@meddleware/nft-gate-gateway 0.0.8 → 0.0.10

package/package.json

@@ -1,11 +1,15 @@
- {
+{
   "name": "@meddleware/nft-gate-gateway",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "type": "module",
   "description": "Cloudflare Workers implementation of the nft-gate gateway: a wire-identical, drop-in sibling of the Rust gateway that gates any HTTP upstream behind an access_gate NFT.",
   "license": "0BSD",
   "main": "src/index.ts",
-  "files": ["src", "wrangler.toml", "tsconfig.json"],
+  "files": [
+    "src",
+    "wrangler.toml",
+    "tsconfig.json"
+  ],
   "publishConfig": {
     "access": "public"
   },
@@ -14,6 +18,7 @@
     "test": "vitest run --project unit",
     "test:unit": "vitest run --project unit",
     "test:integration": "vitest run --project cloudflare-integration",
+    "test:grpc": "GRPC_TESTNET=1 vitest run test/integration/grpc-chain.integration.test.ts",
     "test:all": "vitest run",
     "test:watch": "vitest --project unit",
     "dev": "wrangler dev",
@@ -21,17 +26,17 @@
     "generate:vectors": "node scripts/gen-vectors.mjs > ../conformance/vectors.json"
   },
   "dependencies": {
-    "@meddleware/nft-gate-client": "^0.0.6",
+    "@meddleware/nft-gate-client": "^0.0.11",
     "@mysten/sui": "~2.30.0",
     "@noble/curves": "~2.4.0",
     "@noble/hashes": "~2.4.0"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "~0.22.0",
-    "@cloudflare/workers-types": "~5.20260910.1",
-    "typescript": "~7.0.2",
-    "vitest": "~4.1.11",
-    "wrangler": "~4.130.0"
+    "@cloudflare/workers-types": "~5.20260927.1",
+    "typescript": "^6.0.0",
+    "vitest": "~4.1.0",
+    "wrangler": "^4.142.0"
   },
   "overrides": {
     "sharp": "0.35.4"

package/src/config.ts

@@ -19,6 +19,8 @@ export interface Env {
   SINGLE_USE?: string
   PUBLIC_PATHS?: string
   RATE_LIMIT_PER_MIN?: string
+  PUBLIC_RATE_LIMIT_PER_MIN?: string
+  PUBLIC_CACHE_TTL_SECS?: string
   MAX_BODY_BYTES?: string
   CHALLENGE_TTL_SECS?: string
   OWNERSHIP_CACHE_TTL_MS?: string
@@ -47,6 +49,13 @@ export interface Env {
   UPSTREAM_AUTH_HEADERS?: string
   /** `true` enables the scheduled quota guard. */
   QUOTA_GUARD_ENABLED?: string
+  /**
+   * Comma-separated list of browser origins allowed to make cross-origin requests.
+   * Only origins in this list receive an `Access-Control-Allow-Origin` header.
+   * Defaults to the two Meddleware app origins when absent.
+   * Example: `"https://sui-walrus.meddleware.co.uk,https://sui.meddleware.co.uk"`
+   */
+  ALLOWED_ORIGINS?: string
   // ── bindings ──────────────────────────────────────────────────────────────
   NONCE_STATE?: DurableObjectNamespace
   NONCE_KV?: KVNamespace
@@ -73,6 +82,10 @@ export interface Config {
   singleUse: boolean
   publicPaths: string[]
   rateLimitPerMin: number
+  /** Per-client-IP request cap for unauthenticated public paths (e.g. /v1/tip-config). */
+  publicRateLimitPerMin: number
+  /** Edge-cache TTL (s) for cacheable GET responses on public paths. 0 disables caching. */
+  publicCacheTtlSecs: number
   maxBodyBytes: number
   ownershipCacheTtlMs: number
   /** Single-use: lease TTL (s) for an in-flight consume-digest redemption. */
@@ -83,6 +96,8 @@ export interface Config {
   nonceShard: NonceShardMode
   nonceMaxEntries: number
   quotaGuardEnabled: boolean
+  /** Allowed CORS origins — only these are reflected in Access-Control-Allow-Origin. */
+  allowedOrigins: string[]
 }
 
