xytara 3.1.13 → 3.1.15

package/lib/l402_payment_front.js

@@ -1,265 +1,265 @@
-"use strict";
-
-const crypto = require("crypto");
-const l402Adapter = require("./l402_adapter");
-
-function normalizeString(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function safeEqualHex(left, right) {
-  const a = Buffer.from(String(left || ""), "hex");
-  const b = Buffer.from(String(right || ""), "hex");
-  if (a.length === 0 || b.length === 0 || a.length !== b.length) return false;
-  return crypto.timingSafeEqual(a, b);
-}
-
-function decodeBase64UrlJson(value) {
-  try {
-    return JSON.parse(Buffer.from(String(value || ""), "base64url").toString("utf8"));
-  } catch (_) {
-    return null;
-  }
-}
-
-function loadL402FrontConfig() {
-  const sharedSecret = normalizeString(process.env.XYTARA_L402_SHARED_SECRET);
-  return {
-    enabled: String(process.env.XYTARA_L402_ENABLED || (sharedSecret ? "true" : "false")).trim().toLowerCase() !== "false",
-    shared_secret: sharedSecret || null,
-    max_age_seconds: Math.max(30, Number(process.env.XYTARA_L402_MAX_AGE_SECONDS || 300) || 300),
-    required_headers: ["authorization"],
-    auth_scheme: "L402",
-    token_shape: "base64url_json_with_macaroon_and_hmac_signed_payload"
-  };
-}
-
-function parseL402Authorization(headers) {
-  const authorization = headers && typeof headers.authorization === "string"
-    ? headers.authorization.trim()
-    : "";
-  const match = authorization.match(/^L402\s+(.+)$/i);
-  if (!match) return null;
-  const decoded = decodeBase64UrlJson(match[1]);
-  if (!decoded || typeof decoded !== "object") return null;
-  return {
-    wallet_id: decoded.wallet_id || decoded.gateway_id || "l402_gateway",
-    encoded: decoded.payload || null,
-    signature: decoded.signature || null,
-    macaroon: decoded.macaroon || null,
-    invoice_id: decoded.invoice_id || null,
-    preimage_hash: decoded.preimage_hash || null,
-    scheme: "l402"
-  };
-}
-
-function verifyL402PaymentPayload(paymentPayload, quote, walletId, maxAgeSeconds) {
-  if (!paymentPayload || typeof paymentPayload !== "object") {
-    return { ok: false, reason: "l402_payload_invalid" };
-  }
-  if (!paymentPayload.quote_id || paymentPayload.quote_id !== quote.quote_id) {
-    return { ok: false, reason: "l402_quote_mismatch" };
-  }
-  if (paymentPayload.amount_minor !== quote.amount_minor) {
-    return { ok: false, reason: "l402_amount_mismatch" };
-  }
-  if (paymentPayload.currency !== quote.currency) {
-    return { ok: false, reason: "l402_currency_mismatch" };
-  }
-  if (paymentPayload.account_id && paymentPayload.account_id !== quote.account_id) {
-    return { ok: false, reason: "l402_account_mismatch" };
-  }
-  if (walletId && paymentPayload.wallet_id && paymentPayload.wallet_id !== walletId) {
-    return { ok: false, reason: "l402_wallet_mismatch" };
-  }
-  if (!paymentPayload.nonce || typeof paymentPayload.nonce !== "string") {
-    return { ok: false, reason: "l402_nonce_missing" };
-  }
-  if (!paymentPayload.issued_at_iso || Number.isNaN(Date.parse(paymentPayload.issued_at_iso))) {
-    return { ok: false, reason: "l402_issued_at_invalid" };
-  }
-  const ageSeconds = Math.max(0, Math.floor((Date.now() - Date.parse(paymentPayload.issued_at_iso)) / 1000));
-  if (ageSeconds > maxAgeSeconds) {
-    return { ok: false, reason: "l402_token_expired" };
-  }
-  if (!normalizeString(paymentPayload.macaroon_id || paymentPayload.macaroon)) {
-    return { ok: false, reason: "l402_macaroon_missing" };
-  }
-  if (!normalizeString(paymentPayload.invoice_id || paymentPayload.invoice_reference)) {
-    return { ok: false, reason: "l402_invoice_reference_missing" };
-  }
-  return { ok: true, age_seconds: ageSeconds };
-}
-
-function verifyL402AccessToken(headers, quote, state) {
-  // Real Lightning (L402) path: when a Lightning provider is configured, verify
-  // the standard "L402 <macaroon>:<preimage>" authorization cryptographically
-  // (HMAC-bound macaroon + sha256(preimage) === payment_hash) with single-use
-  // replay protection via the runtime nonce set. Otherwise fall through to the
-  // existing gateway-signed token scheme below (unchanged).
