@canton-network/wallet-gateway-remote 1.4.0 → 1.5.0

package/dist/ledger/wallet-sync-service.js

@@ -297,7 +297,7 @@ export class WalletSyncService {
                     reason: WALLET_DISABLED_REASON.NO_SIGNING_PROVIDER_MATCHED,
                 }),
             };
-            this.logger.info({ ...wallet }, 'Wallet sync result');
+            this.logger.info({ wallet }, 'Wallet sync result');
             await this.store.addWallet(wallet);
             return wallet;
         }));
@@ -324,7 +324,7 @@ export class WalletSyncService {
         try {
             const participantNamespace = await this.getParticipantNamespace();
             const network = await this.store.getCurrentNetwork();
-            this.logger.info(network, 'Current network');
+            this.logger.info({ network }, 'Current network');
             const { rightsByParty, rightsByUser } = await this.getRightsSnapshot();
             const partiesWithRights = Array.from(rightsByParty.keys());
             await this.store.setUserRights(network.id, [
@@ -332,7 +332,7 @@ export class WalletSyncService {
                     new Set()),
             ]);
             const existingWallets = await this.store.getWallets();
-            this.logger.info(existingWallets, 'Existing wallets');
+            this.logger.info({ existingWallets }, 'Existing wallets');
             // Skips wallets for which we didn't allocate a party
             const existingAllocatedWallets = existingWallets.filter((w) => w.status === 'allocated');
             const existingPartiesOnNetwork = new Set(existingAllocatedWallets.map((w) => `${w.partyId}:${w.networkId}`));

package/dist/middleware/apiKeyAuth.d.ts

@@ -0,0 +1,6 @@
+import type { Request, Response, NextFunction } from 'express';
+import { AuthAware } from '@canton-network/core-wallet-auth';
+import { Logger } from 'pino';
+import { Store } from '@canton-network/core-wallet-store';
+export declare function apiKeyAuth(store: Store & AuthAware<Store>, dappApiPath: string, logger: Logger): (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
+//# sourceMappingURL=apiKeyAuth.d.ts.map

package/dist/middleware/apiKeyAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/apiKeyAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EACH,SAAS,EAGZ,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAMzD,wBAAgB,UAAU,CACtB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,IAEA,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,wDAuHhE"}

package/dist/middleware/apiKeyAuth.js

@@ -0,0 +1,88 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { AuthTokenProvider, } from '@canton-network/core-wallet-auth';
+import crypto from 'crypto';
+import { v4 } from 'uuid';
+import { rpcErrors } from '@canton-network/core-rpc-errors';
+import { jsonRpcResponse } from '@canton-network/core-rpc-transport';
+export function apiKeyAuth(store, dappApiPath, logger) {
+    return async (req, res, next) => {
+        const authHeader = req.headers.authorization;
+        // skip if no Authorization header or if it doesn't start with "ApiKey"
+        if (!authHeader?.startsWith('ApiKey')) {
+            logger.trace('No API Key provided, skipping API Key authentication');
+            return next();
+        }
+        const path = req.baseUrl + req.path;
+        const reqId = req.body?.id ?? null;
+        logger.trace({ baseUrl: req.baseUrl, path: req.path }, 'Received request with API Key authentication');
+        // reject if the path is not in the allowed list
+        if (!path.includes(dappApiPath)) {
+            logger.debug(`Path ${path} is not in the allowed list, rejecting API Key authentication`);
+            return res.status(401).json(jsonRpcResponse(reqId, {
+                error: {
+                    code: rpcErrors.invalidRequest().code,
+                    message: `Requested path '${path}' cannot be called with API Key authentication`,
+                },
+            }));
+        }
+        const apiKey = authHeader.slice('ApiKey'.length).trim();
+        const hashedApiKey = crypto
+            .createHash('sha256')
+            .update(apiKey)
+            .digest('hex');
+        const matchingKey = await store.getApiKey(hashedApiKey);
+        if (matchingKey) {
+            logger.debug({ apiKeyId: matchingKey.id, userId: matchingKey.userId }, 'API Key authentication successful');
+            // temporary auth context to access the store with the API key user
+            const authStore = store.withAuthContext({
+                userId: matchingKey.userId,
+                accessToken: 'unused',
+            });
+            // automatically initiate a session for the API key user
+            await authStore.setSession({
+                id: v4(),
+                network: matchingKey.networkId,
+                accessToken: 'unused',
+            });
+            const network = await authStore.getNetwork(matchingKey.networkId);
+            const idp = await authStore.getIdp(network.identityProviderId);
+            if (!network.serviceAccountAuth) {
+                return res.status(401).json(jsonRpcResponse(reqId, {
+                    error: {
+                        code: rpcErrors.invalidRequest().code,
+                        message: `Network '${network.id}' does not have a service account configured`,
+                    },
+                }));
+            }
+            if (network.serviceAccountAuth.method !== 'client_credentials') {
+                return res.status(401).json(jsonRpcResponse(reqId, {
+                    error: {
+                        code: rpcErrors.invalidRequest().code,
+                        message: `Network '${network.id}' does not have a service account configured with client_credentials method`,
+                    },
+                }));
+            }
+            const accessTokenProvider = AuthTokenProvider.fromGatewayConfig(idp, network.serviceAccountAuth, logger);
+            const serviceAccountCtx = await accessTokenProvider.getAuthContext();
+            const context = {
+                isApiKey: true,
+                userId: matchingKey.userId,
+                ledgerUserId: serviceAccountCtx.userId,
+                accessToken: serviceAccountCtx.accessToken,
+                email: matchingKey.email || undefined,
+            };
+            req.authContext = context;
+            return next();
+        }
+        else {
+            logger.warn({ apiKey: apiKey.slice(0, 4) + '*****' }, 'Rejecting invalid API Key');
+            return res.status(401).json(jsonRpcResponse(reqId, {
+                error: {
+                    code: rpcErrors.invalidRequest().code,
+                    message: 'API Key is invalid',
+                },
+            }));
+        }
+    };
+}

