tapimo 0.11.0 → 0.13.0

package/src/admin/apps/earn-vaults.test.ts

@@ -20,6 +20,15 @@ const input = {
   privateOutputTokens: [],
   slug: 'btpathusd-earn',
   vaultAddress,
+  zones: [],
+} as const
+
+const zoneInput = {
+  ...input,
+  label: 'Moderato Earn',
+  slug: 'moderato-earn',
+  vaultAddress: TestEarn.zoneVaultAddress,
+  zones: [TestEarn.zoneRoute],
 } as const
 
 describe('authentication', () => {
@@ -179,6 +188,140 @@ describe('putVerifiedEarnVault', () => {
     expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
   })
 
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'rejects duplicate Zone routes',
+    async () => {
+      const { app } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          ...zoneInput,
+          zones: [TestEarn.zoneRoute, TestEarn.zoneRoute],
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(400)
+      expect(await response.json()).toMatchObject({
+        error: {
+          code: 'body_invalid',
+          details: [{ message: 'Zone 1424310003 is configured more than once.' }],
+        },
+      })
+    },
+    60_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'rejects a router bound to a different vault',
+    async () => {
+      const { app } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({ ...zoneInput, vaultAddress }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(409)
+      expect(await response.json()).toEqual(
+        expect.objectContaining({
+          error: expect.objectContaining({
+            code: 'earn_vault_verification_failed',
+            details: expect.arrayContaining([
+              { message: 'Earn router is configured for a different Earn vault.' },
+            ]),
+          }),
+        }),
+      )
+    },
+    60_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'verifies, stores, and preserves a Zone route',
+    async () => {
+      const { app, db } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify(zoneInput),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(200)
+      const vault = await TestApp.json(response, App.schema.putVerifiedEarnVault.Response)
+      expect(vault.capabilities).toMatchObject({ privateRouting: true, routerSwaps: true })
+      expect(vault.zones).toHaveLength(1)
+      expect(vault.zones?.[0]).toMatchObject(TestEarn.zoneRoute)
+      expect(vault.zone).toStrictEqual(
+        vault.zones?.[0]
+          ? {
+              chainId: vault.zones[0].chainId,
+              inputTokens: vault.zones[0].inputTokens,
+              name: vault.zones[0].name,
+              outputTokens: vault.zones[0].outputTokens,
+            }
+          : null,
+      )
+      expect(vault.zones?.[0]?.inputTokens).toHaveLength(1)
+      expect(vault.zones?.[0]?.outputTokens).toStrictEqual(vault.zones?.[0]?.inputTokens)
+
+      const updatedResponse = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          chainId: zoneInput.chainId,
+          label: 'Updated Moderato Earn',
+          vaultAddress: zoneInput.vaultAddress,
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(updatedResponse.status).toBe(200)
+      expect(
+        (await TestApp.json(updatedResponse, App.schema.putVerifiedEarnVault.Response)).zones,
+      ).toStrictEqual(vault.zones)
+      expect(
+        await core_EarnVaults.get(db, {
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+        }),
+      ).toMatchObject({ zones: [TestEarn.zoneRoute] })
+    },
+    90_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'migrates preserved private tokens to a verified Zone route',
+    async () => {
+      const { app, db } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      await core_EarnVaults.upsert(db, {
+        ...TestEarn.zoneVerifiedVault,
+        privateInputTokens: [asset],
+        privateOutputTokens: [asset],
+        zones: [],
+      })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+          zones: zoneInput.zones,
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+
+      expect(response.status).toBe(200)
+      const vault = await TestApp.json(response, App.schema.putVerifiedEarnVault.Response)
+      expect(vault.zones).toHaveLength(1)
+      expect(
+        await core_EarnVaults.get(db, {
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+        }),
+      ).toMatchObject({
+        privateInputTokens: [asset],
+        privateOutputTokens: [asset],
+        zones: [TestEarn.zoneRoute],
+      })
+    },
+    90_000,
+  )
+
   test.runIf(Runtime.get().mode === 'testnet')(
     'rejects private tokens without a configured router',
     async () => {

