tapimo 0.12.0 → 0.13.0

package/src/App.ts

@@ -5,6 +5,7 @@ import { compress as hono_compress } from 'hono/compress'
 import { cors as hono_cors } from 'hono/cors'
 import { HTTPException } from 'hono/http-exception'
 import { requestId, type RequestIdVariables } from 'hono/request-id'
+import { timeout as hono_timeout } from 'hono/timeout'
 import { generateSpecs } from 'hono-openapi'
 import type { Chain } from 'viem'
 
@@ -183,6 +184,10 @@ export declare namespace GetAsset {
 /** Top-level OpenAPI `info.description`, rendered above the reference. */
 const infoDescription = 'REST API for reading and interacting with Tempo'
 
+// Comfortably above the slowest legitimate time-to-response observed in
+// production (~40s tidx reads), far below the 17-100 minute stalls it bounds.
+const requestTimeoutMs = 60_000
+
 /** Creates the Tempo API Hono app. */
 export function create<const path extends string = '/'>(options: create.Options<path>) {
   const { path = '/' as path } = options
@@ -272,8 +277,8 @@ export function create<const path extends string = '/'>(options: create.Options<
     base.use(
       '*',
       Log.middleware<Environment>({
-        emit: async (entry) => {
-          await log?.(entry)
+        emit: async (entry, cause) => {
+          await log?.(entry, cause)
           recordRequest?.(entry)
           // Return the analytics promise so `Log.middleware` extends the
           // response with `waitUntil`; otherwise the async sink's `queue.send`
@@ -284,6 +289,30 @@ export function create<const path extends string = '/'>(options: create.Options<
       }),
     )
 
+  // Bounds time-to-response only; streaming bodies are unaffected. Without a
+  // deadline, a request stalled on an unbounded upstream wait pins its
+  // invocation (and isolate memory) until the client disconnects.
+  const deadline = hono_timeout(
+    requestTimeoutMs,
+    (c) =>
+      new HTTPException(504, {
+        res: Response.error(c, {
+          code: 'request_timeout',
+          message: 'Request timed out',
+          status: 504,
+        }),
+      }),
+  )
+  // Safe methods only: the expired handler is abandoned, not aborted, so a
+  // mutation could still commit after the 504. Paid requests are also exempt:
+  // MPP consumes payment before the handler, and the Payment-Receipt attaches
+  // only when the handler returns through the payment wrapper.
+  base.use('*', (c, next) => {
+    if (c.req.method !== 'GET' && c.req.method !== 'HEAD') return next()
+    if (Auth.hasPaymentCredential(c)) return next()
+    return deadline(c, next)
+  })
+
   // Normalize the `db` option: the plain form is `{ source }` with no cached
   // side; `cached` falls back to `source` so consumers never branch.
   const db = 'source' in options.db ? options.db : { source: options.db }
@@ -331,7 +360,7 @@ export function create<const path extends string = '/'>(options: create.Options<
     c.set('providers', providers)
     c.set('rpc', options.rpc)
     c.set('scopeCatalog', scopeCatalog)
-    c.set('store', Store.withRequest(store, c.req))
+    c.set('store', Store.withRequest(store, c.req, { waitUntil: getWaitUntil(c) }))
     c.set('supportedChainIds', supportedChainIds)
     c.set('zones', zones)
     await next()
@@ -895,6 +924,16 @@ namespace ResponseBody {
   }
 }
 
+function getWaitUntil(c: { executionCtx?: { waitUntil(promise: Promise<unknown>): void } }) {
+  // `c.executionCtx` throws in runtimes without one, so cache persistence falls back to an awaited write.
+  try {
+    const context = c.executionCtx
+    return context ? context.waitUntil.bind(context) : undefined
+  } catch {
+    return undefined
+  }
+}
+
 namespace NodeServer {
   type GetRequestListener = (typeof import('@hono/node-server'))['getRequestListener']
   export type Fetch = Parameters<GetRequestListener>[0]

package/src/Client.test-d.ts

@@ -3,6 +3,7 @@ import { Mpp as PublicMpp } from 'tapimo/mpp'
 import type * as z from 'zod/mini'
 
 import * as Activities from './apps/data/routes/activities.js'
+import * as ApiKeys from './apps/management/routes/api-keys.js'
 import * as Balances from './apps/data/routes/balances.js'
 import * as Billing from './apps/management/routes/billing.js'
 import * as Blocks from './apps/data/routes/blocks.js'
@@ -82,6 +83,50 @@ test('returns typed client', async () => {
 })
 
