@bsv/wallet-toolbox 2.4.3 → 2.4.20

package/out/src/storage/remoting/StorageServer.js

@@ -10,14 +10,102 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StorageServer = void 0;
+const sdk_1 = require("@bsv/sdk");
 const express_1 = __importDefault(require("express"));
 const auth_express_middleware_1 = require("@bsv/auth-express-middleware");
 const payment_express_middleware_1 = require("@bsv/payment-express-middleware");
+const express_rate_limit_1 = require("express-rate-limit");
 const WERR_errors_1 = require("../../sdk/WERR_errors");
 const entityValidationHelpers_1 = require("./entityValidationHelpers");
 const WalletError_1 = require("../../sdk/WalletError");
 const WalletLogger_1 = require("../../WalletLogger");
+const traceContext_1 = require("../../utility/traceContext");
 const BinaryJson_1 = require("./BinaryJson");
+const RateLimitPolicy_1 = require("./RateLimitPolicy");
+const edgePolicy_1 = require("./edgePolicy");
+const actionBatchPack_1 = require("../../utility/actionBatchPack");
+const actionBatchBlobs_1 = require("../methods/actionBatchBlobs");
+const storageRpcMethods = new Set([
+    'abortAction',
+    'abortActionBatch',
+    'adminStats',
+    'beginActionBatch',
+    'commitActionBatch',
+    'commitActionBatchByDigest',
+    'createAction',
+    'destroy',
+    'extendActionBatch',
+    'findCertificatesAuth',
+    'findOrInsertSyncStateAuth',
+    'findOrInsertUser',
+    'findOutputBaskets',
+    'findOutputBasketsAuth',
+    'findOutputsAuth',
+    'findProvenTxReqs',
+    'getCapabilities',
+    'getSettings',
+    'getSyncChunk',
+    'insertCertificateAuth',
+    'internalizeAction',
+    'listActions',
+    'listCertificates',
+    'listOutputs',
+    'makeAvailable',
+    'migrate',
+    'prepareActionBatchCommit',
+    'processAction',
+    'processSyncChunk',
+    'relinquishCertificate',
+    'relinquishOutput',
+    'renewActionBatch',
+    'setActive',
+    'updateProvenTxReqWithNewProvenTx'
+]);
+const authIdRpcMethods = new Set([
+    'abortAction',
+    'abortActionBatch',
+    'beginActionBatch',
+    'commitActionBatch',
+    'commitActionBatchByDigest',
+    'createAction',
+    'extendActionBatch',
+    'findCertificatesAuth',
+    'findOrInsertSyncStateAuth',
+    'findOutputBaskets',
+    'findOutputBasketsAuth',
+    'findOutputsAuth',
+    'insertCertificateAuth',
+    'internalizeAction',
+    'listActions',
+    'listCertificates',
+    'listOutputs',
+    'prepareActionBatchCommit',
+    'processAction',
+    'relinquishCertificate',
+    'relinquishOutput',
+    'renewActionBatch',
+    'setActive'
+]);
+const actionBatchRpcMethods = new Set([
+    'abortActionBatch',
+    'beginActionBatch',
+    'commitActionBatch',
+    'commitActionBatchByDigest',
+    'extendActionBatch',
+    'prepareActionBatchCommit',
+    'renewActionBatch'
+]);
+function requiredAuthenticatedIdentityKey(req) {
+    const identityKey = req.auth?.identityKey;
+    if (typeof identityKey !== 'string' || identityKey.trim() === '' || identityKey === 'unknown') {
+        throw new WERR_errors_1.WERR_UNAUTHORIZED('authenticated request identity is required');
+    }
+    return identityKey;
+}
+function firstRequestHeader(req, name) {
+    const value = req.headers[name.toLowerCase()];
+    return Array.isArray(value) ? value[0] : value;
+}
 class StorageServer {
     app = (0, express_1.default)();
     port;
@@ -28,7 +116,16 @@ class StorageServer {
     adminIdentityKeys;
     makeLogger;
     sessionManager;
+    rateLimitOptions;
+    preAuthRateLimitOptions;
+    trustProxy;
+    allowedOrigins;
+    maxConcurrentRequests;
+    httpPolicy;
+    securityHeadersPolicy;
     logRpcRequests;
+    telemetry;
+    telemetryConfig;
     constructor(storage, options) {
         this.storage = storage;
         this.port = options.port;
@@ -38,8 +135,25 @@ class StorageServer {
         this.adminIdentityKeys = options.adminIdentityKeys;
         this.makeLogger = options.makeLogger;
