mppx 0.6.28 → 0.6.29

package/src/tempo/server/Charge.test.ts

@@ -3654,6 +3654,75 @@ describe('tempo', () => {
       })
       expect(challenge.request.methodDetails?.supportedModes).toEqual(['pull'])
     })
+
+    test('challenge contains supportedModes from method defaults', async () => {
+      const handler = Mppx_server.create({
+        methods: [
+          tempo_server.charge({
+            getClient: () => client,
+            account: accounts[0].address,
+            currency: asset,
+            supportedModes: ['pull'],
+          }),
+        ],
+        realm,
+        secretKey,
+      })
+
+      const result = await handler.charge({ amount: '1' })(new Request('https://example.com'))
+      expect(result.status).toBe(402)
+      if (result.status !== 402) throw new Error()
+
+      const challenge = Challenge.fromResponse(result.challenge, {
+        methods: [tempo_client.charge()],
+      })
+      expect(challenge.request.methodDetails?.supportedModes).toEqual(['pull'])
+    })
+
+    test('stable binding contains supportedModes', () => {
+      const method = tempo_server.charge({
+        getClient: () => client,
+        account: accounts[0].address,
+        currency: asset,
+      })
+      const request = method.schema.request.parse({
+        amount: '1',
+        currency: asset,
+        decimals: 6,
+        supportedModes: ['pull'],
+      })
+
+      expect(method.stableBinding?.(request)).toMatchObject({
+        supportedModes: ['pull'],
+      })
+    })
+
+    test('challenge contains splits from method defaults', async () => {
+      const split = { amount: '0.2', recipient: accounts[2].address }
+      const handler = Mppx_server.create({
+        methods: [
+          tempo_server.charge({
+            getClient: () => client,
+            account: accounts[0].address,
+            currency: asset,
+            splits: [split],
+          }),
+        ],
+        realm,
+        secretKey,
+      })
+
+      const result = await handler.charge({ amount: '1' })(new Request('https://example.com'))
+      expect(result.status).toBe(402)
+      if (result.status !== 402) throw new Error()
+
+      const challenge = Challenge.fromResponse(result.challenge, {
+        methods: [tempo_client.charge()],
+      })
+      expect(challenge.request.methodDetails?.splits).toEqual([
+        { amount: '200000', recipient: split.recipient },
+      ])
+    })
   })
 
   describe('attribution memo', () => {

package/src/tempo/server/Charge.ts

@@ -63,6 +63,8 @@ export function charge<const parameters extends charge.Parameters>(
     feePayerPolicy,
     html,
     memo,
+    splits,
+    supportedModes,
     validateSender,
     waitForConfirmation = true,
   } = parameters
@@ -96,8 +98,12 @@ export function charge<const parameters extends charge.Parameters>(
       externalId,
       memo,
       recipient,
+      splits,
+      supportedModes,
     } as unknown as Defaults,
 
+    stableBinding: chargeBinding,
+
     html: html
       ? {
           config: {},
@@ -579,6 +585,32 @@ export declare namespace charge {
   type FeePayerPolicy = Partial<FeePayer.Policy>
 }
 
+type ChargeRequest = z.output<typeof Methods.charge.schema.request>
+
+function chargeBinding(request: ChargeRequest) {
+  // Exhaustively destructure so new charge request fields require an explicit binding decision.
+  const { amount, currency, description, externalId, methodDetails, recipient, ...requestRest } =
+    request
+  requestRest satisfies Record<string, never>
+
+  const { chainId, feePayer, memo, splits, supportedModes, ...methodDetailsRest } =
+    methodDetails ?? {}
+  methodDetailsRest satisfies Record<string, never>
+  void feePayer
+
+  return {
+    amount,
+    chainId,
+    currency,
+    description,
+    externalId,
+    memo,
+    recipient,
+    splits,
+    supportedModes,
+  }
+}
+
 type ExpectedTransfer = {
   amount: string
   allowAnyMemo?: boolean | undefined

package/src/tempo/server/Session.test.ts

@@ -668,6 +668,36 @@ describe.runIf(isLocalnet)('session', () => {
       expect(ch!.highestVoucherAmount).toBe(2000000n)
     })
 
+    test('rejects voucher signed for route escrow instead of stored channel escrow', async () => {
+      const { channelId, serializedTransaction } = await createSignedOpenTransaction(10000000n)
+      const server = createServer()
+      await openServerChannel(server, channelId, serializedTransaction)
+
+      const routeEscrow = '0x0000000000000000000000000000000000000999' as Address
+      const signature = await signVoucher(
+        client,
+        payer,
+        { channelId, cumulativeAmount: 2000000n },
+        routeEscrow,
+        chain.id,
+      )
+
+      await expect(
+        server.verify({
+          credential: {
+            challenge: makeChallenge({ id: 'route-escrow-replay', channelId }),
+            payload: {
+              action: 'voucher' as const,
+              channelId,
+              cumulativeAmount: '2000000',
+              signature,
+            },
+          },
+          request: makeRequest({ escrowContract: routeEscrow }),
+        }),
+      ).rejects.toThrow(InvalidSignatureError)
+    })
+
     test('rejects non-increasing voucher replay', async () => {
       const { channelId, serializedTransaction } = await createSignedOpenTransaction(10000000n)
       const server = createServer()

package/src/tempo/server/Session.ts

@@ -141,7 +141,7 @@ export function session<const parameters extends session.Parameters>(
       unitType,
     } as unknown as Defaults,
 
