openpay-x402-sdk 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.0
+
+- Trust query-string variants of a query-free catalog URL after the live
+  challenge passes the same catalog money-field verification.
+- Keep exact catalog URL matches, explicit host allowlisting, resource matching,
+  and public API declarations unchanged.
+
 ## 0.1.0
 
 - Add the ESM `createOpenPayClient` API for discovery, free shop lookup, quotes,

package/README.md

@@ -39,9 +39,12 @@ concurrent calls so every call sees the latest session total.
 | `maxPerCallJpyc` | `10` | Upper bound for the caller-provided `maxTotalJpyc`. |
 | `maxSessionJpyc` | `100` | Cumulative cap for successful payments made by this client instance. |
 | `allowedHosts` | `open-pay.jp` | Comma-separated bare host allowlist. |
-| `catalogTrust` | `true` | Also allows exact URLs in the discovery catalog after the live challenge matches the catalog challenge. |
+| `catalogTrust` | `true` | Also allows catalog URLs after the live challenge matches the catalog challenge. |
 | `discoveryUrl` | `https://open-pay.jp/api/discovery` | Catalog and OpenPay origin used by the client. |
 
+Query string variants of a query-free listed URL are trusted after the same
+money-field verification. Exact query-bearing catalog entries remain exact-only.
+
 `pay(url, { maxTotalJpyc })` always requires `maxTotalJpyc`. It is the maximum
 total—including the resource price and x402 fee—that this individual call is
 authorized to pay. It does not disable or raise `maxPerCallJpyc` or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpay-x402-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Guarded Node.js buyer SDK for OpenPay x402 JPYC resources",
   "type": "module",
   "main": "./src/index.mjs",

package/src/guards.mjs

@@ -366,11 +366,19 @@ export function evaluatePaymentGuards({
     reasons.push(REASONS.invalidUrl);
   } else {
     const hostAllowed = config.allowedHosts.includes(parsedUrl.hostname.toLowerCase());
-    // カタログ信頼はホストでなく **URL 完全一致** — allowlist より狭い単位で許可する。
-    const listedAccept =
-      config.catalogTrust && catalogListings instanceof Map
-        ? catalogListings.get(parsedUrl.toString())
-        : undefined;
+    // 完全一致を先に維持し、miss 時だけ query/hash を除いた同一 origin+pathname を引く。
+    // userinfo は origin に含まれないため、query variant ではない credential 付き URL へは緩和しない。
+    let listedAccept;
+    if (config.catalogTrust && catalogListings instanceof Map) {
+      listedAccept = catalogListings.get(parsedUrl.toString());
+      if (
+        listedAccept === undefined &&
+        parsedUrl.username === '' &&
+        parsedUrl.password === ''
+      ) {
+        listedAccept = catalogListings.get(`${parsedUrl.origin}${parsedUrl.pathname}`);
+      }
+    }
     const catalogListed = listedAccept !== undefined;
     if (!hostAllowed && !catalogListed) {
       reasons.push(REASONS.hostNotAllowed);