tapimo 0.12.0 → 0.14.0

package/src/apps/management/routes/webhooks.ts

@@ -8,7 +8,7 @@ import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as WebhookDestination from '../../../internal/WebhookDestination.js'
 import * as Webhooks from '../../../internal/Webhooks.js'
-import { schema as webhookSchema } from '../../data/routes/webhooks.js'
+import * as DataWebhooks from '../../data/routes/webhooks.js'
 import type { Environment } from '../App.js'
 
 const defaultMaxPerOwner = 100
@@ -21,11 +21,11 @@ export namespace schema {
   export const Subscription = OpenApi.component(
     z
       .object({
-        ...webhookSchema.Subscription.shape,
-        context: webhookSchema.Subscription.shape.context.check(
+        ...DataWebhooks.schema.Subscription.shape,
+        context: DataWebhooks.schema.Subscription.shape.context.check(
           z.meta({ examples: [{ title: 'Production transfers' }] }),
         ),
-        destination: webhookSchema.Subscription.shape.destination.check(
+        destination: DataWebhooks.schema.Subscription.shape.destination.check(
           z.meta({ examples: [{ type: 'url', url: 'https://example.com/webhooks' }] }),
         ),
       })
@@ -35,7 +35,7 @@ export namespace schema {
 
   /** Webhook delivery data returned in collection rows. */
   export const Delivery = OpenApi.component(
-    webhookSchema.Delivery,
+    DataWebhooks.schema.Delivery,
     'OrganizationWebhookDeliverySummary',
   )
 
@@ -44,7 +44,7 @@ export namespace schema {
     const Environment = z
       .enum(['production', 'sandbox'])
       .check(
-        z.describe('API-key environment whose private funding deposits are delivered.'),
+        z.describe('API-key environment whose private funding resources are delivered.'),
         z.meta({ examples: ['production'] }),
       )
 
@@ -52,24 +52,24 @@ export namespace schema {
     export const Body = OpenApi.component(
       z
         .intersection(
-          webhookSchema.createWebhook.Body,
+          DataWebhooks.schema.createWebhook.Body,
           z.object({
-            chainId: webhookSchema.Subscription.shape.chainId,
+            chainId: DataWebhooks.schema.Subscription.shape.chainId,
             environment: z.optional(Environment),
           }),
         )
         .check(
           z.refine(
             (body) =>
-              body.eventType !== 'funding:deposit.updated' || body.environment !== undefined,
-            { error: '`environment` is required for funding deposit subscriptions.' },
+              !DataWebhooks.isFundingEventType(body.eventType) || body.environment !== undefined,
+            { error: '`environment` is required for funding subscriptions.' },
           ),
           z.describe('Details for creating an organization webhook subscription.'),
         ),
       'CreateOrganizationWebhookRequest',
     )
 
-    const secret = webhookSchema.createWebhook.Response.shape.secret
+    const secret = DataWebhooks.schema.createWebhook.Response.shape.secret
     const urlDestination = z
       .object({
         type: z
@@ -192,7 +192,7 @@ export namespace schema {
   /** Schemas for listing an organization webhook's delivery attempts. */
   export namespace listWebhookDeliveries {
     export const Params = WebhookParams
-    export const Query = webhookSchema.listWebhookDeliveries.Query
+    export const Query = DataWebhooks.schema.listWebhookDeliveries.Query
     export const Response = OpenApi.component(
       z
         .object({
@@ -202,10 +202,10 @@ export namespace schema {
               z.describe('Webhook delivery attempts on this page.'),
               z.meta({ examples: [[]] }),
             ),
-          meta: webhookSchema.listWebhookDeliveries.Response.shape.meta.check(
+          meta: DataWebhooks.schema.listWebhookDeliveries.Response.shape.meta.check(
             z.meta({ examples: [{ totalCount: 1, totalCountCapped: false }] }),
           ),
-          nextCursor: webhookSchema.listWebhookDeliveries.Response.shape.nextCursor,
+          nextCursor: DataWebhooks.schema.listWebhookDeliveries.Response.shape.nextCursor,
         })
         .check(z.describe("A page of an organization's webhook delivery attempts.")),
       'OrganizationWebhookDeliveryList',
@@ -214,7 +214,7 @@ export namespace schema {
 