-    transport: transport as never,
+    transport,
 
     // TODO: dedupe `{charge,session}.request`
     async request({ credential, request }) {
@@ -226,6 +226,7 @@ export function session<const parameters extends session.Parameters>(
             payload,
             methodDetails,
             resolvedFeePayer,
+            methodDetails.feePayer === true,
             feePayerPolicy,
             waitForConfirmation,
           )
@@ -240,6 +241,7 @@ export function session<const parameters extends session.Parameters>(
             payload,
             methodDetails,
             resolvedFeePayer,
+            methodDetails.feePayer === true,
             feePayerPolicy,
           )
           lastOnChainVerified.set(sessionReceipt.channelId, Date.now())
@@ -530,10 +532,8 @@ async function verifyAndAcceptVoucher(parameters: {
   channelId: Hex
   voucher: SignedVoucher
   onChain: OnChainChannel
-  methodDetails: SessionMethodDetails
 }): Promise<SessionReceipt> {
-  const { store, minVoucherDelta, challenge, channel, channelId, voucher, onChain, methodDetails } =
-    parameters
+  const { store, minVoucherDelta, challenge, channel, channelId, voucher, onChain } = parameters
 
   if (onChain.finalized) {
     throw new ChannelClosedError({ reason: 'channel is finalized on-chain' })
@@ -568,8 +568,8 @@ async function verifyAndAcceptVoucher(parameters: {
   }
 
   const isValid = await verifyVoucher(
-    methodDetails.escrowContract,
-    methodDetails.chainId,
+    channel.escrowContract,
+    channel.chainId,
     voucher,
     channel.authorizedSigner,
   )
@@ -635,6 +635,7 @@ async function handleOpen(
   payload: SessionCredentialPayload & { action: 'open' },
   methodDetails: SessionMethodDetails,
   feePayer: viem_Account | undefined,
+  isSponsored: boolean,
   feePayerPolicy: session.FeePayerPolicy | undefined,
   waitForConfirmation: boolean,
 ): Promise<SessionReceipt> {
@@ -687,6 +688,7 @@ async function handleOpen(
     challengeExpires: challenge.expires,
     feePayerPolicy,
     feePayer,
+    isSponsored,
     beforeBroadcast: async (pendingOnChain) => {
       await validateOpenVoucher(pendingOnChain)
     },
@@ -772,6 +774,7 @@ async function handleTopUp(
   payload: SessionCredentialPayload & { action: 'topUp' },
   methodDetails: SessionMethodDetails,
   feePayer: viem_Account | undefined,
+  isSponsored: boolean,
   feePayerPolicy: session.FeePayerPolicy | undefined,
 ): Promise<SessionReceipt> {
   const channelId = ChannelStore.normalizeChannelId(payload.channelId)
@@ -793,6 +796,7 @@ async function handleTopUp(
     challengeExpires: challenge.expires,
     feePayerPolicy,
     feePayer,
+    isSponsored,
   })
 
   const updated = await store.updateChannel(channelId, (current) => {
@@ -848,11 +852,7 @@ async function handleVoucher(
 
   const onChain = await (async () => {
     if (isStale) {
-      const onChainChannel = await getOnChainChannel(
-        client,
-        methodDetails.escrowContract,
-        channelId,
-      )
+      const onChainChannel = await getOnChainChannel(client, channel.escrowContract, channelId)
       lastOnChainVerified.set(channelId, Date.now())
       // Persist closeRequestedAt so the cached path detects force-close
       // between re-queries.
@@ -883,7 +883,6 @@ async function handleVoucher(
     channelId,
     voucher,
     onChain,
-    methodDetails,
   })
 }
 
@@ -910,7 +909,7 @@ async function handleClose(
 
   const voucher = parseVoucherFromPayload(channelId, payload.cumulativeAmount, payload.signature)
 
-  const onChain = await getOnChainChannel(client, methodDetails.escrowContract, channelId)
+  const onChain = await getOnChainChannel(client, channel.escrowContract, channelId)
 
   if (onChain.finalized) {
     throw new ChannelClosedError({ reason: 'channel is finalized on-chain' })
@@ -936,8 +935,8 @@ async function handleClose(
   }
 
   const isValid = await verifyVoucher(
-    methodDetails.escrowContract,
-    methodDetails.chainId,
+    channel.escrowContract,
+    channel.chainId,
     voucher,
     channel.authorizedSigner,
   )
@@ -972,7 +971,7 @@ async function handleClose(
       sender: account?.address ?? client.account?.address,
     })
 
-    txHash = await closeOnChain(client, methodDetails.escrowContract, voucher, {
+    txHash = await closeOnChain(client, channel.escrowContract, voucher, {
       ...(feePayer && account ? { feePayer, account } : { account }),
       candidateFeeTokens: [channel.token],
     })