From 2c08aaac493ff8c005e7026ce3b50ea7933c2f66 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 00:11:49 +0000 Subject: [PATCH 1/2] build(deps-dev): bump eslint-plugin-unicorn from 72.0.0 to 73.0.0 Bumps [eslint-plugin-unicorn](https://github.com/sindresorhus/eslint-plugin-unicorn) from 72.0.0 to 73.0.0. - [Release notes](https://github.com/sindresorhus/eslint-plugin-unicorn/releases) - [Commits](https://github.com/sindresorhus/eslint-plugin-unicorn/compare/v72.0.0...v73.0.0) --- updated-dependencies: - dependency-name: eslint-plugin-unicorn dependency-version: 73.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 5809c9f..7055ffd 100644 --- a/bun.lock +++ b/bun.lock @@ -19,7 +19,7 @@ "eslint-plugin-functional": "^10.0.0", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-promise": "^7.3.0", - "eslint-plugin-unicorn": "^72.0.0", + "eslint-plugin-unicorn": "^73.0.0", "prettier": "3.9.6", "prettier-plugin-solidity": "^2.4.0", "typescript-eslint": "^8.66.0", @@ -230,7 +230,7 @@ "eslint-plugin-promise": ["eslint-plugin-promise@7.3.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.4.0" }, "peerDependencies": { "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0" } }, "sha512-6uGiOR0INuujr6PEQmeSSP7GbIMJ/ebEXXiEzb/nOj68LknH5Pxzb/AbZivmr6VE6TkTE8rTjRK9zhKpK6HsRA=="], - "eslint-plugin-unicorn": ["eslint-plugin-unicorn@72.0.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@eslint/css-tree": "^4.0.4", "browserslist": "^4.28.4", "change-case": "^5.4.4", "ci-info": "^4.4.0", "core-js-compat": "^3.49.0", "detect-indent": "^7.0.2", "entities": "^4.5.0", "find-up-simple": "^1.0.1", "globals": "^17.7.0", "indent-string": "^5.0.0", "is-builtin-module": "^5.0.0", "is-identifier": "^1.1.0", "pluralize": "^8.0.0", "quote-js-string": "^0.1.0", "regjsparser": "^0.13.2", "reserved-identifiers": "^1.2.0", "semver": "^7.8.5", "strip-indent": "^4.1.1", "yaml": "^2.9.0" }, "peerDependencies": { "eslint": ">=10.4" } }, "sha512-hqO6ksoOHO+ZhdseTuKRVQbx9U7PRO/cv8qAR1mctwzdVO2hYud8uS9luAhp43RJgziYgHAph8eHyipT8GL0ng=="], + "eslint-plugin-unicorn": ["eslint-plugin-unicorn@73.0.0", "", { "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", "@eslint/css-tree": "^4.0.4", "browserslist": "^4.28.4", "change-case": "^5.4.4", "ci-info": "^4.4.0", "core-js-compat": "^3.49.0", "detect-indent": "^7.0.2", "entities": "^4.5.0", "find-up-simple": "^1.0.1", "globals": "^17.7.0", "indent-string": "^5.0.0", "is-builtin-module": "^5.0.0", "is-identifier": "^1.1.0", "pluralize": "^8.0.0", "quote-js-string": "^0.1.0", "regjsparser": "^0.13.2", "reserved-identifiers": "^1.2.0", "semver": "^7.8.5", "strip-indent": "^4.1.1", "yaml": "^2.9.0" }, "peerDependencies": { "eslint": ">=10.4" } }, "sha512-V0YatLe9nkGhXEXKe2Qljb1EY0sJHwDV0HUF1NKFwtsHh/fU7qGHDgv+6fchzZcgU2/7noHo2gdjnmo0P2uDPw=="], "eslint-scope": ["eslint-scope@9.1.2", "", { "dependencies": { "@types/esrecurse": "^4.3.1", "@types/estree": "^1.0.8", "esrecurse": "^4.3.0", "estraverse": "^5.2.0" } }, "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ=="], diff --git a/package.json b/package.json index 6e56818..c550977 100644 --- a/package.json +++ b/package.json @@ -39,7 +39,7 @@ "eslint-plugin-functional": "^10.0.0", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-promise": "^7.3.0", - "eslint-plugin-unicorn": "^72.0.0", + "eslint-plugin-unicorn": "^73.0.0", "prettier": "3.9.6", "prettier-plugin-solidity": "^2.4.0", "typescript-eslint": "^8.66.0" From 31d2c8a60410e47b99f051c0321ab36c77f27122 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Ogle?