fix(x402): verify and settle payments in Vercel serverless (#107) - #374
Merged
Merged
Conversation
|
@DevRushd is attempting to deploy a commit to the Emmanuel's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@DevRushd Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
…2#107) The Vercel search function previously performed a paid search whenever any payment-signature or x-payment header existed, without facilitator verification or settlement. This allowed forged, malformed, expired, and underpaid payments to reach Serper. Changes: - api/search.ts: use HTTPFacilitatorClient.verify() and .settle() to validate payment before granting search access - Decode payment payload from header using decodePaymentSignatureHeader - Build payment requirements from shared x402Config module - Never trust header presence alone — every payment is verified - Forged, malformed, expired, and underpaid payments rejected with 402 - 14 new verification tests covering all rejection paths Rejection cases now handled: - Invalid/malformed base64 payment headers - Facilitator verify returns isValid: false (forged, expired, wrong amount) - Facilitator verify throws (network errors) - Facilitator settle returns success: false (settlement failure) - Facilitator settle throws (network errors) - Header presence without valid payload Closes Emmy123222#107 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
DevRushd
force-pushed
the
fix/107-vercel-x402-verify
branch
from
September 2, 2026 11:40
67a33e7 to
0b9739b
Compare
Contributor
Author
|
@AbuJulaybeeb I have resolved conflicts and rebase the branch. Kindly review and merge |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Vercel search function previously performed a paid search whenever any payment-signature or x-payment header existed, without facilitator verification or settlement. This allowed forged, malformed, expired, and underpaid payments to reach Serper.
Changes:
Rejection cases now handled:
Closes #107