 function req(env: Env, key: keyof Env): string {
@@ -112,6 +127,19 @@ function parseAuthHeader(v: string | undefined): { name: string; value: string }
  * Each entry follows the same `Name: value` format as `SUI_RPC_AUTH_HEADER`.
  * Entries that cannot be parsed (no colon) are silently skipped.
  */
+const DEFAULT_ALLOWED_ORIGINS = [
+  'https://sui-walrus.meddleware.co.uk',
+  'https://sui.meddleware.co.uk',
+]
+
+function parseAllowedOrigins(v: string | undefined): string[] {
+  if (!v || v.trim().length === 0) return DEFAULT_ALLOWED_ORIGINS
+  return v
+    .split(',')
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+}
+
 function parseUpstreamAuthHeaders(v: string | undefined): Array<{ name: string; value: string }> {
   if (!v || v.trim().length === 0) return []
   return v
@@ -141,6 +169,8 @@ export function loadConfig(env: Env): Config {
       .map((s) => s.trim())
       .filter((s) => s.length > 0),
     rateLimitPerMin: numOr(env.RATE_LIMIT_PER_MIN, 30),
+    publicRateLimitPerMin: numOr(env.PUBLIC_RATE_LIMIT_PER_MIN, 120),
+    publicCacheTtlSecs: numOr(env.PUBLIC_CACHE_TTL_SECS, 60),
     maxBodyBytes: numOr(env.MAX_BODY_BYTES, 262144),
     ownershipCacheTtlMs: numOr(env.OWNERSHIP_CACHE_TTL_MS, 0),
     redemptionLeaseTtlSecs: numOr(env.REDEMPTION_LEASE_TTL_SECS, 120),
@@ -149,6 +179,7 @@ export function loadConfig(env: Env): Config {
     nonceShard,
     nonceMaxEntries: numOr(env.NONCE_MAX_ENTRIES, 1000000),
     quotaGuardEnabled: (env.QUOTA_GUARD_ENABLED ?? 'false').toLowerCase() === 'true',
+    allowedOrigins: parseAllowedOrigins(env.ALLOWED_ORIGINS),
   }
 }
 

package/src/cors.ts

@@ -6,10 +6,14 @@
  * Access-Control-Allow-Origin headers the browser blocks the response even when
  * the Worker returns 200, and OPTIONS preflights (required before non-simple requests
  * such as PUT uploads with an Authorization header) receive no preflight grant.
+ *
+ * Origin allowlist: rather than reflecting `*`, only origins present in the configured
+ * ALLOWED_ORIGINS list receive the Access-Control-Allow-Origin header. An absent or
+ * disallowed origin gets no CORS header — the browser blocks the cross-origin request,
+ * which is the correct fail-closed behaviour.
  */
 
-const CORS_HEADERS: Record<string, string> = {
-  'access-control-allow-origin': '*',
+const CORS_STATIC_HEADERS: Record<string, string> = {
   'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS',
   'access-control-allow-headers': 'authorization, content-type, x-access-proof',
   'access-control-expose-headers': 'location, upload-offset',
@@ -17,12 +21,25 @@ const CORS_HEADERS: Record<string, string> = {
 }
 
 /**
- * Clone `res` and add CORS headers. Using `set()` so calling this on an upstream
- * response that already carries CORS headers just overwrites them consistently.
+ * Resolve the reflected `Access-Control-Allow-Origin` value for a request.
+ * Returns the request origin if it appears in `allowedOrigins`, otherwise `null`.
+ */
+export function resolveAllowedOrigin(
+  requestOrigin: string | null,
+  allowedOrigins: string[],
+): string | null {
+  if (!requestOrigin || !allowedOrigins.includes(requestOrigin)) return null
+  return requestOrigin
+}
+
+/**
+ * Clone `res` and add CORS headers. If `allowedOrigin` is non-null, it is reflected
+ * as `Access-Control-Allow-Origin`; otherwise that header is omitted (fail closed).
  */
-export function withCors(res: Response): Response {
+export function withCors(res: Response, allowedOrigin: string | null): Response {
   const out = new Response(res.body, res)
-  for (const [k, v] of Object.entries(CORS_HEADERS)) {
+  if (allowedOrigin) out.headers.set('access-control-allow-origin', allowedOrigin)
+  for (const [k, v] of Object.entries(CORS_STATIC_HEADERS)) {
     out.headers.set(k, v)
   }
   return out
@@ -30,9 +47,8 @@ export function withCors(res: Response): Response {
 
 /**
  * Return a minimal 204 preflight response for OPTIONS requests.
- * The browser requires this before sending non-simple cross-origin requests
- * (e.g. PUT/POST with Authorization or Content-Type).
+ * The Access-Control-Allow-Origin header is added by the outer withCors wrapper.
  */
 export function corsPreflightResponse(): Response {
-  return new Response(null, { status: 204, headers: CORS_HEADERS })
+  return new Response(null, { status: 204, headers: CORS_STATIC_HEADERS })
 }

package/src/index.ts

@@ -15,7 +15,7 @@ import { SuiGrpc } from './chain.js'
 import { verifyAccessRequest, deniedReason } from './verify.js'
 import { forward } from './proxy.js'
 import { runQuotaGuard } from './quota.js'
-import { withCors, corsPreflightResponse } from './cors.js'
+import { withCors, corsPreflightResponse, resolveAllowedOrigin } from './cors.js'
 
 export { NonceRateState } from './state/durable_object.js'
 
