tapimo 0.10.0 → 0.10.2

package/src/internal/Auth.test.ts

@@ -155,7 +155,7 @@ describe('require', () => {
       const app = createApp({
         policy: {
           apiKey: { scopes: ['data:read'] },
-          public: { rateLimit: { perMinute: 60 } },
+          public: { rateLimit: { limit: 60, period: 'minute' } },
         },
       })
       const response = await app.request('/protected', {
@@ -180,7 +180,7 @@ describe('require', () => {
         logger: (entry) => void entries.push(entry),
         policy: {
           apiKey: { scopes: ['data:read'] },
-          public: { rateLimit: { perMinute: 60 } },
+          public: { rateLimit: { limit: 60, period: 'minute' } },
         },
       })
       const response = await app.request('/protected', {
@@ -723,7 +723,9 @@ describe('require', () => {
       }
       const policy: Auth.require.Policy = {
         apiKey: { scopes: [Scope.wildcard] },
-        ...(options.public === false ? {} : { public: { rateLimit: { perMinute: 60 } } }),
+        ...(options.public === false
+          ? {}
+          : { public: { rateLimit: { limit: 60, period: 'minute' } } }),
         ...(options.mpp ? { mpp: { session: { amount: '1' } } } : {}),
       }
       const app = new Hono<Auth.Environment>()
@@ -825,7 +827,7 @@ describe('require', () => {
 
     test('throttles a sandbox key to the public quota when billing is inactive', async () => {
       const app = createChainApp({
-        public: true, // policy.public.rateLimit is { perMinute: 60 }
+        public: true, // policy.public.rateLimit is { limit: 60, period: 'minute' }
         sandboxBillingActive: false,
       })
       const response = await app.request('/protected?chainId=42431', {
@@ -863,7 +865,7 @@ describe('require', () => {
     test('throttles to the configured public default on API-key-only routes', async () => {
       const app = createChainApp({
         public: false, // no per-route public lane
-        publicRateLimit: { perMinute: 7 },
+        publicRateLimit: { limit: 7, period: 'minute' },
         sandboxBillingActive: false,
       })
       const response = await app.request('/protected?chainId=42431', {
@@ -927,7 +929,7 @@ describe('require', () => {
       expect(response.headers.get('RateLimit-Scope')).toBe('mpp')
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:public:2001:db8:abcd:12',
-        limit: { perMinute: 100 },
+        limit: { limit: 100, period: 'minute' },
       })
     })
 
@@ -954,7 +956,7 @@ describe('require', () => {
       expect(response.status).toBe(200)
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:public:anonymous',
-        limit: { perMinute: 100 },
+        limit: { limit: 100, period: 'minute' },
       })
     })
 
@@ -980,7 +982,7 @@ describe('require', () => {
       expect(response.status).toBe(200)
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:public:2001:db8:abcd:12',
-        limit: { perMinute: 100 },
+        limit: { limit: 100, period: 'minute' },
       })
     })
 
@@ -1009,7 +1011,7 @@ describe('require', () => {
       expect(response.status).toBe(200)
       expect(consume).toHaveBeenCalledWith({
         key: 'mpp:api_key:key_test',
-        limit: { perMinute: 100 },
+        limit: { limit: 100, period: 'minute' },
       })
     })
 