 describe('narrows responses by status', () => {
+  test('POST /v1/orgs/:orgId/projects/:projectId/api-keys/:keyId/rotate', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[
+      ':projectId{prj_[A-Za-z0-9_-]+}'
+    ]['api-keys'][':keyId{key_[A-Za-z0-9_-]+}'].rotate.$post({
+      param: { keyId: 'key_test', orgId: 'org_test', projectId: 'prj_test' },
+    })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    if (res.status === 200) {
+      const json = await res.json()
+      expectTypeOf(json).toEqualTypeOf<z.output<typeof ApiKeys.schema.rotateApiKey.Response>>()
+    }
+  })
+
+  test('POST /v1/orgs/:orgId/api-keys/:keyId/rotate', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['api-keys'][
+      ':keyId{key_[A-Za-z0-9_-]+}'
+    ].rotate.$post({ param: { keyId: 'key_test', orgId: 'org_test' } })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 502>()
+
+    if (res.status === 200) {
+      const json = await res.json()
+      expectTypeOf(json).toEqualTypeOf<z.output<typeof ApiKeys.schema.rotateApiKey.Response>>()
+    }
+  })
+
+  test('DELETE /v1/orgs/:orgId/api-keys/:keyId', async () => {
+    const client = Client.create()
+    const res = await client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['api-keys'][
+      ':keyId{key_[A-Za-z0-9_-]+}'
+    ].$delete({ param: { keyId: 'key_test', orgId: 'org_test' } })
+
+    expectTypeOf(res.status).toEqualTypeOf<200 | 400 | 401 | 403 | 404 | 429 | 502>()
+
+    if (res.status === 200) {
+      const json = await res.json()
+      expectTypeOf(json).toEqualTypeOf<z.output<typeof ApiKeys.schema.revokeApiKey.Response>>()
+    }
+  })
+
   test('POST /v1/mpp/validate', async () => {
     const client = Client.create()
     const res = await client.v1.mpp.validate.$post({ json: mppInput })
@@ -2563,6 +2608,7 @@ describe('narrows responses by status', () => {
       amount: '1000000',
       destinationToken: '0x20c000000000000000000000b9537d11c60e8b50',
       mode: 'exactSource',
+      provider: 'stargate',
       recipient: `0x${'11'.repeat(20)}`,
       sender: `0x${'22'.repeat(20)}`,
       sourceChain: 'eip155:8453',

package/src/Scope.test.ts

@@ -52,3 +52,23 @@ describe('extend', () => {
     ).toThrowErrorMatchingInlineSnapshot(`[Error: Duplicate scope \`data:read\`.]`)
   })
 })
+
+describe('expandAliases', () => {
+  test('adds the current scope for a legacy Zone read scope', () => {
+    expect(
+      Scope.expandAliases(['data:read', 'zone:1424310001:read', 'zone:1424310001:write']),
+    ).toEqual([
+      'data:read',
+      'zone:1424310001:read',
+      'zone:1424310001:write',
+      'zone:1424310003:read',
+    ])
+  })
+
+  test('does not duplicate an existing current scope', () => {
+    expect(Scope.expandAliases(['zone:1424310001:read', 'zone:1424310003:read'])).toEqual([
+      'zone:1424310001:read',
+      'zone:1424310003:read',
+    ])
+  })
+})

package/src/Scope.ts

@@ -6,6 +6,8 @@
 
 import * as z from 'zod/mini'
 
+import * as Schema from './internal/Schema.js'
+
 /**
  * Wildcard scope. A key whose `scopes` contains this value satisfies every
  * required scope, so it never needs re-provisioning when new scopes are added.
@@ -154,6 +156,20 @@ export function includes(catalog: Catalog, scope: string): scope is Id {
   return schema.Zone.safeParse(scope).success || catalog.some((entry) => entry.scope === scope)
 }
 
