tapimo 0.0.0 → 0.0.2

package/src/admin/apps/verified-tokens.test.ts

@@ -0,0 +1,415 @@
+import { Store } from 'cadent'
+
+import * as TestAdmin from '../../../test/Admin.js'
+import * as TestApp from '../../../test/App.js'
+import * as Verified from './verified-tokens.js'
+
+/** A token used for write round-trips. */
+const novel = {
+  address: '0x20c00000000000000000000000000000000000ff',
+  currency: 'GBP',
+  decimals: 8,
+  name: 'Test GBP',
+  symbol: 'tGBP',
+} as const
+
+const chainId = '42431' as const
+
+/** Write-enabled admin client backed by a fresh in-memory state store. */
+function writes() {
+  return TestAdmin.setup({ verifiedTokens: { store: Store.memory() } })
+}
+
+describe('feature gate', () => {
+  test('write routes return 404 when no store is configured', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431 },
+    })
+    expect(response.status).toBe(404)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('verified_tokens_not_enabled')
+  })
+})
+
+describe('authentication', () => {
+  test('denied identity → 401', async () => {
+    const { client } = TestAdmin.setup({
+      identify: () => null,
+      verifiedTokens: { store: Store.memory() },
+    })
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431 },
+    })
+    expect(response.status).toBe(401)
+  })
+})
+
+describe('list', () => {
+  test('returns 404 when no store is configured', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['verified-tokens'].$get({ query: { chainId } })
+    expect(response.status).toBe(404)
+  })
+
+  test('empty list → data [] and null version', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'].$get({ query: { chainId } })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Verified.schema.listVerifiedTokens.Response)
+    expect(body.data).toEqual([])
+    expect(body.version).toBeNull()
+  })
+
+  test('reflects created tokens with a version', async () => {
+    const { client } = writes()
+    await client['verified-tokens'].$post({ json: { ...novel, chainId: 42431 } })
+    const response = await client['verified-tokens'].$get({ query: { chainId } })
+    const body = await TestApp.json(response, Verified.schema.listVerifiedTokens.Response)
+    expect(body.data).toHaveLength(1)
+    expect(body.data[0]?.address).toBe(novel.address)
+    expect(body.version).toBeTruthy()
+  })
+})
+
+describe('write lifecycle', () => {
+  test('create → patch → delete', async () => {
+    const { client } = writes()
+
+    const created = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431 },
+    })
+    expect(created.status).toBe(200)
+    const createdBody = await TestApp.json(created, Verified.schema.createVerifiedToken.Response)
+    expect(createdBody.data.address).toBe(novel.address)
+    expect(createdBody.version).toBeTruthy()
+
+    const patched = await client['verified-tokens'][':address'].$patch({
+      json: { name: 'Renamed GBP' },
+      param: { address: novel.address },
+      query: { chainId },
+    })
+    const patchedBody = await TestApp.json(patched, Verified.schema.patchVerifiedToken.Response)
+    expect(patchedBody.data.name).toBe('Renamed GBP')
+
+    const deleted = await client['verified-tokens'][':address'].$delete({
+      param: { address: novel.address },
+      query: { chainId },
+    })
+    expect(deleted.status).toBe(200)
+
+    // Prove the delete took effect: re-creating the same address now succeeds
+    // instead of conflicting.
+    const recreated = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431 },
+    })
+    expect(recreated.status).toBe(200)
+  })
+
+  test('rejects a duplicate address with 409', async () => {
+    const { client } = writes()
+    await client['verified-tokens'].$post({ json: { ...novel, chainId: 42431 } })
+    const duplicate = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431 },
+    })
+    expect(duplicate.status).toBe(409)
+    const body = (await duplicate.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('duplicate_address')
+  })
+
+  test('returns 404 patching an unknown address', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'][':address'].$patch({
+      json: { name: 'x' },
+      param: { address: novel.address },
+      query: { chainId },
+    })
+    expect(response.status).toBe(404)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('verified_token_not_found')
+  })
+
+  test('rejects a stale If-Match with 412', async () => {
+    const { client } = writes()
+    await client['verified-tokens'].$post({ json: { ...novel, chainId: 42431 } })
+    const response = await client['verified-tokens'][':address'].$patch(
+      { json: { name: 'x' }, param: { address: novel.address }, query: { chainId } },
+      { headers: { 'if-match': '"stale"' } },
+    )
+    expect(response.status).toBe(412)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('version_mismatch')
+  })
+
+  test('replaces the whole list via PUT', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'].$put({
+      json: { tokens: [novel] },
+      query: { chainId },
+    })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Verified.schema.replaceVerifiedTokens.Response)
+    expect(body.data.map((token) => token.address)).toEqual([novel.address])
+  })
+
+  test('requires an explicit chainId on query-addressed mutations', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'].$put({
+      json: { tokens: [novel] },
+      // Cast past the typed client to exercise runtime validation.
