@meddleware/nft-gate-gateway 0.0.10 → 0.0.11

package/README.md

@@ -143,9 +143,9 @@ Then set `NONCE_BACKEND = "kv"` in `[vars]`.
 | Var | Required | Default | Notes |
 | --- | --- | --- | --- |
 | `UPSTREAM_URL` | ✓ | — | Base URL of the protected upstream (set via `wrangler secret put`) |
-| `SUI_RPC_URL` | ✓ | `https://fullnode.testnet.sui.io:443` | Sui JSON-RPC endpoint; change to mainnet for production |
-| `NFT_TYPE` | ✓ | — | `<pkg>::access_gate::AccessNFT` or `SoulboundAccessNFT` (set via `wrangler secret put`) |
-| `GATE_ID` | | — | Restrict ownership checks to a specific gate registry object |
+| `SUI_RPC_URL` | ✓ | `https://fullnode.testnet.sui.io:443` | Sui fullnode (queried over gRPC-web); change to mainnet for production |
+| `NFT_TYPE` | ✓ | — | `<pkg>::access_gate::AccessNFT` or `SoulboundAccessNFT` (set via `wrangler secret put`); any other type — e.g. a fungible `Coin<T>` — is rejected at startup |
+| `GATE_ID` | ✓ | — | The gate whose passes are accepted; also read live so a paused gate with `pause_blocks_access` denies holders (`403 the gate is paused`) |
 | `SINGLE_USE` | | `false` | Require an on-chain `AccessConsumedEvent` bound to the nonce |
 | `PUBLIC_PATHS` | | `/v1/tip-config` | Comma-separated paths served without authentication |
 | `RATE_LIMIT_PER_MIN` | | `30` | Requests per verified address per 60s window (`0` disables) |
@@ -199,7 +199,7 @@ wrangler secret put CF_ACCOUNT_ID        # your Cloudflare account ID
 | `src/config.ts` | `config.rs` | `env` → typed config (same var names as Rust) |
 | `src/wire.ts` | `proof.rs` | Proof helpers reused from `@meddleware/nft-gate-client` |
 | `src/verify.ts` | `verify.rs` | Signature verification + allow/deny decision |
-| `src/chain.ts` | `sui_rpc.rs` | Sui JSON-RPC ownership and consume-event queries |
+| `src/chain.ts` | `sui_rpc.rs` | Sui gRPC ownership and consume-event queries |
 | `src/proxy.ts` | `proxy.rs` | Body-capped reverse proxy; strips `Host`/`Authorization` |
 | `src/state/` | `challenge.rs` + `ratelimit.rs` | Pluggable nonce store and rate limiter |
 | `src/quota.ts` | — | Optional free-tier quota guard (scheduled cron) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/nft-gate-gateway",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "type": "module",
   "description": "Cloudflare Workers implementation of the nft-gate gateway: a wire-identical, drop-in sibling of the Rust gateway that gates any HTTP upstream behind an access_gate NFT.",
   "license": "0BSD",
@@ -26,8 +26,8 @@
     "generate:vectors": "node scripts/gen-vectors.mjs > ../conformance/vectors.json"
   },
   "dependencies": {
-    "@meddleware/nft-gate-client": "^0.0.11",
-    "@mysten/sui": "~2.30.0",
+    "@meddleware/nft-gate-client": "^0.0.12",
+    "@mysten/sui": "~2.33.0",
     "@noble/curves": "~2.4.0",
     "@noble/hashes": "~2.4.0"
   },
@@ -36,7 +36,7 @@
     "@cloudflare/workers-types": "~5.20260927.1",
     "typescript": "^6.0.0",
     "vitest": "~4.1.0",
-    "wrangler": "^4.142.0"
+    "wrangler": "^4.143.0"
   },
   "overrides": {
     "sharp": "0.35.4"

package/src/chain.ts

@@ -124,6 +124,18 @@ export class SuiGrpc implements ChainQuery {
     return this.ownsNftLive(address, nftType, gateId)
   }
 
