tapimo 0.13.0 → 0.15.0

package/src/apps/data/App.ts

@@ -5,13 +5,16 @@ import * as z from 'zod/mini'
 
 import * as Assets from '../../Assets.js'
 import type * as App from '../../App.js'
+import * as AssetResponse from '../../internal/AssetResponse.js'
 import * as Auth from '../../internal/Auth.js'
 import * as EdgeCache from '../../internal/EdgeCache.js'
+import * as OpenApi from '../../internal/OpenApi.js'
 import * as Path from '../../internal/Path.js'
 import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
 import * as Tidx from '../../internal/Tidx.js'
 import * as Timing from '../../internal/Timing.js'
+import * as VercelOidc from '../../internal/VercelOidc.js'
 import * as Viem from '../../internal/Viem.js'
 import * as Scope from '../../Scope.js'
 import * as Metadata from '../metadata.js'
@@ -23,7 +26,7 @@ import { transactions as transactionActivities } from './routes/activities.js'
 import { addresses } from './routes/addresses.js'
 import { blocks, blocksByTimestampCompat } from './routes/blocks.js'
 import { coingecko } from './routes/coingecko.js'
-import { earn } from './routes/earn.js'
+import * as Earn from './routes/earn.js'
 import { exchanges } from './routes/exchanges.js'
 import { feeAmm } from './routes/fee-amm.js'
 import { indexer } from './routes/indexer.js'
@@ -60,7 +63,7 @@ export function data(options: data.Options = {}) {
 
   const getTidx = Tidx.createGetClient({ tidx })
   const addresses_routes = addresses({ fx: options.fx })
-  const earn_routes = earn({ fx: options.fx })
+  const earn_routes = Earn.earn({ fx: options.fx })
   const indexer_routes = indexer()
   const transactionActivities_routes = transactionActivities({ fx: options.fx })
   const indexerRouteHandlers = new Set(indexer_routes.routes.map((route) => route.handler))
@@ -75,6 +78,16 @@ export function data(options: data.Options = {}) {
       .filter((route) => route.path === '/v1/earn/vaults/:vaultId/positions/:address')
       .map((route) => route.handler),
   )
+  const databaseOnlyRouteHandlers = new Set(
+    earn_routes.routes
+      .filter((route) => route.path === '/v1/earn/rewards/eligibility')
+      .map((route) => route.handler),
+  )
+  const bodyChainRouteHandlers = new Set(
+    earn_routes.routes
+      .filter((route) => route.method === 'POST' && databaseOnlyRouteHandlers.has(route.handler))
+      .map((route) => route.handler),
+  )
 