@@ -113,6 +113,45 @@ function regionOf(cfg: Config, request: Request): string {
   return continent ? continent.toLowerCase() : 'g'
 }
 
+/**
+ * Forward an UNAUTHENTICATED public path (e.g. `/v1/tip-config`) to the upstream, hardened so it
+ * can't be used to hammer the single relay origin:
+ *   1. Per-client-IP rate limit (keyed on `CF-Connecting-IP`) — a higher ceiling than the gated
+ *      per-address limit since these are cheap GETs, but bounded so a flood is rejected at the edge.
+ *   2. Edge cache of successful GET responses (tip-config is near-static) via the Cache API, so
+ *      repeat/flood reads are served from Cloudflare without reaching the origin at all.
+ * Non-GET public requests are still rate-limited but not cached.
+ */
+async function forwardPublic(
+  cfg: Config,
+  backend: NonceBackend,
+  request: Request,
+  region: string,
+  ctx: ExecutionContext,
+): Promise<Response> {
+  const ip = request.headers.get('CF-Connecting-IP') ?? 'unknown'
+  if (!(await backend.rateCheck(`ip:${ip}`, cfg.publicRateLimitPerMin, region))) {
+    return deny(429, 'rate limit exceeded')
+  }
+
+  if (request.method !== 'GET' || cfg.publicCacheTtlSecs <= 0) return forward(cfg, request)
+
+  // Cache key is the URL alone (public GET, no auth/cookies to vary on).
+  const cache = (caches as unknown as { default: Cache }).default
+  const cacheKey = new Request(new URL(request.url).toString(), { method: 'GET' })
+  const hit = await cache.match(cacheKey)
+  if (hit) return hit
+
+  const resp = await forward(cfg, request)
+  if (resp.ok) {
+    const cached = new Response(resp.body, resp)
+    cached.headers.set('Cache-Control', `public, max-age=${cfg.publicCacheTtlSecs}`)
+    ctx.waitUntil(cache.put(cacheKey, cached.clone()))
+    return cached
+  }
+  return resp
+}
+
 /**
  * Main request dispatcher. Handles `/healthz`, `/v1/challenge`, configured public paths,
  * and gated paths (signature + ownership verification before proxying to the upstream).
@@ -121,7 +160,7 @@ function regionOf(cfg: Config, request: Request): string {
  * @param env - The Worker environment bindings.
  * @returns A `Response` to send to the client.
  */
-async function handle(request: Request, env: Env): Promise<Response> {
+async function handle(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
   const url = new URL(request.url)
   const path = url.pathname
 
@@ -146,8 +185,11 @@ async function handle(request: Request, env: Env): Promise<Response> {
     return json(200, { nonce, expiresAt })
   }
 
-  // Public passthrough (e.g. /v1/tip-config): forward without auth.
-  if (isPublicPath(cfg, path)) return forward(cfg, request)
+  // Public passthrough (e.g. /v1/tip-config): forward without auth, but protect the single relay
+  // origin — these bypass the NFT gate. Per-client-IP rate limit + edge-cache of GET responses.
+  if (isPublicPath(cfg, path)) {
+    return forwardPublic(cfg, backend, request, regionOf(cfg, request), ctx)
+  }
 
   const token = extractProofToken(request)
   if (!token) return deny(401, 'missing access proof')
@@ -198,8 +240,13 @@ async function handle(request: Request, env: Env): Promise<Response> {
  * {@link handle}; the `scheduled` handler runs the optional quota guard on a cron trigger.
  */
 export default {
-  fetch(request: Request, env: Env): Promise<Response> {
-    return handle(request, env).then(withCors)
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    const origin = request.headers.get('origin')
+    const res = await handle(request, env, ctx)
+    // State is cached after handle() completes; a second call is free.
+    const state = await getState(env).catch(() => null)
+    const allowedOrigin = resolveAllowedOrigin(origin, state?.cfg.allowedOrigins ?? [])
+    return withCors(res, allowedOrigin)
   },
   async scheduled(_controller: ScheduledController, env: Env): Promise<void> {
     if ((env.QUOTA_GUARD_ENABLED ?? 'false').toLowerCase() === 'true') {

