@btx-tools SDK — BTX service-challenge admission control
    Preparing search index...

    Interface BtxAdmissionOpts

    Options for btxAdmission.

    interface BtxAdmissionOpts {
        client: BtxChallengeClient;
        enforceBinding?: boolean;
        isProofPresent?: (req: Request) => boolean;
        issueParams?: Partial<
            Omit<IssueParams, "purpose" | "resource" | "subject">,
        >;
        onAdmit?: (req: Request, result: VerifyResult) => void;
        onError?: (err: unknown, req: Request) => void;
        purpose: StringOrFn;
        resource: StringOrFn;
        subject: StringOrFn;
    }
    Index

    Properties

    client enforceBinding? isProofPresent? issueParams? onAdmit? onError? purpose resource subject

    Properties

    client: BtxChallengeClient

    The BTX RPC client (constructed once at boot).

    enforceBinding?: boolean

    Enforce that the redeemed challenge's binding.{resource,subject,purpose} matches what this request resolves to (audit H-1). Default true. Without it, a valid proof issued for one binding (e.g. a cheap route) can be replayed to admit a different route/tenant on the same btxd, since btxd's redeem can't see the HTTP request. The resource/subject/purpose resolvers must be deterministic per request for this to pass. Set to false only if you intentionally reuse proofs across bindings.

    isProofPresent?: (req: Request) => boolean

    Override the default "is the proof present?" check. By default it returns true iff all of X-BTX-Challenge, X-BTX-Proof-Nonce, X-BTX-Proof-Digest are set.

    issueParams?: Partial<Omit<IssueParams, "purpose" | "resource" | "subject">>

    Extra issue params forwarded to client.issue() (target_solve_time_s, expires_in_s, etc.).

    onAdmit?: (req: Request, result: VerifyResult) => void

    Optional hook fired on successful admission. Receives req + the redeem result.

    onError?: (err: unknown, req: Request) => void

    Optional hook fired when client.issue() or client.redeem() throws. Receives the original error + the request. Fires exactly once before the middleware calls next(err) to hand off to Express's error pipeline. Use this for logging/observability — don't mutate the error or the response. Added in 0.2.0 (audit finding D-1).

    purpose: StringOrFn

    Logical purpose label, e.g. 'ai_inference_gate' or 'rate_limit'.

    resource: StringOrFn

    Resource identifier, e.g. (req) => \model:${req.body.model}|route:${req.path}``.

    subject: StringOrFn

    Subject identifier, e.g. (req) => \tenant:${req.user.id}``.

    Settings

    Member Visibility

    On This Page

    Properties