   const app = new Hono<App.Environment>()
     // Publish the chain-data context vars for this group's handlers. Runs after
@@ -126,18 +139,33 @@ export function data(options: data.Options = {}) {
           message: selection.conflict ? 'Conflicting chain ids' : 'Invalid chain id',
           status: 400,
         })
+      if (matchedRoutes(c).some((route) => databaseOnlyRouteHandlers.has(route.handler))) {
+        if (!supportedChainIds.has(selection.chainId))
+          return Response.unsupportedChainId(c, selection.chainId, supportedChainIds)
+        c.set('chainId', selection.chainId)
+        return next()
+      }
       const principal = Auth.getPrincipal(c)
       const rpc_config = c.get('rpc')
       const tidx_config = c.get('tidx')
       const zones = c.get('zones')
-      // Raw passthroughs and RPC-only reads need only RPC; composed data routes
-      // require both upstreams to avoid falling through to unrelated defaults.
+      const query = Earn.schema.getEarnVaultPosition.Query.safeParse(
+        Object.fromEntries(
+          Object.entries(c.req.queries()).map(([key, values]) => [
+            key,
+            values.length === 1 ? values[0] : values,
+          ]),
+        ),
+      )
+      const requiresTidx = selection.rpcOnly && query.success && query.data.asOf !== undefined
+      // Raw passthroughs and current RPC-only reads need RPC. Historical
+      // position reads and composed data routes require both upstreams.
       const narrowedChainIds = new Set(
         [...supportedChainIds].filter((chainId) => {
           const context = { chainId, principal, zone: zones.get(chainId) }
           const hasRpc = Viem.resolveRpc(rpc_config, context).url !== undefined
           const hasTidx = Tidx.resolve(tidx_config, context).baseUrl !== undefined
-          if (selection.rpc || selection.rpcOnly) return hasRpc
+          if (selection.rpc || (selection.rpcOnly && !requiresTidx)) return hasRpc
           if (selection.indexer) return hasTidx
           return hasRpc && hasTidx
         }),
@@ -165,6 +193,22 @@ export function data(options: data.Options = {}) {
             message: 'The API key has no readable configured Zones.',
             status: 403,
           })
+        const policy = c.get('vercelOidc')
+        if (policy?.applies(principal)) {
+          const results = await Promise.all(
+            zoneChainIds.flatMap((chainId) => {
+              const zone = zones.get(chainId)
+              if (zone?.sourceId === undefined || !Viem.isMainnet(zone.sourceId)) return []
+              return [policy.verify(c.req.raw, zone)]
+            }),
+          )
+          const failures = results.filter(
+            (result) => VercelOidc.authorizationError(result) !== undefined,
+          )
+          const error = failures[0] && VercelOidc.authorizationError(failures[0])
+          if (results.length > 0) c.set('vercelOidcResults', results)
+          if (error) return Response.error(c, error)
+        }
         c.set('supportedChainIds', new Set([selection.chainId, ...zoneChainIds]))
         c.set('zoneChainIds', zoneChainIds)
         return next()
@@ -173,7 +217,7 @@ export function data(options: data.Options = {}) {
       return next()
     })
     // Zone data requires an issued scope. Raw RPC may instead forward the
-    // caller's Zone token to the node that enforces account scoping.
+    // caller's Zone token to an explicitly configured public node that enforces account scoping.
     .use('*', async (c, next) => {
       const zones = c.get('zones')
       if (zones.size === 0) return next()
@@ -188,9 +232,17 @@ export function data(options: data.Options = {}) {
       if (!selection.matched) return next()
       if (selection.inferredZones) return next()
       const chainId = c.get('chainId')
-      if (!zones.has(chainId)) return next()
+      const zone = zones.get(chainId)
+      if (!zone) return next()
 
       const principal = Auth.getPrincipal(c)
+      if (zone.sourceId !== undefined && Viem.isMainnet(zone.sourceId)) {
+        const policy = c.get('vercelOidc')
+        const result = policy?.applies(principal) ? await policy.verify(c.req.raw, zone) : undefined
+        const error = result && VercelOidc.authorizationError(result)
+        if (result) c.set('vercelOidcResults', [result])
+        if (error) return Response.error(c, error)
+      }
       const scopes = principal?.type === 'api_key' ? principal.apiKey.scopes : undefined
       const allowed =
         scopes?.includes(Scope.wildcard) ||
@@ -218,6 +270,7 @@ export function data(options: data.Options = {}) {
     .use('*', async (c, next) => {
       const principal = Auth.getPrincipal(c)
       if (principal?.type !== 'api_key' || principal.environment !== 'sandbox') return next()
+      if (matchedRoutes(c).some((route) => bodyChainRouteHandlers.has(route.handler))) return next()
 
       const selection = resolveChainSelector({
         c,
@@ -227,7 +280,12 @@ export function data(options: data.Options = {}) {
         indexerHandlers: indexerRouteHandlers,
         rpcOnlyHandlers: rpcOnlyRouteHandlers,
       })
-      if (!selection.matched || selection.inferredZones || !Viem.isMainnet(c.get('chainId')))
+      const chainId = c.get('chainId')
+      if (
+        !selection.matched ||
+        selection.inferredZones ||
+        !Viem.isMainnet(c.get('zones').get(chainId)?.sourceId ?? chainId)
+      )
         return next()
 
       return Response.error(c, {
@@ -246,7 +304,7 @@ export function data(options: data.Options = {}) {
       if (!asset) return next()
       return c.body(asset.body, 200, {
         'Cache-Control': 'public, max-age=86400',
-        'Content-Type': asset.contentType,
+        ...AssetResponse.headers(asset),
       })
     })
     .route('/', addresses_routes)
@@ -402,6 +460,8 @@ function resolveChainSelector(options: {
 }
 