   const DeliveryParams = z
     .object({
-      deliveryId: webhookSchema.retryWebhookDelivery.Params.shape.deliveryId,
+      deliveryId: DataWebhooks.schema.retryWebhookDelivery.Params.shape.deliveryId,
       id: WebhookParams.shape.id,
       orgId: WebhookParams.shape.orgId,
     })
@@ -227,7 +227,7 @@ export namespace schema {
       z
         .object({
           ...Delivery.shape,
-          envelope: webhookSchema.Envelope,
+          envelope: DataWebhooks.schema.Envelope,
         })
         .check(z.describe('A webhook delivery attempt with the exact JSON payload Tempo sent.')),
       'OrganizationWebhookDelivery',
@@ -238,7 +238,7 @@ export namespace schema {
   export namespace retryWebhookDelivery {
     export const Params = DeliveryParams
     export const Response = OpenApi.component(
-      webhookSchema.retryWebhookDelivery.Response,
+      DataWebhooks.schema.retryWebhookDelivery.Response,
       'RetryOrganizationWebhookDeliveryResponse',
     )
   }
@@ -261,7 +261,7 @@ export namespace schema {
   /** Lifecycle state editable from the console. */
   export const UpdateBody = OpenApi.component(
     z
-      .object({ status: webhookSchema.Status })
+      .object({ status: DataWebhooks.schema.Status })
       .check(z.describe('New delivery state for a webhook subscription.')),
     'UpdateOrganizationWebhookRequest',
   )
@@ -344,7 +344,7 @@ export function webhooks(options: webhooks.Options = {}) {
 
         const body = c.req.valid('json')
         if (
-          body.eventType === 'funding:deposit.updated' &&
+          DataWebhooks.isFundingEventType(body.eventType) &&
           !options.webhook.applicationEventTypes?.includes(body.eventType)
         )
           return Response.error(c, {
@@ -364,17 +364,16 @@ export function webhooks(options: webhooks.Options = {}) {
           const owner_ = owner(Auth.org(c).id)
           if ((await Webhooks.countSubscriptions(db, owner_)) >= maxPerOwner)
             throw new Webhooks.LimitExceededError(maxPerOwner)
-          const startBlockNumber =
-            body.eventType === 'funding:deposit.updated'
-              ? undefined
-              : Number(await c.get('getClient')(chainId).getBlockNumber())
+          const startBlockNumber = DataWebhooks.isFundingEventType(body.eventType)
+            ? undefined
+            : Number(await c.get('getClient')(chainId).getBlockNumber())
           const subscription = await Webhooks.createSubscription(
             db,
             {
               chainId,
               ...(body.context === undefined ? {} : { context: body.context }),
               destination: body.destination,
-              ...(body.eventType === 'funding:deposit.updated' && body.environment !== undefined
+              ...(DataWebhooks.isFundingEventType(body.eventType) && body.environment !== undefined
                 ? { environment: body.environment }
                 : {}),
               eventType: body.eventType,
@@ -754,7 +753,7 @@ function publicSubscription(subscription: Webhooks.Subscription) {
     ...(subscription.context === undefined ? {} : { context: subscription.context }),
     createdAt: subscription.createdAt,
     destination,
-    ...(subscription.eventType === 'funding:deposit.updated' &&
+    ...(DataWebhooks.isFundingEventType(subscription.eventType) &&
     subscription.environment !== undefined
       ? { environment: subscription.environment }
       : {}),

package/src/apps/relay/App.test.ts

@@ -18,6 +18,7 @@ import type * as Db from '../../db/Db.js'
 import * as Fees from '../../internal/Fees.js'
 import type * as Log from '../../internal/Log.js'
 import * as Organizations from '../../db/tables/organizations.js'
+import * as Projects from '../../db/tables/projects.js'
 import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
 import * as StripeCustomers from '../../db/tables/stripeCustomers.js'
 import * as core_Billing from '../management/Billing.js'
@@ -104,6 +105,13 @@ const keys = [
     scopes: ['rpc-relay:sponsor'],
     token: 'secret_unattributed',
   },
+  {
+    id: 'key_unattributed_prod',
+    orgId: 'org_1',
+    environment: 'production',
+    scopes: ['rpc-relay:sponsor'],
+    token: 'secret_unattributed_prod',
+  },
 ] as const satisfies readonly TestApp.kvStore.Key[]
 
 describe('behavior: Zone chain routing', () => {
@@ -525,7 +533,7 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
     const body = await relayRequest(app, {
       method: 'eth_signRawTransaction',
       params: [await signSponsorable()],
-      token: 'secret_unattributed',
+      token: 'secret_unattributed_prod',
     })
     expect(body.error).toBeUndefined()
     expect(Transaction.deserialize(body.result as `0x76${string}`).feePayerSignature).toBeDefined()
@@ -535,6 +543,28 @@ describe.skipIf(runtime.mode !== 'localnet')('behavior: sponsorship', () => {
     expect(row?.projectId).toBeNull()
   })
 
