tapimo 0.1.0 → 0.2.0

package/src/handlers/relay.ts

@@ -15,7 +15,7 @@ import {
 } from 'viem'
 import type { LocalAccount } from 'viem/accounts'
 import { simulateCalls } from 'viem/actions'
-import { Abis, Actions, Addresses, Capabilities, Transaction, VirtualAddress } from 'viem/tempo'
+import { Abis, Actions, Addresses, Capabilities, VirtualAddress } from 'viem/tempo'
 
 import * as ExecutionError from './internal/executionError.js'
 import type * as RpcSchema from '../internal/RpcSchema.js'
@@ -150,6 +150,13 @@ export function relay(options: relay.Options): Handler {
 
           const { feePayer: _feePayer, ...normalized } =
             Utils.normalizeFillTransactionRequest(parameters)
+          const hasMultisigHints =
+            (typeof normalized['multisig'] === 'object' && normalized['multisig'] !== null) ||
+            (typeof normalized['multisigInit'] === 'object' &&
+              normalized['multisigInit'] !== null) ||
+            typeof normalized['multisigSignatureCount'] !== 'undefined'
+          const shouldDeferFeePayerSignature =
+            feePayerOptions && multisigOptions && hasMultisigHints
 
           // When sponsoring, the sponsor's preferred fee token (if set)
           // overrides whatever the consumer asked for — the sponsor is
@@ -362,9 +369,16 @@ export function relay(options: relay.Options): Handler {
             })(),
             // Sign as fee payer (if sponsored and not already signed).
             (async () => {
-              if (!(sponsored && feePayerOptions && !alreadySigned)) return transaction_filled
+              // Multisig finalization changes the sender signature. Sign after quorum.
+              if (shouldDeferFeePayerSignature) return transaction_filled
+              // Never sign with the managed fee payer for an app-provided
+              // external fee payer URL: that relay is the sponsorship authority,
+              // and signing here would bypass this fee payer's `validate` gate.
+              if (!(sponsored && feePayerOptions && !externalFeePayerUrl && !alreadySigned))
+                return transaction_filled
               return Sponsorship.sign({
                 account: feePayerOptions.account,
+                onSponsored: feePayerOptions.onSponsored,
                 sender: from,
                 transaction: transaction_filled,
               })
@@ -519,6 +533,7 @@ export function relay(options: relay.Options): Handler {
                 ? {
                     account: feePayerOptions.account,
                     feeToken: feePayerOptions.feeToken,
+                    onSponsored: feePayerOptions.onSponsored,
                     resolveFeeToken: async (chainId) => (await getTokens(chainId))[0],
                     validate: feePayerOptions.validate,
                   }
@@ -563,6 +578,7 @@ export function relay(options: relay.Options): Handler {
             getFeeToken: async (chainId) => (await getTokens(chainId))[0],
             getClient,
             method: request.method as Sponsorship.handleRawTransaction.Options['method'],
+            onSponsored: feePayerOptions.onSponsored,
             request: { params: 'params' in request ? request.params : undefined },
             validate: feePayerOptions.validate,
           })
@@ -660,13 +676,15 @@ export namespace relay {
           account: LocalAccount
           /** Preferred fee token the sponsor wants to pay fees in. */
           feeToken?: Address | undefined
+          /**
+           * Called once the fee payer has signed a raw transaction.
+           */
+          onSponsored?: Sponsorship.handleRawTransaction.Options['onSponsored']
           /**
            * Validates whether to sponsor the transaction. When omitted, all
            * transactions are sponsored. Return `false` to reject sponsorship.
            */
-          validate?:
-            | ((request: Transaction.TransactionRequest) => boolean | Promise<boolean>)
-            | undefined
+          validate?: Sponsorship.Validate | undefined
           /** Sponsor display name returned from `eth_fillTransaction`. */
           name?: string | undefined
           /** Sponsor URL returned from `eth_fillTransaction`. */

package/src/internal/Auth.test.ts

@@ -267,6 +267,235 @@ describe('require', () => {
     })
   })
 
