xoonya 3.1.13 → 3.1.15

package/scripts/verify_paywall_flag.js

@@ -1,86 +1,86 @@
-"use strict";
-
-// Verifies the optional paywall flag (XOONYA_REQUIRE_PAID_VERIFICATION) for the FREE
-// direct verification routes. Default OFF => routes stay free (non-breaking). ON => the
-// five crypto-verify routes that have a metered paid equivalent return 402 pointing to
-// the paid x402 lane, while /execute, /health and descriptor GETs stay free.
-
-const assert = require("assert");
-const crypto = require("crypto");
-const http = require("http");
-
-const b64url = (buf) => Buffer.from(buf).toString("base64url");
-function makeJws(payloadObj, privateKey) {
-  const protectedB64 = b64url(Buffer.from(JSON.stringify({ alg: "EdDSA" }), "utf8"));
-  const payloadB64 = b64url(Buffer.from(JSON.stringify(payloadObj), "utf8"));
-  const signingInput = `${protectedB64}.${payloadB64}`;
-  return `${signingInput}.${b64url(crypto.sign(null, Buffer.from(signingInput, "utf8"), privateKey))}`;
-}
-
-async function post(baseUrl, path, body) {
-  const res = await fetch(`${baseUrl}${path}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
-  let json = null; try { json = await res.json(); } catch (_) { json = null; }
-  return { status: res.status, json };
-}
-
-const GATED = [
-  ["/v1/proof-center/import-adapter/verify-signature", "proof.verify-signature"],
-  ["/v1/proof-bundles/verify", "proof.verify-bundle"],
-  ["/v1/proofs/verify", "proof.verify-envelope"],
-  ["/validate", "proof.verify-receipt"],
-  ["/v1/receipts/verify", "proof.verify-receipt"]
-];
-
-async function main() {
-  const prevFlag = process.env.XOONYA_REQUIRE_PAID_VERIFICATION;
-  const prevBearer = process.env.XOONYA_EXECUTOR_BEARER_TOKEN;
-  delete process.env.XOONYA_REQUIRE_PAID_VERIFICATION;
-  process.env.XOONYA_EXECUTOR_BEARER_TOKEN = "paywall-test-bearer";
-
-  delete require.cache[require.resolve("../server.js")];
-  const { createServer } = require("../server.js");
-  const server = createServer();
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-  const baseUrl = `http://127.0.0.1:${server.address().port}`;
-
-  const ed = crypto.generateKeyPairSync("ed25519");
-  const edPubPem = ed.publicKey.export({ type: "spki", format: "pem" });
-  const jws = makeJws({ sub: "a" }, ed.privateKey);
-
-  try {
-    // Flag OFF (default): free direct verification works unchanged (non-breaking).
-    let r = await post(baseUrl, "/v1/proof-center/import-adapter/verify-signature", { signature_verification: { jws, trusted_public_key: edPubPem } });
-    assert.strictEqual(r.status, 200, "flag off: verify-signature free (200)");
-    assert.strictEqual(r.json.signature_valid, true, "flag off: real verdict returned free");
-
-    // Flag ON: every gated route returns 402 pointing to the paid lane.
-    process.env.XOONYA_REQUIRE_PAID_VERIFICATION = "true";
-    for (const [path, tool] of GATED) {
-      r = await post(baseUrl, path, {});
-      assert.strictEqual(r.status, 402, `flag on: ${path} must 402`);
-      assert.strictEqual(r.json.reason, "direct_verification_paywalled", `flag on: ${path} paywall reason`);
-      assert.ok(r.json.paid_lane && r.json.paid_lane.task_ref === "adapter.xoonya.invoke", `flag on: ${path} points to paid lane`);
-      assert.strictEqual(r.json.paid_lane.tool_name, tool, `flag on: ${path} names the paid tool`);
-    }
-    // And the paywalled route no longer performs the free verification (402, not 200).
-    r = await post(baseUrl, "/v1/proof-center/import-adapter/verify-signature", { signature_verification: { jws, trusted_public_key: edPubPem } });
-    assert.strictEqual(r.status, 402, "flag on: a valid request is still paywalled (no free bypass)");
-
-    // Flag ON must NOT paywall /execute (the paid backend) or /health (free).
-    const exec = await fetch(`${baseUrl}/execute`, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
-    assert.notStrictEqual(exec.status, 402, "/execute must not be paywalled (it IS the paid path; 401 without bearer here)");
-    const health = await fetch(`${baseUrl}/health`);
-    assert.strictEqual(health.status, 200, "/health stays free");
-
-    console.log("xoonya verify:paywall-flag passed");
-  } finally {
-    await new Promise((resolve) => server.close(resolve));
-    if (prevFlag === undefined) delete process.env.XOONYA_REQUIRE_PAID_VERIFICATION; else process.env.XOONYA_REQUIRE_PAID_VERIFICATION = prevFlag;
-    if (prevBearer === undefined) delete process.env.XOONYA_EXECUTOR_BEARER_TOKEN; else process.env.XOONYA_EXECUTOR_BEARER_TOKEN = prevBearer;
-  }
-}
-
-main().catch((error) => {
-  console.error(error && error.message ? error.message : error);
-  process.exitCode = 1;
-});
+"use strict";
+
+// Verifies the optional paywall flag (XOONYA_REQUIRE_PAID_VERIFICATION) for the FREE
+// direct verification routes. Default OFF => routes stay free (non-breaking). ON => the
+// five crypto-verify routes that have a metered paid equivalent return 402 pointing to
+// the paid x402 lane, while /execute, /health and descriptor GETs stay free.