package/src/admin/apps/earn-vaults.ts

@@ -94,8 +94,11 @@ export namespace schema {
           .check(z.describe('Custom vault slug, generated from the label when omitted.')),
         vaultAddress: Schema.Address.check(
           z.describe('Earn vault contract address.'),
-          z.meta({ examples: ['0xf4ae63687d6753a78e7f551d2eda1d0d31a5ea3a'] }),
+          z.meta({ examples: ['0x140a09b7c5826d34dfa38ea7bfde1c7e478c4408'] }),
         ),
+        zones: z
+          .optional(z.array(EarnVaults.schema.ZoneRoute))
+          .check(z.describe('Curated private Zone routes.')),
       })
       .check(z.describe('Curated fields used to verify and store one Earn vault.'))
 
@@ -240,11 +243,22 @@ export function earnVaults() {
           const privateInputTokens = input.privateInputTokens ?? existing?.privateInputTokens ?? []
           const privateOutputTokens =
             input.privateOutputTokens ?? existing?.privateOutputTokens ?? []
+          const zoneRoutes = input.zones ?? existing?.zones ?? []
           const hasPrivateInputs = privateInputTokens.length > 0
           const hasPrivateOutputs = privateOutputTokens.length > 0
           if (hasPrivateInputs !== hasPrivateOutputs)
             return verificationFailed(c, 'Private input and output tokens must both be configured.')
-          if (hasPrivateInputs && !discovery.capabilities.privateRouting)
+          const resolvedZoneRoutes = await EarnVaults.resolveZoneRoutes({
+            discovery,
+            getClient: c.get('getClient'),
+            routes: zoneRoutes,
+            zones: c.get('zones'),
+          })
+          const capabilities =
+            resolvedZoneRoutes.length > 0
+              ? EarnVaults.addZoneRouteCapabilities(discovery.capabilities)
+              : discovery.capabilities
+          if (hasPrivateInputs && !capabilities.privateRouting)
             return verificationFailed(c, 'The chain does not support private Earn routing.')
 
           await core_EarnVaults.upsert(db, {
@@ -256,10 +270,11 @@ export function earnVaults() {
             privateOutputTokens,
             ...(input.slug !== undefined ? { slug: input.slug } : {}),
             vaultAddress: input.vaultAddress,
+            zones: zoneRoutes,
           })
           const data = await getVault(c, {
             chainId: input.chainId,
-            include: ['access', 'capabilities', 'zone'],
+            include: ['access', 'capabilities', 'zone', 'zones'],
             vaultAddress: input.vaultAddress,
           })
           return c.json(Response.validated(schema.putVerifiedEarnVault.Response, data), 200)
@@ -326,13 +341,19 @@ async function listVerifiedVaults(
   const matches: listVerifiedVaults.Match[] = []
 
   for (const record of candidates) {
-    const discovery = await resolveVault(c, {
+    const discovered = await resolveVault(c, {
       chainId: options.chainId,
       include: discoveryInclude(options),
       vaultAddress: record.vaultAddress,
     })
+    const { discovery, zoneRoutes } = await resolveVaultRoutes(c, {
+      capability: options.capability,
+      discovery: discovered,
+      include: options.include,
+      record,
+    })
     if (!Earn.matchesVaultFilters(discovery, options)) continue
-    matches.push({ discovery, record })
+    matches.push({ discovery, record, zoneRoutes })
     if (matches.length > options.limit) break
   }
 
@@ -361,6 +382,8 @@ declare namespace listVerifiedVaults {
     discovery: EarnVaults.Discovery
     /** Curated registry row. */
     record: core_EarnVaults.Record
+    /** Verified private Zone routes selected for serialization. */
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
   }
 