         this.sessionManager = options.sessionManager;
+        this.rateLimitOptions = options.rateLimit;
+        this.preAuthRateLimitOptions = options.preAuthRateLimit;
+        this.trustProxy = options.trustProxy;
+        this.allowedOrigins = options.allowedOrigins;
+        this.maxConcurrentRequests = options.maxConcurrentRequests ?? 200;
+        this.httpPolicy = {
+            requestTimeoutMs: 2 * 60 * 1000,
+            headersTimeoutMs: 15_000,
+            keepAliveTimeoutMs: 5_000,
+            socketTimeoutMs: 2 * 60 * 1000,
+            maxRequestsPerSocket: 1_000,
+            ...options.http
+        };
+        this.securityHeadersPolicy = options.securityHeaders ?? {};
         this.logRpcRequests = options.logRpcRequests ?? true;
-        if (options['logShortReqs']) {
+        this.telemetryConfig = options.telemetry;
+        this.telemetry = new sdk_1.Telemetry(options.telemetry);
+        const legacyLogShortReqs = options['logShortReqs'];
+        if (legacyLogShortReqs) {
             this.setupShortReqLogging();
         }
         this.setupRoutes();
@@ -55,51 +169,53 @@ class StorageServer {
                     ts: new Date().toISOString(),
                     url: req.originalUrl,
                     ip: req.ip || req.socket.remoteAddress,
-                    ua: req.headers['user-agent'] || '-',
-                    headers: { ...req.headers } // shallow copy
+                    ua: req.headers['user-agent'] || '-'
                 };
-                const traceContext = (req.headers['X-Cloud-Trace-Context'] || req.headers['x-cloud-trace-context'])?.split('/')[0];
+                const traceContext = firstRequestHeader(req, 'X-Cloud-Trace-Context')?.split('/')[0];
                 if (traceContext) {
                     logObj['logging.googleapis.com/trace'] = `projects/computing-with-integrity/traces/${traceContext}`;
                 }
-                const chunks = [];
-                req.on('data', chunk => chunks.push(Buffer.from(chunk)));
-                req.on('end', () => {
-                    const bodyBuffer = Buffer.concat(chunks);
-                    try {
-                        logObj.body = bodyBuffer.toString('utf8');
-                    }
-                    catch {
-                        logObj.body = bodyBuffer.toString('hex');
-                        logObj.bodyEncoding = 'hex';
-                    }
-                    console.log(JSON.stringify(logObj));
-                });
+                // Request bodies and BSV auth/payment headers can contain sensitive
+                // material. Short-request logging records metadata only.
+                console.log(JSON.stringify(logObj));
             }
             next();
         });
     }
     setupRoutes() {
+        (0, RateLimitPolicy_1.configureTrustProxy)(this.app, this.trustProxy);
+        this.app.disable('x-powered-by');
+        this.app.use((0, edgePolicy_1.securityHeaders)({
+            environmentPrefix: 'WALLET_STORAGE',
+            ...this.securityHeadersPolicy
+        }));
+        this.app.use((0, edgePolicy_1.corsPolicy)({
+            environmentPrefix: 'WALLET_STORAGE',
+            allowedOrigins: this.allowedOrigins,
+            methods: ['GET', 'PUT', 'POST', 'OPTIONS']
+        }));
+        this.app.use((0, edgePolicy_1.concurrencyLimit)('WALLET_STORAGE', this.maxConcurrentRequests));
+        this.app.use((0, express_rate_limit_1.rateLimit)((0, RateLimitPolicy_1.rateLimitOptions)({ windowMs: 60_000, limit: 300 }, {
+            skip: (req) => req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS',
+            ...this.preAuthRateLimitOptions
+        })));
+        if (this.telemetry.enabled) {
+            this.app.use(this.traceHttpRequest.bind(this));
+        }
         // Escape HTML-significant characters in JSON responses. This preserves the
         // decoded JSON value while keeping user-controlled strings inert even if a
         // consumer embeds a response in an HTML context.
