xoonya 3.1.8 → 3.1.9

package/scripts/verify_external_proof_signature.js

@@ -0,0 +1,128 @@
+"use strict";
+
+// Verifies xoonya's external-proof signature verification (lib/external_proof_verify.js
+// + proof_sdk integration) under the HONEST trust model: it reports signature_valid
+// (a fact) + signing_key_ref, and only reports trust_anchored when the caller declared
+// an expected_key_ref that matches the signer. Covers JWS (EdDSA/ES256/RS256), the
+// alg<->key binding, alg:none/crit/malformed rejection, private-key refusal, detached
+// signatures, import-run promotion, and byte-for-byte backward compatibility.
+
+const crypto = require("crypto");
+const assert = require("assert");
+const { verifyJws, verifyDetachedSignature } = require("../lib/external_proof_verify");
+
+const b64url = (buf) => Buffer.from(buf).toString("base64url");
+
+function makeJws(alg, payloadObj, signFn, extraHeader) {
+  const header = { alg, ...(extraHeader || {}) };
+  const protectedB64 = b64url(Buffer.from(JSON.stringify(header), "utf8"));
+  const payloadB64 = b64url(Buffer.from(JSON.stringify(payloadObj), "utf8"));
+  const signingInput = `${protectedB64}.${payloadB64}`;
+  return `${signingInput}.${b64url(signFn(Buffer.from(signingInput, "utf8")))}`;
+}
+
+function main() {
+  const ed = crypto.generateKeyPairSync("ed25519");
+  const edPubPem = ed.publicKey.export({ type: "spki", format: "pem" });
+  const edJws = makeJws("EdDSA", { sub: "agent-1" }, (d) => crypto.sign(null, d, ed.privateKey));
+
+  // 1. EdDSA JWS: signature_valid is a fact; trust requires a declared key ref.
+  let r = verifyJws(edJws, { trusted_public_key: edPubPem });
+  assert.strictEqual(r.ok, true);
+  assert.strictEqual(r.signature_valid, true, "EdDSA signature valid");
+  assert.ok(r.signing_key_ref && r.signing_key_ref.startsWith("ed25519-"));
+  assert.strictEqual(r.trust_anchored, false, "no expected_key_ref -> not trust-anchored");
+  const edRef = r.signing_key_ref;
+  assert.strictEqual(verifyJws(edJws, { trusted_public_key: edPubPem, expected_key_ref: edRef }).trust_anchored, true, "matching expected_key_ref -> anchored");
+  assert.strictEqual(verifyJws(edJws, { trusted_public_key: edPubPem, expected_key_ref: "ed25519-spki-sha256:deadbeef" }).trust_anchored, false, "wrong expected_key_ref -> not anchored");
+
+  // wrong key / tamper -> signature invalid
+  const ed2 = crypto.generateKeyPairSync("ed25519");
+  assert.strictEqual(verifyJws(edJws, { trusted_public_key: ed2.publicKey.export({ type: "spki", format: "pem" }) }).signature_valid, false);
+
+  // 2. Embedded self-asserted key: signature internally valid but NOT caller-supplied.
+  const edJwk = ed.publicKey.export({ format: "jwk" });
+  const edJwsEmbedded = makeJws("EdDSA", { sub: "agent-1" }, (d) => crypto.sign(null, d, ed.privateKey), { jwk: edJwk });
+  r = verifyJws(edJwsEmbedded);
+  assert.strictEqual(r.signature_valid, true, "embedded-key signature internally valid");
+  assert.strictEqual(r.key_source, "embedded_self_asserted");
+  assert.strictEqual(r.trust_anchored, false, "self-asserted key is never trust-anchored");
+
+  // 3. ES256 works; alg<->key binding rejects an ES256K header over a P-256 key.