@@ -1017,7 +1019,7 @@ describe('require', () => {
       const app = createApp({
         auth: {
           apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
-          mpp: createMppHandler({ rateLimit: { perMinute: 25 } }),
+          mpp: createMppHandler({ rateLimit: { limit: 25, period: 'minute' } }),
           rateLimit: underQuota(),
         },
         policy: { mpp: { session: { amount: '1' } } },
@@ -1034,12 +1036,12 @@ describe('require', () => {
       const app = createApp({
         auth: {
           apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
-          mpp: createMppHandler({ rateLimit: { perMinute: 25 } }),
+          mpp: createMppHandler({ rateLimit: { limit: 25, period: 'minute' } }),
           rateLimit: underQuota(),
         },
         policy: {
           mpp: {
-            rateLimit: { perMinute: 5 },
+            rateLimit: { limit: 5, period: 'minute' },
             session: { amount: '1' },
           },
         },
@@ -1082,7 +1084,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1', description: 'Protected data' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const response = await app.request('/protected')
@@ -1103,7 +1105,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1', description: 'Protected data' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const response = await createMppClient(app).fetch('http://tempo-api.test/protected')
@@ -1134,7 +1136,7 @@ describe('require', () => {
         },
         policy: {
           apiKey: {
-            rateLimit: { perMinute: 1 },
+            rateLimit: { limit: 1, period: 'minute' },
             scopes: ['data:read'],
           },
           mpp: { session: { amount: '1', description: 'Protected data' } },
@@ -1160,7 +1162,7 @@ describe('require', () => {
         },
         policy: {
           apiKey: {
-            rateLimit: { perMinute: 1 },
+            rateLimit: { limit: 1, period: 'minute' },
             scopes: ['data:read'],
           },
           mpp: { session: { amount: '1', description: 'Protected data' } },
@@ -1199,7 +1201,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1', description: 'Protected data' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const response = await app.request('/protected')
@@ -1237,7 +1239,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
 
@@ -1272,7 +1274,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
 
@@ -1294,7 +1296,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '2.5', suggestedDeposit: '10' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const response = await app.request('/protected')
@@ -1318,7 +1320,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1', description: 'Protected data' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const response = await createMppClient(app).fetch('http://tempo-api.test/protected')
@@ -1354,7 +1356,7 @@ describe('require', () => {
         policy: {
           // The suggested deposit pre-funds the channel for both requests.
           mpp: { session: { amount: '1', suggestedDeposit: '2' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const client = createMppClient(app)
@@ -1390,7 +1392,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1', suggestedDeposit: '2' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const client = createMppClient({ fetch: (request) => app.fetch(request) })
@@ -1404,7 +1406,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1', suggestedDeposit: '2' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const second = await client.fetch('http://tempo-api.test/protected')
@@ -1427,7 +1429,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const client = createMppClient(app)
@@ -1463,7 +1465,7 @@ describe('require', () => {
         },
         policy: {
           mpp: { session: { amount: '1' } },
-          public: { rateLimit: { perMinute: 1 } },
+          public: { rateLimit: { limit: 1, period: 'minute' } },
         },
       })
       const response = await app.request('/protected', {
@@ -1478,7 +1480,7 @@ describe('require', () => {
   describe('rateLimit', () => {
     test('allows anonymous public requests under quota', async () => {
       const app = createApp({
-        policy: { public: { rateLimit: { perMinute: 60 } } },
+        policy: { public: { rateLimit: { limit: 60, period: 'minute' } } },
       })
       const response = await app.request('/protected', {
         headers: { 'cf-connecting-ip': '203.0.113.10' },
@@ -1502,7 +1504,7 @@ describe('require', () => {
           apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           rateLimit: overQuota(),
         },
-        policy: { public: { rateLimit: { perMinute: 1 } } },
+        policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
       })
       const response = await app.request('/protected')
       const body = await response.json()
@@ -1530,7 +1532,7 @@ describe('require', () => {
               },
             },
           },
-          policy: { public: { rateLimit: { perMinute: 1 } } },
+          policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
         })
         const response = await app.request('/protected', {
           headers: { 'cf-connecting-ip': '203.0.113.10' },
@@ -1588,7 +1590,7 @@ describe('require', () => {
             // the consume must not block the request indefinitely.
             rateLimit: { consume: () => new Promise<never>(() => {}) },
           },
-          policy: { public: { rateLimit: { perMinute: 1 } } },
+          policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
         })
         const pending = app.request('/protected', {
           headers: { 'cf-connecting-ip': '203.0.113.10' },
@@ -1632,7 +1634,7 @@ describe('require', () => {
               },
             },
           },
-          policy: { public: { rateLimit: { perMinute: 1 } } },
+          policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
         })
         const response = await app.request('/protected', {
           headers: { 'cf-connecting-ip': '203.0.113.10' },
@@ -1669,7 +1671,7 @@ describe('require', () => {
               },
             },
           },
-          policy: { public: { rateLimit: { perMinute: 1 } } },
+          policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
         })
         const response = await app.request('/protected', {
           headers: { 'cf-connecting-ip': '203.0.113.10' },
@@ -1698,7 +1700,7 @@ describe('require', () => {
               },
             },
           },
-          policy: { public: { rateLimit: { perMinute: 1 } } },
+          policy: { public: { rateLimit: { limit: 1, period: 'minute' } } },
         })
         const response = await app.request('/protected', {
           headers: { 'cf-connecting-ip': '203.0.113.10' },
@@ -1731,7 +1733,10 @@ describe('require', () => {
     test('does not share quota across scopes', async () => {
       const auth = {
         apiKey: {
-          rateLimits: { 'data:read': { perMinute: 1 }, 'webhooks:write': { perMinute: 1 } },
+          rateLimits: {
+            'data:read': { limit: 1, period: 'minute' },
+            'webhooks:write': { limit: 1, period: 'minute' },
+          },
           resolve: TestApp.resolver({
             keys: [{ ...key, scopes: [Scope.wildcard], token }],
           }),
@@ -1785,7 +1790,7 @@ describe('require', () => {
     test('route cap overrides the configured scope limit', async () => {
       const auth = {
         apiKey: {
-          rateLimits: { 'data:read': { perMinute: 1_000 } },
+          rateLimits: { 'data:read': { limit: 1_000, period: 'minute' } },
           resolve: TestApp.resolver({
             keys: [{ ...key, scopes: [Scope.wildcard], token }],
           }),
@@ -1797,7 +1802,9 @@ describe('require', () => {
         routes: [
           {
             path: '/protected',
-            policy: { apiKey: { rateLimit: { perMinute: 5 }, scopes: ['data:read'] } },
+            policy: {
+              apiKey: { rateLimit: { limit: 5, period: 'minute' }, scopes: ['data:read'] },
+            },
           },
         ],
       })
@@ -1814,7 +1821,7 @@ describe('require', () => {
         keys: [
           {
             ...key,
-            rateLimits: { '*': { perMinute: 7 } },
+            rateLimits: { '*': { limit: 7, period: 'minute' } },
             scopes: [Scope.wildcard],
             token,
           },
@@ -1823,7 +1830,7 @@ describe('require', () => {
 
