@aztec-labs/aztec 6.0.0-nightly.20260829

package/src/bin/index.ts

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+//
+import { injectCommands as injectBuilderCommands } from '@aztec-labs/builder';
+import { injectCommands as injectAztecNodeCommands } from '@aztec-labs/cli/aztec_node';
+import { enrichEnvironmentWithChainName } from '@aztec-labs/cli/config/chain';
+import { enrichEnvironmentWithNetworkConfig } from '@aztec-labs/cli/config/network';
+import { injectCommands as injectInfrastructureCommands } from '@aztec-labs/cli/infrastructure';
+import { injectCommands as injectL1Commands } from '@aztec-labs/cli/l1';
+import { injectCommands as injectMiscCommands } from '@aztec-labs/cli/misc';
+import { injectCommands as injectValidatorKeysCommands } from '@aztec-labs/cli/validator_keys';
+import { getActiveNetworkName } from '@aztec-labs/foundation/config';
+import { createConsoleLogger, createLogger } from '@aztec-labs/foundation/log';
+import { getPackageVersion } from '@aztec-labs/stdlib/update-checker';
+import { Command } from 'commander';
+
+import { injectCompileCommand } from '../cli/cmds/compile.js';
+import { injectMigrateCommand } from '../cli/cmds/migrate_ha_db.js';
+import { injectProfileCommand } from '../cli/cmds/profile.js';
+import { injectProverCommand } from '../cli/cmds/prover.js';
+import { injectAztecCommands } from '../cli/index.js';
+
+const NETWORK_FLAG = 'network';
+
+const userLog = createConsoleLogger();
+const debugLogger = createLogger('cli');
+
+/** CLI & full node main entrypoint */
+async function main() {
+  const shutdown = () => {
+    process.exit(0);
+  };
+  process.once('SIGINT', shutdown);
+  process.once('SIGTERM', shutdown);
+
+  // Intercept the setting of a network and enrich the environment with defaults for that network
+  let networkValue: string | undefined;
+
+  const args = process.argv.slice(2);
+  const networkIndex = args.findIndex(arg => arg.startsWith(`--${NETWORK_FLAG}=`) || arg === `--${NETWORK_FLAG}`);
+
+  if (networkIndex !== -1) {
+    networkValue = args[networkIndex].split('=')[1] || args[networkIndex + 1];
+  }
+
+  const networkName = getActiveNetworkName(networkValue);
+  await enrichEnvironmentWithNetworkConfig(networkName);
+  enrichEnvironmentWithChainName(networkName);
+
+  const cliVersion = getPackageVersion();
+  let program = new Command('aztec');
+  program.description('Aztec command line interface').version(cliVersion).enablePositionalOptions();
+  program = injectAztecCommands(program, userLog, debugLogger);
+  program = injectBuilderCommands(program);
+  program = injectInfrastructureCommands(program, userLog);
+  program = injectL1Commands(program, userLog, debugLogger);
+  program = injectAztecNodeCommands(program, userLog, debugLogger);
+  program = injectMiscCommands(program, userLog);
+  program = injectValidatorKeysCommands(program, userLog);
+  program = injectCompileCommand(program, userLog);
+  program = injectProfileCommand(program, userLog);
+  program = injectMigrateCommand(program, userLog);
+  program = injectProverCommand(program, userLog);
+
+  await program.parseAsync(process.argv);
+}
+
+main().catch(err => {
+  debugLogger.error(`Error in command execution`);
+  debugLogger.error(err + '\n' + err.stack);
+  // See https://nodejs.org/api/process.html#processexitcode
+  process.exitCode = 1;
+  throw err;
+});

package/src/cli/admin_api_key_store.ts

@@ -0,0 +1,127 @@
+import { randomBytes } from '@aztec-labs/foundation/crypto/random';
+import { sha256Hash } from '@aztec-labs/foundation/json-rpc/server';
+import type { Logger } from '@aztec-labs/foundation/log';
+import { promises as fs } from 'fs';
+import { join } from 'path';
+
+/** Subdirectory under dataDirectory for admin API key storage. */
+const ADMIN_STORE_DIR = 'admin';
+const HASH_FILE_NAME = 'api_key_hash';
+
+/**
+ * Result of resolving the admin API key.
+ * Contains the SHA-256 hex hash of the API key to be used by the auth middleware,
+ * and optionally the raw key when newly generated (so the caller can display it).
