agentgateway

- allow: mcp.tool.target == "meridian" && mcp.tool.name in ["search_flights", "get_fare_rules"]

- allow: mcp.tool.target == "meridian" && jwt.opaque_id != ""

- allow: mcp.tool.target == "meridian" && mcp.tool.name in ["hold_seat", "change_seat", "add_bag"] && jwt.opaque_id != ""
- allow: mcp.tool.target == "meridian" && mcp.tool.name in ["issue_refund", "cancel_booking"] && jwt.verdict == "approve"

- allow: mcp.resource.target == "meridian" && jwt.opaque_id != ""
- allow: mcp.resource.target == "meridian" && jwt.verdict == "approve"

- allow: mcp.tool.target == "meridian" && mcp.tool.name == "hold_seat" && jwt.opaque_id != "" && jwt.link == "botshield-bind"

Authorization: Bearer <JWT>

import { createRemoteJWKSet, jwtVerify } from "jose";

const JWKS = createRemoteJWKSet(
  new URL("https://api.botshield.ai/.well-known/jwks.json"),
);

const AGENT_ID = "3f6c2a1e-8b47-4d0a-9c35-7e1d5b2a9f04";

// Use a durable store in production. The set only shows the idea.
const usedProofs = new Set<string>();

export async function assertRefundConfirmed(
  authorization: string | undefined,
  pending: { requestId: string; opaqueId: string },
): Promise<void> {
  const token = authorization?.replace(/^Bearer\s+/i, "");
  if (!token) throw new Error("missing proof");

  // Signature, issuer, audience, and expiry.
  const { payload } = await jwtVerify(token, JWKS, {
    issuer: "https://api.botshield.ai",
    audience: AGENT_ID,
    algorithms: ["ES256"],
  });

  if (payload.verdict !== "approve") throw new Error("not confirmed");

  // The proof must be for THIS action and THIS person.
  if (payload.jti !== pending.requestId) throw new Error("proof is for another action");
  if (payload.sub !== pending.opaqueId) throw new Error("proof is for another person");

  // One proof, one execution.
  if (usedProofs.has(pending.requestId)) throw new Error("proof already used");
  usedProofs.add(pending.requestId);
}