       const open = createScopedApp({
         auth: {
-          apiKey: { rateLimits: { '*': { perMinute: 1_000 } }, resolve },
+          apiKey: { rateLimits: { '*': { limit: 1_000, period: 'minute' } }, resolve },
           rateLimit: RateLimit.memory(),
         },
         routes: [{ path: '/protected', policy: { apiKey: { scopes: ['data:read'] } } }],
@@ -1834,13 +1841,15 @@ describe('require', () => {
 
       const capped = createScopedApp({
         auth: {
-          apiKey: { rateLimits: { '*': { perMinute: 1_000 } }, resolve },
+          apiKey: { rateLimits: { '*': { limit: 1_000, period: 'minute' } }, resolve },
           rateLimit: RateLimit.memory(),
         },
         routes: [
           {
             path: '/protected',
-            policy: { apiKey: { rateLimit: { perMinute: 5 }, scopes: ['data:read'] } },
+            policy: {
+              apiKey: { rateLimit: { limit: 5, period: 'minute' }, scopes: ['data:read'] },
+            },
           },
         ],
       })
@@ -1861,7 +1870,7 @@ describe('require', () => {
             keys: [
               {
                 ...key,
-                rateLimits: { 'data:read': { perMinute: 9 } },
+                rateLimits: { 'data:read': { limit: 9, period: 'minute' } },
                 scopes: [Scope.wildcard],
                 token,
               },
@@ -1875,7 +1884,9 @@ describe('require', () => {
         routes: [
           {
             path: '/protected',
-            policy: { apiKey: { rateLimit: { perMinute: 5 }, scopes: ['data:read'] } },
+            policy: {
+              apiKey: { rateLimit: { limit: 5, period: 'minute' }, scopes: ['data:read'] },
+            },
           },
         ],
       })
@@ -1894,7 +1905,7 @@ describe('require', () => {
           rateLimit: overQuota(),
         },
         logger: (entry) => void entries.push(entry),
-        policy: { apiKey: { rateLimit: { perMinute: 1 }, scopes: ['data:read'] } },
+        policy: { apiKey: { rateLimit: { limit: 1, period: 'minute' }, scopes: ['data:read'] } },
       })
       const response = await app.request('/protected', {
         headers: { 'tempo-api-key': token },
@@ -1923,7 +1934,7 @@ describe('require', () => {
           rateLimit: overQuota(),
         },
         policy: {
-          apiKey: { rateLimit: { perMinute: 1 }, scopes: ['data:read'] },
+          apiKey: { rateLimit: { limit: 1, period: 'minute' }, scopes: ['data:read'] },
           mpp: { session: { amount: '1', description: 'Protected data' } },
         },
       })
@@ -2089,54 +2100,6 @@ describe('ensureProject', () => {
   })
 })
 