+      query: {} as never,
+    })
+    expect(response.status).toBe(400)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('query_invalid')
+  })
+})
+
+describe('create with inline logo', () => {
+  const svg = '<svg xmlns="http://www.w3.org/2000/svg"/>'
+
+  /** Write-enabled setup with an in-memory asset store capturing every put. */
+  function setup() {
+    const stored: { key: string; content: { body: ArrayBuffer; contentType: string } }[] = []
+    const { client } = TestAdmin.setup({
+      assets: {
+        get: async (key) => stored.find((entry) => entry.key === key)?.content,
+        put: async (key, content) => void stored.push({ content, key }),
+      },
+      verifiedTokens: { store: Store.memory() },
+    })
+    return { client, stored }
+  }
+
+  /** Count of tokens currently in the chain's verified list. */
+  async function count(client: ReturnType<typeof setup>['client']) {
+    const response = await client['verified-tokens'].$get({ query: { chainId } })
+    const body = await TestApp.json(response, Verified.schema.listVerifiedTokens.Response)
+    return body.data.length
+  }
+
+  test('uploads the logo and creates the token', async () => {
+    const { client, stored } = setup()
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, logo: svg },
+    })
+    expect(response.status).toBe(200)
+    expect(stored).toHaveLength(1)
+    expect(stored[0]?.key).toBe(`42431/icons/${novel.address}`)
+    expect(new TextDecoder().decode(stored[0]?.content.body)).toBe(svg)
+    expect(await count(client)).toBe(1)
+  })
+
+  test('a duplicate is rejected before the logo is uploaded', async () => {
+    const { client, stored } = setup()
+    await client['verified-tokens'].$post({ json: { ...novel, chainId: 42431 } })
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, logo: svg },
+    })
+    expect(response.status).toBe(409)
+    // The upload must not run for a duplicate, so an existing icon is never overwritten.
+    expect(stored).toHaveLength(0)
+  })
+
+  test('a failed upload leaves no token', async () => {
+    const { client } = TestAdmin.setup({
+      assets: {
+        get: async () => undefined,
+        put: async () => {
+          throw new Error('upload failed')
+        },
+      },
+      verifiedTokens: { store: Store.memory() },
+    })
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, logo: svg },
+    })
+    expect(response.status).toBe(502)
+    expect(await count(client)).toBe(0)
+  })
+
+  test('a logo without an asset writer is rejected, creating no token', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, logo: svg },
+    })
+    expect(response.status).toBe(404)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('assets_not_enabled')
+    expect(await count(client)).toBe(0)
+  })
+
+  test('a non-SVG logo is rejected with 415, creating no token', async () => {
+    const { client, stored } = setup()
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, logo: 'not svg' },
+    })
+    expect(response.status).toBe(415)
+    expect(stored).toHaveLength(0)
+    expect(await count(client)).toBe(0)
+  })
+})
+
+describe('logoUri', () => {
+  test('round-trips through create and patch', async () => {
+    const { client } = writes()
+    const logoUri = 'https://example.com/logo.svg'
+
+    const created = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, logoUri },
+    })
+    expect(created.status).toBe(200)
+    const createdBody = await TestApp.json(created, Verified.schema.createVerifiedToken.Response)
+    expect(createdBody.data.logoUri).toBe(logoUri)
+
+    const patched = await client['verified-tokens'][':address'].$patch({
+      json: { logoUri: 'https://example.com/logo-v2.svg' },
+      param: { address: novel.address },
+      query: { chainId },
+    })
+    const patchedBody = await TestApp.json(patched, Verified.schema.patchVerifiedToken.Response)
+    expect(patchedBody.data.logoUri).toBe('https://example.com/logo-v2.svg')
+    // Untouched fields survive the patch.
