tapimo 0.10.2 → 0.12.0

package/src/apps/management/routes/verified-token-requests.ts

@@ -28,148 +28,160 @@ export namespace schema {
    * An organization's verification request (response shape). `reviewedBy` is
    * deliberately absent: reviewer identity stays on the admin surface.
    */
-  export const VerifiedTokenRequest = Schema.describe(
-    z.extend(tokenSchema.Input, {
-      chainId,
-      createdAt: z
-        .string()
-        .check(
-          z.describe('When the request was created (ISO 8601).'),
-          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
-        ),
-      id: z
-        .string()
-        .check(
-          z.describe('Opaque request resource id (`vtr_…`).'),
-          z.meta({ examples: ['vtr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
-        ),
-      logo: z.optional(
-        z
+  export const VerifiedTokenRequest = OpenApi.component(
+    Schema.describe(
+      z.extend(tokenSchema.Input, {
+        chainId,
+        createdAt: z.iso
+          .datetime()
+          .check(
+            z.describe('When the request was created (ISO 8601).'),
+            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+          ),
+        id: z
           .string()
           .check(
-            z.describe('Inline SVG logo markup uploaded with the request, when present.'),
-            z.meta({ examples: ['<svg xmlns="http://www.w3.org/2000/svg"/>'] }),
+            z.describe('Opaque request resource id (`vtr_…`).'),
+            z.meta({ examples: ['vtr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
           ),
-      ),
-      note: z
-        .nullable(z.string())
-        .check(
-          z.describe('Requester note to the reviewers, or null.'),
-          z.meta({ examples: ['We are the token issuer.', null] }),
-        ),
-      orgId: z
-        .string()
-        .check(
-          z.describe('Requesting organization id (`org_…`).'),
-          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
-        ),
-      requestedBy: z
-        .string()
-        .check(
-          z.describe('User id that submitted the request.'),
-          z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
-        ),
-      reviewNote: z
-        .nullable(z.string())
-        .check(
-          z.describe('Reviewer note shown when the request was denied, or null.'),
-          z.meta({ examples: ['Logo URL is unreachable.', null] }),
-        ),
-      reviewedAt: z
-        .nullable(z.string())
-        .check(
-          z.describe('When the request was reviewed (ISO 8601), or null while pending.'),
-          z.meta({ examples: ['2026-01-02T00:00:00.000Z', null] }),
-        ),
-      status: z
-        .enum(['approved', 'denied', 'pending'])
-        .check(z.describe('Review status of the request.'), z.meta({ examples: ['pending'] })),
-      updatedAt: z
-        .string()
-        .check(
-          z.describe('When the request was last changed (ISO 8601).'),
-          z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+        logo: z.optional(
+          z
+            .string()
+            .check(
+              z.describe('Inline SVG logo markup uploaded with the request, when present.'),
+              z.meta({ examples: ['<svg xmlns="http://www.w3.org/2000/svg"/>'] }),
+            ),
         ),
-    }),
-    "An organization's request to add a token to the curated verified list.",
+        note: z
+          .nullable(z.string())
+          .check(
+            z.describe('Requester note to the reviewers, or null.'),
+            z.meta({ examples: ['We are the token issuer.', null] }),
+          ),
+        orgId: z
+          .string()
+          .check(
+            z.describe('Requesting organization id (`org_…`).'),
+            z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+        requestedBy: z
+          .string()
+          .check(
+            z.describe('User id that submitted the request.'),
+            z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+        reviewNote: z
+          .nullable(z.string())
+          .check(
+            z.describe('Reviewer note shown when the request was denied, or null.'),
+            z.meta({ examples: ['Logo URL is unreachable.', null] }),
+          ),
+        reviewedAt: z
+          .nullable(z.iso.datetime())
+          .check(
+            z.describe('When the request was reviewed (ISO 8601), or null while pending.'),
+            z.meta({ examples: ['2026-01-02T00:00:00.000Z', null] }),
+          ),
+        status: z
+          .enum(['approved', 'denied', 'pending'])
+          .check(z.describe('Review status of the request.'), z.meta({ examples: ['pending'] })),
+        updatedAt: z.iso
+          .datetime()
+          .check(
+            z.describe('When the request was last changed (ISO 8601).'),
+            z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }),
+          ),
+      }),
+      "An organization's request to add a token to the curated verified list.",
+    ),
+    'VerifiedTokenRequest',
   )
 