         this.app.set('json escape', true);
-        this.app.use(express_1.default.json({ limit: '30mb' }));
-        // This allows the API to be used everywhere when CORS is enforced
-        this.app.use((req, res, next) => {
-            res.header('Access-Control-Allow-Origin', '*');
-            res.header('Access-Control-Allow-Headers', '*');
-            res.header('Access-Control-Allow-Methods', '*');
-            res.header('Access-Control-Expose-Headers', '*');
-            res.header('Access-Control-Allow-Private-Network', 'true');
-            if (req.method === 'OPTIONS') {
-                // Handle CORS preflight requests to allow cross-origin POST/PUT requests
-                res.sendStatus(200);
-            }
-            else {
-                next();
-            }
-        });
+        this.app.use(express_1.default.json({
+            limit: (0, edgePolicy_1.readBodyLimitBytes)('WALLET_STORAGE_JSON', 30 * 1024 * 1024)
+        }));
+        // Authentication must see the exact binary body bytes, so parse octet
+        // streams before the auth middleware just as JSON is parsed above.
+        this.app.use(express_1.default.raw({
+            type: 'application/octet-stream',
+            limit: (0, edgePolicy_1.readBodyLimitBytes)('WALLET_STORAGE_BINARY', 8 * 1024 * 1024)
+        }));
+        this.app.use(edgePolicy_1.bodyParserErrorHandler);
         this.app.get('/robots.txt', (req, res) => {
             res.type('text/plain');
             res.send('User-agent: *\nDisallow: /');
@@ -109,170 +225,330 @@ class StorageServer {
             res.send(`BRC-100 ${this.wallet.chain}Net Storage Provider.`);
         });
         const options = {
-            wallet: this.wallet
+            wallet: this.wallet,
+            ...(this.telemetryConfig == null ? {} : { telemetry: this.telemetryConfig })
         };
         if (this.sessionManager != null)
             options.sessionManager = this.sessionManager;
         this.app.use((0, auth_express_middleware_1.createAuthMiddleware)(options));
+        const authenticatedRateLimit = (0, express_rate_limit_1.rateLimit)((0, RateLimitPolicy_1.rateLimitOptions)({ windowMs: 60_000, limit: 1_000 }, {
+            keyGenerator: RateLimitPolicy_1.authenticatedIdentityKey,
+            ...this.rateLimitOptions
+        }));
+        this.app.use(authenticatedRateLimit);
         if (this.monetize) {
             this.app.use((0, payment_express_middleware_1.createPaymentMiddleware)({
                 wallet: this.wallet,
                 calculateRequestPrice: this.calculateRequestPrice || (() => 100)
             }));
         }
-        // A single POST endpoint for JSON-RPC:
-        this.app.post('/', async (req, res) => {
-            const useBinary = req.header(BinaryJson_1.BINARY_ENCODING_HEADER) === BinaryJson_1.BINARY_ENCODING;
-            const requestUsesBinary = req.header(BinaryJson_1.BINARY_REQUEST_ENCODING_HEADER) === BinaryJson_1.BINARY_ENCODING;
-            if (useBinary)
-                res.set(BinaryJson_1.BINARY_ENCODING_HEADER, BinaryJson_1.BINARY_ENCODING);
-            const { jsonrpc, method, id } = req.body;
-            const params = (requestUsesBinary ? (0, BinaryJson_1.decodeBinaryJsonValue)(req.body.params) : req.body.params);
-            const sendRpc = (payload, status = 200) => {
-                res.set('X-Content-Type-Options', 'nosniff');
-                // Normalize with the negotiated binary replacer, then let Express emit
-                // the JSON response through its escaping-aware JSON sink.
