tapimo 0.10.2 → 0.12.0

package/src/admin/apps/earn-vaults.test.ts

@@ -20,6 +20,15 @@ const input = {
   privateOutputTokens: [],
   slug: 'btpathusd-earn',
   vaultAddress,
+  zones: [],
+} as const
+
+const zoneInput = {
+  ...input,
+  label: 'Moderato Earn',
+  slug: 'moderato-earn',
+  vaultAddress: TestEarn.zoneVaultAddress,
+  zones: [TestEarn.zoneRoute],
 } as const
 
 describe('authentication', () => {
@@ -179,6 +188,140 @@ describe('putVerifiedEarnVault', () => {
     expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
   })
 
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'rejects duplicate Zone routes',
+    async () => {
+      const { app } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          ...zoneInput,
+          zones: [TestEarn.zoneRoute, TestEarn.zoneRoute],
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(400)
+      expect(await response.json()).toMatchObject({
+        error: {
+          code: 'body_invalid',
+          details: [{ message: 'Zone 1424310001 is configured more than once.' }],
+        },
+      })
+    },
+    60_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'rejects a router bound to a different vault',
+    async () => {
+      const { app } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({ ...zoneInput, vaultAddress }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(409)
+      expect(await response.json()).toEqual(
+        expect.objectContaining({
+          error: expect.objectContaining({
+            code: 'earn_vault_verification_failed',
+            details: expect.arrayContaining([
+              { message: 'Earn router is configured for a different Earn vault.' },
+            ]),
+          }),
+        }),
+      )
+    },
+    60_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'verifies, stores, and preserves a Zone route',
+    async () => {
+      const { app, db } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify(zoneInput),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(200)
+      const vault = await TestApp.json(response, App.schema.putVerifiedEarnVault.Response)
+      expect(vault.capabilities).toMatchObject({ privateRouting: true, routerSwaps: true })
+      expect(vault.zones).toHaveLength(1)
+      expect(vault.zones?.[0]).toMatchObject(TestEarn.zoneRoute)
+      expect(vault.zone).toStrictEqual(
+        vault.zones?.[0]
+          ? {
+              chainId: vault.zones[0].chainId,
+              inputTokens: vault.zones[0].inputTokens,
+              name: vault.zones[0].name,
+              outputTokens: vault.zones[0].outputTokens,
+            }
+          : null,
+      )
+      expect(vault.zones?.[0]?.inputTokens).toHaveLength(1)
+      expect(vault.zones?.[0]?.outputTokens).toStrictEqual(vault.zones?.[0]?.inputTokens)
+
+      const updatedResponse = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          chainId: zoneInput.chainId,
+          label: 'Updated Moderato Earn',
+          vaultAddress: zoneInput.vaultAddress,
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(updatedResponse.status).toBe(200)
+      expect(
+        (await TestApp.json(updatedResponse, App.schema.putVerifiedEarnVault.Response)).zones,
+      ).toStrictEqual(vault.zones)
+      expect(
+        await core_EarnVaults.get(db, {
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+        }),
+      ).toMatchObject({ zones: [TestEarn.zoneRoute] })
+    },
+    90_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'migrates preserved private tokens to a verified Zone route',
+    async () => {
+      const { app, db } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      await core_EarnVaults.upsert(db, {
+        ...TestEarn.zoneVerifiedVault,
+        privateInputTokens: [asset],
+        privateOutputTokens: [asset],
+        zones: [],
+      })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+          zones: zoneInput.zones,
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+
+      expect(response.status).toBe(200)
+      const vault = await TestApp.json(response, App.schema.putVerifiedEarnVault.Response)
+      expect(vault.zones).toHaveLength(1)
+      expect(
+        await core_EarnVaults.get(db, {
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+        }),
+      ).toMatchObject({
+        privateInputTokens: [asset],
+        privateOutputTokens: [asset],
+        zones: [TestEarn.zoneRoute],
+      })
+    },
+    90_000,
+  )
+
   test.runIf(Runtime.get().mode === 'testnet')(
     'rejects private tokens without a configured router',
     async () => {

package/src/admin/apps/earn-vaults.ts

@@ -96,6 +96,9 @@ export namespace schema {
           z.describe('Earn vault contract address.'),
           z.meta({ examples: ['0xf4ae63687d6753a78e7f551d2eda1d0d31a5ea3a'] }),
         ),
+        zones: z
+          .optional(z.array(EarnVaults.schema.ZoneRoute))
+          .check(z.describe('Curated private Zone routes.')),
       })
       .check(z.describe('Curated fields used to verify and store one Earn vault.'))
 