+ */
+export interface AdminApiKeyResolution {
+  /** The SHA-256 hash of the API key. */
+  apiKeyHash: Buffer;
+  /**
+   * The raw API key, only present when a new key was generated during this call.
+   * The caller MUST display this to the operator — it will not be stored or returned again.
+   */
+  rawKey?: string;
+}
+
+export interface ResolveAdminApiKeyOptions {
+  /** SHA-256 hex hash of a pre-generated API key. When set, the node uses this hash directly. */
+  adminApiKeyHash?: string;
+  /** If true, disable admin API key auth entirely. */
+  disableAdminApiKey?: boolean;
+  /** If true, force-generate a new key even if one is already persisted. */
+  resetAdminApiKey?: boolean;
+  /** Root data directory for persistent storage. */
+  dataDirectory?: string;
+}
+
+/**
+ * Resolves the admin API key for the admin RPC endpoint.
+ *
+ * Strategy:
+ * 1. If opt-out flag is set (`disableAdminApiKey`), return undefined (no auth).
+ * 2. If a pre-generated hash is provided (`adminApiKeyHash`), use it directly.
+ * 3. If a data directory exists, look for a persisted hash file
+ *    at `<dataDirectory>/admin/api_key_hash`:
+ *    - If `resetAdminApiKey` is set, skip loading and force-generate a new key.
+ *    - Found: use the stored hash (operator already saved the key from first run).
+ *    - Not found: auto-generate a random key, display it once, persist the hash.
+ * 3. If no data directory: generate a random key
+ *    each run and display it (cannot persist).
+ *
+ * @param options - The options for resolving the admin API key.
+ * @param log - Logger for outputting the key and status messages.
+ * @returns The resolved API key hash, or undefined if auth is disabled.
+ */
+export async function resolveAdminApiKey(
+  options: ResolveAdminApiKeyOptions,
+  log: Logger,
+): Promise<AdminApiKeyResolution | undefined> {
+  // Operator explicitly opted out of admin auth
+  if (options.disableAdminApiKey) {
+    log.warn('Admin API key authentication is DISABLED (--disable-admin-api-key / AZTEC_DISABLE_ADMIN_API_KEY)');
+    return undefined;
+  }
+
+  // Operator provided a pre-generated hash (e.g. via AZTEC_ADMIN_API_KEY_HASH env var)
+  if (options.adminApiKeyHash) {
+    const hex = options.adminApiKeyHash.trim();
+    if (hex.length !== 64 || !/^[0-9a-f]{64}$/.test(hex)) {
+      throw new Error(`Invalid admin API key hash: expected 64-char hex string, got "${hex}"`);
+    }
+    log.info('Admin API key authentication enabled (using pre-configured key hash)');
+    return { apiKeyHash: Buffer.from(hex, 'hex') };
+  }
+
+  // Persistent storage available, load or generate key
+  if (options.dataDirectory) {
+    const adminDir = join(options.dataDirectory, ADMIN_STORE_DIR);
+    const hashFilePath = join(adminDir, HASH_FILE_NAME);
+
+    // Unless a reset is forced, try to load the existing hash from disk
+    if (!options.resetAdminApiKey) {
+      try {
+        const storedHash = (await fs.readFile(hashFilePath, 'utf-8')).trim();
+        if (storedHash.length === 64) {
+          log.info('Admin API key authentication enabled (loaded stored key hash from disk)');
+          return { apiKeyHash: Buffer.from(storedHash, 'hex') };
+        }
+        log.warn(`Invalid stored admin API key hash at ${hashFilePath}, regenerating...`);
+      } catch (err: any) {
+        if (err.code !== 'ENOENT') {
+          log.warn(`Failed to read admin API key hash from ${hashFilePath}: ${err.message}`);
+        }
+        // File doesn't exist — fall through to generate
+      }
+    } else {
+      log.warn('Admin API key reset requested — generating a new key');
+    }
+
+    // Generate a new key, persist the hash, and return the raw key for the caller to display
+    const { rawKey, hash } = generateApiKey();
+    await fs.mkdir(adminDir, { recursive: true });
+    await fs.writeFile(hashFilePath, hash.toString('hex'), 'utf-8');
+    // Set restrictive permissions (owner read/write only)
+    await fs.chmod(hashFilePath, 0o600);
+
+    log.info('Admin API key authentication enabled (new key generated and hash persisted to disk)');
+    return { apiKeyHash: hash, rawKey };
+  }
+
+  // No data directory, generate a temporary key per session
+  const { rawKey, hash } = generateApiKey();
+
+  log.warn('No data directory configured — admin API key cannot be persisted.');
+  log.warn('A temporary key has been generated for this session only.');
+
+  return { apiKeyHash: hash, rawKey };
+}
+
+/**
+ * Generates a cryptographically random API key and its SHA-256 hash.