-                return res.status(status).json(JSON.parse((0, BinaryJson_1.stringifyJsonRpc)(payload, useBinary)));
-            };
-            // Basic JSON-RPC protocol checks:
-            if (jsonrpc !== '2.0' || !method || typeof method !== 'string') {
-                return sendRpc({ error: { code: -32600, message: 'Invalid Request' } }, 400);
-            }
-            let logObj;
-            if (this.logRpcRequests) {
-                logObj = {
-                    source: 'StorageServer POST handler',
-                    method,
-                    id,
-                    user: req.auth.identityKey,
-                    params: JSON.stringify(params || '').slice(0, 256)
-                };
-                const traceContext = (req.headers['X-Cloud-Trace-Context'] || req.headers['x-cloud-trace-context'])?.split('/')[0];
-                if (traceContext) {
-                    logObj['logging.googleapis.com/trace'] = `projects/computing-with-integrity/traces/${traceContext}`;
+        this.app.put('/action-batch/:batchId/pack', async (req, res) => {
+            try {
+                const auth = await this.authenticatedAuth(req, true);
+                const batchId = String(req.params.batchId);
+                // Express types request bodies as `any`, and other body parsers can
+                // produce strings, arrays, or objects. Keep the runtime narrowing
+                // inline so both the transport and static data-flow analysis can see
+                // that only a real byte view reaches the binary pack decoder.
+                const rawBody = req.body;
+                if (typeof rawBody !== 'object' || rawBody === null || !(rawBody instanceof Uint8Array)) {
+                    throw new TypeError('binary action batch body required');
                 }
-                console.log(JSON.stringify(logObj));
+                // Re-wrap without copying. Besides normalizing Buffer subclasses,
+                // this makes the decoder's runtime type independent of req.body.
+                const body = new Uint8Array(rawBody.buffer, rawBody.byteOffset, rawBody.byteLength);
+                const requestedEncoding = req.header(actionBatchPack_1.ACTION_BATCH_PACK_ENCODING_HEADER) ?? 'identity';
+                const encoding = (0, actionBatchPack_1.supportedActionBatchPackEncodings)().find(candidate => candidate === requestedEncoding);
+                if (encoding == null)
+                    throw new TypeError(`unsupported action batch pack encoding ${requestedEncoding}`);
+                const frame = await (0, actionBatchPack_1.decompressActionBatchPack)(body, encoding, actionBatchBlobs_1.ACTION_BATCH_MAX_PACK_BYTES);
+                const items = (0, actionBatchPack_1.decodeActionBatchPack)(frame, actionBatchBlobs_1.ACTION_BATCH_MAX_PACK_BYTES, actionBatchBlobs_1.ACTION_BATCH_MAX_PACK_ITEMS);
+                await this.storage.putActionBatchPack(auth, {
+                    batchId,
+                    items,
+                    maxPackBytes: actionBatchBlobs_1.ACTION_BATCH_MAX_PACK_BYTES,
+                    maxItems: actionBatchBlobs_1.ACTION_BATCH_MAX_PACK_ITEMS
+                });
+                res.status(200).json({ uploaded: true });
             }
+            catch (error) {
+                const json = WalletError_1.WalletError.unknownToJson(error);
+                res.status(400).json(JSON.parse(json));
+            }
+        });
+        this.app.put('/action-batch/:batchId/blob/:digest', async (req, res) => {
             try {
-                // Dispatch the method call:
-                if (typeof this[method] === 'function') {
-                    // if you wanted to handle certain methods on the server class itself
-                    // e.g. this['someServerMethod'](params)
-                    throw new TypeError('Server method dispatch not used in this approach.');
-                }
-                else if (typeof this.storage[method] === 'function') {
-                    // method is on the walletStorage:
-                    // Find user
-                    switch (method) {
-                        case 'destroy': {
-                            if (logObj != null) {
-                                logObj.result = undefined;
-                                logObj.comment = 'IGNORED';
-                                console.log(JSON.stringify(logObj));
-                            }
-                            return sendRpc({ jsonrpc: '2.0', result: undefined, id });
-                        }
-                        case 'getSettings':
-                            /** */
-                            break;