-describe('parseCredential', () => {
-  test('parses credentials keyed by chain id', () => {
-    const credential = Auth.parseCredential(
-      JSON.stringify({ 4217: 'mainnet:secret', 421700001: 'zone:secret' }),
-    )
-
-    expect(credential).toEqual({ 4217: 'mainnet:secret', 421700001: 'zone:secret' })
-  })
-
-  test('supports a shared credential', () => {
-    expect(Auth.parseCredential('shared:secret')).toBe('shared:secret')
-  })
-
-  test('rejects malformed credential maps', () => {
-    expect(() => Auth.parseCredential('{"4217":1}')).toThrowErrorMatchingInlineSnapshot(
-      `[Error: Expected a credential or a chain-id-to-credential JSON object.]`,
-    )
-  })
-})
-
-describe('resolveCredential', () => {
-  test('infers Basic auth from a credential containing a colon', () => {
-    expect(Auth.resolveCredential({ chainId: 4217, value: 'user:password' })).toEqual({
-      basicAuth: 'user:password',
-    })
-  })
-
-  test('infers Bearer auth from a credential without a colon', () => {
-    expect(Auth.resolveCredential({ chainId: 4217, value: 'bearer-token' })).toEqual({
-      basicAuth: undefined,
-      bearerAuth: 'bearer-token',
-    })
-  })
-
-  test('selects a credential by chain id', () => {
-    const value = JSON.stringify({ 4217: 'mainnet:secret', 421700001: 'zone-token' })
-
-    expect(Auth.resolveCredential({ chainId: 4217, value })).toEqual({
-      basicAuth: 'mainnet:secret',
-    })
-    expect(Auth.resolveCredential({ chainId: 421700001, value })).toEqual({
-      basicAuth: undefined,
-      bearerAuth: 'zone-token',
-    })
-    expect(Auth.resolveCredential({ chainId: 42431, value })).toEqual({ basicAuth: undefined })
-  })
-})
-
 function createScopedApp(options: {
   auth?: Auth.Context | undefined
   routes: readonly { path: string; policy: Auth.require.Policy }[]
@@ -2312,7 +2275,7 @@ function overQuota(): RateLimit.Store {
     async consume(options) {
       return {
         allowed: false,
-        limit: options.limit.perMinute,
+        limit: options.limit.limit,
         remaining: 0,
         reset: Math.ceil(Date.now() / 1_000) + 60,
       }
@@ -2325,8 +2288,8 @@ function underQuota(): RateLimit.Store {
     async consume(options) {
       return {
         allowed: true,
-        limit: options.limit.perMinute,
-        remaining: Math.max(options.limit.perMinute - 1, 0),
+        limit: options.limit.limit,
+        remaining: Math.max(options.limit.limit - 1, 0),
         reset: Math.ceil(Date.now() / 1_000) + 60,
       }
     },
@@ -2339,13 +2302,13 @@ function overQuotaExceptMpp(): RateLimit.Store {
       if (options.key.startsWith('mpp:'))
         return {
           allowed: true,
-          limit: options.limit.perMinute,
-          remaining: Math.max(options.limit.perMinute - 1, 0),
+          limit: options.limit.limit,
+          remaining: Math.max(options.limit.limit - 1, 0),
           reset: Math.ceil(Date.now() / 1_000) + 60,
         }
       return {
         allowed: false,
-        limit: options.limit.perMinute,
+        limit: options.limit.limit,
         remaining: 0,
         reset: Math.ceil(Date.now() / 1_000) + 60,
       }