   /**
    * Create body. The shared token fields trust admin curation, so the
    * member-facing surface re-declares them with length caps.
    */
-  export const CreateBody = Schema.describe(
-    z.extend(tokenSchema.Input, {
-      chainId: Schema.ChainId,
-      currency: z
-        .string()
-        .check(
-          z.minLength(1),
-          z.maxLength(10),
-          z.describe('The currency label for this token, such as `USD`.'),
-          z.meta({ examples: ['USD'] }),
-        ),
-      logo: z.optional(
-        z.string().check(
-          z.refine(
-            (value) => /^<(\?xml|svg)[\s/>]/i.test(value.trimStart()),
-            'Logo must be SVG markup.',
+  export const CreateBody = OpenApi.component(
+    Schema.describe(
+      z.extend(tokenSchema.Input, {
+        chainId: Schema.ChainId,
+        currency: z
+          .string()
+          .check(
+            z.minLength(1),
+            z.maxLength(10),
+            z.describe('The currency label for this token, such as `USD`.'),
+            z.meta({ examples: ['USD'] }),
           ),
-          z.refine(
-            (value) => new TextEncoder().encode(value).byteLength <= maxLogoBytes,
-            `Logo exceeds the ${maxLogoBytes / 1024} KiB limit.`,
+        logo: z.optional(
+          z.string().check(
+            z.refine(
+              (value) => /^<(\?xml|svg)[\s/>]/i.test(value.trimStart()),
+              'Logo must be SVG markup.',
+            ),
+            z.refine(
+              (value) => new TextEncoder().encode(value).byteLength <= maxLogoBytes,
+              `Logo exceeds the ${maxLogoBytes / 1024} KiB limit.`,
+            ),
+            z.describe('Inline SVG logo markup, published to the asset store on approval.'),
+            z.meta({ examples: ['<svg xmlns="http://www.w3.org/2000/svg"/>'] }),
           ),
-          z.describe('Inline SVG logo markup, published to the asset store on approval.'),
-          z.meta({ examples: ['<svg xmlns="http://www.w3.org/2000/svg"/>'] }),
         ),
-      ),
-      logoUri: z.optional(
-        z
-          .url({ protocol: /^https$/ })
+        logoUri: z.optional(
+          z
+            .url({ protocol: /^https$/ })
+            .check(
+              z.maxLength(2048),
+              z.describe('The HTTPS URL for this token’s logo image, when one is set.'),
+              z.meta({ examples: ['https://assets.tempo.xyz/icons/usdc.svg'] }),
+            ),
+        ),
+        name: z
+          .string()
           .check(
-            z.maxLength(2048),
-            z.describe('The HTTPS URL for this token’s logo image, when one is set.'),
-            z.meta({ examples: ['https://assets.tempo.xyz/icons/usdc.svg'] }),
+            z.minLength(1),
+            z.maxLength(100),
+            z.describe('The token’s human-readable name.'),
+            z.meta({ examples: ['USD Coin'] }),
           ),
-      ),
-      name: z
-        .string()
-        .check(
-          z.minLength(1),
-          z.maxLength(100),
-          z.describe('The token’s human-readable name.'),
-          z.meta({ examples: ['USD Coin'] }),
+        note: z.optional(
+          z
+            .string()
+            .check(
+              z.trim(),
+              z.maxLength(500),
+              z.describe('Optional note to the reviewers.'),
+              z.meta({ examples: ['We are the token issuer.'] }),
+            ),
         ),
-      note: z.optional(
-        z
+        symbol: z
           .string()
           .check(
-            z.trim(),
-            z.maxLength(500),
-            z.describe('Optional note to the reviewers.'),
-            z.meta({ examples: ['We are the token issuer.'] }),
+            z.minLength(1),
+            z.maxLength(20),
+            z.describe('The short ticker symbol wallets and apps show for this token.'),
+            z.meta({ examples: ['USDC'] }),
           ),
-      ),
-      symbol: z
-        .string()
-        .check(
-          z.minLength(1),
-          z.maxLength(20),
-          z.describe('The short ticker symbol wallets and apps show for this token.'),
-          z.meta({ examples: ['USDC'] }),
-        ),
-    }),
-    'Fields for requesting verification of a token.',
+      }),
+      'Fields for requesting verification of a token.',
+    ),
+    'CreateVerifiedTokenRequestInput',
   )
 