-                        case 'findOrInsertUser':
-                            if (params[0] !== req.auth.identityKey) {
-                                throw new WERR_errors_1.WERR_UNAUTHORIZED('function may only access authenticated user.');
-                            }
-                            break;
-                        case 'adminStats':
-                            // Add check for admin user
-                            if (params[0] !== req.auth.identityKey) {
-                                throw new WERR_errors_1.WERR_UNAUTHORIZED('function may only access authenticated admin user.');
-                            }
-                            if (!this.adminIdentityKeys?.includes(req.auth.identityKey)) {
-                                throw new WERR_errors_1.WERR_UNAUTHORIZED('function may only be accessed by admin user.');
-                            }
-                            break;
-                        case 'processSyncChunk': {
-                            await this.validateParam0(params, req);
-                            // const args: RequestSyncChunkArgs = params[0]
-                            const r = params[1];
-                            (0, entityValidationHelpers_1.validateSyncChunkEntities)(r);
-                            break;
-                        }
-                        default:
-                            await this.validateParam0(params, req);
-                            break;
-                    }
-                    // If makeLogger is valid, setup and potentially initialize to return data
-                    let logger;
-                    if ((this.makeLogger != null) && typeof params[1] === 'object') {
-                        logger = this.makeLogger(params[1].logger);
-                        params[1].logger = logger;
-                        logger.group(`StorageSever ${method}`);
-                        const userId = params[0]?.userId;
-                        const identityKey = params[0]?.identityKey;
-                        if (userId)
-                            logger.log(`userId: ${userId}`);
-                        if (identityKey)
-                            logger.log(`identityKey: ${identityKey}`);
-                    }
-                    try {
-                        const result = await this.storage[method](...(params || []));
-                        if (logger != null) {
-                            logger.groupEnd();
-                            logger.flush?.();
-                            if (logger.isOrigin) {
-                                // Potentially only flush if isOrigin...
-                            }
-                            else if ((logger.logs != null) && typeof result === 'object') {
-                                // If not the start of logging, return logged data with result.
-                                result.log = { logs: logger.logs };
-                            }
-                        }
-                        return sendRpc({ jsonrpc: '2.0', result, id });
-                    }
-                    catch (error_) {
-                        (0, WalletLogger_1.logWalletError)(error_, logger, 'error executing requested method');
-                        logger?.flush?.();
-                        throw error_;
-                    }
-                }
-                else {
-                    // Unknown method
-                    return sendRpc({
-                        jsonrpc: '2.0',
-                        error: { code: -32601, message: `Method not found: ${method}` },
-                        id
-                    }, 400);
-                }
+                const auth = await this.authenticatedAuth(req, true);
+                const batchId = String(req.params.batchId);
+                const digest = String(req.params.digest);
+                const body = req.body;
+                if (!(body instanceof Uint8Array))
+                    throw new TypeError('binary action batch body required');
+                await this.storage.putActionBatchBlob(auth, { batchId, digest, bytes: body });
+                res.status(200).json({ uploaded: true });
             }
             catch (error) {
-                /**
-                 * Catch any thrown errors from the local walletStorage method.
-                 *
-                 * Convert errors to standard JSON object format that can be converted
-                 * back to WalletError derived objects on the client side and re-thrown.
-                 *
-                 * Uses WalletError.fromJson(<error object>) on the client side to re-create
-                 * an error object of the right class and properties.