+ * @returns The raw key (hex string) and its SHA-256 hash as a Buffer.
+ */
+function generateApiKey(): { rawKey: string; hash: Buffer } {
+  const rawKey = randomBytes(32).toString('hex');
+  const hash = sha256Hash(rawKey);
+  return { rawKey, hash };
+}

package/src/cli/aztec_start_action.ts

@@ -0,0 +1,173 @@
+import { registerAztecNodeRpcHandlers } from '@aztec-labs/aztec-node';
+import { getActiveNetworkName } from '@aztec-labs/foundation/config';
+import {
+  type NamespacedApiHandlers,
+  createNamespacedSafeJsonRpcServer,
+  getApiKeyAuthMiddleware,
+  startHttpRpcServer,
+} from '@aztec-labs/foundation/json-rpc/server';
+import type { LogFn, Logger } from '@aztec-labs/foundation/log';
+import { type ChainConfig, getRpcCorsAllowedOrigins } from '@aztec-labs/stdlib/config';
+import { getPackageVersion } from '@aztec-labs/stdlib/update-checker';
+import { getVersioningMiddleware } from '@aztec-labs/stdlib/versioning';
+import {
+  getOtelJsonRpcDiagnosticsMiddleware,
+  getOtelJsonRpcPropagationMiddleware,
+  getOtelJsonRpcServerMetricsMiddleware,
+} from '@aztec-labs/telemetry-client';
+
+import { createLocalNetwork } from '../local-network/index.js';
+import { github, splash } from '../splash.js';
+import { resolveAdminApiKey } from './admin_api_key_store.js';
+import { extractNamespacedOptions, installSignalHandlers } from './util.js';
+import { getVersions } from './versioning.js';
+
+export async function aztecStart(options: any, userLog: LogFn, debugLogger: Logger) {
+  // list of 'stop' functions to call when process ends
+  const signalHandlers: Array<() => Promise<void>> = [];
+  const services: NamespacedApiHandlers = {};
+  const adminServices: NamespacedApiHandlers = {};
+  const packageVersion = getPackageVersion();
+  let config: ChainConfig | undefined = undefined;
+
+  if (options.localNetwork) {
+    const localNetwork = extractNamespacedOptions(options, 'localNetwork');
+    userLog(`${splash}\n${github}\n\n`);
+    userLog(`Setting up Aztec local network ${packageVersion}, please stand by...`);
+
+    const { node, stop } = await createLocalNetwork(
+      {
+        l1Mnemonic: localNetwork.l1Mnemonic,
+        l1RpcUrls: options.l1RpcUrls,
+        testAccounts: localNetwork.testAccounts,
+      },
+      userLog,
+    );
+
+    // Start Node and PXE JSON-RPC server
+    signalHandlers.push(stop);
+    registerAztecNodeRpcHandlers(node, services, adminServices, { debug: true });
+  } else {
+    // Route --prover-node through startNode
+    if (options.proverNode && !options.node) {
+      options.node = true;
+    }
+
+    if (options.node) {
+      const { startNode } = await import('./cmds/start_node.js');
+      const networkName = getActiveNetworkName(options.network);
+      ({ config } = await startNode(options, signalHandlers, services, adminServices, userLog, networkName));
+    } else if (options.bot) {
+      const { startBot } = await import('./cmds/start_bot.js');
+      await startBot(options, signalHandlers, services, userLog);
+    } else if (options.p2pBootstrap) {
+      const { startP2PBootstrap } = await import('./cmds/start_p2p_bootstrap.js');
+      ({ config } = await startP2PBootstrap(options, signalHandlers, services, userLog));
+    } else if (options.proverAgent) {
+      const { startProverAgent } = await import('./cmds/start_prover_agent.js');
+      await startProverAgent(options, signalHandlers, services, userLog);
+    } else if (options.proverBroker) {
+      const { startProverBroker } = await import('./cmds/start_prover_broker.js');
+      await startProverBroker(options, signalHandlers, services, userLog);
+    } else if (options.txe) {
+      const { startTXE } = await import('./cmds/start_txe.js');
+      await startTXE(options, signalHandlers, debugLogger);
+    } else if (options.sequencer) {
+      userLog(`Cannot run a standalone sequencer without a node`);
+      process.exit(1);
+    } else {
+      userLog(`No module specified to start`);
+      process.exit(1);
+    }
+  }
+
+  installSignalHandlers(debugLogger.info, signalHandlers);
+  const versions = getVersions(config);
+  const versioningOpts = { packageVersion };
+
+  // Start the main JSON-RPC server
+  if (Object.entries(services).length > 0) {
+    if (services.aztec) {
+      const { BarretenbergSync } = await import('@aztec/bb.js');
+      // JSON-RPC schema parsing may decompress compressed Chonk proofs before the node handler runs.
