mppx 0.8.13 → 0.8.15

package/src/tempo/session/client/Session.test.ts

@@ -1,20 +1,22 @@
 import { type Address, createClient, custom, decodeFunctionData, encodeFunctionResult } from 'viem'
 import { privateKeyToAccount } from 'viem/accounts'
 import { Account as TempoAccount, Secp256k1, Transaction } from 'viem/tempo'
-import { describe, expect, test } from 'vp/test'
+import { describe, expect, test, vi } from 'vp/test'
 
 import { serialize as serializeChallenge, type Challenge } from '../../../Challenge.js'
 import * as Fetch from '../../../client/internal/Fetch.js'
+import * as MethodChallenge from '../../../client/internal/MethodChallenge.js'
 import * as Constants from '../../../Constants.js'
 import * as Credential from '../../../Credential.js'
 import * as z from '../../../zod.js'
+import * as AutoSwap from '../../internal/auto-swap.js'
 import * as Methods from '../../Methods.js'
 import * as Channel from '../precompile/Channel.js'
 import { escrowAbi } from '../precompile/escrow.abi.js'
 import { tip20ChannelEscrow } from '../precompile/Protocol.js'
 import * as Types from '../precompile/Protocol.js'
 import * as Voucher from '../precompile/Voucher.js'
-import { createChannelStore } from './ChannelStore.js'
+import { channelKey, createChannelStore } from './ChannelStore.js'
 import { session } from './Session.js'
 
 const account = privateKeyToAccount(
@@ -58,6 +60,13 @@ type SessionChallenge = Challenge<
   typeof Methods.session.name
 >
 
+const defaultChannelKey = channelKey({
+  chainId,
+  escrow: tip20ChannelEscrow,
+  payee: descriptor.payee,
+  token: descriptor.token,
+})
+
 function makeChallenge(overrides: Partial<SessionChallenge['request']> = {}): SessionChallenge {
   const request: SessionChallenge['request'] = {
     amount: '100',
@@ -76,6 +85,83 @@ function makeChallenge(overrides: Partial<SessionChallenge['request']> = {}): Se
   }
 }
 
+function makeSessionChallenge(
+  overrides: Partial<SessionChallenge['request']> = {},
+): SessionChallenge {
+  return makeChallenge({
+    ...overrides,
+    methodDetails: {
+      chainId,
+      escrowContract: tip20ChannelEscrow,
+      sessionProtocol: Constants.SessionProtocols.v2,
+      ...overrides.methodDetails,
+    },
+  })
+}
+
+function paymentRequired(challenge: SessionChallenge, headers?: HeadersInit): Response {
+  const responseHeaders = new Headers(headers)
+  responseHeaders.set(Constants.Headers.wwwAuthenticate, serializeChallenge(challenge))
+  return new Response(null, {
+    headers: responseHeaders,
+    status: 402,
+  })
+}
+
+function withSnapshot(
+  payload: Types.SessionCredentialPayload,
+  acceptedCumulative?: string,
+): SessionChallenge {
+  if (payload.action !== 'open') throw new Error('expected open credential')
+  return {
+    ...makeSessionChallenge({
+      methodDetails: {
+        chainId,
+        escrowContract: tip20ChannelEscrow,
+        sessionProtocol: Constants.SessionProtocols.v2,
+        sessionSnapshot: {
+          acceptedCumulative: acceptedCumulative ?? payload.cumulativeAmount,
+          chainId,
+          channelId: payload.channelId,
+          deposit: '1000',
+          descriptor: payload.descriptor,
+          escrow: tip20ChannelEscrow,
+          requiredCumulative: '200',
+          settled: '0',
+          spent: payload.cumulativeAmount,
+        },
+      },
+    }),
+    id: 'replacement-id',
+  }
+}
+
+function makeSessionMethod(
+  channelStore = createChannelStore(),
+  parameters: Partial<session.Parameters> = {},
+) {
+  return session({
+    account,
+    channelStore,
+    decimals: 0,
+    getClient: () => client,
+    maxDeposit: '1000',
+    ...parameters,
+  })
+}
+
+function makeSessionFetch(
+  fetch: typeof globalThis.fetch,
+  channelStore = createChannelStore(),
+  maxPaymentRetries?: number,
+) {
+  return Fetch.from({
+    fetch,
+    maxPaymentRetries,
+    methods: [makeSessionMethod(channelStore)],
+  })
+}
+
 function deserialize(credential: string) {
   return Credential.deserialize(credential).payload as Types.SessionCredentialPayload
 }
@@ -99,6 +185,14 @@ function openDeposit(payload: Types.SessionCredentialPayload): bigint {
   return openArgs(payload)[3]
 }
 