-                 */
                 const json = WalletError_1.WalletError.unknownToJson(error);
-                return sendRpc({
+                res.status(400).json(JSON.parse(json));
+            }
+        });
+        // A single POST endpoint for JSON-RPC:
+        this.app.post('/', this.handleRpcRequest.bind(this));
+    }
+    async handleRpcRequest(req, res) {
+        if (!this.telemetry.enabled)
+            return await this.handleRpcRequestCore(req, res);
+        return await this.telemetry.withSpan('wallet.storage.rpc', {
+            component: 'wallet-storage-server',
+            kind: 'server',
+            carrier: req,
+            attributes: {
+                'rpc.system': 'wallet-storage',
+                'rpc.method': typeof req.body?.method === 'string' ? req.body.method : 'invalid'
+            }
+        }, async (span) => await this.handleRpcRequestCore(req, res, span));
+    }
+    async handleRpcRequestCore(req, res, rpcSpan) {
+        const useBinary = req.header(BinaryJson_1.BINARY_ENCODING_HEADER) === BinaryJson_1.BINARY_ENCODING;
+        const requestUsesBinary = req.header(BinaryJson_1.BINARY_REQUEST_ENCODING_HEADER) === BinaryJson_1.BINARY_ENCODING;
+        if (useBinary)
+            res.set(BinaryJson_1.BINARY_ENCODING_HEADER, BinaryJson_1.BINARY_ENCODING);
+        const { jsonrpc, method, id } = req.body;
+        const params = (requestUsesBinary ? (0, BinaryJson_1.decodeBinaryJsonValue)(req.body.params) : req.body.params);
+        if (jsonrpc !== '2.0' || !method || typeof method !== 'string') {
+            return this.sendRpc(res, useBinary, { error: { code: -32600, message: 'Invalid Request' } }, 400);
+        }
+        const logObj = this.createRpcLog(req, method, id, params);
+        try {
+            const dispatch = await this.dispatchRpcCall(method, params, req, logObj, rpcSpan);
+            if (!dispatch.found) {
+                return this.sendRpc(res, useBinary, {
                     jsonrpc: '2.0',
-                    error: JSON.parse(json),
+                    error: { code: -32601, message: `Method not found: ${method}` },
                     id
-                });
+                }, 400);
+            }
+            return this.sendRpc(res, useBinary, { jsonrpc: '2.0', result: dispatch.result, id });
+        }
+        catch (error) {
+            return this.sendRpcError(res, useBinary, id, error);
+        }
+    }
+    traceHttpRequest(req, res, next) {
+        const span = this.telemetry.startSpan('wallet.storage.http.request', {
+            component: 'wallet-storage-server',
+            kind: 'server',
+            parent: (0, traceContext_1.parseTraceparent)(req.headers.traceparent),
+            carrier: req,
+            attributes: {
+                'http.request.method': req.method,
+                'http.request.body_size': Number(req.headers['content-length'] ?? 0),
+                'network.protocol': 'http'
             }
         });
+        span.bind(req);
+        let ended = false;
+        const end = (status) => {
+            if (ended)
+                return;
+            ended = true;
+            span.end({
+                status,
+                attributes: {
+                    'http.response.status_code': res.statusCode
+                }
+            });
+        };
+        res.once('finish', () => {
+            end(res.statusCode >= 500 ? 'error' : 'ok');
+        });
+        res.once('close', () => {
+            end(res.writableEnded ? 'ok' : 'cancelled');
+        });
+        next();
+    }
+    sendRpc(res, useBinary, payload, status = 200) {
+        res.set('X-Content-Type-Options', 'nosniff');
+        // Normalize with the negotiated binary replacer, then let Express emit
+        // the JSON response through its escaping-aware JSON sink.
+        return res.status(status).json(JSON.parse((0, BinaryJson_1.stringifyJsonRpc)(payload, useBinary)));
+    }
+    sendRpcError(res, useBinary, id, error) {
+        /**
+         * Convert errors to standard JSON object format that can be converted back
+         * to WalletError derived objects on the client side and re-thrown.
+         */
+        const json = WalletError_1.WalletError.unknownToJson(error);
+        return this.sendRpc(res, useBinary, {
+            jsonrpc: '2.0',
+            error: JSON.parse(json),
+            id
+        });
+    }
+    createRpcLog(req, method, id, params) {
+        if (!this.logRpcRequests)
+            return undefined;
+        const logObj = {
+            source: 'StorageServer POST handler',
+            method,
+            requestIdType: typeof id,
+            authenticated: requiredAuthenticatedIdentityKey(req) !== '',
+            parameterCount: Array.isArray(params) ? params.length : 0
+        };
+        const traceContext = this.telemetry.contextFor(req)?.traceId ??