package/dist/middleware/apiKeyAuth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=apiKeyAuth.test.d.ts.map

package/dist/middleware/apiKeyAuth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyAuth.test.d.ts","sourceRoot":"","sources":["../../src/middleware/apiKeyAuth.test.ts"],"names":[],"mappings":""}

package/dist/middleware/apiKeyAuth.test.js

@@ -0,0 +1,126 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { apiKeyAuth } from './apiKeyAuth.js';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import crypto from 'crypto';
+vi.mock('@canton-network/core-wallet-auth', async () => {
+    const actual = await vi.importActual('@canton-network/core-wallet-auth');
+    return {
+        ...actual,
+        AuthTokenProvider: {
+            fromGatewayConfig: vi.fn().mockReturnValue({
+                getAuthContext: vi.fn().mockResolvedValue({
+                    userId: 'service_account',
+                    accessToken: 'abc',
+                }),
+            }),
+        },
+    };
+});
+describe('apiKeyAuth', () => {
+    const getApiKey = vi.fn();
+    const logger = pino({ level: 'silent' }, sink());
+    const store = {
+        getApiKey,
+        getNetwork: vi.fn().mockResolvedValue({
+            id: 'canton:local-oauth',
+            identityProviderId: 'idp-mock-oauth',
+            serviceAccountAuth: {
+                method: 'client_credentials',
+                scope: 'daml_ledger_api',
+                audience: 'aud',
+                clientId: 'service_account',
+                clientSecret: 'service-account-secret',
+            },
+        }),
+        getIdp: vi.fn().mockResolvedValue({
+            id: 'idp-mock-oauth',
+            type: 'oauth',
+            issuer: 'http://127.0.0.1:8889',
+            configUrl: 'http://127.0.0.1:8889/.well-known/openid-configuration',
+        }),
+        setSession: vi.fn(),
+        authContext: undefined,
+        withAuthContext(context) {
+            this.authContext = context;
+            return this;
+        },
+    };
+    let next;
+    let status;
+    let json;
+    beforeEach(() => {
+        getApiKey.mockReset();
+        next = vi.fn();
+        status = vi.fn().mockReturnThis();
+        json = vi.fn();
+    });
+    function makeReq(partial) {
+        return {
+            baseUrl: '/api/v0/dapp',
+            path: '/',
+            headers: {},
+            query: {},
+            ...partial,
+        };
+    }
+    function makeRes() {
+        return { status, json };
+    }
+    it('skips processing if using JWT auth', async () => {
+        const req = makeReq({
+            headers: { authorization: 'Bearer abc' },
+        });
+        const res = makeRes();
+        const middleware = apiKeyAuth(store, '/api/v0/dapp', logger);
+        await middleware(req, res, next);
+        expect(getApiKey).not.toHaveBeenCalled();
+        expect(req.authContext).toBeUndefined();
+        expect(next).toHaveBeenCalledOnce();
+    });
+    it('sets authContext and calls next when verification succeeds', async () => {
+        const ctx = {
+            userId: 'alice',
+            ledgerUserId: 'service_account',
+            accessToken: 'abc',
+            isApiKey: true,
+            email: undefined,
+        };
+        getApiKey.mockResolvedValue({
+            id: 'key1',
+            digest: crypto.createHash('sha256').update('abc').digest('hex'),
+            userId: 'alice',
+        });
+        const req = makeReq({
+            headers: { authorization: 'ApiKey abc' },
+        });
+        const res = makeRes();
+        const middleware = apiKeyAuth(store, '/api/v0/dapp', logger);
+        await middleware(req, res, next);
+        expect(getApiKey).toHaveBeenCalled();
+        expect(req.authContext).toEqual(ctx);
+        expect(next).toHaveBeenCalledOnce();
+        expect(status).not.toHaveBeenCalled();
+    });
+    it('returns 401 JSON when no matching API key is found', async () => {
+        getApiKey.mockResolvedValue(null);
+        const req = makeReq({
+            headers: { authorization: 'ApiKey invalid' },
+        });
+        const res = makeRes();
+        const middleware = apiKeyAuth(store, '/api/v0/dapp', logger);
+        await middleware(req, res, next);
+        expect(next).not.toHaveBeenCalled();
+        expect(status).toHaveBeenCalledWith(401);
+        expect(json).toHaveBeenCalledWith({
+            error: {
+                code: -32600,
+                message: 'API Key is invalid',
+            },
+            id: null,
+            jsonrpc: '2.0',
+        });
+    });
+});