-  const lightningConfig = l402Adapter.loadL402Config();
-  if (l402Adapter.isConfigured(lightningConfig)) {
-    const authorization = headers && typeof headers.authorization === "string" ? headers.authorization : "";
-    const result = l402Adapter.verifyL402Authorization(lightningConfig, authorization);
-    if (!result.ok) {
-      return { ok: false, status: result.reason === "l402_authorization_malformed" ? 402 : 403, reason: result.reason };
-    }
-    if (state && state.acceptedPaymentNonces && state.acceptedPaymentNonces.has(result.payment_hash)) {
-      return { ok: false, status: 403, reason: "l402_preimage_replayed" };
-    }
-    return {
-      ok: true,
-      verification_mode: "l402_lightning",
-      wallet_id: "l402",
-      payment_payload: {
-        nonce: result.payment_hash,
-        payment_hash: result.payment_hash,
-        preimage: result.preimage,
-        quote_id: quote && quote.quote_id,
-        issued_at_iso: new Date().toISOString()
-      },
-      l402: { payment_hash: result.payment_hash, preimage: result.preimage }
-    };
-  }
-
-  const config = loadL402FrontConfig();
-  if (!config.enabled) {
-    return {
-      ok: false,
-      status: 503,
-      reason: "l402_not_enabled"
-    };
-  }
-  if (!config.shared_secret) {
-    return {
-      ok: false,
-      status: 503,
-      reason: "l402_shared_secret_missing"
-    };
-  }
-  const payment = parseL402Authorization(headers || {});
-  if (!payment || !payment.encoded || !payment.signature || !payment.macaroon) {
-    return {
-      ok: false,
-      status: 402,
-      reason: "l402_headers_incomplete"
-    };
-  }
-  const expectedSignature = crypto.createHmac("sha256", config.shared_secret).update(payment.encoded).digest("hex");
-  if (!safeEqualHex(expectedSignature, payment.signature)) {
-    return {
-      ok: false,
-      status: 403,
-      reason: "l402_signature_invalid"
-    };
-  }
-  const payload = decodeBase64UrlJson(payment.encoded);
-  const validation = verifyL402PaymentPayload(payload, quote, payment.wallet_id, config.max_age_seconds);
-  if (!validation.ok) {
-    return {
-      ok: false,
-      status: 403,
-      reason: validation.reason
-    };
-  }
-  return {
-    ok: true,
-    verification_mode: "l402_gateway_signed",
-    wallet_id: payment.wallet_id,
-    payment_payload: payload,
-    age_seconds: validation.age_seconds,
-    l402: {
-      macaroon: payment.macaroon,
-      invoice_id: payment.invoice_id || payload.invoice_id || null,
-      preimage_hash: payment.preimage_hash || payload.preimage_hash || null
-    }
-  };
-}
-
-function buildL402SecuritySummary() {
-  const config = loadL402FrontConfig();
-  const blockers = [];
-  if (config.enabled && !config.shared_secret) blockers.push("l402_shared_secret_missing");
-  return {
-    ok: true,
-    category: "machine-commerce-l402-security-summary",
-    summary_version: "xytara-l402-security-summary-v1",
-    enabled: config.enabled,
-    shared_secret_configured: Boolean(config.shared_secret),
-    max_age_seconds: config.max_age_seconds,
-    auth_scheme: config.auth_scheme,
-    token_shape: config.token_shape,
-    ready: config.enabled && blockers.length === 0,
-    blockers,
-    linked_surfaces: {
-      l402_lane_ref: "/v1/l402",
-      commands_execute_ref: "/l402/commands/execute",
-      mcp_invoke_ref: "/l402/mcp/tools/invoke"
-    }
-  };
-}
-
-async function buildL402ChallengePayload(quote) {
-  // Real Lightning (L402) challenge: when a Lightning provider is configured,
-  // issue a real bolt11 invoice + an HMAC-bound macaroon and advertise the
-  // standard L402 WWW-Authenticate value. Otherwise return the existing
-  // token-shape descriptor (unchanged).