   type Options = z.output<typeof schema.listVerifiedEarnVaults.Query> & {
@@ -373,14 +396,20 @@ async function getVault(c: Context<App.Environment>, options: getVault.Options)
   const db = Db.get(c.get('db'))
   const record = await core_EarnVaults.get(db, options)
   try {
-    const [discovery, snapshot] = await Promise.all([
+    const [discovered, snapshot] = await Promise.all([
       resolveVault(c, {
         ...options,
         include: discoveryInclude({ capability: [], include: options.include }),
       }),
       VerifiedTokens.read(db, options.chainId),
     ])
-    return serializeVault(c, { ...options, discovery, record, snapshot })
+    const { discovery, zoneRoutes } = await resolveVaultRoutes(c, {
+      capability: [],
+      discovery: discovered,
+      include: options.include,
+      record,
+    })
+    return serializeVault(c, { ...options, discovery, record, snapshot, zoneRoutes })
   } catch (cause) {
     if (Earn.isIncompatible(cause)) throw new Earn.NotFoundError()
     throw cause
@@ -421,6 +450,51 @@ declare namespace resolveVault {
   }
 }
 
+async function resolveVaultRoutes(
+  c: Context<App.Environment>,
+  options: resolveVaultRoutes.Options,
+): Promise<resolveVaultRoutes.Result> {
+  const { discovery, record } = options
+  if (!record || record.zones.length === 0) return { discovery, zoneRoutes: [] }
+
+  const includesRoutes = options.include.includes('zone') || options.include.includes('zones')
+  const needsCapabilities =
+    options.include.includes('capabilities') ||
+    options.capability.includes('privateRouting') ||
+    options.capability.includes('routerSwaps')
+  if (!includesRoutes && !needsCapabilities) return { discovery, zoneRoutes: [] }
+
+  const zoneRoutes = await EarnVaults.resolveZoneRoutes({
+    discovery,
+    getClient: c.get('getClient'),
+    routes: record.zones,
+    zones: c.get('zones'),
+  })
+  const capabilities = discovery.capabilities
+  if (needsCapabilities && !capabilities)
+    throw new Error('Earn vault capabilities were not resolved.')
+  return {
+    discovery: capabilities
+      ? { ...discovery, capabilities: EarnVaults.addZoneRouteCapabilities(capabilities) }
+      : discovery,
+    zoneRoutes: includesRoutes ? zoneRoutes : [],
+  }
+}
+
+declare namespace resolveVaultRoutes {
+  type Options = {
+    capability: z.output<typeof schema.listVerifiedEarnVaults.Query>['capability']
+    discovery: EarnVaults.Discovery
+    include: z.output<typeof schema.getVerifiedEarnVault.Query>['include']
+    record?: core_EarnVaults.Record | undefined
+  }
+
+  type Result = {
+    discovery: EarnVaults.Discovery
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
+  }
+}
+
 async function serializeVault(
   c: Context<App.Environment>,
   options: serializeVault.Options,
@@ -439,6 +513,7 @@ async function serializeVault(
     record: options.record,
     shareToken,
     tvl: null,
+    zoneRoutes: options.zoneRoutes,
     zones: c.get('zones'),
   })
 }
@@ -455,6 +530,8 @@ declare namespace serializeVault {
     record?: core_EarnVaults.Record | undefined
     /** Verified-token snapshot, when configured. */
     snapshot: VerifiedTokens.Snapshot | null
+    /** Verified private Zone routes selected for serialization. */
+    zoneRoutes: readonly EarnVaults.ResolvedZoneRoute[]
   }
 }
 

package/src/admin/apps/organizations.ts

@@ -504,11 +504,15 @@ export namespace schema {
         .check(
           z.int(),
           z.nonnegative(),
-          z.describe('Consecutive delivery failures.'),
+          z.describe('Consecutive delivery failures, capped at the auto-disable threshold.'),
           z.meta({ examples: [2] }),
         ),
       id: z.string().check(z.describe('Subscription id.'), z.meta({ examples: ['wh_123'] })),
-      lastDeliveryAt: z.nullable(timestamp).check(z.describe('Last successful delivery, or null.')),
+      lastDeliveryAt: z
+        .nullable(timestamp)
+        .check(
+          z.describe('Last successful delivery (refreshed at most once per minute), or null.'),
+        ),
       status: z
         .enum(['active', 'disabled', 'paused'])
         .check(z.describe('Subscription status.'), z.meta({ examples: ['active'] })),

