tapimo 0.14.0 → 0.15.1

package/src/apps/composition.test.ts

@@ -1,5 +1,5 @@
-import { App, Store } from 'tapimo'
-import { data, funding, management, mpp, relay } from 'tapimo/apps'
+import { data, routes, management, mpp, relay } from 'tapimo/apps'
+import { App, Store } from 'tapimo/server'
 import { Hono } from 'hono'
 import { describeRoute } from 'hono-openapi'
 import * as TestApp from '../../test/App.js'
@@ -92,7 +92,9 @@ describe('App.from()', () => {
         externalKey: { in: 'header', name: 'external-key', type: 'apiKey' },
       },
       tags: [{ description: 'Externally defined routes.', name: 'External' }],
-      webhooks: () => ({ externalEvent: { post: { responses: { 200: { description: 'OK' } } } } }),
+      webhooks: () => ({
+        document: { externalEvent: { post: { responses: { 200: { description: 'OK' } } } } },
+      }),
       'x-tagGroups': [{ name: 'External API', tags: ['External'] }],
     })
     expectTypeOf(external).toEqualTypeOf<typeof group>()
@@ -154,12 +156,12 @@ describe('data()', () => {
     expect(keys.some((path) => path.startsWith('/v1/blocks'))).toBe(true)
     expect(keys.some((path) => path.startsWith('/v1/orgs'))).toBe(false)
     expect(keys.some((path) => path.startsWith('/v1/me'))).toBe(false)
-    expect(keys.some((path) => path.startsWith('/v1/funding'))).toBe(false)
+    expect(keys.some((path) => path.startsWith('/v1/routes'))).toBe(false)
 
     // The omitted management route resolves to a 404 (never mounted), not a 401.
     const orgs = await app.request('/v1/orgs')
     expect(orgs.status).toBe(404)
-    expect((await app.request('/v1/funding/chains')).status).toBe(404)
+    expect((await app.request('/v1/routes/chains')).status).toBe(404)
   })
 
   test('inherits shared chain context', async () => {
@@ -196,6 +198,7 @@ describe('data()', () => {
           4217,
           42431,
           421700001,
+          421700002,
           421700006,
           1424310003,
         ],
@@ -283,41 +286,41 @@ describe('data()', () => {
   })
 })
 
-describe('funding()', () => {
-  test('mounts the Funding & Bridge API independently', async () => {
-    const group = funding()
-    expectTypeOf(App.funding).toEqualTypeOf<typeof funding>()
-    expectTypeOf(group).toEqualTypeOf<App.FundingApp>()
+describe('routes()', () => {
+  test('mounts the Routes API independently', async () => {
+    const group = routes()
+    expectTypeOf(App.routes).toEqualTypeOf<typeof routes>()
+    expectTypeOf(group).toEqualTypeOf<App.RoutesApp>()
     const app = App.create({ auth: false, db: TestApp.database() }).route('/', group)
     const spec = await document(app)
 