+  /**
+   * Live read of the gate: blocked while paused if its policy has `pause_blocks_access`. Not
+   * cached — pausing takes effect on the next request.
+   *
+   * @param gateId - The `Gate` shared object ID.
+   * @throws If the gate cannot be read (surfaces as ChainError → 502; fail closed).
+   */
+  async gateAccessBlocked(gateId: string): Promise<boolean> {
+    const { object } = await this.client.core.getObject({ objectId: gateId, include: { json: true } })
+    return gateBlocksAccess(object.json)
+  }
+
   /**
    * Fetch a transaction by digest via gRPC, retrying briefly to absorb the window between the
    * client's finality wait and the gateway fullnode indexing the transaction.
@@ -226,6 +238,15 @@ function eventFields(ev: Json): Json {
 }
 
 /** True if the event's type ends with `::access_gate::AccessConsumedEvent`. */
+/**
+ * True if a `Gate` object's JSON (gRPC core shape: fields flat) is paused and its policy has
+ * `pause_blocks_access`. Gates without a `policy` (pre-policy package versions) never block.
+ */
+export function gateBlocksAccess(gateJson: Json): boolean {
+  const g = gateJson as { paused?: unknown; policy?: { pause_blocks_access?: unknown } } | null
+  return Boolean(g && g.paused === true && g.policy && g.policy.pause_blocks_access === true)
+}
+
 export function isConsumedEvent(ev: Json): boolean {
   const t = eventType(ev)
   return t !== undefined && t.endsWith('::access_gate::AccessConsumedEvent')

package/src/config.ts

@@ -77,7 +77,8 @@ export interface Config {
   /** Headers injected into every upstream relay request (e.g. CF Access service token). */
   upstreamAuthHeaders: Array<{ name: string; value: string }>
   nftType: string
-  gateId?: string
+  /** The access_gate `Gate` whose passes are accepted (required). */
+  gateId: string
   challengeTtlSecs: number
   singleUse: boolean
   publicPaths: string[]
@@ -148,8 +149,24 @@ function parseUpstreamAuthHeaders(v: string | undefined): Array<{ name: string;
     .filter((h): h is { name: string; value: string } => h !== undefined)
 }
 
-/** Build the typed config from `env`. Throws if a required var is missing (fail fast). */
+/**
+ * `NFT_TYPE` must be an access_gate pass type: `<pkg>::access_gate::AccessNFT` or
+ * `…::SoulboundAccessNFT`. Anything else (a fungible `Coin<T>`, an arbitrary NFT) would gate on
+ * mere ownership of an object that access_gate never sold, so it is rejected at startup.
+ */
+const NFT_TYPE_RE = /^0x[0-9a-fA-F]{1,64}::access_gate::(?:AccessNFT|SoulboundAccessNFT)$/
+/** A Sui object ID. */
+const OBJECT_ID_RE = /^0x[0-9a-fA-F]{1,64}$/
+
+/** Build the typed config from `env`. Throws if a required var is missing or invalid (fail fast). */
 export function loadConfig(env: Env): Config {
+  const nftType = req(env, 'NFT_TYPE').trim()
+  if (!NFT_TYPE_RE.test(nftType)) {
+    throw new Error('NFT_TYPE must be <pkg>::access_gate::AccessNFT or <pkg>::access_gate::SoulboundAccessNFT')
+  }
+  const gateId = req(env, 'GATE_ID').trim()
+  if (!OBJECT_ID_RE.test(gateId)) throw new Error('GATE_ID must be a 0x-prefixed object ID')
+
   const backendRaw = (env.NONCE_BACKEND ?? 'durable-object').toLowerCase()
   const nonceBackend: NonceBackendKind = backendRaw === 'kv' ? 'kv' : 'durable-object'
   const shardRaw = (env.NONCE_SHARD ?? 'region').toLowerCase()
@@ -160,8 +177,8 @@ export function loadConfig(env: Env): Config {
     suiRpcUrl: req(env, 'SUI_RPC_URL'),
     suiRpcAuthHeader: parseAuthHeader(env.SUI_RPC_AUTH_HEADER),
     upstreamAuthHeaders: parseUpstreamAuthHeaders(env.UPSTREAM_AUTH_HEADERS),
-    nftType: req(env, 'NFT_TYPE'),
-    gateId: env.GATE_ID && env.GATE_ID.length > 0 ? env.GATE_ID : undefined,
+    nftType,
+    gateId,
     challengeTtlSecs: numOr(env.CHALLENGE_TTL_SECS, 300),
     singleUse: (env.SINGLE_USE ?? 'false').toLowerCase() === 'true',
     publicPaths: (env.PUBLIC_PATHS ?? '/v1/tip-config')

