openpay-x402-sdk 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.2.1
+
+- Compare `accept.resource` against the requested URL using decoded query
+  canonicalization (ordered `URLSearchParams` pairs) instead of byte equality.
+  Hosts such as Vercel/Next.js normalize `%20` to `+` before the app sees the
+  request, which made honest sellers fail `resource_mismatch`. Distinct decoded
+  values (`%2B`, double encoding, reordered or extra params) still mismatch.
+
+## 0.2.0
+
+- Trust query-string variants of a query-free catalog URL after the live
+  challenge passes the same catalog money-field verification.
+- Keep exact catalog URL matches, explicit host allowlisting, resource matching,
+  and public API declarations unchanged.
+
 ## 0.1.0
 
 - Add the ESM `createOpenPayClient` API for discovery, free shop lookup, quotes,

package/README.md

@@ -39,9 +39,12 @@ concurrent calls so every call sees the latest session total.
 | `maxPerCallJpyc` | `10` | Upper bound for the caller-provided `maxTotalJpyc`. |
 | `maxSessionJpyc` | `100` | Cumulative cap for successful payments made by this client instance. |
 | `allowedHosts` | `open-pay.jp` | Comma-separated bare host allowlist. |
-| `catalogTrust` | `true` | Also allows exact URLs in the discovery catalog after the live challenge matches the catalog challenge. |
+| `catalogTrust` | `true` | Also allows catalog URLs after the live challenge matches the catalog challenge. |
 | `discoveryUrl` | `https://open-pay.jp/api/discovery` | Catalog and OpenPay origin used by the client. |
 
+Query string variants of a query-free listed URL are trusted after the same
+money-field verification. Exact query-bearing catalog entries remain exact-only.
+
 `pay(url, { maxTotalJpyc })` always requires `maxTotalJpyc`. It is the maximum
 total—including the resource price and x402 fee—that this individual call is
 authorized to pay. It does not disable or raise `maxPerCallJpyc` or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpay-x402-sdk",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Guarded Node.js buyer SDK for OpenPay x402 JPYC resources",
   "type": "module",
   "main": "./src/index.mjs",

package/src/guards.mjs

@@ -251,6 +251,19 @@ function addAssetReasons(reasons, rawAccept) {
   }
 }
 
+// クエリの正準比較: URLSearchParams でデコードした (key, value) 列の順序付き一致。
+// Vercel/Next 系ホストは request.url の時点でスペースを `+` に正規化するため (`%20` の原文は
+// サーバー側で復元不可能)、accept.resource と要求 URL のバイト一致要求は正当な売り手を
+// 恒常的に落とす (gateway.open-pay.jp で実害)。`%20` と `+` は form-urlencoding で同一の
+// スペースにデコードされる一方、`%2B` (リテラル +) や二重エンコードは異なる値にデコード
+// されるので、この比較は同義エンコーディングだけを同一視し resource 束縛は緩めない。
+function sameQuery(a, b) {
+  const ap = [...a.searchParams];
+  const bp = [...b.searchParams];
+  if (ap.length !== bp.length) return false;
+  return ap.every(([k, v], i) => bp[i][0] === k && bp[i][1] === v);
+}
+
 function addResourceReason(reasons, rawAccept, requestUrl) {
   const requested = parseHttpUrl(requestUrl, 'url');
   const resource =
@@ -261,7 +274,11 @@ function addResourceReason(reasons, rawAccept, requestUrl) {
     requested === null ||
     resource === null ||
     resource.hostname.toLowerCase() !== requested.hostname.toLowerCase() ||
-    resource.toString() !== requested.toString()
+    resource.origin !== requested.origin ||
+    resource.pathname !== requested.pathname ||
+    resource.username !== requested.username ||
+    resource.password !== requested.password ||
+    !sameQuery(resource, requested)
   ) {
     reasons.push(REASONS.resourceMismatch);
   }
@@ -366,11 +383,19 @@ export function evaluatePaymentGuards({
     reasons.push(REASONS.invalidUrl);
   } else {
     const hostAllowed = config.allowedHosts.includes(parsedUrl.hostname.toLowerCase());
-    // カタログ信頼はホストでなく **URL 完全一致** — allowlist より狭い単位で許可する。
-    const listedAccept =
-      config.catalogTrust && catalogListings instanceof Map
-        ? catalogListings.get(parsedUrl.toString())
-        : undefined;
+    // 完全一致を先に維持し、miss 時だけ query/hash を除いた同一 origin+pathname を引く。
+    // userinfo は origin に含まれないため、query variant ではない credential 付き URL へは緩和しない。
+    let listedAccept;
+    if (config.catalogTrust && catalogListings instanceof Map) {
+      listedAccept = catalogListings.get(parsedUrl.toString());
+      if (
+        listedAccept === undefined &&
+        parsedUrl.username === '' &&
+        parsedUrl.password === ''
+      ) {
+        listedAccept = catalogListings.get(`${parsedUrl.origin}${parsedUrl.pathname}`);
+      }
+    }
     const catalogListed = listedAccept !== undefined;
     if (!hostAllowed && !catalogListed) {
       reasons.push(REASONS.hostNotAllowed);