   /** Non-paginated list of an organization's requests. */
-  export const ListResponse = Schema.describe(
-    z.object({
-      data: z
-        .array(VerifiedTokenRequest)
-        .check(z.describe("The organization's verification requests, newest first.")),
-    }),
-    "A non-paginated list of an organization's verified-token requests.",
+  export const ListResponse = OpenApi.component(
+    Schema.describe(
+      z.object({
+        data: z
+          .array(VerifiedTokenRequest)
+          .check(
+            z.describe("The organization's verification requests, newest first."),
+            z.meta({ examples: [[]] }),
+          ),
+      }),
+      "A non-paginated list of an organization's verified-token requests.",
+    ),
+    'VerifiedTokenRequestList',
   )
 
   /** Path parameters addressing an organization's requests. */
@@ -203,16 +215,19 @@ export namespace schema {
     .check(z.describe('Path parameters for one verified-token request.'))
 
   /** Cancel confirmation. */
-  export const DeleteResponse = z
-    .object({
-      id: z
-        .string()
-        .check(
-          z.describe('Canceled request resource id.'),
-          z.meta({ examples: ['vtr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
-        ),
-    })
-    .check(z.describe('Confirmation that a verified-token request was canceled.'))
+  export const DeleteResponse = OpenApi.component(
+    z
+      .object({
+        id: z
+          .string()
+          .check(
+            z.describe('Canceled request resource id.'),
+            z.meta({ examples: ['vtr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+      })
+      .check(z.describe('Confirmation that a verified-token request was canceled.')),
+    'CancelVerifiedTokenRequestResponse',
+  )
 }
 
 const bodyValidation = {
@@ -240,7 +255,14 @@ export function verifiedTokenRequests() {
         operationId: 'createVerifiedTokenRequest',
         responses: OpenApi.responses({
           errors: {
-            404: 'No accessible organization was found.',
+            400: {
+              codes: ['body_invalid', 'param_invalid'],
+              description: 'Malformed API key, invalid path, or invalid body.',
+            },
+            404: {
+              codes: ['organization_not_found'],
+              description: 'No accessible organization was found.',
+            },
             409: {
               codes: ['request_limit_reached', 'request_pending_exists', 'verified_symbol_exists', 'verified_token_exists'], // prettier-ignore
               description: 'The token is already verified or requested, or the organization is at its pending-request limit.', // prettier-ignore
@@ -254,6 +276,7 @@ export function verifiedTokenRequests() {
       async (c) => {
         if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (OpenApi.narrowValidation) return OpenApi.validationError(c, paramValidation)
         if (OpenApi.narrowValidation) return OpenApi.validationError(c, bodyValidation)
         const body = c.req.valid('json')
         try {
@@ -319,7 +342,13 @@ export function verifiedTokenRequests() {
       OpenApi.describeRoute({
         operationId: 'listVerifiedTokenRequests',
         responses: OpenApi.responses({
-          errors: { 404: 'No accessible organization was found.' },
+          errors: {
+            400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+            404: {
+              codes: ['organization_not_found'],
+              description: 'No accessible organization was found.',
+            },
+          },
           success: { description: 'Verification requests.', schema: schema.ListResponse },
         }),
         summary: 'List token requests',
@@ -351,7 +380,11 @@ export function verifiedTokenRequests() {
         operationId: 'cancelVerifiedTokenRequest',
         responses: OpenApi.responses({
           errors: {
-            404: 'No accessible verification request was found.',
+            400: { codes: ['param_invalid'], description: 'Malformed API key or invalid path.' },
+            404: {
+              codes: ['organization_not_found', 'verified_token_request_not_found'],
+              description: 'No accessible organization or verification request was found.',
+            },
             409: {
               codes: ['request_not_pending'],
               description: 'Only pending requests can be canceled.',