+
+const assert = require("assert");
+const crypto = require("crypto");
+const http = require("http");
+
+const b64url = (buf) => Buffer.from(buf).toString("base64url");
+function makeJws(payloadObj, privateKey) {
+  const protectedB64 = b64url(Buffer.from(JSON.stringify({ alg: "EdDSA" }), "utf8"));
+  const payloadB64 = b64url(Buffer.from(JSON.stringify(payloadObj), "utf8"));
+  const signingInput = `${protectedB64}.${payloadB64}`;
+  return `${signingInput}.${b64url(crypto.sign(null, Buffer.from(signingInput, "utf8"), privateKey))}`;
+}
+
+async function post(baseUrl, path, body) {
+  const res = await fetch(`${baseUrl}${path}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  let json = null; try { json = await res.json(); } catch (_) { json = null; }
+  return { status: res.status, json };
+}
+
+const GATED = [
+  ["/v1/proof-center/import-adapter/verify-signature", "proof.verify-signature"],
+  ["/v1/proof-bundles/verify", "proof.verify-bundle"],
+  ["/v1/proofs/verify", "proof.verify-envelope"],
+  ["/validate", "proof.verify-receipt"],
+  ["/v1/receipts/verify", "proof.verify-receipt"]
+];
+
+async function main() {
+  const prevFlag = process.env.XOONYA_REQUIRE_PAID_VERIFICATION;
+  const prevBearer = process.env.XOONYA_EXECUTOR_BEARER_TOKEN;
+  delete process.env.XOONYA_REQUIRE_PAID_VERIFICATION;
+  process.env.XOONYA_EXECUTOR_BEARER_TOKEN = "paywall-test-bearer";
+
+  delete require.cache[require.resolve("../server.js")];
+  const { createServer } = require("../server.js");
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+
+  const ed = crypto.generateKeyPairSync("ed25519");
+  const edPubPem = ed.publicKey.export({ type: "spki", format: "pem" });
+  const jws = makeJws({ sub: "a" }, ed.privateKey);
+
+  try {
+    // Flag OFF (default): free direct verification works unchanged (non-breaking).
+    let r = await post(baseUrl, "/v1/proof-center/import-adapter/verify-signature", { signature_verification: { jws, trusted_public_key: edPubPem } });
+    assert.strictEqual(r.status, 200, "flag off: verify-signature free (200)");
+    assert.strictEqual(r.json.signature_valid, true, "flag off: real verdict returned free");
+
+    // Flag ON: every gated route returns 402 pointing to the paid lane.
+    process.env.XOONYA_REQUIRE_PAID_VERIFICATION = "true";
+    for (const [path, tool] of GATED) {
+      r = await post(baseUrl, path, {});
+      assert.strictEqual(r.status, 402, `flag on: ${path} must 402`);
+      assert.strictEqual(r.json.reason, "direct_verification_paywalled", `flag on: ${path} paywall reason`);
+      assert.ok(r.json.paid_lane && r.json.paid_lane.task_ref === "adapter.xoonya.invoke", `flag on: ${path} points to paid lane`);
+      assert.strictEqual(r.json.paid_lane.tool_name, tool, `flag on: ${path} names the paid tool`);
+    }
+    // And the paywalled route no longer performs the free verification (402, not 200).
+    r = await post(baseUrl, "/v1/proof-center/import-adapter/verify-signature", { signature_verification: { jws, trusted_public_key: edPubPem } });
+    assert.strictEqual(r.status, 402, "flag on: a valid request is still paywalled (no free bypass)");
+
+    // Flag ON must NOT paywall /execute (the paid backend) or /health (free).
+    const exec = await fetch(`${baseUrl}/execute`, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+    assert.notStrictEqual(exec.status, 402, "/execute must not be paywalled (it IS the paid path; 401 without bearer here)");
+    const health = await fetch(`${baseUrl}/health`);
+    assert.strictEqual(health.status, 200, "/health stays free");
+
+    console.log("xoonya verify:paywall-flag passed");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    if (prevFlag === undefined) delete process.env.XOONYA_REQUIRE_PAID_VERIFICATION; else process.env.XOONYA_REQUIRE_PAID_VERIFICATION = prevFlag;
+    if (prevBearer === undefined) delete process.env.XOONYA_EXECUTOR_BEARER_TOKEN; else process.env.XOONYA_EXECUTOR_BEARER_TOKEN = prevBearer;
+  }
+}
+
+main().catch((error) => {
+  console.error(error && error.message ? error.message : error);
+  process.exitCode = 1;
+});