package/src/admin/ui/src/lib/api-keys.ts

@@ -93,6 +93,25 @@ export namespace update {
   }
 }
 
+/** Rotates an API key while preserving its access and attribution. */
+export namespace rotate {
+  export async function fn(id: string) {
+    const response = await client['api-keys'][':id'].rotate.$post({ param: { id } })
+    if (!response.ok)
+      throw new Error(
+        await Response.errorMessage(response, { fallback: 'Failed to rotate the API key.' }),
+      )
+    return response.json()
+  }
+  export function useMutation() {
+    const queryClient = ReactQuery.useQueryClient()
+    return ReactQuery.useMutation({
+      mutationFn: fn,
+      onSuccess: () => queryClient.invalidateQueries({ queryKey: get.baseKey }),
+    })
+  }
+}
+
 /** Revoke an API key by id. */
 export namespace revoke {
   export async function fn(id: string) {

package/src/admin/ui/src/routes/api-keys.tsx

@@ -8,6 +8,7 @@ import {
   Copy as CopyIcon,
   Pencil,
   Plus,
+  RefreshCw,
   Search,
   Trash2,
   TriangleAlert,
@@ -59,6 +60,14 @@ function RouteComponent() {
       alert('Enter a name that identifies what uses this key.')
       return
     }
+    const allowedIps = [
+      ...new Set(
+        field('allowedIps')
+          .split(/[,\n]/)
+          .map((value) => value.trim())
+          .filter(Boolean),
+      ),
+    ]
     const expiresAt_value = field('expiresAt')
     const expiresAt = expiresAt_value ? new Date(expiresAt_value).toISOString() : undefined
     const orgId = filters.orgId ?? field('orgId')
@@ -88,6 +97,7 @@ function RouteComponent() {
     }
     provision.mutate(
       {
+        allowedIps,
         environment,
         ...(expiresAt === undefined ? {} : { expiresAt }),
         name,
@@ -198,13 +208,13 @@ function RouteComponent() {
   )
 }
 
-function TokenBanner(props: { onDismiss: () => void; token: string }) {
+function TokenBanner(props: { onDismiss: () => void; title?: string; token: string }) {
   const { copy, notifying } = useCopy()
   return (
     <Card className="flex flex-col gap-3 p-4">
       <div className="flex items-start justify-between gap-3">
         <div className="flex flex-col gap-1">
-          <span className="text-label-14 text-foreground">Key provisioned</span>
+          <span className="text-label-14 text-foreground">{props.title ?? 'Key provisioned'}</span>
           <span className="text-label-12 text-foreground-secondary">
             Copy this token now, it won't be shown again.
           </span>
@@ -309,6 +319,19 @@ function ProvisionForm(props: {
             suffix="req/min"
             type="number"
           />
+          <label className="flex min-w-0 flex-col gap-2">
+            <span className="text-label-13 text-foreground-secondary">IP allowlist (optional)</span>
+            <textarea
+              className="min-h-24 w-full resize-y rounded-body border-2 border-transparent bg-secondary px-3 py-2.5 font-mono text-copy-13 text-foreground outline-none placeholder:font-sans placeholder:text-foreground-secondary/50 hover:bg-secondary-hover focus-visible:border-focus focus-visible:bg-secondary-hover"
+              name="allowedIps"
+              placeholder={'203.0.113.10\n198.51.100.0/24'}
+              rows={4}
+            />
+            <span className="text-label-12 text-foreground-secondary">
+              Separate exact IP addresses or CIDR ranges with commas or new lines. Leave empty for
+              unrestricted access.
+            </span>
+          </label>
           <div className="flex flex-col gap-2">
             <span className="label-13 text-foreground-secondary">Scopes</span>
             {scopes.isPending ? (
@@ -681,6 +704,19 @@ function KeyRow(props: { currentUser?: string | undefined; record: ApiKeys.ApiKe
             {record.expiresAt ? (
               <Detail label="Expires">{Format.date(record.expiresAt)}</Detail>
             ) : null}
+            <Detail className="w-full" label="IP allowlist">
+              {record.allowedIps.length === 0 ? (
+                'Unrestricted'
+              ) : (
+                <span className="flex flex-wrap gap-x-3 gap-y-1 font-mono">
+                  {record.allowedIps.map((address) => (
+                    <span className="break-all" key={address}>
+                      {address}
+                    </span>
+                  ))}
+                </span>
+              )}
+            </Detail>
             <Detail className="w-full" label="Scopes">
               {record.scopes.length === 0 ? (
                 '—'
@@ -697,6 +733,7 @@ function KeyRow(props: { currentUser?: string | undefined; record: ApiKeys.ApiKe
           </dl>
           <div className="flex justify-end gap-2 border-t border-border px-5 py-3">
             <EditDialog record={record} />
+            <RotateDialog record={record} />
             <RevokeDialog currentUser={currentUser} record={record} />
           </div>
         </Rows.Panel>
@@ -777,6 +814,91 @@ declare namespace EditDialog {
   }
 }
 