+  test('behavior: organization-attributed keys use a validated request project', async () => {
+    const db = TestApp.database()
+    await Organizations.create(db, { id: 'org_1', name: 'One' })
+    const project = await Projects.create(db, { name: 'Privy app', orgId: 'org_1' })
+    const app = TestApp.create({
+      auth: { keys },
+      db,
+      relay: { feePayer: { account: feePayerAccount } },
+    })
+
+    const body = await relayRequest(app, {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable()],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+    expect(body.error).toBeUndefined()
+
+    const [row] = await SponsoredTransactions.listPending(db)
+    expect(row?.projectId).toBe(project.id)
+  })
+
   test('behavior: batches aggregate sponsorship rejections without retaining payloads', async () => {
     const db = TestApp.database()
     const entries: Log.Entry[] = []
@@ -948,6 +978,18 @@ describe('behavior: mainnet billing gate', () => {
     await TestApp.verifiedSeed(db, Viem.chainId.mainnet)
   }
 
+  /** Configures one attributed project for Tempo-funded sponsorship. */
+  async function configureSubsidy(db: ReturnType<typeof TestApp.database>) {
+    await Organizations.create(db, { id: 'org_1', name: 'Privy' })
+    await Organizations.setSponsorshipSubsidy(db, 'org_1', {
+      durationDays: 90,
+      projectSpendLimit: '100.00',
+    })
+    const project = await Projects.create(db, { name: 'Privy app', orgId: 'org_1' })
+    await activate(db)
+    return project
+  }
+
   // Gas prices are attodollars (1e-18 USD) per gas; the signed cap in
   // fee-token units is ceil(gas × maxFeePerGas / 1e12). The helper's default
   // envelope (100k gas × 1e6 atto) caps at 1 microdollar — negligible.
@@ -956,6 +998,172 @@ describe('behavior: mainnet billing gate', () => {
   /** A $2 signed cap, over the `'1.00'` platform default. */
   const overCapFees = { gas: 1_000_000n, maxFeePerGas: 2_000_000_000_000n } as const
 