@@ -240,11 +243,22 @@ export function earnVaults() {
           const privateInputTokens = input.privateInputTokens ?? existing?.privateInputTokens ?? []
           const privateOutputTokens =
             input.privateOutputTokens ?? existing?.privateOutputTokens ?? []
+          const zoneRoutes = input.zones ?? existing?.zones ?? []
           const hasPrivateInputs = privateInputTokens.length > 0
           const hasPrivateOutputs = privateOutputTokens.length > 0
           if (hasPrivateInputs !== hasPrivateOutputs)
             return verificationFailed(c, 'Private input and output tokens must both be configured.')
-          if (hasPrivateInputs && !discovery.capabilities.privateRouting)
+          const resolvedZoneRoutes = await EarnVaults.resolveZoneRoutes({
+            discovery,
+            getClient: c.get('getClient'),
+            routes: zoneRoutes,
+            zones: c.get('zones'),
+          })
+          const capabilities =
+            resolvedZoneRoutes.length > 0
+              ? EarnVaults.addZoneRouteCapabilities(discovery.capabilities)
+              : discovery.capabilities
+          if (hasPrivateInputs && !capabilities.privateRouting)
             return verificationFailed(c, 'The chain does not support private Earn routing.')
 
           await core_EarnVaults.upsert(db, {
@@ -256,10 +270,11 @@ export function earnVaults() {
             privateOutputTokens,
             ...(input.slug !== undefined ? { slug: input.slug } : {}),
             vaultAddress: input.vaultAddress,
+            zones: zoneRoutes,
           })
           const data = await getVault(c, {
             chainId: input.chainId,
-            include: ['access', 'capabilities', 'zone'],
+            include: ['access', 'capabilities', 'zone', 'zones'],
             vaultAddress: input.vaultAddress,
           })
           return c.json(Response.validated(schema.putVerifiedEarnVault.Response, data), 200)
@@ -326,13 +341,19 @@ async function listVerifiedVaults(
   const matches: listVerifiedVaults.Match[] = []
 
   for (const record of candidates) {
-    const discovery = await resolveVault(c, {
+    const discovered = await resolveVault(c, {
       chainId: options.chainId,
       include: discoveryInclude(options),
       vaultAddress: record.vaultAddress,
     })
+    const { discovery, zoneRoutes } = await resolveVaultRoutes(c, {
+      capability: options.capability,
+      discovery: discovered,
+      include: options.include,
+      record,
+    })
     if (!Earn.matchesVaultFilters(discovery, options)) continue
-    matches.push({ discovery, record })
+    matches.push({ discovery, record, zoneRoutes })
     if (matches.length > options.limit) break
   }
 
@@ -361,6 +382,8 @@ declare namespace listVerifiedVaults {
     discovery: EarnVaults.Discovery
     /** Curated registry row. */
     record: core_EarnVaults.Record
+    /** Verified private Zone routes selected for serialization. */
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
   }
 
   type Options = z.output<typeof schema.listVerifiedEarnVaults.Query> & {
@@ -373,14 +396,20 @@ async function getVault(c: Context<App.Environment>, options: getVault.Options)
   const db = Db.get(c.get('db'))
   const record = await core_EarnVaults.get(db, options)
   try {
-    const [discovery, snapshot] = await Promise.all([
+    const [discovered, snapshot] = await Promise.all([
       resolveVault(c, {
         ...options,
         include: discoveryInclude({ capability: [], include: options.include }),
       }),
       VerifiedTokens.read(db, options.chainId),
     ])
-    return serializeVault(c, { ...options, discovery, record, snapshot })
+    const { discovery, zoneRoutes } = await resolveVaultRoutes(c, {
+      capability: [],
+      discovery: discovered,
+      include: options.include,
+      record,
+    })
+    return serializeVault(c, { ...options, discovery, record, snapshot, zoneRoutes })
   } catch (cause) {
     if (Earn.isIncompatible(cause)) throw new Earn.NotFoundError()
     throw cause
@@ -421,6 +450,51 @@ declare namespace resolveVault {
   }
 }
 
+async function resolveVaultRoutes(
+  c: Context<App.Environment>,
+  options: resolveVaultRoutes.Options,
+): Promise<resolveVaultRoutes.Result> {
+  const { discovery, record } = options
+  if (!record || record.zones.length === 0) return { discovery, zoneRoutes: [] }
+
+  const includesRoutes = options.include.includes('zone') || options.include.includes('zones')
+  const needsCapabilities =
+    options.include.includes('capabilities') ||
+    options.capability.includes('privateRouting') ||
+    options.capability.includes('routerSwaps')
+  if (!includesRoutes && !needsCapabilities) return { discovery, zoneRoutes: [] }
+
+  const zoneRoutes = await EarnVaults.resolveZoneRoutes({
+    discovery,
+    getClient: c.get('getClient'),
+    routes: record.zones,
+    zones: c.get('zones'),
+  })
+  const capabilities = discovery.capabilities
+  if (needsCapabilities && !capabilities)
+    throw new Error('Earn vault capabilities were not resolved.')
+  return {
+    discovery: capabilities
+      ? { ...discovery, capabilities: EarnVaults.addZoneRouteCapabilities(capabilities) }
+      : discovery,
+    zoneRoutes: includesRoutes ? zoneRoutes : [],
+  }
+}
+
+declare namespace resolveVaultRoutes {
+  type Options = {
+    capability: z.output<typeof schema.listVerifiedEarnVaults.Query>['capability']
+    discovery: EarnVaults.Discovery
+    include: z.output<typeof schema.getVerifiedEarnVault.Query>['include']
+    record?: core_EarnVaults.Record | undefined
+  }
+
+  type Result = {
+    discovery: EarnVaults.Discovery
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
+  }
+}
+
 async function serializeVault(
   c: Context<App.Environment>,
   options: serializeVault.Options,
@@ -439,6 +513,7 @@ async function serializeVault(
     record: options.record,
     shareToken,
     tvl: null,
+    zoneRoutes: options.zoneRoutes,
     zones: c.get('zones'),
   })
 }
@@ -455,6 +530,8 @@ declare namespace serializeVault {
     record?: core_EarnVaults.Record | undefined
     /** Verified-token snapshot, when configured. */
     snapshot: VerifiedTokens.Snapshot | null
+    /** Verified private Zone routes selected for serialization. */
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
   }
 }
 