+function RotateDialog(options: RotateDialog.Props) {
+  const { record } = options
+  const [open, setOpen] = useState(false)
+  const rotate = ApiKeys.rotate.useMutation()
+
+  return (
+    <Dialog.Root
+      onOpenChange={(value) => {
+        if (!value && rotate.isPending) return
+        setOpen(value)
+        if (!value) rotate.reset()
+      }}
+      open={open}
+    >
+      <Dialog.Trigger
+        render={
+          <Button size="small">
+            <RefreshCw className="size-4" />
+            Rotate key
+          </Button>
+        }
+      />
+      <Dialog.Popup>
+        {rotate.data ? (
+          <>
+            <Dialog.Title>Key rotated</Dialog.Title>
+            <Dialog.Description>
+              Copy the replacement token now. The source key remains active until it is revoked.
+            </Dialog.Description>
+            <div className="mt-5">
+              <TokenBanner
+                onDismiss={() => setOpen(false)}
+                title="Replacement key provisioned"
+                token={rotate.data.token}
+              />
+            </div>
+          </>
+        ) : (
+          <>
+            <Dialog.Title>Rotate {record.name ?? 'API key'}?</Dialog.Title>
+            <Dialog.Description>
+              This creates a replacement with the same scopes, ownership, limits, and restrictions.
+              The source key remains active.
+            </Dialog.Description>
+            <dl className="mt-5 grid grid-cols-2 gap-4 border border-border bg-secondary p-4">
+              <Detail className="col-span-2" label="Key ID">
+                <code className="break-all">{record.id}</code>
+              </Detail>
+              <Detail label="Environment">{record.environment}</Detail>
+              <Detail label="Organization">{organization(record)}</Detail>
+              <Detail label="Project">{project(record)}</Detail>
+              <Detail label="Scopes">{record.scopes.length}</Detail>
+            </dl>
+            {rotate.error ? (
+              <p className="mt-3 text-copy-13 text-negative">{rotate.error.message}</p>
+            ) : null}
+            <div className="mt-6 flex justify-end gap-2">
+              <Dialog.Close
+                render={
+                  <Button disabled={rotate.isPending} type="button">
+                    Cancel
+                  </Button>
+                }
+              />
+              <Button
+                loading={rotate.isPending}
+                onClick={() => rotate.mutate(record.id)}
+                variant="primary"
+              >
+                Rotate key
+              </Button>
+            </div>
+          </>
+        )}
+      </Dialog.Popup>
+    </Dialog.Root>
+  )
+}
+
+declare namespace RotateDialog {
+  type Props = {
+    record: ApiKeys.ApiKey
+  }
+}
+
 function RevokeDialog(props: { currentUser?: string | undefined; record: ApiKeys.ApiKey }) {
   const { currentUser, record } = props
   const [confirmation, setConfirmation] = useState('')
@@ -893,6 +1015,7 @@ function matches(record: ApiKeys.ApiKey, query?: string) {
     record.projectId,
     record.projectName,
     record.tokenLast4,
+    ...record.allowedIps,
     ...record.scopes,
   ].some((value) => value?.toLowerCase().includes(normalized))
 }