x402-surface-check 0.2.13 → 0.2.15

package/README.md

@@ -14,8 +14,9 @@ npx --yes x402-surface-check --endpoint --method POST https://x402.rpc.ankr.com/
 
 ## What It Checks
 
-- Manifest endpoint discovery from `items[]`, `endpoints[]`, `x402Endpoints`, category arrays, resource strings, and OpenAPI paths
+- Manifest endpoint discovery from `items[]`, `endpoints[]`, `resources[]`, `x402Endpoints`, category arrays, resource strings, and OpenAPI paths
 - Linked discovery documents via `discovery_url`, `discoveryUrl`, `resources_url`, `resourcesUrl`, or manifest-level OpenAPI links
+- OpenAPI `servers[]` base-path preservation, so `/paths` are probed through the documented gateway rather than the domain root
 - OpenAPI query/path examples and JSON request-body examples for safer no-payment probes
 - No-payment HTTP 402 challenge shape
 - x402 v1 and v2 price fields, including `accepts[]` and `schemes[]` challenge arrays
@@ -26,7 +27,7 @@ npx --yes x402-surface-check --endpoint --method POST https://x402.rpc.ankr.com/
 - Placeholder recipients such as zero addresses and Solana system-program values
 - Testnet or staging rails such as Base Sepolia and Solana devnet
 - HTTPS resource URLs and stable resource metadata
-- Browser CORS allowance for `X-PAYMENT`
+- Browser CORS allowance for the requesting origin and `X-PAYMENT`, including the actual 402 challenge response
 - Over-broad public method surfaces
 - Auth, validation, and free/trial responses that appear before a payment challenge, without piling on missing-field findings when no challenge was actually returned
 - Operational health/status endpoints, without treating expected free health checks as paid-route failures
@@ -44,6 +45,7 @@ Recent public no-payment checks have found and verified real launch fixes:
 - anchor-x402: multi-rail x402 challenges verified, with browser preflight blockers isolated before merge. https://github.com/solana-foundation/pay-skills/pull/47#issuecomment-4455678163
 - Agent Trust Bench: linked discovery URL and browser-compatibility notes verified clean for adversarial agent-payment resources. https://github.com/solana-foundation/pay-skills/pull/23#issuecomment-4455722170
 - Solrouter: private LLM inference route verified with HTTPS resource-binding and price-alignment notes. https://github.com/solana-foundation/pay-skills/pull/39#issuecomment-4455800060
+- Tetrac: Solana market-data payment gates verified, with browser payment-header preflight blocker isolated. https://github.com/solana-foundation/pay-skills/pull/32#issuecomment-4455923744
 
 Field notes and browser version: https://tateprograms.com/x402-surface-check.html
 

package/bin/x402-surface-check.mjs

@@ -132,6 +132,12 @@ function endpointUrl(rawPath, baseUrl, sourceUrl) {
   return new URL(value, base).toString()
 }
 
+function openApiServerBaseUrl(document, sourceUrl) {
+  const rawUrl = document.servers?.find(server => typeof server?.url === 'string')?.url
+  if (!rawUrl) return documentBaseUrl(document, sourceUrl)
+  return endpointUrl(rawUrl, documentBaseUrl(document, sourceUrl), sourceUrl)
+}
+
 function linkedDiscoveryUrl(document, sourceUrl) {
   const rawUrl = document?.discovery_url
     ?? document?.discoveryUrl
@@ -217,7 +223,9 @@ function openApiProbeUrl(path, operation, baseUrl) {
     }
   }
 
-  const url = path.startsWith('http') ? new URL(resolvedPath) : new URL(resolvedPath, baseUrl)
+  const url = /^https?:\/\//i.test(String(resolvedPath))
+    ? new URL(resolvedPath)
+    : new URL(String(resolvedPath).replace(/^\/+/, ''), `${baseUrl.replace(/\/?$/, '/')}`)
   for (const [name, value] of searchParams.entries()) {
     url.searchParams.set(name, value)
   }
@@ -273,8 +281,7 @@ function endpointEntries(document, sourceUrl, limit) {
   }
 
   if (document.openapi && document.paths && typeof document.paths === 'object') {
-    const baseUrl = document.servers?.find(server => typeof server?.url === 'string')?.url
-      ?? sourceUrl
+    const baseUrl = openApiServerBaseUrl(document, sourceUrl)
 