+  const ec = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  const ecPubPem = ec.publicKey.export({ type: "spki", format: "pem" });
+  const es256Jws = makeJws("ES256", { sub: "a" }, (d) => crypto.sign("sha256", d, { key: ec.privateKey, dsaEncoding: "ieee-p1363" }));
+  assert.strictEqual(verifyJws(es256Jws, { trusted_public_key: ecPubPem }).signature_valid, true, "ES256 valid");
+  const es256kMisdeclared = makeJws("ES256K", { sub: "a" }, (d) => crypto.sign("sha256", d, { key: ec.privateKey, dsaEncoding: "ieee-p1363" }));
+  assert.strictEqual(verifyJws(es256kMisdeclared, { trusted_public_key: ecPubPem }).signature_valid, false, "alg<->key mismatch (ES256K over P-256) rejected");
+
+  // 4. RS256
+  const rsa = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  const rsaJws = makeJws("RS256", { sub: "a" }, (d) => crypto.sign("sha256", d, rsa.privateKey));
+  assert.strictEqual(verifyJws(rsaJws, { trusted_public_key: rsa.publicKey.export({ type: "spki", format: "pem" }) }).signature_valid, true, "RS256 valid");
+
+  // 5. none / crit / malformed / private-key refusal.
+  assert.strictEqual(verifyJws(makeJws("none", { x: 1 }, () => Buffer.alloc(0)), { trusted_public_key: edPubPem }).reason, "jws_alg_none_rejected");
+  const critJws = makeJws("EdDSA", { sub: "a" }, (d) => crypto.sign(null, d, ed.privateKey), { crit: ["exp"] });
+  assert.strictEqual(verifyJws(critJws, { trusted_public_key: edPubPem }).reason, "jws_crit_unsupported");
+  assert.strictEqual(verifyJws("only.two").reason, "jws_malformed");
+  assert.strictEqual(verifyJws(edJws, { trusted_public_key: ed.privateKey.export({ type: "pkcs8", format: "pem" }) }).reason, "no_public_key", "PEM private key refused as trust key");
+  assert.strictEqual(verifyJws(edJws, { trusted_public_key: ed.privateKey.export({ format: "jwk" }) }).reason, "no_public_key", "private JWK refused");
+
+  // 6. Detached signature.
+  const material = "x402-receipt:0xabc";
+  const detSig = crypto.sign(null, Buffer.from(material), ed.privateKey).toString("base64");
+  r = verifyDetachedSignature({ material, signature: detSig, signature_encoding: "base64", public_key: edPubPem, algorithm: "EdDSA", expected_key_ref: edRef });
+  assert.strictEqual(r.signature_valid, true);
+  assert.strictEqual(r.trust_anchored, true, "detached with matching expected_key_ref -> anchored");
+  assert.strictEqual(verifyDetachedSignature({ material: "tampered", signature: detSig, signature_encoding: "base64", public_key: edPubPem, algorithm: "EdDSA" }).signature_valid, false);
+
+  // 7. proof_sdk integration.
+  const proofSdk = require("../proof_sdk");
+  // no verification input -> structural, NO external_signature_* fields (byte-for-byte).
+  const run0 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss" });
+  assert.strictEqual(run0.external_signature_valid, undefined, "no verification -> no top-level field");
+  assert.strictEqual(run0.proof_bundle.attestations[0].external_signature_valid, undefined, "no verification -> no attestation field");
+  assert.ok(String(run0.proof_bundle.attestations[0].verification_boundary).includes("external_truth_out_of_scope"));
+  const run0Keys = Object.keys(run0.proof_bundle.attestations[0]).length;
+
+  // A stray TOP-LEVEL signature/key field must NOT activate verification (namespace only).
+  const run0b = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature: "ZZZZ", public_key: edPubPem });
+  assert.strictEqual(run0b.external_signature_valid, undefined, "top-level fields do not activate verification");
+  assert.strictEqual(Object.keys(run0b.proof_bundle.attestations[0]).length, run0Keys, "attestation shape unchanged by stray top-level fields");
+
+  // trusted key but no expected_key_ref -> signature_valid, NOT anchored; result echo is whitelisted.