package/src/internal/Auth.ts

@@ -28,11 +28,12 @@ import * as Response from './Response.js'
 import * as Schema from './Schema.js'
 import * as Scope from '../Scope.js'
 import * as Users from '../db/tables/users.js'
+import type * as Viem from './Viem.js'
 
 const policySymbol = Symbol('tempo-api.auth.policy')
 const mppManagementSymbol = Symbol('tempo-api.auth.mpp-management')
-const defaultApiKeyRateLimit = { perMinute: 10_000 } satisfies RateLimit.Limit
-const defaultMppRateLimit = { perMinute: 100 } satisfies RateLimit.Limit
+const defaultApiKeyRateLimit = { limit: 10_000, period: 'minute' } satisfies RateLimit.Limit
+const defaultMppRateLimit = { limit: 100, period: 'minute' } satisfies RateLimit.Limit
 
 /** Auth context consumed by Tempo API handlers. */
 export type Context = {
@@ -788,6 +789,7 @@ export function install(options: install.Options) {
       (typeof options_session === 'object' ? options_session.wallet : undefined) ?? {}
 
     const handler = Accounts.Handler.auth({
+      getClient: options.getClient,
       ...(issuer || requireEmail
         ? { identity: { ...(issuer ? { issuer } : {}), ...(requireEmail ? { required: true } : {}) } } // prettier-ignore
         : {}),
@@ -912,6 +914,7 @@ export function install(options: install.Options) {
           409: handlerError('Challenge nonce already used or unknown.'),
           429: OpenApi.standardError(429, 'Rate limited.'),
           500: OpenApi.standardError(500, 'Internal server error.'),
+          502: handlerError('The Tempo RPC could not verify the signature.'),
         },
         summary: 'Authenticate (SIWE)',
         tags: ['Authentication'],
@@ -967,6 +970,8 @@ export declare namespace install {
       | undefined
     /** Authoritative database holding user rows. */
     db: Db.Source
+    /** Resolves the configured Tempo RPC client used for SIWE signature verification. */
+    getClient: (chainId: number) => Viem.getClient.ReturnType
     /** KV state store, or undefined when key auth is closed. */
     kv: { store: Store.State } | undefined
     /** Scope catalog accepted while resolving API-key records. */
@@ -1142,7 +1147,7 @@ function laneDefaults(options: middleware.Options): LaneDefaults {
       scopes: apiKey?.scopes ?? [Scope.wildcard],
     },
     mpp: { session: {} },
-    public: { rateLimit: public_?.rateLimit ?? { perMinute: 60 } },
+    public: { rateLimit: public_?.rateLimit ?? { limit: 60, period: 'minute' } },
     session: true,
   }
 }
@@ -1525,7 +1530,7 @@ export function require<environment extends Environment = Environment>(
         // A throttled sandbox key shares the key's bucket but at the public
         // ceiling, so activating billing lifts the limit on the same counter.
         const limit = throttled
-          ? (policy.public?.rateLimit ?? auth.publicRateLimit ?? { perMinute: 60 })
+          ? (policy.public?.rateLimit ?? auth.publicRateLimit ?? { limit: 60, period: 'minute' })
           : resolveApiKeyLimit({ apiKey, auth, policy: policy.apiKey, scope })
         const result = await consumeRateLimit(auth, {
           key: `api_key:${apiKey.id}:scope:${scope}`,
@@ -1669,65 +1674,6 @@ type RateLimitAccess = PaymentAccess & {
   rateLimit: RateLimit.Result
 }
 