+            (0, traceContext_1.parseTraceparent)(firstRequestHeader(req, 'traceparent'))?.traceId ??
+            firstRequestHeader(req, 'X-Cloud-Trace-Context')?.split('/')[0];
+        if (traceContext) {
+            logObj['logging.googleapis.com/trace'] = `projects/computing-with-integrity/traces/${traceContext}`;
+        }
+        console.log(JSON.stringify(logObj));
+        return logObj;
+    }
+    async dispatchRpcCall(method, params, req, logObj, rpcSpan) {
+        if (!storageRpcMethods.has(method))
+            return { found: false };
+        const storageMethod = method === 'findOutputBaskets' ? 'findOutputBasketsAuth' : method;
+        const storageHandler = this.storage[storageMethod];
+        if (typeof storageHandler !== 'function')
+            return { found: false };
+        const shouldInvoke = await this.traceRpcStep('wallet.storage.authorize', rpcSpan, async () => await this.authorizeRpcCall(method, params, req, logObj), { 'rpc.method': method });
+        if (!shouldInvoke)
+            return { found: true, result: undefined };
+        const logger = this.createRpcLogger(method, params);
+        try {
+            const result = await this.traceRpcStep('wallet.storage.handler', rpcSpan, async () => await storageHandler.call(this.storage, ...params), { 'rpc.method': method });
+            this.finishRpcLogging(logger, result);
+            return { found: true, result };
+        }
+        catch (error) {
+            (0, WalletLogger_1.logWalletError)(error, logger, 'error executing requested method');
+            logger?.flush?.();
+            throw error;
+        }
+    }
+    async traceRpcStep(name, parent, callback, attributes) {
+        if (parent == null)
+            return await callback();
+        return await this.telemetry.withSpan(name, {
+            component: 'wallet-storage-server',
+            kind: 'server',
+            parent: parent.context,
+            attributes
+        }, callback);
+    }
+    async authorizeRpcCall(method, params, req, logObj) {
+        switch (method) {
+            case 'destroy':
+                this.logIgnoredDestroy(logObj);
+                return false;
+            case 'getSettings':
+                return true;
+            case 'findOrInsertUser':
+                if (params[0] !== requiredAuthenticatedIdentityKey(req)) {
+                    throw new WERR_errors_1.WERR_UNAUTHORIZED('function may only access authenticated user.');
+                }
+                return true;
+            case 'adminStats':
+                this.authorizeAdminStats(params, req);
+                return true;
+            case 'processSyncChunk':
+                await this.validateParam0(params, req);
+                (0, entityValidationHelpers_1.validateSyncChunkEntities)(params[1]);
+                return true;
+            default:
+                await this.authorizeStandardRpcCall(method, params, req);
+                return true;
+        }
+    }
+    logIgnoredDestroy(logObj) {
+        if (logObj == null)
+            return;
+        logObj.result = undefined;
+        logObj.comment = 'IGNORED';
+        console.log(JSON.stringify(logObj));
+    }
+    authorizeAdminStats(params, req) {
+        const identityKey = requiredAuthenticatedIdentityKey(req);
+        if (params[0] !== identityKey) {
+            throw new WERR_errors_1.WERR_UNAUTHORIZED('function may only access authenticated admin user.');
+        }
+        if (!this.adminIdentityKeys?.includes(identityKey)) {
+            throw new WERR_errors_1.WERR_UNAUTHORIZED('function may only be accessed by admin user.');
+        }
+    }
+    async authorizeStandardRpcCall(method, params, req) {
+        if (authIdRpcMethods.has(method)) {
+            await this.bindAuthenticatedAuth(params, req, actionBatchRpcMethods.has(method));
+            return;
+        }
+        await this.validateParam0(params, req);
+    }
+    createRpcLogger(method, params) {
+        if (this.makeLogger == null || params[1] == null || typeof params[1] !== 'object')
+            return undefined;
+        const logger = this.makeLogger(params[1].logger);
+        params[1].logger = logger;
+        logger.group(`StorageSever ${method}`);
+        const userId = params[0]?.userId;
+        const identityKey = params[0]?.identityKey;
+        if (userId)
+            logger.log(`userId: ${userId}`);
+        if (identityKey)
+            logger.log(`identityKey: ${identityKey}`);
+        return logger;
+    }
+    finishRpcLogging(logger, result) {
+        if (logger == null)
+            return;
+        logger.groupEnd();
+        logger.flush?.();
+        if (!logger.isOrigin && logger.logs != null && result != null && typeof result === 'object') {
+            // If this is not the start of logging, return logged data with the result.
