tapimo 0.13.0 → 0.15.0

package/src/apps/data/routes/rpc.zone.test.ts

@@ -0,0 +1,340 @@
+import { ZoneRpcAuthentication } from 'ox/tempo'
+
+import type * as Log from '../../../internal/Log.js'
+import type * as Viem from '../../../internal/Viem.js'
+import * as RequestListener from '../../../handlers/internal/requestListener.js'
+import * as TestApp from '../../../../test/App.js'
+import * as Relay from '../../../../test/Relay.js'
+
+const chainId = 421_700_001
+
+describe('POST /rpc Zone authorization', () => {
+  test('rejects unavailable public endpoints before contacting the internal node', async () => {
+    const calls: string[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        calls.push(await request.text())
+        return Response.json({ id: 1, jsonrpc: '2.0', result: null })
+      }),
+    )
+    try {
+      const configurations: readonly Viem.getClient.Rpc[] = [
+        {},
+        { publicZoneUrl: {} },
+        { publicZoneUrl: { [chainId + 1]: 'https://public.zone.test' } },
+        { publicZoneUrl: '' },
+        { publicZoneUrl: 'not a URL' },
+        { publicZoneUrl: 'file:///rpc' },
+        { publicZoneUrl: 'https://user:secret@public.zone.test' },
+        { publicZoneUrl: server.url },
+        { publicZoneUrl: `${server.url}/?public=true#rpc` },
+        { publicZoneUrl: `${server.url}/public` },
+        () => ({}),
+      ]
+      const rpc = {
+        auth: 'internal:secret',
+        url: server.url,
+        zoneHeaders: {
+          'CF-Access-Client-Id': 'service-id',
+          'CF-Access-Client-Secret': 'service-secret',
+        },
+      }
+      for (const configuration of configurations)
+        for (const scopes of [undefined, ['data:read'], ['*']]) {
+          const entries: Log.Entry[] = []
+          const key = { ...TestApp.key, scopes: scopes ?? [] }
+          const app = TestApp.create({
+            auth: scopes ? { keys: [key] } : {},
+            logger: (entry) => void entries.push(entry),
+            rpc:
+              typeof configuration === 'function'
+                ? (context) => ({ ...rpc, ...configuration(context) })
+                : { ...rpc, ...configuration },
+            zones: [TestApp.zone({ chainId, rpcUrl: server.url })],
+          })
+          const response = await app.fetch(
+            new Request(`http://tempo-api.test/rpc/${chainId}`, {
+              body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+              headers: {
+                ...(scopes ? { 'tempo-api-key': key.token } : {}),
+                [ZoneRpcAuthentication.headerName]: 'unvalidated-token',
+              },
+              method: 'POST',
+            }),
+          )
+          expect(response.status).toBe(502)
+          expect(await response.json()).toMatchObject({ error: { code: 'upstream_error' } })
+          expect(entries[0]?.provider).toMatchInlineSnapshot(`
+            {
+              "chainId": 421700001,
+              "failure": "unknown",
+              "id": "rpc",
+              "operation": "request",
+            }
+          `)
+        }
+      expect(calls).toMatchInlineSnapshot(`[]`)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('rejects oversized Zone bodies before proxying, regardless of declared length', async () => {
+    const calls: string[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        calls.push(await request.text())
+        return Response.json({ id: 1, jsonrpc: '2.0', result: null })
+      }),
+    )
+    try {
+      const app = TestApp.create({
+        rpc: { publicZoneUrl: server.url, url: 'http://internal.zone.test' },
+        zones: [TestApp.zone({ chainId, rpcUrl: 'http://internal.zone.test' })],
+      })
+      for (const length of [undefined, '1', '71680']) {
+        let chunks = 0
+        let cancelled = false
+        const request = new Request(`http://tempo-api.test/rpc/${chainId}`, {
+          body: new ReadableStream({
+            cancel() {
+              cancelled = true
+            },
+            pull(controller) {
+              const value =
+                chunks === 0 ? JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }) : ''
+              controller.enqueue(new TextEncoder().encode(value.padEnd(1024, ' ')))
+              if (++chunks === 70) controller.close()
+            },
+          }),
+          duplex: 'half',
+          headers: {
+            ...(length ? { 'content-length': length } : {}),
+            [ZoneRpcAuthentication.headerName]: 'caller-token',