package/src/state/types.ts

@@ -59,7 +59,9 @@ export function shardOfNonce(nonce: string): string {
 
 /**
  * Generate a cryptographically random 48-character hex string (24 bytes of entropy). Matches
- * the Rust gateway's `random_nonce()` entropy so conformance vectors apply to both.
+ * the Rust gateway's `random_nonce()` entropy so conformance vectors apply to both. Nonces are
+ * **ASCII by contract** — this hex plus an ASCII `<region>.` prefix — and the client's
+ * `decodeAccessProof` enforces ASCII, so the proof-token base64 never carries non-ASCII bytes.
  *
  * @returns A 48-character lowercase hex string.
  */

package/src/verify.ts

@@ -190,6 +190,14 @@ export async function verifyAccessRequest(
     return { ok: false, denied: 'BadSignature' }
   }
 
+  // Canonicalise the address once the signature is proven, then use ONLY the normalised form for
+  // on-chain comparisons and the returned value. The client emits the raw caller address; on-chain
+  // owners are canonical (lower-case, 0x-prefixed, 64-hex), so comparing the raw string would
+  // fail-closed for a non-canonical input (e.g. missing leading zeros). Owning canonicalisation
+  // here — the security boundary — keeps the client wire format unchanged. (See conformance
+  // vectors `addressNormalization`; matched by the Rust gateway.)
+  const address = normalizeAddress(proof.address)
+
   // Consume the nonce exactly once (fresh, unexpired, unused) — before the chain call.
   if (!(await store.takeIfValid(proof.nonce))) {
     return { ok: false, denied: 'NonceInvalid' }
@@ -201,25 +209,25 @@ export async function verifyAccessRequest(
     }
     let ok: boolean
     try {
-      ok = await chain.consumeTxValid(proof.consumeDigest, proof.address, cfg.gateId)
+      ok = await chain.consumeTxValid(proof.consumeDigest, address, cfg.gateId)
     } catch {
       return { ok: false, denied: 'ChainError' }
     }
     if (!ok) return { ok: false, denied: 'ConsumeMissing' }
     // The consume is valid on-chain; the dispatcher leases/commits this digest so the use is
     // spent only on a successful upload (and a duplicate can't double-spend it).
-    return { ok: true, address: proof.address, redemptionKey: proof.consumeDigest }
+    return { ok: true, address, redemptionKey: proof.consumeDigest }
   }
 
   let ok: boolean
   try {
-    ok = await chain.ownsNft(proof.address, cfg.nftType, cfg.gateId)
+    ok = await chain.ownsNft(address, cfg.nftType, cfg.gateId)
   } catch {
     return { ok: false, denied: 'ChainError' }
   }
   if (!ok) return { ok: false, denied: 'NotOwner' }
 
-  return { ok: true, address: proof.address }
+  return { ok: true, address }
 }
 
 export { FLAG_ED25519, FLAG_SECP256K1, FLAG_SECP256R1, FLAG_MULTISIG, FLAG_ZKLOGIN }

package/wrangler.toml

@@ -49,6 +49,10 @@ GATE_ID = "0x0485c1fa80e4c355c85ab99c0281a328d8fb5c60ac50ab64f10be0f8be792aba"
 SINGLE_USE = "true"
 PUBLIC_PATHS = "/v1/tip-config"
 RATE_LIMIT_PER_MIN = "30"
+# Unauthenticated public paths (/v1/tip-config) are protected separately: a higher per-client-IP
+# request ceiling (cheap GETs) plus an edge cache so floods are absorbed before reaching the relay.
+PUBLIC_RATE_LIMIT_PER_MIN = "120"
+PUBLIC_CACHE_TTL_SECS = "60"
 MAX_BODY_BYTES = "104857600"
 CHALLENGE_TTL_SECS = "300"
 OWNERSHIP_CACHE_TTL_MS = "0"
@@ -64,6 +68,9 @@ NONCE_BACKEND = "durable-object" # "durable-object" (default) | "kv"
 NONCE_SHARD = "region"           # "region" (default) | "global"
 NONCE_MAX_ENTRIES = "1000000"
 QUOTA_GUARD_ENABLED = "false"
+# Comma-separated list of browser origins allowed to make cross-origin requests.
+# Only these origins receive Access-Control-Allow-Origin in responses.
+ALLOWED_ORIGINS = "https://sui-walrus.meddleware.co.uk,https://dash.meddleware.co.uk"
 
 # ── nonce store + rate limiter: region-sharded, SQLite-backed Durable Objects (free-tier) ────
 [[durable_objects.bindings]]