 function pathChainSelector(routePath: string, requestPath: string) {
+  // Bare RPC always uses the default chain; query parameters never select its upstream.
+  if (routePath.endsWith('/rpc')) return { name: 'chain' as const, value: undefined }
   const route = routePath.split('/')
   const request = requestPath.split('/')
   for (let index = 0; index < route.length; index++) {
@@ -475,42 +535,51 @@ const openapi = {
 function webhooksBlock() {
   const envelope = z.toJSONSchema(webhookSchema.Envelope, {
     io: 'output',
+    override: OpenApi.recoverExamples,
     target: 'draft-2020-12',
     unrepresentable: 'any',
   })
   delete envelope.$schema
-  const header = (name: string, description: string) => ({
+  const header = (name: string, description: string, example: string) => ({
     description,
     in: 'header' as const,
     name,
     required: true,
-    schema: { type: 'string' as const },
+    schema: { examples: [example], type: 'string' as const },
   })
   return {
-    event: {
-      post: {
-        description:
-          'When an event you subscribed to happens, Tempo sends this signed message to your webhook URL as an HTTP POST (the same shape is used by `POST /webhooks/:id/ping` so you can test your endpoint). Always verify the `tempo-signature` header before trusting the body, then reply with any 2xx status to confirm you received it. If your endpoint returns a non-2xx status, times out, or redirects, Tempo retries with increasing delays; an endpoint that keeps failing is eventually disabled.',
-        parameters: [
-          header(
-            'tempo-signature',
-            'Signature proving the message really came from Tempo. An HMAC-SHA256 of the body using your webhook secret, formatted `t=<unix>,v1=<hex>`. Verify this before trusting the payload.',
-          ),
-          header(
-            'tempo-event-id',
-            'A unique, stable id for this event (`evt_…`). The same event may be delivered more than once, so use this id to skip duplicates.',
-          ),
-          header('tempo-event-type', 'What happened: `token:transfer`, `transaction:included`, `log:emitted`, `block:created`, `funding:deposit.updated`, or `ping`.'), // prettier-ignore
-        ],
-        requestBody: {
-          content: { 'application/json': { schema: envelope } },
-          required: true,
+    document: {
+      event: {
+        post: {
+          description:
+            'When an event you subscribed to happens, Tempo sends this signed message to your webhook URL as an HTTP POST (the same shape is used by `POST /webhooks/:id/ping` so you can test your endpoint). Always verify the `tempo-signature` header before trusting the body, then reply with any 2xx status to confirm you received it. If your endpoint returns a non-2xx status, times out, or redirects, Tempo retries with increasing delays; an endpoint that keeps failing is eventually disabled.',
+          parameters: [
+            header(
+              'tempo-signature',
+              'Signature proving the message really came from Tempo. An HMAC-SHA256 of the body using your webhook secret, formatted `t=<unix>,v1=<hex>`. Verify this before trusting the payload.',
+              't=1786543200,v1=5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8',
+            ),
+            header(
+              'tempo-event-id',
+              'A unique, stable id for this event (`evt_…`). The same event may be delivered more than once, so use this id to skip duplicates.',
+              'evt_515801d7f9a5ac705e793e85904c9c69b3f1694b465cc8fb6ba3f0298dc82665',
+            ),
+            header('tempo-event-type', 'What happened: `token:transfer`, `transaction:included`, `log:emitted`, `block:created`, `routes:deposit.updated`, `routes:transfer.updated`, or `ping`.', 'token:transfer'), // prettier-ignore
+          ],
+          operationId: 'receiveWebhookEvent',
+          requestBody: {
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/WebhookEventEnvelope' } },
+            },
+            required: true,
+          },
+          responses: { '2XX': { description: 'Delivery acknowledged.' } },
+          summary: 'Webhook event delivery',
+          tags: ['Webhooks'],
         },
-        responses: { '2xx': { description: 'Delivery acknowledged.' } },
-        summary: 'Webhook event delivery',
-        tags: ['Webhooks'],
       },
     },
+    schemas: { WebhookEventEnvelope: envelope },
   }
 }
 
@@ -529,7 +598,7 @@ function createGetAsset(options: createGetAsset.Options): App.GetAsset {
     if (!asset) return undefined
     return {
       response: new globalThis.Response(asset.body, {
-        headers: { 'Content-Type': asset.contentType },
+        headers: AssetResponse.headers(asset),
       }),
       uri: Assets.url({ basePath, chainId, origin, path }),
     }