+          },
+          method: 'POST',
+        } as RequestInit)
+        const response = await app.fetch(request)
+        expect(response.status).toBe(413)
+        expect(await response.json()).toMatchObject({ error: { code: 'payload_too_large' } })
+        expect(chunks).toBeLessThan(70)
+        expect(cancelled).toBe(true)
+      }
+      expect(calls).toMatchInlineSnapshot(`[]`)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('forwards Zone bodies at the inspection limit unchanged', async () => {
+    const calls: string[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        calls.push(await request.text())
+        return Response.json({ id: 1, jsonrpc: '2.0', result: null })
+      }),
+    )
+    try {
+      const app = TestApp.create({
+        defaultChainId: chainId,
+        rpc: { publicZoneUrl: server.url, url: 'http://internal.zone.test' },
+        zones: [TestApp.zone({ chainId, rpcUrl: 'http://internal.zone.test' })],
+      })
+      const body = JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }).padEnd(
+        65536,
+        ' ',
+      )
+      for (const path of ['/rpc', `/rpc/${chainId}`]) {
+        const response = await app.fetch(
+          new Request(`http://tempo-api.test${path}`, {
+            body,
+            headers: { [ZoneRpcAuthentication.headerName]: 'caller-token' },
+            method: 'POST',
+          }),
+        )
+        expect(response.status).toBe(200)
+      }
+      expect(calls).toEqual([body, body])
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('keeps privileged methods blocked with caller tokens, including mixed batches', async () => {
+    const calls: string[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        calls.push(await request.text())
+        return Response.json({ id: 1, jsonrpc: '2.0', result: null })
+      }),
+    )
+    try {
+      for (const scopes of [undefined, ['data:read'], ['*']]) {
+        const key = { ...TestApp.key, scopes: scopes ?? [] }
+        const app = TestApp.create({
+          auth: scopes ? { keys: [key] } : {},
+          rpc: { publicZoneUrl: server.url, url: 'http://internal.zone.test' },
+          zones: [TestApp.zone({ chainId, rpcUrl: 'http://internal.zone.test' })],
+        })
+        for (const method of [
+          'eth_accounts',
+          'eth_sendTransaction',
+          'eth_sign',
+          'eth_signTransaction',
+          'tempo_fundAddress',
+          'admin_nodeInfo',
+          'debug_traceTransaction',
+        ])
+          for (const batch of [false, true]) {
+            const request = { id: 1, jsonrpc: '2.0', method }
+            const response = await app.fetch(
+              new Request(`http://tempo-api.test/rpc/${chainId}`, {
+                body: JSON.stringify(
+                  batch ? [{ id: 2, jsonrpc: '2.0', method: 'eth_chainId' }, request] : request,
+                ),
+                headers: {
+                  ...(scopes ? { 'tempo-api-key': key.token } : {}),
+                  [ZoneRpcAuthentication.headerName]: 'unvalidated-token',
+                },
+                method: 'POST',
+              }),
+            )
+            expect(response.status).toBe(!scopes && !method.startsWith('eth_') ? 401 : 403)
+          }
+      }
+      expect(calls).toMatchInlineSnapshot(`[]`)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('separates caller-token requests from trusted scoped reads and their credentials', async () => {
+    type Call = {
+      authorization: string | null
+      serviceId: string | null
+      serviceSecret: string | null
+      tempoApiKey: string | null
+      token: string | null
+      url: string
+    }
+    const calls: Call[] = []
+    const listener = RequestListener.fromFetchHandler(async (request) => {
+      await request.text()
+      calls.push({
+        authorization: request.headers.get('authorization'),
+        serviceId: request.headers.get('CF-Access-Client-Id'),
+        serviceSecret: request.headers.get('CF-Access-Client-Secret'),
+        tempoApiKey: request.headers.get('tempo-api-key'),
+        token: request.headers.get(ZoneRpcAuthentication.headerName),
+        url: new URL(request.url).pathname,
+      })
+      return Response.json({ id: 1, jsonrpc: '2.0', result: null })
+    })
+    const server = await Relay.createServer(listener)
+    const internal = await Relay.createServer(listener)
+    try {
+      const key = {
+        ...TestApp.key,
