number;
+  amountUsd?: number;
+  expiresInSeconds?: number;
+}
+
+export function l402Paywall(options: L402Options) {
+  if (!options.amountSats && !options.amountUsd) {
+    throw new Error('Either amountSats or amountUsd must be provided for l402Paywall');
+  }
+
+  return async (req: any, res: any, next: any) => {
+    const authHeader = req.headers.authorization || req.headers.Authorization;
+    let valid = false;
+
+    if (authHeader && typeof authHeader === 'string' && authHeader.startsWith('L402 ')) {
+      const parts = authHeader.substring(5).split(':');
+      if (parts.length === 2) {
+        const [macaroonStr, preimage] = parts;
+        try {
+          // Verify JWT signature and expiration
+          const payload = verifyJwt(macaroonStr, options.jwtSecret);
+          
+          if (payload.resource_id !== options.resourceId) {
+            throw new Error('Invalid resource');
+          }
+
+          // Verify preimage hash matches payment_hash securely
+          const preimageHash = crypto.createHash('sha256').update(Buffer.from(preimage, 'hex')).digest('hex');
+          const expectedHash = payload.payment_hash;
+          
+          if (
+            typeof expectedHash === 'string' &&
+            expectedHash.length === preimageHash.length &&
+            crypto.timingSafeEqual(Buffer.from(preimageHash, 'hex'), Buffer.from(expectedHash, 'hex'))
+          ) {
+            valid = true;
+          }
+        } catch (e) {
+          // Invalid or expired JWT -> Fall through to 402 and issue new invoice
+        }
+      }
+    }
+
+    if (valid) {
+      return next();
+    }
+
+    try {
+      // Create invoice via AIPP
+      const charge = await options.client.createCharge({
+        amountSats: options.amountSats,
+        amountUsd: options.amountUsd,
+        memo: `L402 Payment for ${options.resourceId}`
+      });
+
+      // Issue JWT
+      const expiresIn = options.expiresInSeconds || 3600; // default 1 hour
+      const payload = {
+        payment_hash: charge.payment_hash,
+        resource_id: options.resourceId,
+        exp: Math.floor(Date.now() / 1000) + expiresIn
+      };
+      
+      const jwtToken = signJwt(payload, options.jwtSecret);
+
+      res.status(402);
+      res.setHeader('Www-Authenticate', `L402 macaroon="${jwtToken}" invoice="${charge.payment_request}"`);
+      res.json({
+        error: "Payment Required",
+        code: "L402",
+        payment_request: charge.payment_request,
+        macaroon: jwtToken
+      });
+    } catch (err: any) {
+      res.status(500).json({ error: "Failed to generate L402 challenge", details: err.message || err });
+    }
+  };
+}