+  test('behavior: active project promotions waive charges with active billing', async () => {
+    const db = TestApp.database()
+    const project = await configureSubsidy(db)
+    const body = await relayRequest(createMainnetApp({ db }), {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+    expect(body.error).toBeUndefined()
+
+    const [row] = await SponsoredTransactions.listPending(db)
+    expect(row).toMatchObject({
+      billable: false,
+      orgId: 'org_1',
+      projectId: project.id,
+    })
+    const updated = await Projects.get(db, project.id)
+    const startsAt = updated?.sponsorshipSubsidyStartsAt
+    const endsAt = updated?.sponsorshipSubsidyEndsAt
+    expect({ endsAt, startsAt }).toMatchObject({ endsAt: expect.any(String), startsAt: expect.any(String) }) // prettier-ignore
+    if (!endsAt || !startsAt) throw new Error('Expected an activated promotion window.')
+    expect(Date.parse(endsAt) - Date.parse(startsAt)).toBe(90 * 86_400_000)
+  })
+
+  test('behavior: exhausted project promotions return to customer billing', async () => {
+    const db = TestApp.database()
+    await Organizations.create(db, { id: 'org_1', name: 'Privy' })
+    await Organizations.setSponsorshipSubsidy(db, 'org_1', {
+      durationDays: 90,
+      projectSpendLimit: '0.000001',
+    })
+    const project = await Projects.create(db, { name: 'Privy app', orgId: 'org_1' })
+    await activate(db)
+    const app = createMainnetApp({ db })
+
+    const subsidized = await relayRequest(app, {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+    const billed = await relayRequest(app, {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet, nonce: 1 })],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+
+    expect({ billed: billed.error, subsidized: subsidized.error }).toStrictEqual({
+      billed: undefined,
+      subsidized: undefined,
+    })
+    expect(await SponsoredTransactions.listPending(db)).toMatchObject([
+      { billable: false, projectId: project.id },
+      { billable: true, projectId: project.id },
+    ])
+  })
+
+  test('behavior: uncapped project promotions waive charges with active billing', async () => {
+    const db = TestApp.database()
+    await Organizations.create(db, { id: 'org_1', name: 'Privy' })
+    await Organizations.setSponsorshipSubsidy(db, 'org_1', {
+      durationDays: 90,
+      projectSpendLimit: null,
+    })
+    const project = await Projects.create(db, { name: 'Privy app', orgId: 'org_1' })
+    await activate(db)
+    const body = await relayRequest(createMainnetApp({ db }), {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+    expect(body.error).toBeUndefined()
+    expect(await SponsoredTransactions.listPending(db)).toMatchObject([
+      { billable: false, projectId: project.id },
+    ])
+  })
+
+  test('behavior: project promotions still require active billing', async () => {
+    const db = TestApp.database()
+    await Organizations.create(db, { id: 'org_1', name: 'Privy' })
+    await Organizations.setSponsorshipSubsidy(db, 'org_1', {
+      durationDays: 90,
+      projectSpendLimit: null,
+    })
+    const project = await Projects.create(db, { name: 'Privy app', orgId: 'org_1' })
+    await TestApp.verifiedSeed(db, Viem.chainId.mainnet)
+    const body = await relayRequest(createMainnetApp({ db }), {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+    expect(body.error?.data).toStrictEqual({ code: 'billing_required' })
+    expect(await SponsoredTransactions.listPending(db)).toHaveLength(0)
+    expect(await Projects.get(db, project.id)).toMatchObject({
+      sponsorshipSubsidyEndsAt: null,
+      sponsorshipSubsidyStartsAt: null,
+    })
+  })
+
+  test('behavior: subsidized organization keys without project attribution use customer billing', async () => {
+    const db = TestApp.database()
+    await configureSubsidy(db)
+    const body = await relayRequest(createMainnetApp({ db }), {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      token: 'secret_unattributed_prod',
+    })
+    expect(body.error).toBeUndefined()
+    expect(await SponsoredTransactions.listPending(db)).toMatchObject([
+      { billable: true, orgId: 'org_1', projectId: null },
+    ])
+  })
+
+  test('behavior: expired project promotions return to customer billing', async () => {
+    const db = TestApp.database()
+    const project = await configureSubsidy(db)
+    await Projects.activateSponsorship(db, {
+      at: new Date(Date.now() - 91 * 86_400_000).toISOString(),
+      endsAt: new Date(Date.now() - 86_400_000).toISOString(),
+      id: project.id,
+      orgId: 'org_1',
+      spendLimit: '100000000',
+    })
+    const body = await relayRequest(createMainnetApp({ db }), {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+    expect(body.error).toBeUndefined()
+    expect(await SponsoredTransactions.listPending(db)).toMatchObject([
+      { billable: true, projectId: project.id },
+    ])
+  })
+
+  test('behavior: rejects request attribution from project-scoped keys', async () => {
+    const body = await relayRequest(createMainnetApp(), {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      projectId: 'prj_1',
+      token: 'secret_sponsor_prod',
+    })
+    expect(body.error).toStrictEqual({
+      code: -32602,
+      data: { code: 'project_id_invalid' },
+      message: 'Project attribution rejected.',
+    })
+  })
+
+  test('behavior: rejects request attribution outside the key organization', async () => {
+    const db = TestApp.database()
+    await Organizations.create(db, { id: 'org_2', name: 'Two' })
+    const project = await Projects.create(db, { name: 'Other app', orgId: 'org_2' })
+    const body = await relayRequest(createMainnetApp({ db }), {
+      method: 'eth_signRawTransaction',
+      params: [await signSponsorable({ chainId: Viem.chainId.mainnet })],
+      projectId: project.id,
+      token: 'secret_unattributed_prod',
+    })
+    expect(body.error?.data).toStrictEqual({ code: 'project_id_invalid' })
+  })
+
   test('behavior: refuses mainnet sponsorship without a billing source', async () => {
     const entries: Log.Entry[] = []
     const body = await relayRequest(
@@ -1584,6 +1792,7 @@ async function relayRequest(app: ReturnType<typeof TestApp.create>, options: rel
       body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: options.method, params: options.params }), // prettier-ignore
       headers: {
         'content-type': 'application/json',
+        ...(options.projectId ? { 'tempo-project-id': options.projectId } : {}),
         ...(options.token ? { 'tempo-api-key': options.token } : {}),
       },
       method: 'POST',
@@ -1604,6 +1813,8 @@ declare namespace relayRequest {
     mount?: 'relay' | 'sponsor' | undefined
     /** JSON-RPC parameters. */
     params: readonly unknown[]
+    /** Request-level project attribution. */
+    projectId?: string | undefined
     /** API-key credential. */
     token?: string | undefined
   }