     expect(
       Object.keys(spec.paths)
-        .filter((path) => path.startsWith('/v1/funding'))
+        .filter((path) => path.startsWith('/v1/routes'))
         .sort(),
     ).toEqual(
       [
-        '/v1/funding/chains',
-        '/v1/funding/deposit-addresses',
-        '/v1/funding/deposit-addresses/{id}',
-        '/v1/funding/deposit-addresses/{id}/reconcile',
-        '/v1/funding/deposits',
-        '/v1/funding/deposits/{id}',
-        '/v1/funding/providers',
-        '/v1/funding/quotes',
-        '/v1/funding/transfers',
-        '/v1/funding/transfers/vault',
-        '/v1/funding/transfers/zone',
-        '/v1/funding/transfers/{id}',
-        '/v1/funding/transfers/{id}/source-transactions',
+        '/v1/routes/chains',
+        '/v1/routes/deposit-addresses',
+        '/v1/routes/deposit-addresses/{id}',
+        '/v1/routes/deposit-addresses/{id}/reconcile',
+        '/v1/routes/deposits',
+        '/v1/routes/deposits/{id}',
+        '/v1/routes/providers',
+        '/v1/routes/quotes',
+        '/v1/routes/transfers',
+        '/v1/routes/transfers/vault',
+        '/v1/routes/transfers/zone',
+        '/v1/routes/transfers/{id}',
+        '/v1/routes/transfers/{id}/source-transactions',
       ].sort(),
     )
     expect(Object.keys(spec.paths).some((path) => path.startsWith('/v1/tokens'))).toBe(false)
-    expect(spec.paths['/webhooks/funding/{providerId}']).toBeUndefined()
+    expect(spec.paths['/webhooks/routes/{providerId}']).toBeUndefined()
     expect(spec['x-tagGroups']).toEqual([
       {
-        name: 'Funding & Bridge API',
-        tags: ['Chains', 'Deposit Addresses', 'Providers', 'Quotes', 'Funding Transfers'],
+        name: 'Routes API',
+        tags: ['Chains', 'Deposit Addresses', 'Providers', 'Quotes', 'Route Transfers'],
       },
     ])
     expect(
@@ -327,20 +330,20 @@ describe('funding()', () => {
         ),
       ),
     ).toEqual([
-      'listFundingDepositAddresses',
-      'createFundingDepositAddress',
-      'reconcileFundingDepositAddress',
-      'getFundingDepositAddress',
-      'getFundingDeposit',
-      'listFundingDeposits',
+      'listRoutesDepositAddresses',
+      'createRoutesDepositAddress',
+      'reconcileRoutesDepositAddress',
+      'getRoutesDepositAddress',
+      'getRoutesDeposit',
+      'listRoutesDeposits',
     ])
     expect((await app.request('/v1/tokens')).status).toBe(404)
   })
 
-  test('keeps data and funding transfers separate with the same display name', async () => {
+  test('keeps data and route transfers separate with the same display name', async () => {
     const app = App.create({ auth: false, db: TestApp.database() })
       .route('/', data())
-      .route('/', funding())
+      .route('/', routes())
     const spec = await document(app)
     const operationTag = (path: string, method: 'get' | 'post') =>
       (spec.paths[path] as Record<string, { tags?: readonly string[] | undefined } | undefined>)[
@@ -348,15 +351,15 @@ describe('funding()', () => {
       ]?.tags
 
     expect({
-      chains: operationTag('/v1/funding/chains', 'get'),
-      depositAddress: operationTag('/v1/funding/deposit-addresses', 'post'),
-      deposits: operationTag('/v1/funding/deposits', 'get'),
-      providers: operationTag('/v1/funding/providers', 'get'),
-      quotes: operationTag('/v1/funding/quotes', 'get'),
+      chains: operationTag('/v1/routes/chains', 'get'),
+      depositAddress: operationTag('/v1/routes/deposit-addresses', 'post'),
+      deposits: operationTag('/v1/routes/deposits', 'get'),
+      providers: operationTag('/v1/routes/providers', 'get'),
+      quotes: operationTag('/v1/routes/quotes', 'get'),
       tokenTransfers: operationTag('/v1/transfers', 'get'),
-      transfers: operationTag('/v1/funding/transfers', 'get'),
-      vault: operationTag('/v1/funding/transfers/vault', 'post'),
-      zone: operationTag('/v1/funding/transfers/zone', 'post'),
+      transfers: operationTag('/v1/routes/transfers', 'get'),
+      vault: operationTag('/v1/routes/transfers/vault', 'post'),
+      zone: operationTag('/v1/routes/transfers/zone', 'post'),
     }).toEqual({
       chains: ['Chains'],
       depositAddress: ['Deposit Addresses'],
@@ -364,40 +367,40 @@ describe('funding()', () => {
       providers: ['Providers'],
       quotes: ['Quotes'],
       tokenTransfers: ['Transfers'],
-      transfers: ['Funding Transfers'],
-      vault: ['Funding Transfers'],
-      zone: ['Funding Transfers'],
+      transfers: ['Route Transfers'],
+      vault: ['Route Transfers'],
+      zone: ['Route Transfers'],
     })
 