+  const run1 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: edPubPem } });
+  assert.strictEqual(run1.external_signature_valid, true, "imported JWS signature verified");
+  assert.strictEqual(run1.external_signature_trust_anchored, false);
+  assert.ok(String(run1.proof_bundle.attestations[0].verification_boundary).includes("consumer_decision"));
+  assert.strictEqual(run1.signature_verification.header, undefined, "result echo does not leak JWS header");
+  assert.strictEqual(run1.signature_verification.payload_b64url, undefined, "result echo does not leak payload");
+
+  // declared expected_key_ref matching the signer -> trust-anchored.
+  const run2 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: edPubPem, expected_key_ref: edRef } });
+  assert.strictEqual(run2.external_signature_trust_anchored, true, "declared+matching key -> anchored");
+  assert.ok(String(run2.proof_bundle.attestations[0].verification_boundary).includes("cryptographically_verified_against_declared_key_ref"));
+
+  // Requested-but-INVALID signature hard-fails the import (ok:false).
+  const run3 = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: ed2.publicKey.export({ type: "spki", format: "pem" }) } });
+  assert.strictEqual(run3.ok, false, "invalid requested signature hard-fails");
+  assert.strictEqual(run3.reason, "external_signature_invalid");
+  // ...unless the caller opts out.
+  const run3b = proofSdk.runExternalProofImport({ method: "jwt-assertion-v1", token: edJws, issuer_ref: "iss", signature_verification: { trusted_public_key: ed2.publicKey.export({ type: "spki", format: "pem" }), require_valid_signature: false } });
+  assert.strictEqual(run3b.ok, true, "opt-out records the import despite invalid signature");
+  assert.strictEqual(run3b.external_signature_valid, false);
+
+  // Object material + detached signature request -> unsupported (does not mislead), hard-fails by default.
+  const run4 = proofSdk.runExternalProofImport({ method: "signed-envelope-v1", proof_envelope: { claim: "x" }, issuer_ref: "iss", signature_verification: { trusted_public_key: edPubPem, signature: "AA", algorithm: "EdDSA" } });
+  assert.strictEqual(run4.ok, false);
+  assert.strictEqual(run4.reason, "unsupported_import_signature_verification");
+
+  // standalone function
+  assert.strictEqual(proofSdk.verifyExternalProofSignature({ jws: edJws, trusted_public_key: edPubPem }).signature_valid, true);
+  assert.strictEqual(proofSdk.verifyExternalProofSignature({}).reason, "no_signature_verification_input");
+
+  console.log("verify_external_proof_signature: all checks passed");
+}
+
+main();

package/scripts/verify_paid_execute.js

@@ -0,0 +1,133 @@
+"use strict";
+
+// Verifies the bearer-authed /execute backend that exposes xoonya's real proof
+// verification pay-per-call through the xytara x402 spine (xytara settles, then calls
+// this as an external execution target). Covers: fail-closed when the bearer env is
+// unset (503), 401 on missing/wrong bearer, 422 on unknown tool / unprocessable input /
+// private-key material, 200 with the MCP-executor-compatible output contract for a real
+// EdDSA JWS verification, and that existing free routes are unchanged.