+    expect(patchedBody.data.symbol).toBe(novel.symbol)
+  })
+
+  test('rejects a non-HTTPS logoUri with 400', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, logoUri: 'javascript:alert(1)' },
+    })
+    expect(response.status).toBe(400)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('body_invalid')
+  })
+})
+
+describe('PUT /verified-tokens/:address/logo', () => {
+  const svg = '<svg xmlns="http://www.w3.org/2000/svg"/>'
+
+  /** Setup with an in-memory asset store capturing every put. */
+  function uploads() {
+    const stored: { key: string; content: { body: ArrayBuffer; contentType: string } }[] = []
+    const { client } = TestAdmin.setup({
+      assets: {
+        get: async (key) => stored.find((entry) => entry.key === key)?.content,
+        put: async (key, content) => {
+          stored.push({ content, key })
+        },
+      },
+      verifiedTokens: { store: Store.memory() },
+    })
+    return { client, stored }
+  }
+
+  test('stores the SVG under the main API icon key', async () => {
+    const { client, stored } = uploads()
+    const response = await client['verified-tokens'][':address'].logo.$put(
+      { param: { address: novel.address }, query: { chainId } },
+      { headers: { 'content-type': 'image/svg+xml' }, init: { body: svg } },
+    )
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Verified.schema.uploadVerifiedTokenLogo.Response)
+
+    const key = `42431/icons/${novel.address}`
+    expect(body).toEqual({ key, path: `/assets/${key}` })
+    expect(stored).toHaveLength(1)
+    expect(stored[0]?.key).toBe(key)
+    expect(stored[0]?.content.contentType).toBe('image/svg+xml')
+    expect(new TextDecoder().decode(stored[0]?.content.body)).toBe(svg)
+  })
+
+  test('404 when no asset writer is configured', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'][':address'].logo.$put(
+      { param: { address: novel.address }, query: { chainId } },
+      { headers: { 'content-type': 'image/svg+xml' }, init: { body: svg } },
+    )
+    expect(response.status).toBe(404)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('assets_not_enabled')
+  })
+
+  test('rejects a non-SVG content type with 415', async () => {
+    const { client, stored } = uploads()
+    const response = await client['verified-tokens'][':address'].logo.$put(
+      { param: { address: novel.address }, query: { chainId } },
+      { headers: { 'content-type': 'image/png' }, init: { body: svg } },
+    )
+    expect(response.status).toBe(415)
+    expect(stored).toHaveLength(0)
+  })
+
+  test('rejects an empty body with 400', async () => {
+    const { client, stored } = uploads()
+    const response = await client['verified-tokens'][':address'].logo.$put(
+      { param: { address: novel.address }, query: { chainId } },
+      { headers: { 'content-type': 'image/svg+xml' } },
+    )
+    expect(response.status).toBe(400)
+    expect(stored).toHaveLength(0)
+  })
+
+  test('rejects an oversized body with 413', async () => {
+    const { client, stored } = uploads()
+    const response = await client['verified-tokens'][':address'].logo.$put(
+      { param: { address: novel.address }, query: { chainId } },
+      {
+        headers: { 'content-type': 'image/svg+xml' },
+        init: { body: 'x'.repeat(256 * 1024 + 1) },
+      },
+    )
+    expect(response.status).toBe(413)
+    expect(stored).toHaveLength(0)
+  })
+})
+
+describe('GET /verified-tokens/:address/logo', () => {
+  const svg = '<svg xmlns="http://www.w3.org/2000/svg"/>'
+
+  /** Setup with an in-memory asset store backing both put and get. */
+  function store() {
+    const objects = new Map<string, { body: ArrayBuffer; contentType: string }>()
+    const { client } = TestAdmin.setup({
+      assets: {
+        get: async (key) => objects.get(key),
+        put: async (key, content) => void objects.set(key, content),
+      },
+      verifiedTokens: { store: Store.memory() },
+    })
+    return { client, objects }
+  }
+
+  test('serves a previously uploaded SVG', async () => {
+    const { client } = store()
+    await client['verified-tokens'][':address'].logo.$put(
+      { param: { address: novel.address }, query: { chainId } },
+      { headers: { 'content-type': 'image/svg+xml' }, init: { body: svg } },
+    )
+    const response = await client['verified-tokens'][':address'].logo.$get({
+      param: { address: novel.address },
+      query: { chainId },
+    })
+    expect(response.status).toBe(200)
+    expect(response.headers.get('content-type')).toBe('image/svg+xml')
+    expect(await response.text()).toBe(svg)
+  })
+
+  test('404 when the logo is absent', async () => {
+    const { client } = store()
+    const response = await client['verified-tokens'][':address'].logo.$get({
+      param: { address: novel.address },
+      query: { chainId },
+    })
+    expect(response.status).toBe(404)
+  })
+
+  test('404 when no asset reader is configured', async () => {
+    const { client } = writes()
+    const response = await client['verified-tokens'][':address'].logo.$get({
+      param: { address: novel.address },
+      query: { chainId },
+    })
+    expect(response.status).toBe(404)
+  })
+})