     const groups = Object.fromEntries(
       (spec['x-tagGroups'] ?? []).map((group) => [group.name, group.tags]),
     )
     expect(groups['Data API']).toContain('Transfers')
-    expect(groups['Data API']).not.toContain('Funding Transfers')
-    expect(groups['Funding & Bridge API']).toContain('Funding Transfers')
-    expect(groups['Funding & Bridge API']).not.toContain('Transfers')
+    expect(groups['Data API']).not.toContain('Route Transfers')
+    expect(groups['Routes API']).toContain('Route Transfers')
+    expect(groups['Routes API']).not.toContain('Transfers')
     expect(spec.tags.filter((tag) => tag.name === 'Transfers')).toHaveLength(1)
-    expect(spec.tags.filter((tag) => tag.name === 'Funding Transfers')).toEqual([
+    expect(spec.tags.filter((tag) => tag.name === 'Route Transfers')).toEqual([
       {
-        description: 'Inbound funding transfers.',
-        name: 'Funding Transfers',
+        description: 'Transfers routed between supported chains.',
+        name: 'Route Transfers',
         'x-displayName': 'Transfers',
-        'x-pagePath': 'funding/transfers',
+        'x-pagePath': 'routes/transfers',
       },
     ])
     expect(
       Object.fromEntries(
-        (groups['Funding & Bridge API'] ?? []).map((name) => {
+        (groups['Routes API'] ?? []).map((name) => {
           const tag = spec.tags.find((tag) => tag.name === name)
           return [tag?.['x-displayName'] ?? tag?.name, tag?.['x-pagePath']]
         }),
       ),
     ).toEqual({
-      Chains: 'funding/chains',
-      'Deposit Addresses': 'funding/deposit-addresses',
-      Providers: 'funding/providers',
-      Quotes: 'funding/quotes',
-      Transfers: 'funding/transfers',
+      Chains: 'routes/chains',
+      'Deposit Addresses': 'routes/deposit-addresses',
+      Providers: 'routes/providers',
+      Quotes: 'routes/quotes',
+      Transfers: 'routes/transfers',
     })
   })
 })
@@ -434,7 +437,12 @@ describe('mpp()', () => {
 describe('management()', () => {
   test('mounts management routes and omits data routes', async () => {
     const app = App.create({
-      auth: { session: { wallet: { origin: 'https://test.example' } } },
+      auth: {
+        session: {
+          secret: 'test-better-auth-secret-at-least-32-characters',
+          wallet: { origin: 'https://test.example' },
+        },
+      },
       db: TestApp.database(),
       kv: { store: Store.memory() },
     }).route('/', management())

package/src/apps/data/App.test.ts

@@ -1,11 +1,14 @@
+import * as jose from 'jose'
 import { Secp256k1 } from 'ox'
 import { ZoneRpcAuthentication } from 'ox/tempo'
 import { Challenge, PaymentRequest } from 'mppx'
-import { RateLimit } from 'tapimo'
+import { RateLimit } from 'tapimo/server'
 
 import * as TestApp from '../../../test/App.js'
 import * as Tempo from '../../../test/Tempo.js'
+import type * as Log from '../../internal/Log.js'
 import * as Store from '../../internal/Store.js'
+import * as VercelOidc from '../../internal/VercelOidc.js'
 import * as Viem from '../../internal/Viem.js'
 
 /** A supported non-mainnet chain id, exercising the sandbox testnet allowance. */
@@ -150,6 +153,32 @@ describe('MPP session management', () => {
     )
   })
 