+
+const assert = require("assert");
+const crypto = require("crypto");
+const http = require("http");
+
+const b64url = (buf) => Buffer.from(buf).toString("base64url");
+function makeJws(alg, payloadObj, signFn) {
+  const protectedB64 = b64url(Buffer.from(JSON.stringify({ alg }), "utf8"));
+  const payloadB64 = b64url(Buffer.from(JSON.stringify(payloadObj), "utf8"));
+  const signingInput = `${protectedB64}.${payloadB64}`;
+  return `${signingInput}.${b64url(signFn(Buffer.from(signingInput, "utf8")))}`;
+}
+
+async function post(baseUrl, path, body, headers = {}) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...headers },
+    body: JSON.stringify(body)
+  });
+  let json = null;
+  try { json = await res.json(); } catch (_) { json = null; }
+  return { status: res.status, json };
+}
+
+function executeBody(toolName, args, taskRef) {
+  return { command: "xoonya proof verify", task_ref: taskRef || "adapter.xoonya.invoke", tasks: [], body: { tool_name: toolName, arguments: args }, account_id: "acct_test", quote: {}, authorization_context: null };
+}
+
+async function main() {
+  const prev = {
+    bearer: process.env.XOONYA_EXECUTOR_BEARER_TOKEN,
+    pkm: process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL
+  };
+  delete process.env.XOONYA_EXECUTOR_BEARER_TOKEN;
+
+  delete require.cache[require.resolve("../server.js")];
+  const { createServer } = require("../server.js");
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+  const TOKEN = "test-executor-bearer-token";
+  const authHdr = { authorization: `Bearer ${TOKEN}` };
+
+  // Build a real EdDSA JWS + its public key for a genuine verification.
+  const ed = crypto.generateKeyPairSync("ed25519");
+  const edPubPem = ed.publicKey.export({ type: "spki", format: "pem" });
+  const edJws = makeJws("EdDSA", { sub: "agent-1" }, (d) => crypto.sign(null, d, ed.privateKey));
+
+  try {
+    // 1. Fail-closed: bearer env unset -> 503, never runs unauthenticated.
+    let r = await post(baseUrl, "/execute", executeBody("proof.verify-signature", {}), authHdr);
+    assert.strictEqual(r.status, 503, "unset bearer env must 503");
+    assert.strictEqual(r.json.reason, "executor_not_configured", "503 reason");
+
+    process.env.XOONYA_EXECUTOR_BEARER_TOKEN = TOKEN;
+
+    // 2. Missing / wrong bearer -> 401.
+    r = await post(baseUrl, "/execute", executeBody("proof.verify-signature", {}));
+    assert.strictEqual(r.status, 401, "missing bearer must 401");
+    r = await post(baseUrl, "/execute", executeBody("proof.verify-signature", {}), { authorization: "Bearer wrong" });
+    assert.strictEqual(r.status, 401, "wrong bearer must 401");
+
+    // 3. Unknown tool -> 422 (don't-charge class).
+    r = await post(baseUrl, "/execute", executeBody("proof.nope", {}), authHdr);
+    assert.strictEqual(r.status, 422, "unknown tool must 422");
+    assert.strictEqual(r.json.reason, "unknown_tool", "unknown_tool reason");
+    assert.ok(Array.isArray(r.json.enabled_tools) && r.json.enabled_tools.includes("proof.verify-signature"), "enabled_tools listed");
+
+    // 4. Real EdDSA JWS verification -> 200 with the MCP-executor output contract.
+    r = await post(baseUrl, "/execute", executeBody("proof.verify-signature", { signature_verification: { jws: edJws, trusted_public_key: edPubPem } }), authHdr);
+    assert.strictEqual(r.status, 200, "valid verification must 200");
+    assert.strictEqual(r.json.ok, true, "200 ok");
+    assert.strictEqual(r.json.status, "completed", "status completed");
+    assert.strictEqual(r.json.provider_status, "completed", "provider_status completed");
+    assert.ok(r.json.output_payload && r.json.output_payload.signature_valid === true, "real signature verified valid in output_payload");
+    assert.ok(r.json.result && r.json.result.output && r.json.result.output.signature_valid === true, "nested result.output present (xytara lifts this)");
+    assert.strictEqual(r.json.output_payload.trust_anchored, false, "no expected_key_ref -> not trust-anchored (honest model preserved)");
+
+    // 4b. A NEGATIVE verdict (wrong key) is NOT billed: money-safety rule charges only on
+    //     a positively-successful verification. 422, not charged, verdict surfaced.