+function transactionCalls(payload: Types.SessionCredentialPayload) {
+  if (payload.action !== 'open' && payload.action !== 'topUp')
+    throw new Error('expected transaction payload')
+  const transaction = Transaction.deserialize(payload.transaction)
+  if (!('calls' in transaction)) throw new Error('expected tempo calls')
+  return transaction.calls as readonly { to?: Address; data?: `0x${string}` }[]
+}
+
 describe('precompile client session', () => {
   test('handles only TIP-1034 session challenges', () => {
     const method = session({ account, getClient: () => client })
@@ -205,7 +299,341 @@ describe('precompile client session', () => {
     expect(await response.text()).toBe(
       `${Types.formatMessageEvent('first')}${Types.formatMessageEvent('second')}`,
     )
-    expect(actions).toEqual(['open', 'voucher', 'topUp', 'voucher'])
+    expect(actions).toEqual(['open', 'topUp', 'voucher', 'voucher'])
+  })
+
+  test('tops up before signing plain HTTP vouchers through Fetch.from', async () => {
+    const challenge = makeChallenge({
+      suggestedDeposit: '100',
+      methodDetails: {
+        chainId,
+        escrowContract: tip20ChannelEscrow,
+        sessionProtocol: Constants.SessionProtocols.v2,
+      },
+    })
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    const paidRequests: {
+      body: BodyInit | null
+      header: string | null
+      method: string | undefined
+    }[] = []
+    const vouchers: string[] = []
+    let opened: Extract<Types.SessionCredentialPayload, { action: 'open' }> | undefined
+    const paymentRequired = () =>
+      new Response(null, {
+        status: 402,
+        headers: { [Constants.Headers.wwwAuthenticate]: serializeChallenge(challenge) },
+      })
+    const rawFetch: typeof globalThis.fetch = async (_input, init) => {
+      const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+      if (!authorization) return paymentRequired()
+
+      const payload = deserialize(authorization)
+      actions.push(payload.action)
+      if (payload.action === 'open') {
+        opened = payload
+        return new Response('opened')
+      }
+      if (payload.action === 'topUp') return new Response(null, { status: 204 })
+      if (payload.action !== 'voucher' || !opened) throw new Error('expected open voucher')
+      vouchers.push(authorization)
+      if (vouchers.length === 1) return paymentRequired()
+
+      paidRequests.push({
+        body: init?.body ?? null,
+        header: new Headers(init?.headers).get('x-test'),
+        method: init?.method,
+      })
+      return new Response('paid')
+    }
+    const fetch = Fetch.from({
+      fetch: rawFetch,
+      methods: [
+        session({
+          account,
+          decimals: 0,
+          getClient: () => client,
+          maxDeposit: '300',
+        }),
+      ],
+    })
+
+    expect(await (await fetch('https://example.com/resource')).text()).toBe('opened')
+    const response = await fetch('https://example.com/resource', {
+      body: 'request-body',
+      headers: { 'x-test': 'preserved' },
+      method: 'POST',
+    })
+
+    expect(await response.text()).toBe('paid')
+    expect(actions).toEqual(['open', 'topUp', 'voucher', 'voucher'])
+    expect(new Set(vouchers).size).toBe(1)
+    expect(paidRequests).toEqual([{ body: 'request-body', header: 'preserved', method: 'POST' }])
+  })
+
+  test('retries an open rejected by a replacement challenge', async () => {
+    const challenge = makeSessionChallenge({ suggestedDeposit: '1000' })
+    const replacement = { ...challenge, id: 'replacement-id' }
+    const channelStore = createChannelStore()
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    let paidRequests = 0
+    const fetch = makeSessionFetch(async (_input, init) => {
+      const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+      if (!authorization) return paymentRequired(challenge)
+      actions.push(deserialize(authorization).action)
+      if (++paidRequests === 1) return paymentRequired(replacement)
+      return new Response('rejected', { status: 500 })
+    }, channelStore)
+
+    expect((await fetch('https://example.com/resource')).status).toBe(500)
+    expect(actions).toEqual(['open', 'open'])
+    expect(await channelStore.get(defaultChannelKey)).toBeUndefined()
+  })
+
+  test('retries an open after the paid request throws', async () => {
+    const challenge = makeSessionChallenge({ suggestedDeposit: '1000' })
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    const fetch = makeSessionFetch(async (_input, init) => {
+      const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+      if (!authorization) return paymentRequired(challenge)