+/** Adds current read scopes granted by legacy Zone read scopes. */
+export function expandAliases(scopes: readonly string[]): readonly string[] {
+  const aliases = new Set<string>()
+  for (const scope of scopes) {
+    const match = /^zone:([1-9]\d*):read$/.exec(scope)
+    if (!match) continue
+    const chainId = Number(match[1])
+    const resolved = Schema.resolveChainId(chainId)
+    if (resolved !== chainId) aliases.add(`zone:${resolved}:read`)
+  }
+  for (const scope of scopes) aliases.delete(scope)
+  return aliases.size ? [...scopes, ...aliases] : scopes
+}
+
 /** Returns the self-issuable identifiers in a scope catalog. */
 export function selfServeFrom(catalog: Catalog): readonly Id[] {
   return catalog

package/src/admin/apps/api-keys.test.ts

@@ -299,6 +299,81 @@ describe('DELETE /api-keys/:id', () => {
   })
 })
 
+describe('POST /api-keys/:id/rotate', () => {
+  test('mints a replacement with the source access and attribution', async () => {
+    const { client, store } = await setup()
+    const { record: source, token: sourceToken } = await core_ApiKeys.mint(store, {
+      allowedIps: ['203.0.113.0/24'],
+      billingActive: true,
+      createdBy: 'customer@example.com',
+      environment: 'sandbox',
+      expiresAt: '2100-01-01T00:00:00.000Z',
+      name: 'Privy Zones',
+      orgId: 'org_privy',
+      projectId: 'prj_privy',
+      rateLimits: { '*': { limit: 10_000, period: 'minute' } },
+      scopes: ['zone:421700001:read', 'zone:421700001:write'],
+    })
+
+    const response = await client['api-keys'][':id'].rotate.$post({
+      param: { id: source.id },
+    })
+    const body = await TestApp.json(response, ApiKeys.schema.rotateApiKey.Response)
+
+    expect(response.status).toBe(200)
+    expect(body).toMatchObject({
+      allowedIps: source.allowedIps,
+      billingActive: source.billingActive,
+      createdBy: TestAdmin.identity.email,
+      environment: source.environment,
+      expiresAt: source.expiresAt,
+      name: source.name,
+      orgId: source.orgId,
+      projectId: source.projectId,
+      rateLimits: source.rateLimits,
+      scopes: source.scopes,
+    })
+    expect(body.id).not.toBe(source.id)
+    expect(body.token).not.toBe(sourceToken)
+    expect(await core_ApiKeys.resolve(store, sourceToken)).not.toBeNull()
+    expect(await core_ApiKeys.resolve(store, body.token)).toMatchObject({
+      id: body.id,
+      scopes: source.scopes,
+    })
+  })
+
+  test('unknown id → 404', async () => {
+    const { client } = await setup()
+    const response = await client['api-keys'][':id'].rotate.$post({
+      param: { id: 'key_missing' },
+    })
+
+    expect(response.status).toMatchInlineSnapshot(`404`)
+  })
+
+  test('keeps a rotated one-off key assignable to an organization', async () => {
+    const { client, db, store } = await setup()
+    const organization = await Organizations.create(db, { name: 'Tempo' })
+    const { record: source } = await core_ApiKeys.mint(store, {
+      name: 'One-off',
+      scopes: ['data:read'],
+    })
+
+    const rotateResponse = await client['api-keys'][':id'].rotate.$post({
+      param: { id: source.id },
+    })
+    const replacement = await TestApp.json(rotateResponse, ApiKeys.schema.rotateApiKey.Response)
+    expect(replacement.orgId).toBe(replacement.id)
+
+    const updateResponse = await client['api-keys'][':id'].$patch({
+      json: { orgId: organization.id },
+      param: { id: replacement.id },
+    })
+    expect(updateResponse.status).toBe(200)
+    expect((await core_ApiKeys.get(store, replacement.id))?.orgId).toBe(organization.id)
+  })
+})
+
 describe('PATCH /api-keys/:id', () => {
   test('preserves the allowlist when omitted', async () => {
     const { client, store } = TestAdmin.setup()

package/src/admin/apps/api-keys.ts

@@ -173,6 +173,24 @@ export namespace schema {
       .object({ id: z.string().check(z.describe('Revoked key id.')) })
       .check(z.describe('API-key revocation result.'))
   }
+
+  /** Schemas for the rotateApiKey operation. */
+  export namespace rotateApiKey {
+    /** Path parameters for rotating a key. */
+    export const Params = z
+      .object({
+        id: z
+          .string()
+          .check(
+            z.describe('Stable id of the key to rotate.'),
+            z.meta({ examples: ['key_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+          ),
+      })
+      .check(z.describe('Path parameters for rotating an API key.'))
+
+    /** Response: the replacement record plus its one-time plaintext token. */
+    export const Response = createApiKey.Response
+  }
 }
 