-  const lightningConfig = l402Adapter.loadL402Config();
-  if (l402Adapter.isConfigured(lightningConfig)) {
-    const invoice = await l402Adapter.createLightningInvoice(lightningConfig, {
-      amountSats: lightningConfig.priceSats,
-      memo: quote && quote.quote_id ? `naxytra ${quote.quote_id}` : "naxytra L402"
-    });
-    if (!invoice.ok) {
-      return {
-        ok: false,
-        payment_required: {
-          scheme: "l402",
-          quote,
-          error: invoice.reason,
-          operator_requirements: { auth_scheme: "L402", security_ref: "/v1/l402/security" }
-        }
-      };
-    }
-    const macaroon = l402Adapter.issueL402Macaroon(lightningConfig, {
-      payment_hash: invoice.payment_hash,
-      amountSats: lightningConfig.priceSats
-    });
-    return {
-      ok: false,
-      payment_required: {
-        scheme: "l402",
-        quote,
-        invoice: invoice.payment_request,
-        payment_hash: invoice.payment_hash,
-        macaroon,
-        www_authenticate: l402Adapter.buildWwwAuthenticate(macaroon, invoice.payment_request),
-        operator_requirements: {
-          auth_scheme: "L402",
-          token_shape: "authorization_header_L402_macaroon_colon_preimage",
-          security_ref: "/v1/l402/security"
-        }
-      }
-    };
-  }
-  return {
-    ok: false,
-    payment_required: {
-      scheme: "l402",
-      quote,
-      operator_requirements: {
-        auth_scheme: "L402",
-        token_shape: "base64url_json_with_macaroon_and_hmac_signed_payload",
-        security_ref: "/v1/l402/security"
-      }
-    }
-  };
-}
-
-module.exports = {
-  buildL402ChallengePayload,
-  buildL402SecuritySummary,
-  loadL402FrontConfig,
-  parseL402Authorization,
-  verifyL402AccessToken
-};
+"use strict";
+
+const crypto = require("crypto");
+const l402Adapter = require("./l402_adapter");
+
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function safeEqualHex(left, right) {
+  const a = Buffer.from(String(left || ""), "hex");
+  const b = Buffer.from(String(right || ""), "hex");
+  if (a.length === 0 || b.length === 0 || a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+
+function decodeBase64UrlJson(value) {
+  try {
+    return JSON.parse(Buffer.from(String(value || ""), "base64url").toString("utf8"));
+  } catch (_) {
+    return null;
+  }
+}
+
+function loadL402FrontConfig() {
+  const sharedSecret = normalizeString(process.env.XYTARA_L402_SHARED_SECRET);
+  return {
+    enabled: String(process.env.XYTARA_L402_ENABLED || (sharedSecret ? "true" : "false")).trim().toLowerCase() !== "false",
+    shared_secret: sharedSecret || null,
+    max_age_seconds: Math.max(30, Number(process.env.XYTARA_L402_MAX_AGE_SECONDS || 300) || 300),
+    required_headers: ["authorization"],
+    auth_scheme: "L402",
+    token_shape: "base64url_json_with_macaroon_and_hmac_signed_payload"
+  };
+}
+
+function parseL402Authorization(headers) {
+  const authorization = headers && typeof headers.authorization === "string"
+    ? headers.authorization.trim()
+    : "";
+  const match = authorization.match(/^L402\s+(.+)$/i);
+  if (!match) return null;
+  const decoded = decodeBase64UrlJson(match[1]);
+  if (!decoded || typeof decoded !== "object") return null;
+  return {
+    wallet_id: decoded.wallet_id || decoded.gateway_id || "l402_gateway",
+    encoded: decoded.payload || null,
+    signature: decoded.signature || null,
+    macaroon: decoded.macaroon || null,
+    invoice_id: decoded.invoice_id || null,
+    preimage_hash: decoded.preimage_hash || null,
+    scheme: "l402"
+  };
+}
+
+function verifyL402PaymentPayload(paymentPayload, quote, walletId, maxAgeSeconds) {
+  if (!paymentPayload || typeof paymentPayload !== "object") {