package/dist/middleware/jsonRpcHandler.d.ts

@@ -1,9 +1,19 @@
 import { NextFunction, Request, Response } from 'express';
 import { Logger } from 'pino';
+import { JsonRpcResponse } from '@canton-network/core-types';
 interface JsonRpcHttpOptions<T> {
     logger: Logger;
     controller: T;
 }
-export declare const jsonRpcHandler: <T extends Record<string, (...args: any[]) => any>>({ controller, logger: _logger, }: JsonRpcHttpOptions<T>) => (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Handles JSON-RPC errors and maps them to HTTP responses.
+ * @param error The error that occurred.
+ * @param id The JSON-RPC request ID.
+ * @param logger The logger instance.
+ * @param method The name of the JSON-RPC method being called.
+ * @returns A tuple containing the HTTP status code and the JSON-RPC response.
+ */
+export declare const handleRpcError: (error: unknown, id: string | number | null, method?: string) => [number, JsonRpcResponse];
+export declare const jsonRpcHandler: <T extends Record<string, (...args: any[]) => any>>({ controller, logger: _logger, }: JsonRpcHttpOptions<T>) => (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 export {};
 //# sourceMappingURL=jsonRpcHandler.d.ts.map

package/dist/middleware/jsonRpcHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonRpcHandler.d.ts","sourceRoot":"","sources":["../../src/middleware/jsonRpcHandler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAc7B,UAAU,kBAAkB,CAAC,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,CAAC,CAAA;CAChB;AAiED,eAAO,MAAM,cAAc,GAEtB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,kCAGjD,kBAAkB,CAAC,CAAC,CAAC,MAMZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,SA4E1D,CAAA"}
+{"version":3,"file":"jsonRpcHandler.d.ts","sourceRoot":"","sources":["../../src/middleware/jsonRpcHandler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAM7B,OAAO,EAGH,eAAe,EAClB,MAAM,4BAA4B,CAAA;AAInC,UAAU,kBAAkB,CAAC,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,CAAC,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACvB,OAAO,OAAO,EACd,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,EAC1B,SAAS,MAAM,KAChB,CAAC,MAAM,EAAE,eAAe,CA8C1B,CAAA;AAED,eAAO,MAAM,cAAc,GAEtB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,kCAGjD,kBAAkB,CAAC,CAAC,CAAC,MAMZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,8CAgF1D,CAAA"}