package/src/verify.ts

@@ -126,6 +126,12 @@ export interface ChainQuery {
    * — single-use is enforced by the redemption store keying on the digest.
    */
   consumeTxValid(consumeDigest: string, address: string, gateId?: string): Promise<boolean>
+  /**
+   * True if `gateId` is paused AND its immutable `GatePolicy` has `pause_blocks_access` — holders
+   * must then be denied until the gate is unpaused. False for gates without that policy flag
+   * (including gates of package versions that predate policies).
+   */
+  gateAccessBlocked(gateId: string): Promise<boolean>
 }
 
 /** The reason a request was rejected by {@link verifyAccessRequest}. Mirror of Rust `Denied`. */
@@ -136,6 +142,7 @@ export type Denied =
   | 'NotOwner'
   | 'ConsumeMissing'
   | 'RedeemConflict'
+  | 'GatePaused'
   | 'ChainError'
 
 /** A short, client-visible description of why access was denied. */
@@ -153,6 +160,8 @@ export function deniedReason(d: Denied): string {
       return 'no matching single-use consume for this address'
     case 'RedeemConflict':
       return 'this consume is already redeemed or an upload for it is in progress'
+    case 'GatePaused':
+      return 'the gate is paused'
     case 'ChainError':
       return 'on-chain verification failed'
   }
@@ -203,6 +212,16 @@ export async function verifyAccessRequest(
     return { ok: false, denied: 'NonceInvalid' }
   }
 
+  // A gate whose policy has `pause_blocks_access` admits no one while paused. Checked before the
+  // single-use lease, so a consume made just before a pause stays redeemable after unpausing.
+  let blocked: boolean
+  try {
+    blocked = await chain.gateAccessBlocked(cfg.gateId)
+  } catch {
+    return { ok: false, denied: 'ChainError' }
+  }
+  if (blocked) return { ok: false, denied: 'GatePaused' }
+
   if (cfg.singleUse) {
     if (proof.consumeDigest === undefined) {
       return { ok: false, denied: 'ConsumeMissing' }

package/wrangler.toml

@@ -45,6 +45,11 @@ compatibility_flags = ["nodejs_compat"]
 # Public fullnode — safe to keep as a plain var (no sensitive information).
 SUI_RPC_URL = "https://fullnode.testnet.sui.io:443"
 
+# Required: the gate whose passes are accepted. This is the live testnet relay gate on the
+# pre-policy access_gate 0x0bedd0…; switch to the policy-aware gate
+# 0xcb8206cab55902247daba61bad3d6c92f072425fe4034a98d6a22400d25a5f50 (package 0x1a81ca…, with
+# NFT_TYPE = 0x1a81ca…::access_gate::SoulboundAccessNFT) together with the walrus-ui release that
+# targets the new package — never one without the other.
 GATE_ID = "0x0485c1fa80e4c355c85ab99c0281a328d8fb5c60ac50ab64f10be0f8be792aba"
 SINGLE_USE = "true"
 PUBLIC_PATHS = "/v1/tip-config"