+    return { ok: false, reason: "l402_payload_invalid" };
+  }
+  if (!paymentPayload.quote_id || paymentPayload.quote_id !== quote.quote_id) {
+    return { ok: false, reason: "l402_quote_mismatch" };
+  }
+  if (paymentPayload.amount_minor !== quote.amount_minor) {
+    return { ok: false, reason: "l402_amount_mismatch" };
+  }
+  if (paymentPayload.currency !== quote.currency) {
+    return { ok: false, reason: "l402_currency_mismatch" };
+  }
+  if (paymentPayload.account_id && paymentPayload.account_id !== quote.account_id) {
+    return { ok: false, reason: "l402_account_mismatch" };
+  }
+  if (walletId && paymentPayload.wallet_id && paymentPayload.wallet_id !== walletId) {
+    return { ok: false, reason: "l402_wallet_mismatch" };
+  }
+  if (!paymentPayload.nonce || typeof paymentPayload.nonce !== "string") {
+    return { ok: false, reason: "l402_nonce_missing" };
+  }
+  if (!paymentPayload.issued_at_iso || Number.isNaN(Date.parse(paymentPayload.issued_at_iso))) {
+    return { ok: false, reason: "l402_issued_at_invalid" };
+  }
+  const ageSeconds = Math.max(0, Math.floor((Date.now() - Date.parse(paymentPayload.issued_at_iso)) / 1000));
+  if (ageSeconds > maxAgeSeconds) {
+    return { ok: false, reason: "l402_token_expired" };
+  }
+  if (!normalizeString(paymentPayload.macaroon_id || paymentPayload.macaroon)) {
+    return { ok: false, reason: "l402_macaroon_missing" };
+  }
+  if (!normalizeString(paymentPayload.invoice_id || paymentPayload.invoice_reference)) {
+    return { ok: false, reason: "l402_invoice_reference_missing" };
+  }
+  return { ok: true, age_seconds: ageSeconds };
+}
+
+function verifyL402AccessToken(headers, quote, state) {
+  // Real Lightning (L402) path: when a Lightning provider is configured, verify
+  // the standard "L402 <macaroon>:<preimage>" authorization cryptographically
+  // (HMAC-bound macaroon + sha256(preimage) === payment_hash) with single-use
+  // replay protection via the runtime nonce set. Otherwise fall through to the
+  // existing gateway-signed token scheme below (unchanged).
+  const lightningConfig = l402Adapter.loadL402Config();
+  if (l402Adapter.isConfigured(lightningConfig)) {
+    const authorization = headers && typeof headers.authorization === "string" ? headers.authorization : "";
+    const result = l402Adapter.verifyL402Authorization(lightningConfig, authorization);
+    if (!result.ok) {
+      return { ok: false, status: result.reason === "l402_authorization_malformed" ? 402 : 403, reason: result.reason };
+    }
+    if (state && state.acceptedPaymentNonces && state.acceptedPaymentNonces.has(result.payment_hash)) {
+      return { ok: false, status: 403, reason: "l402_preimage_replayed" };
+    }
+    return {
+      ok: true,
+      verification_mode: "l402_lightning",
+      wallet_id: "l402",
+      payment_payload: {
+        nonce: result.payment_hash,
+        payment_hash: result.payment_hash,
+        preimage: result.preimage,
+        quote_id: quote && quote.quote_id,
+        issued_at_iso: new Date().toISOString()
+      },
+      l402: { payment_hash: result.payment_hash, preimage: result.preimage }
+    };
+  }
+
+  const config = loadL402FrontConfig();
+  if (!config.enabled) {
+    return {
+      ok: false,
+      status: 503,
+      reason: "l402_not_enabled"
+    };
+  }
+  if (!config.shared_secret) {
+    return {
+      ok: false,
+      status: 503,
+      reason: "l402_shared_secret_missing"
+    };
+  }
+  const payment = parseL402Authorization(headers || {});
+  if (!payment || !payment.encoded || !payment.signature || !payment.macaroon) {
+    return {
+      ok: false,
+      status: 402,
+      reason: "l402_headers_incomplete"
+    };
+  }
+  const expectedSignature = crypto.createHmac("sha256", config.shared_secret).update(payment.encoded).digest("hex");