+        id: 'key_zone_reader',
+        scopes: ['data:read', `zone:${chainId}:read`],
+        token: 'secret_zone_reader',
+      }
+      const app = TestApp.create({
+        auth: { keys: [key, TestApp.key] },
+        rpc: {
+          auth: 'internal:secret',
+          publicZoneUrl: { [chainId]: `${server.url}/public` },
+          url: `${internal.url}/internal`,
+          zoneHeaders: {
+            'CF-Access-Client-Id': 'service-id',
+            'CF-Access-Client-Secret': 'service-secret',
+          },
+        },
+        zones: [TestApp.zone({ chainId, rpcUrl: `${internal.url}/internal` })],
+      })
+      for (const method of [
+        'eth_chainId',
+        'eth_getBlockAccessList',
+        'eth_getStorageValues',
+        'eth_sendRawTransaction',
+        'eth_sendRawTransactionSync',
+        'zone_getAuthorizationTokenInfo',
+        'zone_getDepositStatus',
+      ]) {
+        const response = await app.fetch(
+          new Request(`http://tempo-api.test/rpc/${chainId}`, {
+            body: JSON.stringify({ id: 1, jsonrpc: '2.0', method }),
+            headers: {
+              authorization: 'Bearer inbound-credential',
+              'tempo-api-key': TestApp.key.token,
+              [ZoneRpcAuthentication.headerName]: 'caller-token',
+            },
+            method: 'POST',
+          }),
+        )
+        expect(response.status).toBe(200)
+        expect(calls.at(-1)).toMatchInlineSnapshot(`
+          {
+            "authorization": null,
+            "serviceId": "service-id",
+            "serviceSecret": "service-secret",
+            "tempoApiKey": null,
+            "token": "caller-token",
+            "url": "/public",
+          }
+        `)
+      }
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${chainId}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          headers: { 'tempo-api-key': key.token },
+          method: 'POST',
+        }),
+      )
+      expect(response.status).toBe(200)
+      expect(calls.at(-1)).toMatchInlineSnapshot(`
+        {
+          "authorization": "Basic aW50ZXJuYWw6c2VjcmV0",
+          "serviceId": "service-id",
+          "serviceSecret": "service-secret",
+          "tempoApiKey": null,
+          "token": null,
+          "url": "/internal",
+        }
+      `)
+    } finally {
+      await server.closeAsync()
+      await internal.closeAsync()
+    }
+  })
+
+  test('does not fall back when a public URL map only contains a legacy Zone alias', async () => {
+    const calls: string[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        calls.push(await request.text())
+        return Response.json({ id: 1, jsonrpc: '2.0', result: null })
+      }),
+    )
+    try {
+      const app = TestApp.create({
+        rpc: {
+          publicZoneUrl: { 1_424_310_001: `${server.url}/public` },
+          url: server.url,
+        },
+        zones: [TestApp.zone({ chainId: 1_424_310_003, rpcUrl: server.url })],
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc/1424310001', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          headers: { [ZoneRpcAuthentication.headerName]: 'caller-token' },
+          method: 'POST',
+        }),
+      )
+      expect(response.status).toBe(502)
+      expect(calls).toMatchInlineSnapshot(`[]`)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+})

package/src/apps/data/routes/tokenlist.test.ts

@@ -1,8 +1,62 @@
 import * as TestApp from '../../../../test/App.js'
 import * as Runtime from '../../../../test/runtime.js'
+import * as Db from '../../../db/Db.js'
+import * as Log from '../../../internal/Log.js'
+import * as Schema from '../../../internal/Schema.js'
 import * as VerifiedTokens from '../../../internal/VerifiedTokens.js'
 import * as Tokenlist from './tokenlist.js'
 
+type JsonSchema = {
+  /** Referenced component path. */
+  $ref?: string
+  /** Alternative schemas accepted by this value. */
+  anyOf?: readonly JsonSchema[]
+  /** Human-readable schema description. */
+  description?: string
+  /** Allowed string values. */
+  enum?: readonly string[]
+  /** Representative schema values. */
+  examples?: readonly unknown[]
+  /** OpenAPI value format. */
+  format?: string
+  /** Schema for array entries. */
+  items?: JsonSchema
+  /** Schemas for object properties. */
+  properties?: Record<string, JsonSchema>
+  /** Required object property names. */
+  required?: readonly string[]
+}
+type OpenApiMediaType = {
+  /** Schema for this media type. */
+  schema?: JsonSchema
+}