= Date: Tue, 11 Aug 2026 11:37:34 -0500 Subject: [PATCH 2/2] Rename verifyPayment to isPaymentValid eslint-plugin-unicorn 73 adds consistent-boolean-name, which requires boolean-returning functions to use an is/has/can-style prefix. Matches the existing convention (isExpired, hasAddressInRecords). --- src/auth.test.ts | 2 +- src/auth.ts | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/auth.test.ts b/src/auth.test.ts index 90c17f4..c367742 100644 --- a/src/auth.test.ts +++ b/src/auth.test.ts @@ -133,7 +133,7 @@ describe('buildPaymentAuthHash', () => { // ============================================================================= // x402 payment auth // -// verifyPayment talks to an RPC node; tests inject a fake client via +// isPaymentValid talks to an RPC node; tests inject a fake client via // setRpcClientFactory so the on-chain checks are exercised deterministically. // ============================================================================= const TRANSFER_TOPIC = '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'; diff --git a/src/auth.ts b/src/auth.ts index 6814bc1..94115e1 100644 --- a/src/auth.ts +++ b/src/auth.ts @@ -53,7 +53,7 @@ function isPaymentRequired(result: AuthResult): result is AuthPaymentRequired { // ============================================================================= // Shared RPC client pool // -// `verifyPayment` only needs three read methods. We model that narrow surface +// `isPaymentValid` only needs three read methods. We model that narrow surface // explicitly (a) so it's clear what an RPC outage / mismatch can affect and // (b) so tests can inject a fake client via `setRpcClientFactory`. // ============================================================================= @@ -162,7 +162,7 @@ const PROOF_RETENTION_MS = (MAX_TX_AGE_SECONDS + 60) * 1000; const MAX_PROOF_LIFETIME_MS = 10 * 60 * 1000; // Replay protection. FIFO eviction is refused for entries that are still -// within the recency window enforced by verifyPayment — otherwise a flooder +// within the recency window enforced by isPaymentValid — otherwise a flooder // could push legitimate entries out and replay them. const usedPaymentProofs = createBoundedMap({ maxEntries: 500_000, @@ -174,7 +174,7 @@ const usedPaymentProofs = createBoundedMap({ // ============================================================================= // x402 DoS guard — verification rate limit // -// `verifyPayment` hits the chain RPC (3 reads × up to 3 retries) per attempt, +// `isPaymentValid` hits the chain RPC (3 reads × up to 3 retries) per attempt, // so unauthenticated callers spamming bogus `X-Payment-Proof` headers would // otherwise drain the operator's RPC quota. A separate, much stricter per-IP // token bucket on x402 verification attempts (the global `server.rateLimit` @@ -223,7 +223,7 @@ function parsePaymentProof(raw: string): PaymentProofHeader | string { }; } -async function verifyPayment( +async function isPaymentValid( rpc: string, txHash: Hex, token: string, @@ -313,7 +313,7 @@ async function checkX402( } // A submitted proof — whether bogus or not — will hit the chain RPC in - // verifyPayment. Apply a stricter per-IP bucket here so an attacker can't use + // isPaymentValid. Apply a stricter per-IP bucket here so an attacker can't use // a single permissive `server.rateLimit` to flood the verification path and // drain the operator's RPC quota. The bucket is independent of the global // limit; missing client IPs (programmatic callers) share an 'unknown' bucket. @@ -364,7 +364,7 @@ async function checkX402( return { authenticated: false, error: 'Replay cache full — retry shortly' }; } - const isValid = await verifyPayment(config.rpc, parsed.txHash, config.token, config.amount, config.recipient, payer); + const isValid = await isPaymentValid(config.rpc, parsed.txHash, config.token, config.amount, config.recipient, payer); if (!isValid) { usedPaymentProofs.delete(normalizedHash); return { authenticated: false, error: 'Payment verification failed' };