+      await BarretenbergSync.initSingleton();
+    }
+
+    const rpcServer = createNamespacedSafeJsonRpcServer(services, {
+      diagnostic: getOtelJsonRpcDiagnosticsMiddleware(),
+      http200OnError: false,
+      log: debugLogger,
+      middlewares: [
+        getOtelJsonRpcServerMetricsMiddleware(),
+        getOtelJsonRpcPropagationMiddleware(),
+        getVersioningMiddleware(versions, versioningOpts),
+      ],
+      maxBatchSize: options.rpcMaxBatchSize,
+      maxBodySizeBytes: options.rpcMaxBodySize,
+      corsAllowedHeaders: options.rpcCorsAllowedHeaders,
+      corsAllowedOrigins: getRpcCorsAllowedOrigins(options),
+    });
+    const { port } = await startHttpRpcServer(rpcServer, {
+      port: options.port,
+      keepAliveTimeoutMs: options.rpcHttpKeepAliveTimeoutMs,
+      headersTimeoutMs: options.rpcHttpHeadersTimeoutMs,
+    });
+    debugLogger.info(`Aztec Server listening on port ${port}`, versions);
+  }
+
+  // If there are any admin services, start a separate JSON-RPC server for them
+  if (Object.entries(adminServices).length > 0) {
+    // Resolve the admin API key (auto-generated and persisted, or opt-out)
+    const apiKeyResolution = await resolveAdminApiKey(
+      {
+        adminApiKeyHash: options.adminApiKeyHash,
+        disableAdminApiKey: options.disableAdminApiKey,
+        resetAdminApiKey: options.resetAdminApiKey,
+        dataDirectory: options.dataDirectory,
+      },
+      debugLogger,
+    );
+    if (!apiKeyResolution) {
+      debugLogger.warn('No admin API key set — admin endpoint is unauthenticated');
+    }
+    const adminMiddlewares = [
+      getOtelJsonRpcServerMetricsMiddleware(),
+      ...(apiKeyResolution ? [getApiKeyAuthMiddleware(apiKeyResolution.apiKeyHash)] : []),
+      getOtelJsonRpcPropagationMiddleware(),
+      getVersioningMiddleware(versions, versioningOpts),
+    ];
+
+    const rpcServer = createNamespacedSafeJsonRpcServer(adminServices, {
+      diagnostic: getOtelJsonRpcDiagnosticsMiddleware(),
+      http200OnError: false,
+      log: debugLogger,
+      middlewares: adminMiddlewares,
+      maxBatchSize: options.rpcMaxBatchSize,
+      maxBodySizeBytes: options.rpcMaxBodySize,
+    });
+    const { port } = await startHttpRpcServer(rpcServer, { port: options.adminPort });
+    debugLogger.info(`Aztec Server admin API listening on port ${port}`, versions);
+
+    // Display the API key after the server has started
+    // Uses userLog which is never filtered by LOG_LEVEL.
+    if (apiKeyResolution?.rawKey) {
+      const separator = '='.repeat(70);
+      userLog('');
+      userLog(separator);
+      userLog('  ADMIN API KEY (save this — it will NOT be shown again)');
+      userLog('');
+      userLog(`  ${apiKeyResolution.rawKey}`);
+      userLog('');
+      userLog(`  Use via header:  x-api-key: <key>`);
+      userLog(`  Or via header:   Authorization: Bearer <key>`);
+      if (options.dataDirectory) {
+        userLog('');
+        userLog('  The key hash has been persisted — on next restart, the same key will be used.');
+      }
+      userLog('');
+      userLog('  To disable admin auth: --disable-admin-api-key or AZTEC_DISABLE_ADMIN_API_KEY=true');
+      userLog(separator);
+      userLog('');
+    }
+  }
+}