package/dist/middleware/jsonRpcHandler.js

@@ -12,7 +12,7 @@ import { isJsCantonError } from '@canton-network/core-ledger-client';
  * @param method The name of the JSON-RPC method being called.
  * @returns A tuple containing the HTTP status code and the JSON-RPC response.
  */
-const handleRpcError = (error, id, logger, method) => {
+export const handleRpcError = (error, id, method) => {
     const genericMessage = method
         ? `Something went wrong while calling ${method}`
         : 'Something went wrong';
@@ -54,7 +54,6 @@ const handleRpcError = (error, id, logger, method) => {
         response.error.data = error;
     }
     const jsonResponse = jsonRpcResponse(id, response);
-    logger.error(jsonResponse, 'RPC response');
     return [500, jsonResponse];
 };
 export const jsonRpcHandler = 
@@ -63,7 +62,7 @@ export const jsonRpcHandler =
     const logger = _logger.child({ component: 'json-rpc-http' });
     return (req, res, next) => {
         if (req.method !== 'POST') {
-            next();
+            return next();
         }
         const parsed = JsonRpcRequest.safeParse(req.body);
         if (!parsed.success) {
@@ -73,37 +72,37 @@ export const jsonRpcHandler =
             }, 'RPC request: Invalid request format');
             const [status, response] = handleRpcError(rpcErrors.invalidRequest({
                 message: 'Invalid JSON-RPC request format',
-            }), null, logger);
-            res.status(status).json(response);
+            }), null);
+            return res.status(status).json(response);
         }
         else {
             const { method, params, id = null } = parsed.data;
-            logger.debug({
+            logger.trace({
                 request: {
-                    id: id,
-                    method: method,
-                    params: params,
+                    id,
+                    method,
+                    params,
                     authContext: req.authContext,
                 },
-            }, `RPC request: ${method}`);
+            }, `RPC request: Method called ${method}`);
             const methodFn = controller[method];
             if (!methodFn) {
                 const [status, response] = handleRpcError(rpcErrors.methodNotFound({
                     message: `Method ${method} not found`,
-                }), null, logger, method);
-                res.status(status).json(response);
+                }), null, method);
+                return res.status(status).json(response);
             }
             // TODO: validate params match the expected schema for the method
             methodFn(params)
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
                 .then((result) => {
                 const response = jsonRpcResponse(id, { result });
-                logger.debug(response, 'RPC response');
+                logger.trace({ response }, 'RPC response: success with response');
                 res.json(response);
             })
                 .catch((error) => {
-                const [status, response] = handleRpcError(error, id, logger, method);
-                logger.error(response, 'RPC response');
+                const [status, response] = handleRpcError(error, id, method);
+                logger.error({ response }, 'RPC response: error with response');
                 res.status(status).json(response);
             });
         }

package/dist/middleware/jsonRpcHandler.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jsonRpcHandler.test.d.ts.map

package/dist/middleware/jsonRpcHandler.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonRpcHandler.test.d.ts","sourceRoot":"","sources":["../../src/middleware/jsonRpcHandler.test.ts"],"names":[],"mappings":""}