+  test('keeps GET quota controls off generated management routes', async () => {
+    const rateLimitStore = Store.memory()
+    const limit = { limit: 1, period: 'minute' } satisfies RateLimit.Limit
+    const app = TestApp.create({
+      auth: {
+        mpp,
+        overrides: {
+          'GET /v1/scopes': { mpp: { bucket: 'scopes', rateLimit: limit } },
+        },
+      },
+      rateLimit: { store: rateLimitStore },
+    })
+    await RateLimit.memory({ store: rateLimitStore }).consume({
+      key: 'mpp:public:anonymous:bucket:scopes',
+      limit,
+    })
+
+    const response = await app.request('/v1/scopes', {
+      headers: { authorization: 'Payment not-a-credential' },
+      method: 'POST',
+    })
+
+    expect(response.status).toBe(402)
+    expect(response.headers.get('RateLimit-Limit')).toBe('100')
+  })
+
   test('applies POST auth overrides to QUERY aliases', async () => {
     const app = TestApp.create({
       auth: {
@@ -197,10 +226,14 @@ describe('zone chain gate', () => {
     token: 'secret_legacy_moderato',
   } satisfies TestApp.kvStore.Key
 
-  function zoneOptions(chainId: number) {
+  function zoneOptions(
+    chainId: number,
+    options: { sourceChainId?: Viem.ChainId | undefined } = {},
+  ) {
     return TestApp.zone({
       chainId,
       rpcUrl: `https://${chainId}.rpc.test`,
+      ...options,
     })
   }
 
@@ -212,6 +245,14 @@ describe('zone chain gate', () => {
     token: 'secret_zone',
   } satisfies TestApp.kvStore.Key
 
+  /** Zone reader owned by an organization outside the OIDC rollout. */
+  const otherOrganizationReader = {
+    id: 'key_other_organization',
+    orgId: 'org_other',
+    scopes: ['data:read', `zone:${zone}:read`],
+    token: 'secret_other_organization',
+  } satisfies TestApp.kvStore.Key
+
   /** Zone writer: broadcasts signed transactions and reads data for `zone`. */
   const zoneWriter = {
     id: 'key_zone_writer',
@@ -301,6 +342,115 @@ describe('zone chain gate', () => {
     expect(response.status).toBe(200)
   })
 