 /**
@@ -183,6 +201,7 @@ export namespace schema {
  * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
  * - `DELETE /:id` revokes a key by id (`404` if absent).
  * - `PATCH /:id` updates a key's allowlist, name, or project, or assigns its first organization.
+ * - `POST /:id/rotate` mints a replacement with the source key's access and attribution.
  * - `POST /backfill` rebuilds the id and org index entries for every record.
  */
 export function apiKeys() {
@@ -315,6 +334,51 @@ export function apiKeys() {
         return c.json(Response.validated(schema.revokeApiKey.Response, { id }))
       },
     )
+    .post(
+      '/:id/rotate',
+      OpenApi.validate('param', schema.rotateApiKey.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+      }),
+      OpenApi.describeRoute({
+        description: 'Create a replacement that preserves the source key access and attribution. The source key remains active.', // prettier-ignore
+        operationId: 'rotateAdminApiKey',
+        responses: OpenApi.responses({
+          errors: { 404: 'API key not found.' },
+          success: {
+            description: 'Replacement key (includes the one-time token).',
+            schema: schema.rotateApiKey.Response,
+          },
+        }),
+        summary: 'Rotate API key',
+        tags: ['API keys'],
+      }),
+      async (c) => {
+        const { id } = c.req.valid('param')
+        const store = c.get('kv').store
+        const source = await ApiKeys.get(store, id)
+        if (!source)
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'API key not found.',
+            status: 404,
+          })
+
+        const { record, token } = await ApiKeys.mint(store, {
+          allowedIps: source.allowedIps,
+          createdBy: c.get('identity')!.email,
+          environment: source.environment,
+          scopes: source.scopes,
+          ...(source.billingActive === undefined ? {} : { billingActive: source.billingActive }),
+          ...(source.expiresAt === undefined ? {} : { expiresAt: source.expiresAt }),
+          ...(source.name === undefined ? {} : { name: source.name }),
+          ...(source.orgId === source.id ? {} : { orgId: source.orgId }),
+          ...(source.projectId === undefined ? {} : { projectId: source.projectId }),
+          ...(source.rateLimits === undefined ? {} : { rateLimits: source.rateLimits }),
+        })
+        return c.json(Response.validated(schema.rotateApiKey.Response, { ...record, token }), 200)
+      },
+    )
     .patch(
       '/:id',
       OpenApi.validate('param', schema.updateApiKey.Params, {

package/src/admin/apps/earn-vaults.test.ts

@@ -204,7 +204,7 @@ describe('putVerifiedEarnVault', () => {
       expect(await response.json()).toMatchObject({
         error: {
           code: 'body_invalid',
-          details: [{ message: 'Zone 1424310001 is configured more than once.' }],
+          details: [{ message: 'Zone 1424310003 is configured more than once.' }],
         },
       })
     },

package/src/admin/apps/earn-vaults.ts

@@ -94,7 +94,7 @@ export namespace schema {
           .check(z.describe('Custom vault slug, generated from the label when omitted.')),
         vaultAddress: Schema.Address.check(
           z.describe('Earn vault contract address.'),
-          z.meta({ examples: ['0xf4ae63687d6753a78e7f551d2eda1d0d31a5ea3a'] }),
+          z.meta({ examples: ['0x140a09b7c5826d34dfa38ea7bfde1c7e478c4408'] }),
         ),
         zones: z
           .optional(z.array(EarnVaults.schema.ZoneRoute))

package/src/admin/ui/src/lib/api-keys.ts

@@ -93,6 +93,25 @@ export namespace update {
   }
 }
 
+/** Rotates an API key while preserving its access and attribution. */
+export namespace rotate {
+  export async function fn(id: string) {
+    const response = await client['api-keys'][':id'].rotate.$post({ param: { id } })
+    if (!response.ok)
+      throw new Error(
+        await Response.errorMessage(response, { fallback: 'Failed to rotate the API key.' }),
+      )
+    return response.json()
+  }
+  export function useMutation() {
+    const queryClient = ReactQuery.useQueryClient()
+    return ReactQuery.useMutation({
+      mutationFn: fn,
+      onSuccess: () => queryClient.invalidateQueries({ queryKey: get.baseKey }),
+    })
+  }
+}
+
 /** Revoke an API key by id. */
 export namespace revoke {
   export async function fn(id: string) {

package/src/admin/ui/src/routes/api-keys.tsx

@@ -8,6 +8,7 @@ import {
   Copy as CopyIcon,
   Pencil,
   Plus,
+  RefreshCw,
   Search,
   Trash2,
   TriangleAlert,
@@ -207,13 +208,13 @@ function RouteComponent() {
   )
 }
 