+      actions.push(deserialize(authorization).action)
+      throw new Error('paid request failed')
+    })
+
+    await expect(fetch('https://example.com/resource')).rejects.toThrow('paid request failed')
+    await expect(fetch('https://example.com/resource')).rejects.toThrow('paid request failed')
+    expect(actions).toEqual(['open', 'open'])
+  })
+
+  test('keeps an open acknowledged by a payment receipt', async () => {
+    const challenge = makeSessionChallenge({ suggestedDeposit: '1000' })
+    const channelStore = createChannelStore()
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    const credentials: string[] = []
+    let paidRequests = 0
+    const fetch = makeSessionFetch(async (_input, init) => {
+      const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+      if (!authorization) return paymentRequired(challenge)
+      const payload = deserialize(authorization)
+      actions.push(payload.action)
+      credentials.push(authorization)
+      if (++paidRequests === 1) return paymentRequired(challenge)
+      if (paidRequests > 2) return new Response('rejected', { status: 500 })
+      return paymentRequired(challenge, {
+        [Constants.Headers.paymentReceipt]: Types.serializeSessionReceipt(
+          Types.createSessionReceipt({
+            acceptedCumulative: 100n,
+            challengeId: challenge.id,
+            channelId: payload.channelId,
+            spent: 100n,
+          }),
+        ),
+      })
+    }, channelStore)
+
+    expect((await fetch('https://example.com/resource')).status).toBe(500)
+    expect(actions).toEqual(['open', 'open', 'voucher'])
+    expect(credentials[0]).toBe(credentials[1])
+    expect(await channelStore.get(defaultChannelKey)).toMatchObject({ opened: true })
+  })
+
+  test.each([
+    [
+      'keeps an open acknowledged by the final session snapshot',
+      undefined,
+      ['open', 'voucher'],
+      true,
+    ],
+    [
+      'fails closed on malformed acknowledgement snapshots without leaking the open lock',
+      'not-a-number',
+      ['open', 'open'],
+      undefined,
+    ],
+  ])('%s', async (_name, acceptedCumulative, expectedActions, expectedOpened) => {
+    const challenge = makeSessionChallenge({ suggestedDeposit: '1000' })
+    const channelStore = createChannelStore()
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    let paidRequests = 0
+    const fetch = makeSessionFetch(
+      async (_input, init) => {
+        const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+        if (!authorization) return paymentRequired(challenge)
+        const payload = deserialize(authorization)
+        actions.push(payload.action)
+        if (++paidRequests > 1) return new Response('rejected', { status: 500 })
+        return paymentRequired(withSnapshot(payload, acceptedCumulative))
+      },
+      channelStore,
+      1,
+    )
+
+    expect((await fetch('https://example.com/resource')).status).toBe(402)
+    expect((await fetch('https://example.com/resource')).status).toBe(500)
+    expect(actions).toEqual(expectedActions)
+    expect((await channelStore.get(defaultChannelKey))?.opened).toBe(expectedOpened)
+  })
+
+  test('keeps an acknowledged open when challenge ordering throws', async () => {
+    const challenge = makeSessionChallenge({ suggestedDeposit: '1000' })
+    const channelStore = createChannelStore()
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    let ordered = 0
+    let paidRequests = 0
+    const fetch = Fetch.from({
+      fetch: async (_input, init) => {
+        const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+        if (!authorization) return paymentRequired(challenge)
+        const payload = deserialize(authorization)
+        actions.push(payload.action)
+        if (++paidRequests > 1) return new Response('paid')
+        return paymentRequired(withSnapshot(payload))
+      },
+      methods: [makeSessionMethod(channelStore)],
+      orderChallenges(candidates) {
+        if (++ordered === 2) throw new Error('ordering failed')
+        return candidates
+      },
+    })
+
+    await expect(fetch('https://example.com/resource')).rejects.toThrow('ordering failed')
+    expect(await (await fetch('https://example.com/resource')).text()).toBe('paid')
+    expect(actions).toEqual(['open', 'voucher'])
+    expect(await channelStore.get(defaultChannelKey)).toMatchObject({ opened: true })
+  })
+
+  test('serializes concurrent opens against the committed channel', async () => {
+    const challenge = makeSessionChallenge()
+    const channelStore = createChannelStore()
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    const vouchers: bigint[] = []