+  if (!safeEqualHex(expectedSignature, payment.signature)) {
+    return {
+      ok: false,
+      status: 403,
+      reason: "l402_signature_invalid"
+    };
+  }
+  const payload = decodeBase64UrlJson(payment.encoded);
+  const validation = verifyL402PaymentPayload(payload, quote, payment.wallet_id, config.max_age_seconds);
+  if (!validation.ok) {
+    return {
+      ok: false,
+      status: 403,
+      reason: validation.reason
+    };
+  }
+  return {
+    ok: true,
+    verification_mode: "l402_gateway_signed",
+    wallet_id: payment.wallet_id,
+    payment_payload: payload,
+    age_seconds: validation.age_seconds,
+    l402: {
+      macaroon: payment.macaroon,
+      invoice_id: payment.invoice_id || payload.invoice_id || null,
+      preimage_hash: payment.preimage_hash || payload.preimage_hash || null
+    }
+  };
+}
+
+function buildL402SecuritySummary() {
+  const config = loadL402FrontConfig();
+  const blockers = [];
+  if (config.enabled && !config.shared_secret) blockers.push("l402_shared_secret_missing");
+  return {
+    ok: true,
+    category: "machine-commerce-l402-security-summary",
+    summary_version: "xytara-l402-security-summary-v1",
+    enabled: config.enabled,
+    shared_secret_configured: Boolean(config.shared_secret),
+    max_age_seconds: config.max_age_seconds,
+    auth_scheme: config.auth_scheme,
+    token_shape: config.token_shape,
+    ready: config.enabled && blockers.length === 0,
+    blockers,
+    linked_surfaces: {
+      l402_lane_ref: "/v1/l402",
+      commands_execute_ref: "/l402/commands/execute",
+      mcp_invoke_ref: "/l402/mcp/tools/invoke"
+    }
+  };
+}
+
+async function buildL402ChallengePayload(quote) {
+  // Real Lightning (L402) challenge: when a Lightning provider is configured,
+  // issue a real bolt11 invoice + an HMAC-bound macaroon and advertise the
+  // standard L402 WWW-Authenticate value. Otherwise return the existing
+  // token-shape descriptor (unchanged).
+  const lightningConfig = l402Adapter.loadL402Config();
+  if (l402Adapter.isConfigured(lightningConfig)) {
+    const invoice = await l402Adapter.createLightningInvoice(lightningConfig, {
+      amountSats: lightningConfig.priceSats,
+      memo: quote && quote.quote_id ? `naxytra ${quote.quote_id}` : "naxytra L402"
+    });
+    if (!invoice.ok) {
+      return {
+        ok: false,
+        payment_required: {
+          scheme: "l402",
+          quote,
+          error: invoice.reason,
+          operator_requirements: { auth_scheme: "L402", security_ref: "/v1/l402/security" }
+        }
+      };
+    }
+    const macaroon = l402Adapter.issueL402Macaroon(lightningConfig, {
+      payment_hash: invoice.payment_hash,
+      amountSats: lightningConfig.priceSats
+    });
+    return {
+      ok: false,
+      payment_required: {
+        scheme: "l402",
+        quote,
+        invoice: invoice.payment_request,
+        payment_hash: invoice.payment_hash,
+        macaroon,
+        www_authenticate: l402Adapter.buildWwwAuthenticate(macaroon, invoice.payment_request),
+        operator_requirements: {
+          auth_scheme: "L402",
+          token_shape: "authorization_header_L402_macaroon_colon_preimage",
+          security_ref: "/v1/l402/security"
+        }
+      }
+    };
+  }
+  return {
+    ok: false,
+    payment_required: {
+      scheme: "l402",
+      quote,
+      operator_requirements: {
+        auth_scheme: "L402",
+        token_shape: "base64url_json_with_macaroon_and_hmac_signed_payload",
+        security_ref: "/v1/l402/security"
+      }
+    }
+  };
+}
+
+module.exports = {
+  buildL402ChallengePayload,
+  buildL402SecuritySummary,
+  loadL402FrontConfig,
+  parseL402Authorization,
+  verifyL402AccessToken
+};