+type OpenApiResponse = {
+  /** Referenced response component path. */
+  $ref?: string
+  /** Response bodies keyed by media type. */
+  content?: Record<string, OpenApiMediaType>
+}
+type OpenApiOperation = {
+  /** Stable generated-client method name. */
+  operationId?: string
+  /** Responses keyed by HTTP status. */
+  responses?: Record<string, OpenApiResponse>
+}
+type OpenApiComponents = {
+  /** Reusable schemas keyed by component name. */
+  schemas: Record<string, JsonSchema>
+}
+type OpenApiPath = {
+  /** GET operation for this path. */
+  get?: OpenApiOperation
+}
+type OpenApiDocument = {
+  /** Reusable OpenAPI components. */
+  components: OpenApiComponents
+  /** Operations keyed by request path. */
+  paths: Record<string, OpenApiPath>
+}
+
 /** Reader key for the data routes. */
 const reader = {
   id: 'key_reader',
@@ -33,7 +87,238 @@ async function seeded() {
   })
 }
 
+function component(document: OpenApiDocument, name: string): JsonSchema {
+  const value = document.components.schemas[name]
+  if (!value) throw new Error(`Missing OpenAPI component ${name}`)
+  return value
+}
+
+function resolveSchema(document: OpenApiDocument, value: JsonSchema | undefined): JsonSchema {
+  if (!value) throw new Error('Missing OpenAPI schema')
+  if (!value.$ref) return value
+  const name = value.$ref.split('/').at(-1)
+  if (!name) throw new Error(`Invalid OpenAPI component ref ${value.$ref}`)
+  return component(document, name)
+}
+
+describe('OpenAPI', () => {
+  test('publishes a generator-ready token list contract', async () => {
+    const app = TestApp.create({ auth: false })
+    const document = (await (await app.request('/openapi.json')).json()) as OpenApiDocument
+    const operation = document.paths['/v1/tokenlist']?.get
+    if (!operation) throw new Error('Missing token-list OpenAPI operation')
+
+    const errors = Object.fromEntries(
+      [400, 401, 402, 403, 429, 500, 502, 504]
+        .filter((status) => operation.responses?.[status])
+        .map((status) => {
+          const response = operation.responses?.[status]
+          if (response?.$ref) return [status, { $ref: response.$ref }]
+          const schema = response?.content?.['application/json']?.schema
+          return [
+            status,
+            resolveSchema(document, schema).properties?.['error']?.properties?.['code']?.enum,
+          ]
+        }),
+    )
+    const list = component(document, 'TokenListDocument')
+    const token = component(document, 'TokenListToken')
+    const version = component(document, 'TokenListVersion')
+
+    expect({
+      components: {
+        list: {
+          description: list.description,
+          required: list.required,
+          tokenExamples: list.properties?.['tokens']?.examples,
+          tokens: list.properties?.['tokens']?.items,
+          version: {
+            anyOf: list.properties?.['version']?.anyOf,
+            examples: list.properties?.['version']?.examples,
+          },
+        },
+        token: {
+          description: token.description,
+          logoFormat: token.properties?.['logoURI']?.format,
+          required: token.required,
+        },
+        version: { description: version.description, required: version.required },
+      },
+      operation: {
+        errors,
+        operationId: operation.operationId,
+        response: operation.responses?.['200']?.content?.['application/json']?.schema,
+      },
+    }).toMatchInlineSnapshot(`
+      {
+        "components": {
+          "list": {
+            "description": "A Uniswap Token Lists-compatible list of Tempo’s verified TIP-20 tokens.",
+            "required": [
+              "name",
+              "timestamp",
+              "version",
+              "tokens",
+            ],
+            "tokenExamples": [
+              [
+                {
+                  "address": "0x20c000000000000000000000b9537d11c60e8b50",
+                  "chainId": 4217,
+                  "decimals": 6,
+                  "logoURI": "https://api.tempo.xyz/assets/4217/icons/0x20c000000000000000000000b9537d11c60e8b50?__response=svg-sandbox-v1",
+                  "name": "Bridged USDC (Stargate)",
+                  "symbol": "USDC.e",
+                },
+              ],
+            ],
+            "tokens": {
+              "$ref": "#/components/schemas/TokenListToken",
+              "examples": [
+                {
+                  "address": "0x20c000000000000000000000b9537d11c60e8b50",