+    const firstGate = Promise.withResolvers<void>()
+    const firstRequest = Promise.withResolvers<void>()
+    const waitersReady = Promise.withResolvers<void>()
+    let credentialPlans = 0
+    const fetch = Fetch.from({
+      fetch: async (input, init) => {
+        const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+        if (!authorization) return paymentRequired(challenge)
+        const payload = deserialize(authorization)
+        actions.push(payload.action)
+        if (payload.action === 'topUp') return new Response(null, { status: 204 })
+        if (payload.action === 'voucher') vouchers.push(BigInt(payload.cumulativeAmount))
+        if (input.toString().endsWith('/first')) {
+          firstRequest.resolve()
+          await firstGate.promise
+          return new Response('paid')
+        }
+        return new Response('rejected', { status: 500 })
+      },
+      methods: [
+        makeSessionMethod(channelStore, {
+          resolveAccount() {
+            if (++credentialPlans === 3) waitersReady.resolve()
+            return account
+          },
+        }),
+      ],
+    })
+
+    const first = fetch('https://example.com/first')
+    await firstRequest.promise
+    const second = fetch('https://example.com/second')
+    const third = fetch('https://example.com/third')
+    await waitersReady.promise
+    firstGate.resolve()
+
+    expect((await first).status).toBe(200)
+    expect((await second).status).toBe(500)
+    expect((await third).status).toBe(500)
+    expect(actions).toEqual(['open', 'topUp', 'voucher', 'topUp', 'voucher'])
+    expect(vouchers).toEqual([200n, 300n])
+    expect(await channelStore.get(defaultChannelKey)).toMatchObject({ opened: true })
+  })
+
+  test('replaces a stored channel owned by another account', async () => {
+    const channelStore = createChannelStore()
+    const foreign = '0x0000000000000000000000000000000000000004' as Address
+    await channelStore.set({
+      chainId,
+      channelId: `0x${'44'.repeat(32)}`,
+      cumulativeAmount: 100n,
+      deposit: 100n,
+      descriptor: { ...descriptor, authorizedSigner: foreign, payer: foreign },
+      escrow: tip20ChannelEscrow,
+      opened: true,
+    })
+    const actions: Types.SessionCredentialPayload['action'][] = []
+    const challenge = makeSessionChallenge({ suggestedDeposit: '1000' })
+    const fetch = makeSessionFetch(async (_input, init) => {
+      const authorization = new Headers(init?.headers).get(Constants.Headers.authorization)
+      if (!authorization) return paymentRequired(challenge)
+      actions.push(deserialize(authorization).action)
+      return new Response('paid')
+    }, channelStore)
+
+    expect(await (await fetch('https://example.com/resource')).text()).toBe('paid')
+    expect(await (await fetch('https://example.com/resource')).text()).toBe('paid')
+    expect(actions).toEqual(['open', 'voucher'])
+    expect(await channelStore.get(defaultChannelKey)).toMatchObject({
+      descriptor: { authorizedSigner: account.address, payer: account.address },
+      opened: true,
+    })
+  })
+
+  test('uses a matching server snapshot deposit when checking headroom', async () => {
+    const channelStore = createChannelStore()
+    const channelId = Channel.computeId({ ...descriptor, chainId, escrow: tip20ChannelEscrow })
+    await channelStore.set({
+      chainId,
+      channelId,
+      cumulativeAmount: 100n,
+      deposit: 100n,
+      descriptor,
+      escrow: tip20ChannelEscrow,
+      opened: true,
+    })
+    const challenge = makeChallenge({
+      methodDetails: {
+        chainId,
+        escrowContract: tip20ChannelEscrow,
+        sessionProtocol: Constants.SessionProtocols.v2,
+        sessionSnapshot: {
+          acceptedCumulative: '100',
+          chainId,
+          channelId,
+          deposit: '200',
+          descriptor,
+          escrow: tip20ChannelEscrow,
+          requiredCumulative: '200',
+          settled: '0',
+          spent: '100',
+          units: 1,
+        },
+      },
+    })
+    let updatedDeposit = 0n
+    const method = session({
+      account,
+      channelStore,
+      decimals: 0,
+      getClient: () => client,
+      onChannelUpdate: (entry) => {
+        updatedDeposit = entry.deposit
+      },
+    })
+
+    await expect(
+      MethodChallenge.handle(method, {
+        challenge,
+        context: {},
+        fetch: async () => {
+          throw new Error('unexpected top-up')
+        },
+        input: 'https://example.com/resource',
+      }),
+    ).resolves.toBeUndefined()
+    expect(updatedDeposit).toBe(200n)
   })
 