+    const ed2 = crypto.generateKeyPairSync("ed25519");
+    r = await post(baseUrl, "/execute", executeBody("proof.verify-signature", { signature_verification: { jws: edJws, trusted_public_key: ed2.publicKey.export({ type: "spki", format: "pem" }) } }), authHdr);
+    assert.strictEqual(r.status, 422, "a ran-but-invalid verdict must not be charged (422)");
+    assert.ok(r.json.verdict && r.json.verdict.signature_valid === false, "negative verdict surfaced in 422 body");
+
+    // 5. Unprocessable input (no signature_verification) -> 422, not charged.
+    r = await post(baseUrl, "/execute", executeBody("proof.verify-signature", {}), authHdr);
+    assert.strictEqual(r.status, 422, "no sig input must 422");
+    assert.strictEqual(r.json.reason, "no_signature_verification_input", "unprocessable reason surfaced");
+
+    // 5b. The other three tools report unprocessable/negative via {valid:false} with NO
+    //     `ok` field — empty args to each must be 422 (the structural-reject bug fix), so
+    //     a paid caller is never charged for sending nothing verifiable.
+    for (const tool of ["proof.verify-bundle", "proof.verify-envelope", "proof.verify-receipt"]) {
+      r = await post(baseUrl, "/execute", executeBody(tool, {}), authHdr);
+      assert.strictEqual(r.status, 422, `${tool} with empty args must 422 (not a billable 200)`);
+      assert.strictEqual(r.json.ok, false, `${tool} empty-args must report ok:false`);
+    }
+    // A malformed receipt hex is likewise a structural reject -> 422, not a billed 200.
+    r = await post(baseUrl, "/execute", executeBody("proof.verify-receipt", { opreturn_hex: "zz" }), authHdr);
+    assert.strictEqual(r.status, 422, "non-hex receipt must 422");
+    assert.strictEqual(r.json.reason, "non_hex", "non_hex reason surfaced");
+
+    // 6. Private-key material refused -> 422 (only when the deployment rejects it).
+    process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL = "false";
+    r = await post(baseUrl, "/execute", executeBody("proof.verify-signature", { signature_verification: { private_key: "-----BEGIN PRIVATE KEY-----\nAAAA\n-----END PRIVATE KEY-----" } }), authHdr);
+    assert.strictEqual(r.status, 422, "private key material must 422");
+    assert.strictEqual(r.json.reason, "private_key_material_not_accepted", "pkm reason");
+
+    // 7. Non-breaking: an existing free route still answers unchanged.
+    const health = await fetch(`${baseUrl}/health`);
+    assert.strictEqual(health.status, 200, "free /health route unchanged");
+
+    console.log("xoonya verify:paid-execute passed");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    if (prev.bearer === undefined) delete process.env.XOONYA_EXECUTOR_BEARER_TOKEN; else process.env.XOONYA_EXECUTOR_BEARER_TOKEN = prev.bearer;
+    if (prev.pkm === undefined) delete process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL; else process.env.XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL = prev.pkm;
+  }
+}
+
+main().catch((error) => {
+  console.error(error && error.message ? error.message : error);
+  process.exitCode = 1;
+});

package/scripts/verify_paywall_flag.js

@@ -0,0 +1,86 @@
+"use strict";
+
+// Verifies the optional paywall flag (XOONYA_REQUIRE_PAID_VERIFICATION) for the FREE
+// direct verification routes. Default OFF => routes stay free (non-breaking). ON => the
+// five crypto-verify routes that have a metered paid equivalent return 402 pointing to
+// the paid x402 lane, while /execute, /health and descriptor GETs stay free.
