tapimo 0.14.0 → 0.15.1

package/src/db/tables/verifiedTokenRequests.test.ts

@@ -70,6 +70,26 @@ describe('create', () => {
     const other = await VerifiedTokenRequests.create(db, { ...input, chainId: 4217 })
     expect(other).toBeDefined()
   })
+
+  test("atomically caps pending requests across a requester's organizations", async () => {
+    const db = TestApp.database()
+    const attempts = await Promise.allSettled(
+      Array.from({ length: VerifiedTokenRequests.maxPendingPerRequester + 1 }, (_, index) =>
+        VerifiedTokenRequests.create(db, {
+          ...input,
+          address: `0x${(index + 1).toString(16).padStart(40, '0')}`,
+          orgId: `org_${index}`,
+          symbol: `T${index}`,
+        }),
+      ),
+    )
+    expect(attempts.filter((attempt) => attempt.status === 'fulfilled')).toHaveLength(
+      VerifiedTokenRequests.maxPendingPerRequester,
+    )
+    expect(attempts.filter((attempt) => attempt.status === 'rejected')).toMatchObject([
+      { reason: { name: 'VerifiedTokenRequests.PendingLimitError' } },
+    ])
+  })
 })
 
 describe('list', () => {
@@ -108,38 +128,37 @@ describe('listByStatus', () => {
       status: 'denied',
     })
 
-    const queue = await VerifiedTokenRequests.listByStatus(db, 'pending')
+    const queue = await VerifiedTokenRequests.listByStatus(db, 'pending', { limit: 10 })
     expect(queue.map(({ id, orgName }) => ({ id, orgName }))).toEqual([
       { id: pending!.id, orgName: 'Acme' },
     ])
     // The denied row's org has no organizations row; the join yields null.
-    const reviewed = await VerifiedTokenRequests.listByStatus(db, 'denied')
+    const reviewed = await VerifiedTokenRequests.listByStatus(db, 'denied', { limit: 10 })
     expect(reviewed.map(({ id, orgName }) => ({ id, orgName }))).toEqual([
       { id: denied!.id, orgName: null },
     ])
   })
-})
 
-describe('countPending', () => {
-  test('counts only the organization pending requests', async () => {
+  test('continues after a stable oldest-first cursor', async () => {
     const db = TestApp.database()
+    for (const [suffix, symbol] of [
+      ['bb', 'tEUR'],
+      ['cc', 'tGBP'],
+    ] as const)
+      await VerifiedTokenRequests.create(db, {
+        ...input,
+        address: `0x20c00000000000000000000000000000000000${suffix}`,
+        symbol,
+      })
     await VerifiedTokenRequests.create(db, input)
-    const denied = await VerifiedTokenRequests.create(db, {
-      ...input,
-      address: '0x20c00000000000000000000000000000000000bb',
-      symbol: 'tEUR',
-    })
-    await VerifiedTokenRequests.review(db, denied!.id, {
-      reviewedBy: 'admin@tempo.xyz',
-      status: 'denied',
-    })
-    await VerifiedTokenRequests.create(db, {
-      ...input,
-      address: '0x20c00000000000000000000000000000000000cc',
-      orgId: 'org_2b3c4d5e6f7g8h9j0k1m2n3p',
-      symbol: 'tGBP',
+    const all = await VerifiedTokenRequests.listByStatus(db, 'pending', { limit: 10 })
+    const first = await VerifiedTokenRequests.listByStatus(db, 'pending', { limit: 2 })
+    const last = first.at(-1)!
+    const second = await VerifiedTokenRequests.listByStatus(db, 'pending', {
+      cursor: { createdAt: last.createdAt, id: last.id },
+      limit: 2,
     })
-    expect(await VerifiedTokenRequests.countPending(db, input.orgId)).toBe(1)
+    expect([...first, ...second].map(({ id }) => id)).toEqual(all.map(({ id }) => id))
   })
 })
 

package/src/db/tables/verifiedTokenRequests.ts

@@ -11,44 +11,61 @@ export type Record = Selectable<Table>
 /** Review status of a request. */
 export type Status = Record['status']
 