   test('opens for the current amount without client deposit configuration', async () => {
@@ -218,6 +646,72 @@ describe('precompile client session', () => {
     expect(openDeposit(payload)).toBe(100n)
   })
 
+  test('atomically auto-swaps before opening a session channel', async () => {
+    const sourceToken = '0x0000000000000000000000000000000000000007' as Address
+    const swapCalls = [
+      { to: sourceToken, data: '0x1234' as const },
+      { to: '0x0000000000000000000000000000000000000008' as Address, data: '0x5678' as const },
+    ]
+    const findCalls = vi.spyOn(AutoSwap, 'findCalls').mockResolvedValue(swapCalls)
+    try {
+      const method = session({
+        account,
+        autoSwap: { slippage: 2, tokenIn: [sourceToken] },
+        getClient: () => client,
+      })
+      const payload = deserialize(
+        await method.createCredential({ challenge: makeChallenge(), context: {} }),
+      )
+
+      expect(findCalls).toHaveBeenCalledWith(expect.any(Object), {
+        account: account.address,
+        amountOut: 100n,
+        slippage: 2,
+        tokenIn: expect.arrayContaining([sourceToken]),
+        tokenOut: descriptor.token,
+      })
+      const calls = transactionCalls(payload)
+      expect(calls.slice(0, 2)).toEqual(swapCalls)
+      expect(calls[2]!.to?.toLowerCase()).toBe(tip20ChannelEscrow.toLowerCase())
+      expect(decodeFunctionData({ abi: escrowAbi, data: calls[2]!.data! }).functionName).toBe(
+        'open',
+      )
+    } finally {
+      findCalls.mockRestore()
+    }
+  })
+
+  test('atomically auto-swaps before topping up a session channel', async () => {
+    const sourceToken = '0x0000000000000000000000000000000000000007' as Address
+    const swapCalls = [{ to: sourceToken, data: '0x1234' as const }]
+    const findCalls = vi.spyOn(AutoSwap, 'findCalls').mockResolvedValue(swapCalls)
+    try {
+      const method = session({ account, autoSwap: true, getClient: () => client })
+      const payload = deserialize(
+        await method.createCredential({
+          challenge: makeChallenge(),
+          context: { action: 'topUp', additionalDepositRaw: '250', descriptor },
+        }),
+      )
+
+      expect(findCalls).toHaveBeenCalledWith(expect.any(Object), {
+        account: account.address,
+        amountOut: 250n,
+        slippage: 1,
+        tokenIn: AutoSwap.defaultCurrencies,
+        tokenOut: descriptor.token,
+      })
+      const calls = transactionCalls(payload)
+      expect(calls[0]).toEqual(swapCalls[0])
+      expect(calls[1]!.to?.toLowerCase()).toBe(tip20ChannelEscrow.toLowerCase())
+      expect(decodeFunctionData({ abi: escrowAbi, data: calls[1]!.data! }).functionName).toBe(
+        'topUp',
+      )
+    } finally {
+      findCalls.mockRestore()
+    }
+  })
+
   test('uses client chain ID when the challenge omits chain ID', async () => {
     const method = session({ account, getClient: () => client })
     const credential = deserializeCredential(
@@ -286,12 +780,17 @@ describe('precompile client session', () => {
     expect(openDeposit(payload)).toBe(100n)
   })
 
-  test('rejects open when maxDeposit is below the request amount', async () => {
+  test('rejects open above maxDeposit without leaking the Fetch lock', async () => {
     const method = session({ account, decimals: 0, maxDeposit: '50', getClient: () => client })
+    const fetch = Fetch.from({
+      fetch: async () => paymentRequired(makeSessionChallenge()),
+      methods: [method],
+    })
 
-    await expect(
-      method.createCredential({ challenge: makeChallenge(), context: {} }),
-    ).rejects.toThrow('requested voucher amount 100 exceeds local maxDeposit 50')
+    for (let attempt = 0; attempt < 2; attempt++)
+      await expect(fetch('https://example.com/resource')).rejects.toThrow(
+        'requested voucher amount 100 exceeds local maxDeposit 50',
+      )
   })
 
   test('rejects explicit opening deposits below the request amount', async () => {