package/dist/middleware/jsonRpcHandler.test.js

@@ -0,0 +1,254 @@
+// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { pino } from 'pino';
+import { sink } from 'pino-test';
+import { rpcErrors, toHttpErrorCode } from '@canton-network/core-rpc-errors';
+import { handleRpcError, jsonRpcHandler } from './jsonRpcHandler.js';
+function errorPayload(body) {
+    if (!('error' in body)) {
+        throw new Error('expected JSON-RPC error response');
+    }
+    return body.error;
+}
+async function waitForRpcResponse(res) {
+    const json = res.json;
+    await vi.waitUntil(() => json.mock.calls.length > 0);
+}
+describe('jsonRpcHandler', () => {
+    const logger = pino({ level: 'silent' }, sink());
+    const resolve = vi.fn(async () => 'response');
+    const reject = vi.fn(async () => {
+        throw new Error('error');
+    });
+    const rpcError = vi.fn(async () => {
+        throw rpcErrors.invalidParams({ message: 'bad params' });
+    });
+    beforeEach(() => {
+        resolve.mockClear();
+        reject.mockClear();
+        rpcError.mockClear();
+    });
+    function makeHandler() {
+        return jsonRpcHandler({
+            controller: { resolve, reject, rpcError },
+            logger,
+        });
+    }
+    function makeRes() {
+        const res = {
+            status: vi.fn(),
+            json: vi.fn(),
+        };
+        // Express response methods are chainable, like `res.status(500).json(body)`
+        // Make the mocked status() return this fake res object so .json() can be called after it.
+        res.status.mockReturnValue(res);
+        return res;
+    }
+    it('delegates to next() if method is not POST', () => {
+        const handler = makeHandler();
+        const next = vi.fn();
+        const res = makeRes();
+        const req = {
+            method: 'GET',
+            body: {},
+        };
+        handler(req, res, next);
+        expect(next).toHaveBeenCalledOnce();
+        expect(res.status).not.toHaveBeenCalled();
+    });
+    it('responds with invalid request when body is not valid JSON-RPC 2.0', async () => {
+        const handler = makeHandler();
+        const next = vi.fn();
+        const res = makeRes();
+        const req = {
+            method: 'POST',
+            body: { jsonrpc: '1.0', method: 'resolve', id: 1 },
+        };
+        handler(req, res, next);
+        await waitForRpcResponse(res);
+        expect(next).not.toHaveBeenCalled();
+        expect(res.status).toHaveBeenCalled();
+        expect(res.json).toHaveBeenCalledWith(expect.objectContaining({
+            jsonrpc: '2.0',
+            id: null,
+            error: expect.objectContaining({
+                code: expect.any(Number),
+            }),
+        }));
+    });
+    it('returns method not found when controller has no such method', async () => {
+        const handler = makeHandler();
+        const next = vi.fn();
+        const res = makeRes();
+        const req = {
+            method: 'POST',
+            body: {
+                jsonrpc: '2.0',
+                id: 42,
+                method: 'missing',
+                params: [],
+            },
+        };
+        handler(req, res, next);
+        await waitForRpcResponse(res);
+        expect(res.status).toHaveBeenCalled();
+        const payload = res.json.mock.calls[0][0];
+        expect(payload.id).toBeNull();
+        expect(payload.error.message).toContain('missing');
+    });
+    it('returns JSON-RPC success when the method resolves', async () => {
+        const handler = makeHandler();
+        const next = vi.fn();
+        const res = makeRes();
+        const req = {
+            method: 'POST',
+            body: {
+                jsonrpc: '2.0',
+                id: 7,
+                method: 'resolve',
+                params: { x: 1 },
+            },
+            authContext: { userId: 'u', accessToken: 't' },
+        };
+        handler(req, res, next);
+        await waitForRpcResponse(res);
+        expect(resolve).toHaveBeenCalledWith({ x: 1 });
+        expect(res.json).toHaveBeenCalledWith({
+            jsonrpc: '2.0',
+            id: 7,
+            result: 'response',
+        });
+    });
+    it('maps thrown Error to JSON-RPC error with HTTP 500', async () => {
+        const handler = makeHandler();
+        const next = vi.fn();
+        const res = makeRes();
+        const req = {
+            method: 'POST',
+            body: {
+                jsonrpc: '2.0',
+                id: 'rid',
+                method: 'reject',
+                params: [],
+            },
+        };
+        handler(req, res, next);
+        await waitForRpcResponse(res);
+        expect(reject).toHaveBeenCalled();
+        expect(res.status).toHaveBeenCalledWith(500);
+        expect(res.json).toHaveBeenCalledWith(expect.objectContaining({
+            jsonrpc: '2.0',
+            id: 'rid',
+            error: expect.objectContaining({
+                message: 'error',
+            }),
+        }));
+    });
+    it('maps JsonRpcError to the corresponding HTTP status', async () => {
+        const handler = makeHandler();
+        const next = vi.fn();
+        const res = makeRes();