+                  "chainId": 4217,
+                  "decimals": 6,
+                  "logoURI": "https://api.tempo.xyz/assets/4217/icons/0x20c000000000000000000000b9537d11c60e8b50?__response=svg-sandbox-v1",
+                  "name": "Bridged USDC (Stargate)",
+                  "symbol": "USDC.e",
+                },
+              ],
+            },
+            "version": {
+              "anyOf": [
+                {
+                  "$ref": "#/components/schemas/TokenListVersion",
+                },
+              ],
+              "examples": [
+                {
+                  "major": 1,
+                  "minor": 0,
+                  "patch": 2,
+                },
+              ],
+            },
+          },
+          "token": {
+            "description": "One token entry in the standard verified token list format.",
+            "logoFormat": "uri",
+            "required": [
+              "chainId",
+              "address",
+              "name",
+              "symbol",
+              "decimals",
+            ],
+          },
+          "version": {
+            "description": "The token list’s semantic version.",
+            "required": [
+              "major",
+              "minor",
+              "patch",
+            ],
+          },
+        },
+        "operation": {
+          "errors": {
+            "400": [
+              "api_key_malformed",
+              "chain_id_invalid",
+              "chain_id_unsupported",
+              "query_invalid",
+            ],
+            "401": [
+              "api_key_invalid",
+              "api_key_missing",
+              "unauthorized",
+            ],
+            "402": {
+              "$ref": "#/components/responses/PaymentRequired",
+            },
+            "403": [
+              "api_key_forbidden",
+              "api_key_ip_forbidden",
+              "forbidden",
+            ],
+            "429": {
+              "$ref": "#/components/responses/RateLimited",
+            },
+            "500": {
+              "$ref": "#/components/responses/InternalError",
+            },
+            "502": [
+              "upstream_error",
+            ],
+            "504": {
+              "$ref": "#/components/responses/RequestTimeout",
+            },
+          },
+          "operationId": "getTokenList",
+          "response": {
+            "$ref": "#/components/schemas/TokenListDocument",
+          },
+        },
+      }
+    `)
+  })
+
+  test('returns the documented validation errors', async () => {
+    const app = TestApp.create({ auth: false })
+    const responses = await Promise.all([
+      app.request('/v1/tokenlist?chainId=not-a-chain'),
+      app.request('/v1/tokenlist?chainId=999999'),
+      app.request('/v1/tokenlist?unknown=true'),
+    ])
+
+    expect(
+      await Promise.all(
+        responses.map(
+          async (response) => (await TestApp.json(response, Schema.ErrorResponse)).error.code,
+        ),
+      ),
+    ).toStrictEqual(['chain_id_invalid', 'chain_id_unsupported', 'query_invalid'])
+  })
+})
+
 describe('GET /tokenlist', () => {
+  test('maps cold snapshot failures to the upstream error contract', async () => {
+    const causes: Error[] = []
+    const db = Db.postgres({
+      connectionString: 'postgresql://postgres:postgres@127.0.0.1:1/none',
+    })
+    const entries: Log.Entry[] = []
+    try {
+      const app = TestApp.create({
+        auth: false,
+        db,
+        logger: (entry, cause) => {
+          entries.push(entry)
+          if (cause) causes.push(cause)
+        },
+        verifiedTokens: { refreshMs: 0 },
+      })
+
+      const response = await app.request('/v1/tokenlist')
+      expect(response.status).toBe(502)
+      expect(await TestApp.json(response, Schema.ErrorResponse)).toMatchObject({
+        error: { code: 'upstream_error' },
+      })
+      expect(response.headers.get('cache-control')).toBe('no-store')
+      expect(entries).toMatchObject([
+        {
+          level: 'error',
+          provider: { failure: 'query', id: 'verified_tokens', operation: 'snapshot' },
+          status: 502,
+        },
+      ])
+      expect(causes).toHaveLength(1)
+      expect(causes[0]?.message).toBeTruthy()
+    } finally {
+      await db.close()
+    }
+  })
+
   test('serves verified tokens in the Uniswap token-list format', async () => {
     const response = await (await seeded()).v1.tokenlist.$get({ query: {} }, as(reader))
     expect(response.status).toBe(200)