+  test('enforces Vercel OIDC independently from the existing Zone API key', async () => {
+    const entries: Log.Entry[] = []
+    const { privateKey, publicKey } = await jose.generateKeyPair('RS256', { extractable: true })
+    const issuer = 'https://oidc.vercel.com/privy'
+    const kid = 'vercel-test-key'
+    const jwks = jose.createLocalJWKSet({
+      keys: [{ ...(await jose.exportJWK(publicKey)), kid }],
+    })
+    const vercelOidc = VercelOidc.create(
+      {
+        enforce: true,
+        environments: ['preview', 'production'],
+        issuer,
+        orgIds: [zoneReader.orgId],
+        projectIds: ['prj_expected'],
+        teamId: 'team_privy',
+      },
+      { jwks: () => jwks },
+    )
+    const credential = await new jose.SignJWT({
+      environment: 'preview',
+      owner_id: 'team_privy',
+      project_id: 'prj_expected',
+    })
+      .setProtectedHeader({ alg: 'RS256', kid, typ: 'JWT' })
+      .setIssuer(issuer)
+      .setAudience(String(zone))
+      .setIssuedAt()
+      .setExpirationTime('1h')
+      .sign(privateKey)
+    const app = TestApp.create({
+      auth: { keys: [admin, otherOrganizationReader, zoneReader] },
+      logger: (entry) => void entries.push(entry),
+      vercelOidc,
+      zones: [
+        zoneOptions(zone, { sourceChainId: Viem.chainId.mainnet }),
+        zoneOptions(zoneB, { sourceChainId: Viem.chainId.testnet }),
+      ],
+    })
+    const response = await app.request(`/v1/tokenlist?chainId=${zone}`, {
+      headers: {
+        authorization: `Bearer ${credential}`,
+        'tempo-api-key': zoneReader.token,
+      },
+    })
+
+    expect(response.status).toBe(200)
+    expect(entries[0]).toMatchObject({
+      principal: { id: zoneReader.id, type: 'api_key' },
+      vercelOidc: [
+        {
+          chainId: zone,
+          environment: 'preview',
+          enforce: true,
+          outcome: 'authorized',
+          reason: 'authorized',
+        },
+      ],
+    })
+    const deniedResponse = await app.request(`/v1/tokenlist?chainId=${zone}`, {
+      headers: { 'tempo-api-key': zoneReader.token },
+    })
+    expect(deniedResponse.status).toBe(401)
+    expect(entries[1]).toMatchObject({
+      level: 'warn',
+      vercelOidc: [
+        {
+          chainId: zone,
+          enforce: true,
+          outcome: 'denied',
+          reason: 'missing',
+        },
+      ],
+    })
+    const inferredDeniedResponse = await app.request(
+      `/v1/addresses/${Tempo.accounts[0].address}/activities?chainId=${Viem.chainId.mainnet}&include=zones`,
+      { headers: { 'tempo-api-key': zoneReader.token } },
+    )
+    expect(inferredDeniedResponse.status).toBe(401)
+    expect(entries[2]).toMatchObject({
+      level: 'warn',
+      vercelOidc: [
+        {
+          chainId: zone,
+          enforce: true,
+          outcome: 'denied',
+          reason: 'missing',
+        },
+      ],
+    })
+    const testnetResponse = await app.request(`/v1/tokenlist?chainId=${zoneB}`, {
+      headers: {
+        authorization: `Bearer ${credential}`,
+        'tempo-api-key': admin.token,
+      },
+    })
+    expect(testnetResponse.status).toBe(200)
+    expect(entries[3]).not.toHaveProperty('vercelOidc')
+    const otherOrganizationResponse = await app.request(`/v1/tokenlist?chainId=${zone}`, {
+      headers: { 'tempo-api-key': otherOrganizationReader.token },
+    })
+    expect(otherOrganizationResponse.status).toBe(200)
+    expect(entries[4]).toMatchObject({
+      level: 'info',
+      principal: { id: otherOrganizationReader.id, type: 'api_key' },
+    })
+    expect(entries[4]).not.toHaveProperty('vercelOidc')
+  })
+
   test('the legacy Moderato id and read scope route to current upstreams', async () => {
     const fetch = vi
       .spyOn(globalThis, 'fetch')
@@ -472,6 +622,8 @@ describe('zone chain gate', () => {
 })
 
 describe('sandbox chain guard', () => {
+  const mainnetZone = 421_700_001
+
   test('rejects a sandbox key that omits `chainId` on a mainnet-default deployment', async () => {
     const response = await mainnetDefaultClient().v1.tokenlist.$get({ query: {} }, as(sandbox))
     expect(response.status).toBe(403)
@@ -492,6 +644,32 @@ describe('sandbox chain guard', () => {
     )
   })
 
+  test('rejects a sandbox key on a mainnet-backed Zone', async () => {
+    const key = {
+      ...sandbox,
+      scopes: ['data:read', `zone:${mainnetZone}:read`],
+    } satisfies TestApp.kvStore.Key
+    const client = TestApp.client({
+      auth: { keys: [key] },
+      zones: [
+        TestApp.zone({
+          chainId: mainnetZone,
+          rpcUrl: `https://${mainnetZone}.rpc.test`,
+          sourceChainId: Viem.chainId.mainnet,
+        }),
+      ],
+    })
+    const response = await client.v1.tokenlist.$get(
+      { query: { chainId: String(mainnetZone) } },
+      as(key),
+    )
+
+    expect(response.status).toBe(403)
+    expect(((await response.json()) as { error: { code: string } }).error.code).toBe(
+      'api_key_forbidden',
+    )
+  })
+
   test('allows a sandbox key on a testnet `chainId`', async () => {
     const client = mainnetDefaultClient()
     const response = await client.v1.tokenlist.$get(