     for (const [path, operations] of Object.entries(document.paths)) {
       if (!operations || typeof operations !== 'object') continue
@@ -294,17 +301,32 @@ function endpointEntries(document, sourceUrl, limit) {
   }
 
   for (const resource of document.resources ?? []) {
-    if (typeof resource !== 'string') continue
-    const match = resource.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)/i)
-    if (!match) continue
-    const [, method, rawPath] = match
-    const url = rawPath.startsWith('http')
-      ? rawPath
-      : new URL(rawPath, document.baseUrl ?? sourceUrl).toString()
+    if (typeof resource === 'string') {
+      const match = resource.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)/i)
+      if (!match) continue
+      const [, method, rawPath] = match
+      const url = rawPath.startsWith('http')
+        ? rawPath
+        : new URL(rawPath, document.baseUrl ?? sourceUrl).toString()
+      entries.push({
+        name: rawPath.split('/').filter(Boolean).at(-1) ?? rawPath,
+        url,
+        method: method.toUpperCase(),
+      })
+      continue
+    }
+
+    if (!resource || typeof resource !== 'object') continue
+    const rawPath = resource.url ?? resource.endpoint ?? resource.resource ?? resource.path
+    if (!rawPath) continue
     entries.push({
-      name: rawPath.split('/').filter(Boolean).at(-1) ?? rawPath,
-      url,
-      method: method.toUpperCase(),
+      name: resource.id
+        ?? resource.name
+        ?? resource.title
+        ?? String(resource.path ?? rawPath).split('/').filter(Boolean).at(-1)
+        ?? String(rawPath),
+      url: endpointUrl(rawPath, baseUrl, sourceUrl),
+      method: String(resource.method ?? 'GET').toUpperCase(),
     })
   }
 
@@ -413,7 +435,7 @@ async function fetchDocument(url) {
   }
 }
 
-async function probeEndpoint(entry) {
+async function probeEndpoint(entry, origin) {
   const method = entry.method ?? 'POST'
   const response = await fetch(entry.url, {
     method,
@@ -421,6 +443,7 @@ async function probeEndpoint(entry) {
       'user-agent': `x402-surface-check/${packageJson.version}`,
       accept: 'application/json',
       'content-type': 'application/json',
+      ...(origin ? { origin } : {}),
     },
     body: method === 'GET' || method === 'HEAD'
       ? undefined
@@ -641,6 +664,9 @@ function findingList(documentResult, challengeResults, preflightResults, entries
       continue
     }
 
+    if (!result.headers?.['access-control-allow-origin']) {
+      findings.push(`P1 - ${result.name} 402 challenge response does not allow the requesting origin; browser agents cannot read the payment requirements even if preflight succeeds.`)
+    }
     if (summary.resourceUrl.startsWith('http://') || summary.extraResource.startsWith('http://')) {
       findings.push(`P1 - ${result.name} challenge uses a non-HTTPS resource URL: ${summary.resourceUrl || summary.extraResource}.`)
     }
@@ -669,6 +695,10 @@ function findingList(documentResult, challengeResults, preflightResults, entries
   for (const result of preflightResults) {
     const challengeResult = challengesByEntry.get(entryKey(result))
     if (!challengeResult || !hasPaymentChallenge(challengeResult)) continue
+    const allowedOrigin = result.headers['access-control-allow-origin'] ?? ''
+    if (!allowedOrigin) {
+      findings.push(`P1 - ${result.name} CORS preflight does not allow the requesting origin; observed allow-origin: none.`)
+    }
     const allowed = result.headers['access-control-allow-headers'] ?? ''
     if (allowed !== '*' && !/x-payment/i.test(allowed)) {
       const observed = result.status >= 400
@@ -777,7 +807,7 @@ async function runCheck(options) {
   const preflights = []
 
   for (const entry of entries) {
-    challenges.push(await probeEndpoint(entry))
+    challenges.push(await probeEndpoint(entry, origin))
     preflights.push(await probePreflight(entry, origin))
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x402-surface-check",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "description": "No-payment x402 public-surface checker for manifests, OpenAPI specs, and HTTP 402 challenges.",
   "type": "module",
   "bin": {