-function TokenBanner(props: { onDismiss: () => void; token: string }) {
+function TokenBanner(props: { onDismiss: () => void; title?: string; token: string }) {
   const { copy, notifying } = useCopy()
   return (
     <Card className="flex flex-col gap-3 p-4">
       <div className="flex items-start justify-between gap-3">
         <div className="flex flex-col gap-1">
-          <span className="text-label-14 text-foreground">Key provisioned</span>
+          <span className="text-label-14 text-foreground">{props.title ?? 'Key provisioned'}</span>
           <span className="text-label-12 text-foreground-secondary">
             Copy this token now, it won't be shown again.
           </span>
@@ -732,6 +733,7 @@ function KeyRow(props: { currentUser?: string | undefined; record: ApiKeys.ApiKe
           </dl>
           <div className="flex justify-end gap-2 border-t border-border px-5 py-3">
             <EditDialog record={record} />
+            <RotateDialog record={record} />
             <RevokeDialog currentUser={currentUser} record={record} />
           </div>
         </Rows.Panel>
@@ -812,6 +814,91 @@ declare namespace EditDialog {
   }
 }
 
+function RotateDialog(options: RotateDialog.Props) {
+  const { record } = options
+  const [open, setOpen] = useState(false)
+  const rotate = ApiKeys.rotate.useMutation()
+
+  return (
+    <Dialog.Root
+      onOpenChange={(value) => {
+        if (!value && rotate.isPending) return
+        setOpen(value)
+        if (!value) rotate.reset()
+      }}
+      open={open}
+    >
+      <Dialog.Trigger
+        render={
+          <Button size="small">
+            <RefreshCw className="size-4" />
+            Rotate key
+          </Button>
+        }
+      />
+      <Dialog.Popup>
+        {rotate.data ? (
+          <>
+            <Dialog.Title>Key rotated</Dialog.Title>
+            <Dialog.Description>
+              Copy the replacement token now. The source key remains active until it is revoked.
+            </Dialog.Description>
+            <div className="mt-5">
+              <TokenBanner
+                onDismiss={() => setOpen(false)}
+                title="Replacement key provisioned"
+                token={rotate.data.token}
+              />
+            </div>
+          </>
+        ) : (
+          <>
+            <Dialog.Title>Rotate {record.name ?? 'API key'}?</Dialog.Title>
+            <Dialog.Description>
+              This creates a replacement with the same scopes, ownership, limits, and restrictions.
+              The source key remains active.
+            </Dialog.Description>
+            <dl className="mt-5 grid grid-cols-2 gap-4 border border-border bg-secondary p-4">
+              <Detail className="col-span-2" label="Key ID">
+                <code className="break-all">{record.id}</code>
+              </Detail>
+              <Detail label="Environment">{record.environment}</Detail>
+              <Detail label="Organization">{organization(record)}</Detail>
+              <Detail label="Project">{project(record)}</Detail>
+              <Detail label="Scopes">{record.scopes.length}</Detail>
+            </dl>
+            {rotate.error ? (
+              <p className="mt-3 text-copy-13 text-negative">{rotate.error.message}</p>
+            ) : null}
+            <div className="mt-6 flex justify-end gap-2">
+              <Dialog.Close
+                render={
+                  <Button disabled={rotate.isPending} type="button">
+                    Cancel
+                  </Button>
+                }
+              />
+              <Button
+                loading={rotate.isPending}
+                onClick={() => rotate.mutate(record.id)}
+                variant="primary"
+              >
+                Rotate key
+              </Button>
+            </div>
+          </>
+        )}
+      </Dialog.Popup>
+    </Dialog.Root>
+  )
+}
+
+declare namespace RotateDialog {
+  type Props = {
+    record: ApiKeys.ApiKey
+  }
+}
+
 function RevokeDialog(props: { currentUser?: string | undefined; record: ApiKeys.ApiKey }) {
   const { currentUser, record } = props
   const [confirmation, setConfirmation] = useState('')