+
+const assert = require("assert");
+const crypto = require("crypto");
+const http = require("http");
+
+const b64url = (buf) => Buffer.from(buf).toString("base64url");
+function makeJws(payloadObj, privateKey) {
+  const protectedB64 = b64url(Buffer.from(JSON.stringify({ alg: "EdDSA" }), "utf8"));
+  const payloadB64 = b64url(Buffer.from(JSON.stringify(payloadObj), "utf8"));
+  const signingInput = `${protectedB64}.${payloadB64}`;
+  return `${signingInput}.${b64url(crypto.sign(null, Buffer.from(signingInput, "utf8"), privateKey))}`;
+}
+
+async function post(baseUrl, path, body) {
+  const res = await fetch(`${baseUrl}${path}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  let json = null; try { json = await res.json(); } catch (_) { json = null; }
+  return { status: res.status, json };
+}
+
+const GATED = [
+  ["/v1/proof-center/import-adapter/verify-signature", "proof.verify-signature"],
+  ["/v1/proof-bundles/verify", "proof.verify-bundle"],
+  ["/v1/proofs/verify", "proof.verify-envelope"],
+  ["/validate", "proof.verify-receipt"],
+  ["/v1/receipts/verify", "proof.verify-receipt"]
+];
+
+async function main() {
+  const prevFlag = process.env.XOONYA_REQUIRE_PAID_VERIFICATION;
+  const prevBearer = process.env.XOONYA_EXECUTOR_BEARER_TOKEN;
+  delete process.env.XOONYA_REQUIRE_PAID_VERIFICATION;
+  process.env.XOONYA_EXECUTOR_BEARER_TOKEN = "paywall-test-bearer";
+
+  delete require.cache[require.resolve("../server.js")];
+  const { createServer } = require("../server.js");
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+
+  const ed = crypto.generateKeyPairSync("ed25519");
+  const edPubPem = ed.publicKey.export({ type: "spki", format: "pem" });
+  const jws = makeJws({ sub: "a" }, ed.privateKey);
+
+  try {
+    // Flag OFF (default): free direct verification works unchanged (non-breaking).
+    let r = await post(baseUrl, "/v1/proof-center/import-adapter/verify-signature", { signature_verification: { jws, trusted_public_key: edPubPem } });
+    assert.strictEqual(r.status, 200, "flag off: verify-signature free (200)");
+    assert.strictEqual(r.json.signature_valid, true, "flag off: real verdict returned free");
+
+    // Flag ON: every gated route returns 402 pointing to the paid lane.
+    process.env.XOONYA_REQUIRE_PAID_VERIFICATION = "true";
+    for (const [path, tool] of GATED) {
+      r = await post(baseUrl, path, {});
+      assert.strictEqual(r.status, 402, `flag on: ${path} must 402`);
+      assert.strictEqual(r.json.reason, "direct_verification_paywalled", `flag on: ${path} paywall reason`);
+      assert.ok(r.json.paid_lane && r.json.paid_lane.task_ref === "adapter.xoonya.invoke", `flag on: ${path} points to paid lane`);
+      assert.strictEqual(r.json.paid_lane.tool_name, tool, `flag on: ${path} names the paid tool`);
+    }
+    // And the paywalled route no longer performs the free verification (402, not 200).
+    r = await post(baseUrl, "/v1/proof-center/import-adapter/verify-signature", { signature_verification: { jws, trusted_public_key: edPubPem } });
+    assert.strictEqual(r.status, 402, "flag on: a valid request is still paywalled (no free bypass)");
+
+    // Flag ON must NOT paywall /execute (the paid backend) or /health (free).
+    const exec = await fetch(`${baseUrl}/execute`, { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+    assert.notStrictEqual(exec.status, 402, "/execute must not be paywalled (it IS the paid path; 401 without bearer here)");
+    const health = await fetch(`${baseUrl}/health`);
+    assert.strictEqual(health.status, 200, "/health stays free");
+
+    console.log("xoonya verify:paywall-flag passed");
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    if (prevFlag === undefined) delete process.env.XOONYA_REQUIRE_PAID_VERIFICATION; else process.env.XOONYA_REQUIRE_PAID_VERIFICATION = prevFlag;
+    if (prevBearer === undefined) delete process.env.XOONYA_EXECUTOR_BEARER_TOKEN; else process.env.XOONYA_EXECUTOR_BEARER_TOKEN = prevBearer;
+  }
+}
+
+main().catch((error) => {
+  console.error(error && error.message ? error.message : error);
+  process.exitCode = 1;
+});