+  describe('session', () => {
+    const sessionPrincipal = {
+      id: 'usr_test',
+      identity: { provider: 'wallet', subject: '0x0000000000000000000000000000000000000001' },
+      type: 'session',
+    } as const satisfies Auth.SessionPrincipal
+
+    /** Harness with the session capability installed on the auth context. */
+    function createSessionApp(
+      options: {
+        policy?: Auth.require.Policy | undefined
+        resolve?: Auth.Session['resolve'] | undefined
+      } = {},
+    ) {
+      const auth = {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+        ...(options.resolve ? { session: { resolve: options.resolve } } : {}),
+      }
+      const app = new Hono<Auth.Environment>()
+      app.use('*', async (c, next) => {
+        c.set('auth', auth)
+        await next()
+      })
+      app.use('/protected', Auth.require(options.policy ?? { session: true }))
+      app.get('/protected', (c) => c.json(serializePrincipal(Auth.getPrincipal(c))))
+      return app
+    }
+
+    test('resolves cookie sessions for session-lane routes', async () => {
+      const app = createSessionApp({ resolve: async () => sessionPrincipal })
+      const response = await app.request('/protected')
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "usr_test",
+          "type": "session",
+        }
+      `)
+    })
+
+    test('falls through to the session lane on invalid bearer tokens', async () => {
+      const app = createSessionApp({ resolve: async () => sessionPrincipal })
+      const response = await app.request('/protected', {
+        headers: { authorization: 'Bearer not-an-api-key' },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('rejects anonymous requests without a session', async () => {
+      const app = createSessionApp({ resolve: async () => null })
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('stays closed without the app session capability', async () => {
+      const app = createSessionApp()
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('valid API keys win over sessions', async () => {
+      const app = createSessionApp({
+        policy: { apiKey: { scopes: ['data:read'] }, session: true },
+        resolve: async () => sessionPrincipal,
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "key_test",
+          "orgId": "org_test",
+          "type": "api_key",
+        }
+      `)
+    })
+
+    test('is not consulted on lane-less routes', async () => {
+      const app = createSessionApp({
+        policy: {},
+        resolve: async () => sessionPrincipal,
+      })
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+  })
+
+  describe('superAdmin', () => {
+    const secret = 'tempo:sk:a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0'
+
+    /** Auth context with the super admin secret configured alongside the test key. */
+    function withSuperAdmin(): Auth.Context {
+      return {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+        superAdmin: { tokenHash: ApiKey.hash(secret) },
+      }
+    }
+
+    test('resolves the super admin secret before key lookup', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "actor": "super_admin",
+          "id": "super_admin",
+          "type": "super_admin",
+        }
+      `)
+    })
+
+    test('accepts the super admin secret as a bearer token', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { authorization: `Bearer ${secret}` },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('bypasses scope checks', async () => {
+      const app = createApp({
+        auth: withSuperAdmin(),
+        policy: { apiKey: { scopes: [Scope.wildcard] } },
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('non-matching tokens fall through to key lookup', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "key_test",
+          "orgId": "org_test",
+          "type": "api_key",
+        }
+      `)
+    })
+
+    test('is disabled when unconfigured', async () => {
+      const app = createApp()
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "api_key_invalid",
+            "message": "Invalid API key",
+          },
+        }
+      `)
+    })
+
+    test('is the only principal for lane-less routes', async () => {
+      const app = createApp({ auth: withSuperAdmin(), policy: {} })
+
+      const superAdmin = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      expect(superAdmin.status).toMatchInlineSnapshot(`200`)
+
+      const keyed = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await keyed.json()
+      expect(keyed.status).toMatchInlineSnapshot(`403`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "forbidden",
+            "message": "API key not permitted for this route",
+          },
+        }
+      `)
+
+      const anonymous = await app.request('/protected')
+      expect(anonymous.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('logs the principal actor, never the secret', async () => {
+      const entries: Log.Entry[] = []
+      const app = createApp({
+        auth: withSuperAdmin(),
+        logger: (entry) => {
+          entries.push(entry)
+        },
+      })
+      await app.request('/protected', { headers: { 'tempo-api-key': secret } })
+
+      expect(entries[0]?.principal).toMatchInlineSnapshot(`
+        {
+          "actor": "super_admin",
+          "id": "super_admin",
+          "type": "super_admin",
+        }
+      `)
+      expect(JSON.stringify(entries)).not.toContain(secret)
+    })
+  })
+
   describe('environment', () => {
     const sandboxToken = 'secret_sandbox'
 
@@ -613,6 +842,85 @@ describe('require', () => {
         error.mockRestore()
       }
     })
+
+    test('fails open (at warn) when the rate-limit store stalls past the timeout', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      vi.useFakeTimers()
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            // A hot Durable Object under a storage-latency blip never returns;
+            // the consume must not block the request indefinitely.
+            rateLimit: { consume: () => new Promise<never>(() => {}) },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const pending = app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+        // Advance past the 300ms consume timeout so it fails open.
+        await vi.advanceTimersByTimeAsync(300)
+        const response = await pending
+        const body = await response.json()
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(body).toMatchInlineSnapshot(`
+          {
+            "id": "203.0.113.10",
+            "type": "public",
+          }
+        `)
+        // A timeout is an expected degradation: warn, never error.
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        vi.useRealTimers()
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
+
+    test('fails open (at warn) when the rate-limit Durable Object is overloaded', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            rateLimit: {
+              async consume() {
+                throw Object.assign(
+                  new Error('Durable Object is overloaded. Requests queued for too long.'),
+                  { overloaded: true },
+                )
+              },
+            },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const response = await app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+        const body = await response.json()
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(body).toMatchInlineSnapshot(`
+          {
+            "id": "203.0.113.10",
+            "type": "public",
+          }
+        `)
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
   })
 
   describe('rateLimit per-scope', () => {
@@ -948,6 +1256,14 @@ function serializePrincipal(principal: Auth.Principal | null) {
       type: principal.type,
     }
 
+  if (principal.type === 'super_admin')
+    return {
+      actor: principal.actor,
+      id: principal.id,
+      ...payment,
+      type: principal.type,
+    }
+
   return {
     id: principal.id,
     ...payment,