+            result.log = { logs: logger.logs };
+        }
+    }
+    async authenticatedAuth(req, requireActive) {
+        const identityKey = requiredAuthenticatedIdentityKey(req);
+        const { user } = await this.storage.findOrInsertUser(identityKey);
+        const isActive = user.activeStorage === this.storage.getSettings().storageIdentityKey;
+        if (requireActive && !isActive) {
+            throw new WERR_errors_1.WERR_NOT_ACTIVE("action batch methods require the authenticated user's active storage provider");
+        }
+        return {
+            identityKey,
+            userId: user.userId,
+            isActive
+        };
+    }
+    async bindAuthenticatedAuth(params, req, requireActive) {
+        if (!Array.isArray(params))
+            throw new WERR_errors_1.WERR_UNAUTHORIZED('authenticated RPC parameters are required');
+        const claimed = typeof params[0] === 'object' && params[0] != null ? params[0] : {};
+        const identityKey = requiredAuthenticatedIdentityKey(req);
+        if (claimed.identityKey != null && claimed.identityKey !== identityKey) {
+            throw new WERR_errors_1.WERR_UNAUTHORIZED('identityKey does not match authentication');
+        }
+        const auth = await this.authenticatedAuth(req, requireActive);
+        params[0] = {
+            ...claimed,
+            ...auth,
+            reqAuthUserId: auth.userId
+        };
     }
     async validateParam0(params, req) {
+        if (!Array.isArray(params))
+            throw new WERR_errors_1.WERR_UNAUTHORIZED('authenticated RPC parameters are required');
         if (typeof params[0] !== 'object' || !params[0]) {
-            params = [{}];
+            params[0] = {};
         }
-        if (params[0].identityKey && params[0].identityKey !== req.auth.identityKey) {
-            throw new WERR_errors_1.WERR_UNAUTHORIZED('identityKey does not match authentiation');
+        const identityKey = requiredAuthenticatedIdentityKey(req);
+        if (params[0].identityKey && params[0].identityKey !== identityKey) {
+            throw new WERR_errors_1.WERR_UNAUTHORIZED('identityKey does not match authentication');
         }
-        // console.log('looking up user with identityKey:', req.auth.identityKey)
-        const { user } = await this.storage.findOrInsertUser(req.auth.identityKey);
+        // console.log('looking up user with identityKey:', identityKey)
+        const { user } = await this.storage.findOrInsertUser(identityKey);
         params[0].reqAuthUserId = user.userId;
-        if (params[0].identityKey)
+        if (params[0].identityKey || params[0].userId != null)
             params[0].userId = user.userId;
     }
     server;
@@ -280,6 +556,7 @@ class StorageServer {
         this.server = this.app.listen(this.port, () => {
             console.log(`WalletStorageServer listening at http://localhost:${this.port}`);
         });
+        (0, edgePolicy_1.configureHttpServer)(this.server, 'WALLET_STORAGE', this.httpPolicy);
     }
     async close() {
         if (this.server) {
@@ -289,7 +566,9 @@ class StorageServer {
         }
     }
     /** @see {@link validateDate} */
-    validateDate(date) { return (0, entityValidationHelpers_1.validateDate)(date); }
+    validateDate(date) {
+        return (0, entityValidationHelpers_1.validateDate)(date);
+    }
     /**
      * Helper to force uniform behavior across database engines.
      * Use to process all individual records with time stamps retreived from database.