package/src/admin/apps/organizations.ts

@@ -504,11 +504,15 @@ export namespace schema {
         .check(
           z.int(),
           z.nonnegative(),
-          z.describe('Consecutive delivery failures.'),
+          z.describe('Consecutive delivery failures, capped at the auto-disable threshold.'),
           z.meta({ examples: [2] }),
         ),
       id: z.string().check(z.describe('Subscription id.'), z.meta({ examples: ['wh_123'] })),
-      lastDeliveryAt: z.nullable(timestamp).check(z.describe('Last successful delivery, or null.')),
+      lastDeliveryAt: z
+        .nullable(timestamp)
+        .check(
+          z.describe('Last successful delivery (refreshed at most once per minute), or null.'),
+        ),
       status: z
         .enum(['active', 'disabled', 'paused'])
         .check(z.describe('Subscription status.'), z.meta({ examples: ['active'] })),

package/src/admin/ui/src/routes/api-keys.tsx

@@ -59,6 +59,14 @@ function RouteComponent() {
       alert('Enter a name that identifies what uses this key.')
       return
     }
+    const allowedIps = [
+      ...new Set(
+        field('allowedIps')
+          .split(/[,\n]/)
+          .map((value) => value.trim())
+          .filter(Boolean),
+      ),
+    ]
     const expiresAt_value = field('expiresAt')
     const expiresAt = expiresAt_value ? new Date(expiresAt_value).toISOString() : undefined
     const orgId = filters.orgId ?? field('orgId')
@@ -88,6 +96,7 @@ function RouteComponent() {
     }
     provision.mutate(
       {
+        allowedIps,
         environment,
         ...(expiresAt === undefined ? {} : { expiresAt }),
         name,
@@ -309,6 +318,19 @@ function ProvisionForm(props: {
             suffix="req/min"
             type="number"
           />
+          <label className="flex min-w-0 flex-col gap-2">
+            <span className="text-label-13 text-foreground-secondary">IP allowlist (optional)</span>
+            <textarea
+              className="min-h-24 w-full resize-y rounded-body border-2 border-transparent bg-secondary px-3 py-2.5 font-mono text-copy-13 text-foreground outline-none placeholder:font-sans placeholder:text-foreground-secondary/50 hover:bg-secondary-hover focus-visible:border-focus focus-visible:bg-secondary-hover"
+              name="allowedIps"
+              placeholder={'203.0.113.10\n198.51.100.0/24'}
+              rows={4}
+            />
+            <span className="text-label-12 text-foreground-secondary">
+              Separate exact IP addresses or CIDR ranges with commas or new lines. Leave empty for
+              unrestricted access.
+            </span>
+          </label>
           <div className="flex flex-col gap-2">
             <span className="label-13 text-foreground-secondary">Scopes</span>
             {scopes.isPending ? (
@@ -681,6 +703,19 @@ function KeyRow(props: { currentUser?: string | undefined; record: ApiKeys.ApiKe
             {record.expiresAt ? (
               <Detail label="Expires">{Format.date(record.expiresAt)}</Detail>
             ) : null}
+            <Detail className="w-full" label="IP allowlist">
+              {record.allowedIps.length === 0 ? (
+                'Unrestricted'
+              ) : (
+                <span className="flex flex-wrap gap-x-3 gap-y-1 font-mono">
+                  {record.allowedIps.map((address) => (
+                    <span className="break-all" key={address}>
+                      {address}
+                    </span>
+                  ))}
+                </span>
+              )}
+            </Detail>
             <Detail className="w-full" label="Scopes">
               {record.scopes.length === 0 ? (
                 '—'
@@ -893,6 +928,7 @@ function matches(record: ApiKeys.ApiKey, query?: string) {
     record.projectId,
     record.projectName,
     record.tokenLast4,
+    ...record.allowedIps,
     ...record.scopes,
   ].some((value) => value?.toLowerCase().includes(normalized))
 }