-/** Shared or per-chain credentials. */
-export type ChainCredential = string | Record<number, string>
-
-/** Parses shared or per-chain credentials from an environment value. */
-export function parseCredential(value: ChainCredential | undefined): parseCredential.ReturnType {
-  if (!value) return undefined
-  if (typeof value !== 'string') return value
-  const credentials = (() => {
-    try {
-      return JSON.parse(value) as unknown
-    } catch {
-      return value
-    }
-  })()
-  if (typeof credentials === 'string') return credentials
-  if (
-    !credentials ||
-    typeof credentials !== 'object' ||
-    Array.isArray(credentials) ||
-    Object.values(credentials).some((credential) => typeof credential !== 'string')
-  )
-    throw new Error('Expected a credential or a chain-id-to-credential JSON object.')
-  return credentials as Record<number, string>
-}
-
-export declare namespace parseCredential {
-  /** Parsed shared or per-chain credentials. */
-  type ReturnType = ChainCredential | undefined
-}
-
-/** Resolves a chain credential and infers its HTTP authorization scheme. */
-export function resolveCredential(
-  options: resolveCredential.Options,
-): resolveCredential.ReturnType {
-  const credentials = parseCredential(options.value)
-  const credential = typeof credentials === 'string' ? credentials : credentials?.[options.chainId]
-  if (!credential) return { basicAuth: undefined }
-  if (credential.includes(':')) return { basicAuth: credential }
-  return { basicAuth: undefined, bearerAuth: credential }
-}
-
-export declare namespace resolveCredential {
-  /** Options for resolving a chain credential. */
-  type Options = {
-    /** Chain id selecting a per-chain credential. */
-    chainId: number
-    /** Shared or per-chain credentials. */
-    value?: ChainCredential | undefined
-  }
-
-  /** Resolved HTTP authorization credentials. */
-  type ReturnType = {
-    /** Basic credentials inferred from a value containing a colon. */
-    basicAuth: string | undefined
-    /** Bearer credential inferred from a value without a colon. */
-    bearerAuth?: string | undefined
-  }
-}
-
 /**
  * How long to wait for the rate-limit counter before failing open. A hot
  * counter backend (e.g. a single Durable Object serving one busy quota bucket)

package/src/internal/Credential.test.ts

@@ -0,0 +1,51 @@
+import * as Credential from './Credential.js'
+
+describe('parseCredential', () => {
+  test('parses credentials keyed by chain id', () => {
+    const credential = Credential.parseCredential(
+      JSON.stringify({ 4217: 'mainnet:secret', 421700001: 'zone:secret' }),
+    )
+
+    expect(credential).toEqual({ 4217: 'mainnet:secret', 421700001: 'zone:secret' })
+  })
+
+  test('supports a shared credential', () => {
+    expect(Credential.parseCredential('shared:secret')).toBe('shared:secret')
+  })
+
+  test('rejects malformed credential maps', () => {
+    expect(() => Credential.parseCredential('{"4217":1}')).toThrowErrorMatchingInlineSnapshot(
+      `[Error: Expected a credential or a chain-id-to-credential JSON object.]`,
+    )
+  })
+})
+
+describe('resolveCredential', () => {
+  test('infers Basic auth from a credential containing a colon', () => {
+    expect(Credential.resolveCredential({ chainId: 4217, value: 'user:password' })).toEqual({
+      basicAuth: 'user:password',
+    })
+  })
+
+  test('infers Bearer auth from a credential without a colon', () => {
+    expect(Credential.resolveCredential({ chainId: 4217, value: 'bearer-token' })).toEqual({
+      basicAuth: undefined,
+      bearerAuth: 'bearer-token',
+    })
+  })
+
+  test('selects a credential by chain id', () => {
+    const value = JSON.stringify({ 4217: 'mainnet:secret', 421700001: 'zone-token' })
+
+    expect(Credential.resolveCredential({ chainId: 4217, value })).toEqual({
+      basicAuth: 'mainnet:secret',
+    })
+    expect(Credential.resolveCredential({ chainId: 421700001, value })).toEqual({
+      basicAuth: undefined,
+      bearerAuth: 'zone-token',
+    })
+    expect(Credential.resolveCredential({ chainId: 42431, value })).toEqual({
+      basicAuth: undefined,
+    })
+  })
+})