wayleave 0.5.1 → 0.5.2

package/README.md

@@ -62,8 +62,10 @@ npm install wayleave
 
 [Create a Meter account](https://meter.wayleave.dev/account.html), issue an API key,
 and set `WAYLEAVE_METER_KEY` in your server environment. Signing in does not
-start billing. The optional hosted Meter trial requires a card and becomes
-$49/month after 3 days unless canceled; see your account for current terms.
+start billing. The optional hosted plans require a card and start after a
+3-day trial unless canceled — current plans and prices are at
+[wayleave.dev/pricing](https://wayleave.dev/pricing/), which is the one place
+they are kept up to date.
 
 In your existing Express app:
 

package/index.js

@@ -95,6 +95,31 @@ function sigBase(components, ctx, paramsRaw) {
   return Buffer.from(lines.join('\n'));
 }
 
+/**
+ * Does `path` fall under `prefix`?
+ *
+ * Not `startsWith`. A raw prefix test makes "/api" match "/apiv2" and
+ * "/api-internal", which is wrong in both directions and dangerous in one:
+ *
+ *   pricedPaths { "/api": 0.05 }     charges for /apiv2, which the operator
+ *                                    never priced
+ *   rules { bot: [["/public", true]] }  ALLOWS /public-admin, which the
+ *                                    operator never opened
+ *
+ * The second is the one that matters. An over-matching deny is merely
+ * annoying; an over-matching allow is a hole.
+ *
+ * A prefix matches the path itself or anything beneath its boundary, and a
+ * trailing slash on the prefix changes nothing — "/api" and "/api/" mean the
+ * same thing, because operators write both and neither should surprise them.
+ */
+export function pathUnder(path, prefix) {
+  if (typeof path !== 'string' || typeof prefix !== 'string') return false;
+  if (prefix === '' || prefix === '/') return true;
+  const base = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+  return path === base || path.startsWith(base + '/');
+}
+
 export function buildParams(keyid, created, expires, nonce = null) {
   return `("@authority" "signature-agent");created=${created};` +
          `keyid="${keyid}";alg="ed25519";expires=${expires};tag="web-bot-auth"` +
@@ -631,7 +656,7 @@ export class Wayleave {
    */
   _preDecide(req, lane, ident, now, paymentProof, c) {
     for (const [prefix, allow] of this.rules[lane] || []) {
-      if (req.path.startsWith(prefix)) {
+      if (pathUnder(req.path, prefix)) {
         if (!allow) return { status: 403, why: `${lane} denied on ${prefix}` };
         break;
       }
@@ -659,7 +684,7 @@ export class Wayleave {
       : lane === LANES.HUMAN;
     if (!freeOnPriced) {
       for (const [prefix, price] of Object.entries(this.pricedPaths)) {
-        if (req.path.startsWith(prefix)) {
+        if (pathUnder(req.path, prefix)) {
           const challenge = { scheme: 'x402', price_usd: price, resource: prefix };
           if (!paymentProof) {
             const why = this.strictPricedPaths && lane === LANES.HUMAN

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "wayleave",
-  "version": "0.5.1",
-  "description": "Know which AI agents cross your API — verified by signature, not guessed from an IP. Sorts every request into four lanes, prices the non-human ones with HTTP 402, and never charges a human. Zero dependencies.",
+  "version": "0.5.2",
+  "description": "Know which AI agents cross your API \u2014 verified by signature, not guessed from an IP. Sorts every request into four lanes, prices the non-human ones with HTTP 402, and never charges a human. Zero dependencies.",
   "type": "module",
   "main": "index.js",
   "types": "./index.d.ts",

package/policy.js

@@ -114,9 +114,33 @@ export class RemotePolicy {
    * @param {(e:object)=>void} [o.onEvent] observability; never throws into us
    */
   constructor({ apiKey = null, url = null, publicKey = null, endpoint = DEFAULT_ENDPOINT,
-                refreshMs = DEFAULT_REFRESH_MS, graceMs = 0,
+                refreshMs = DEFAULT_REFRESH_MS, graceMs = 0, allowUnsigned = false,
                 cachePath = null, onEvent = null, onChange = null, fetchImpl = null } = {}) {
     if (!apiKey && !url) throw new Error('RemotePolicy requires a policy url (or the meter apiKey)');
+    /* A policy document decides who is allowed through and what they are
+       charged. Applying one nobody signed means whoever can answer that URL
+       — a hijacked CDN, a DNS answer, anyone on the path — writes your access
+       rules. Until 0.5.2 a missing publicKey silently skipped the check.
+
+       The requirement applies to a bare `url` only. With `apiKey` the document
+       comes from the customer's own meter over TLS with their key, which is an
+       authenticated channel; the signature is defence in depth there, not the
+       only defence. A public policy URL has no such channel — being publicly
+       cacheable is the point of it — so the signature IS the authentication.
+
+       Refusing at construction rather than at fetch time is deliberate: the
+       failure belongs at startup, where someone is watching, not on a poll at
+       three in the morning. `allowUnsigned: true` remains for a URL you trust
+       end to end, and it has to be written down. */
+    if (url && !apiKey && !publicKey && !allowUnsigned)
+      throw new Error(
+        'RemotePolicy requires publicKey: an unsigned policy document is an ' +
+        'unauthenticated one, and it decides access and pricing. Pass the ' +
+        'signing key, or allowUnsigned: true if you genuinely trust this URL.');
+    this.allowUnsigned = allowUnsigned;
+    // True only for a bare public URL, where the signature is the only
+    // thing authenticating the document.
+    this._needsSignature = Boolean(url) && !apiKey;
     this.apiKey = apiKey;
     this.publicKey = publicKey;
     this.graceMs = graceMs;
@@ -186,6 +210,11 @@ export class RemotePolicy {
         const v = verifyEnvelope(raw, this.publicKey, { graceMs: this.graceMs });
         if (!v.ok) { this._emit('policy.rejected', { why: v.reason }); return this.document; }
         doc = v.policy;
+      } else if (this._needsSignature && !this.allowUnsigned) {
+        // Unreachable via the constructor, which refuses this combination.
+        // Kept because the field is public and a caller may clear it.
+        this._emit('policy.rejected', { why: 'no signing key configured' });
+        return this.document;
       }
       if (!isUsable(doc)) { this._emit('policy.rejected', { why: 'document not usable' }); return this.document; }