mppx 0.5.14 → 0.5.16

package/src/tempo/server/Session.ts

@@ -181,7 +181,7 @@ export function session<const parameters extends session.Parameters>(
       }
     },
 
-    async verify({ credential, request }) {
+    async verify({ credential, envelope, request }) {
       const { challenge, payload } = credential as Credential.Credential<SessionCredentialPayload>
 
       const resolvedRequest = Methods.session.schema.request.parse(request)
@@ -255,6 +255,28 @@ export function session<const parameters extends session.Parameters>(
           })
       }
 
+      // In the default HTTP request/response mode, each successful content
+      // request consumes one unit immediately after the credential is accepted.
+      // This keeps equal-voucher replays bounded by the voucher's remaining
+      // balance instead of serving repeated responses for free.
+      if (
+        !parameters.sse &&
+        envelope &&
+        isBillableContentRequest(envelope.capturedRequest) &&
+        (payload.action === 'open' || payload.action === 'voucher')
+      ) {
+        const charged = await charge(
+          store,
+          sessionReceipt.channelId,
+          BigInt(resolvedRequest.amount),
+        )
+        sessionReceipt = {
+          ...sessionReceipt,
+          spent: charged.spent.toString(),
+          units: charged.units,
+        }
+      }
+
       return sessionReceipt
     },
 
@@ -265,28 +287,24 @@ export function session<const parameters extends session.Parameters>(
     //
     // close and topUp are always gated (204) — they are pure management.
     //
-    // open and voucher are gated only for bodyless POSTs (management
-    // updates). POSTs with a body are content requests — the client's
-    // original request piggybacked on the credential — so they fall
-    // through to serve content. GETs always fall through so auto-mode
-    // clients (whose fetch wrapper bundles open+voucher into a single
-    // GET retry) receive content as expected.
-    respond({ credential, input }) {
+    // open and voucher share the same captured-request classifier used
+    // during verification. Non-billable requests are treated as management
+    // updates; billable requests fall through to the application handler.
+    respond({ credential, envelope, input }) {
       const { payload } = credential as Credential.Credential<SessionCredentialPayload>
 
       if (payload.action === 'close') return new Response(null, { status: 204 })
       if (payload.action === 'topUp') return new Response(null, { status: 204 })
 
-      // open and voucher: gate only bodyless POSTs (management updates).
-      // POSTs with a body are content requests — fall through so the
-      // upstream response is returned to the client.
-      if (input.method === 'POST') {
-        const contentLength = input.headers.get('content-length')
-        if (contentLength !== null && contentLength !== '0') return undefined
-        if (input.headers.has('transfer-encoding')) return undefined
-        return new Response(null, { status: 204 })
+      const capturedRequest = envelope?.capturedRequest ?? {
+        hasBody: input.body !== null,
+        headers: input.headers,
+        method: input.method,
+        url: new URL(input.url),
       }
-      return undefined
+
+      if (isBillableContentRequest(capturedRequest)) return undefined
+      return new Response(null, { status: 204 })
     },
   })
 }
@@ -452,6 +470,30 @@ function validateOnChainChannel(
   }
 }
 
+function isBillableContentRequest(input: {
+  hasBody?: boolean | undefined
+  headers: Headers
+  method: string
+}): boolean {
+  if (input.method === 'POST') return hasCapturedRequestBody(input)
+
+  if (input.method === 'HEAD') return false
+
+  return true
+}
+
+function hasCapturedRequestBody(input: {
+  hasBody?: boolean | undefined
+  headers: Headers
+}): boolean {
+  const contentLength = input.headers.get('content-length')
+  const headerIndicatesBody =
+    (contentLength !== null && contentLength !== '0') || input.headers.has('transfer-encoding')
+
+  if (input.hasBody === true) return true
+  return headerIndicatesBody
+}
+
 /**
  * Shared logic for verifying an incremental voucher and updating channel state.
  * Used by both handleVoucher and (indirectly) handleOpen.