+        const req = {
+            method: 'POST',
+            body: {
+                jsonrpc: '2.0',
+                id: 0,
+                method: 'rpcError',
+                params: [],
+            },
+        };
+        handler(req, res, next);
+        await waitForRpcResponse(res);
+        expect(rpcError).toHaveBeenCalled();
+        expect(res.status).toHaveBeenCalledWith(toHttpErrorCode(rpcErrors.invalidParams().code));
+        expect(res.json).toHaveBeenCalledWith(expect.objectContaining({
+            jsonrpc: '2.0',
+            id: 0,
+            error: expect.objectContaining({
+                message: 'bad params',
+            }),
+        }));
+    });
+});
+describe('handleRpcError', () => {
+    const logger = pino({ level: 'silent' }, sink());
+    const errorLog = vi.spyOn(logger, 'error');
+    it('maps JsonRpcError to HTTP status from toHttpErrorCode and does not log RPC response as error', () => {
+        const err = rpcErrors.invalidParams({ message: 'bad' });
+        const [status, body] = handleRpcError(err, 99, 'whateverMethod');
+        expect(status).toBe(toHttpErrorCode(err.code));
+        expect(status).toBe(400);
+        expect(body).toEqual({
+            jsonrpc: '2.0',
+            id: 99,
+            error: err,
+        });
+        expect(errorLog).not.toHaveBeenCalled();
+    });
+    it('uses generic method-specific message for non-JsonRpcError then replaces with Error.message', () => {
+        const [status, body] = handleRpcError(new Error('some error'), 'id', 'submit');
+        expect(status).toBe(500);
+        expect(body).toEqual({
+            jsonrpc: '2.0',
+            id: 'id',
+            error: expect.objectContaining({
+                code: rpcErrors.internal().code,
+                message: 'some error',
+                data: expect.any(Error),
+            }),
+        });
+    });
+    it('uses generic message when method name is omitted', () => {
+        const [status, body] = handleRpcError(new Error('x'), null);
+        expect(status).toBe(500);
+        expect(errorPayload(body)).toMatchObject({
+            message: 'x',
+        });
+    });
+    it('maps string errors to the error message', () => {
+        const [status, body] = handleRpcError('plain', 0);
+        expect(status).toBe(500);
+        expect(errorPayload(body)).toMatchObject({
+            message: 'plain',
+        });
+    });
+    it('accepts a full ErrorResponse object when safeParse succeeds', () => {
+        const custom = {
+            error: {
+                code: -32000,
+                message: 'from client',
+                data: { hint: 1 },
+            },
+        };
+        const [status, body] = handleRpcError(custom, 3);
+        expect(status).toBe(500);
+        expect(body).toEqual({
+            jsonrpc: '2.0',
+            id: 3,
+            error: custom.error,
+        });
+    });
+    it('maps JsCantonError objects to internal code with cause as message', () => {
+        const ledgerErr = {
+            code: 'CODE',
+            cause: 'something went wrong',
+        };
+        const [status, body] = handleRpcError(ledgerErr, null);
+        expect(status).toBe(500);
+        expect(errorPayload(body)).toMatchObject({
+            code: rpcErrors.internal().code,
+            message: 'something went wrong',
+            data: ledgerErr,
+        });
+    });
+    it('falls back to generic internal error for unknown payloads', () => {
+        const [status, body] = handleRpcError({ foo: 'bar' }, 2, 'wrongMethod');
+        expect(status).toBe(500);
+        expect(errorPayload(body)).toMatchObject({
+            code: rpcErrors.internal().code,
+            message: 'Something went wrong while calling wrongMethod',
+            data: { foo: 'bar' },
+        });
+    });
+});

package/dist/middleware/jwtAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwtAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/jwtAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B,wBAAgB,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkBhE"}
+{"version":3,"file":"jwtAuth.d.ts","sourceRoot":"","sources":["../../src/middleware/jwtAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE7B,wBAAgB,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAuBhE"}

package/dist/middleware/jwtAuth.js

@@ -2,6 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0
 export function jwtAuth(authService, logger) {
     return async (req, res, next) => {
+        // If the request has been verified as an API key, skip JWT verification
+        if (req.authContext?.isApiKey) {
+            return next();
+        }
         // Support both Authorization header and token query parameter (for EventSource)
         const authHeader = req.headers.authorization ||
             (req.query.token ? `Bearer ${req.query.token}` : undefined);

package/dist/middleware/jwtAuth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwtAuth.test.d.ts.map

package/dist/middleware/jwtAuth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtAuth.test.d.ts","sourceRoot":"","sources":["../../src/middleware/jwtAuth.test.ts"],"names":[],"mappings":""}