+/** Maximum pending verification requests retained for one requester. */
+export const maxPendingPerRequester = 10
+
 /**
  * Inserts a pending request; `undefined` when a pending request for
- * (chainId, address) already exists.
+ * (chainId, address) already exists. Throws `PendingLimitError` when the
+ * requester already has the maximum retained pending requests.
  */
 export function create(db: Db.Db, input: create.Input): Promise<Record | undefined> {
   const now = new Date().toISOString()
-  return db.kysely
-    .insertInto('verified_token_requests')
-    .values({
-      address: input.address,
-      chainId: input.chainId,
-      createdAt: now,
-      currency: input.currency,
-      decimals: input.decimals,
-      id: Id.generate('vtr'),
-      logo: input.logo ?? null,
-      logoUri: input.logoUri ?? null,
-      name: input.name,
-      note: input.note ?? null,
-      orgId: input.orgId,
-      requestedBy: input.requestedBy,
-      reviewNote: null,
-      reviewedAt: null,
-      reviewedBy: null,
-      status: 'pending',
-      symbol: input.symbol,
-      updatedAt: now,
-    })
-    .onConflict((oc) =>
-      oc
-        .columns(['chainId', 'address'])
-        // `sql.lit` keeps the predicate literal; a bound parameter would
-        // defeat partial-index inference for the conflict target.
-        .where('status', '=', sql.lit('pending'))
-        .doNothing(),
+  return db.transaction(async (tx) => {
+    // Serialize admission per requester so parallel organizations cannot exceed the retained queue cap.
+    await sql`SELECT pg_advisory_xact_lock(hashtextextended(${`verified-token-requests:${input.requestedBy}`}, 0))`.execute(
+      tx.kysely,
     )
-    .returningAll()
-    .executeTakeFirst()
+    const pending = await tx.kysely
+      .selectFrom('verified_token_requests')
+      .select(({ fn }) => fn.countAll<string>().as('count'))
+      .where('requestedBy', '=', input.requestedBy)
+      .where('status', '=', 'pending')
+      .executeTakeFirstOrThrow()
+    if (Number(pending.count) >= maxPendingPerRequester) throw new PendingLimitError()
+    return tx.kysely
+      .insertInto('verified_token_requests')
+      .values({
+        address: input.address,
+        chainId: input.chainId,
+        createdAt: now,
+        currency: input.currency,
+        decimals: input.decimals,
+        id: Id.generate('vtr'),
+        logo: input.logo ?? null,
+        logoUri: input.logoUri ?? null,
+        name: input.name,
+        note: input.note ?? null,
+        orgId: input.orgId,
+        requestedBy: input.requestedBy,
+        reviewNote: null,
+        reviewedAt: null,
+        reviewedBy: null,
+        status: 'pending',
+        symbol: input.symbol,
+        updatedAt: now,
+      })
+      .onConflict((oc) =>
+        oc
+          .columns(['chainId', 'address'])
+          // `sql.lit` keeps the predicate literal; a bound parameter would
+          // defeat partial-index inference for the conflict target.
+          .where('status', '=', sql.lit('pending'))
+          .doNothing(),
+      )
+      .returningAll()
+      .executeTakeFirst()
+  })
 }
 
 export declare namespace create {
@@ -96,17 +113,42 @@ export function list(db: Db.Db, orgId: string): Promise<Record[]> {
 export function listByStatus(
   db: Db.Db,
   status: Status,
+  options: listByStatus.Options,
 ): Promise<(Record & { orgName: string | null })[]> {
-  return db.kysely
+  const { cursor } = options
+  let query = db.kysely
     .selectFrom('verified_token_requests')
     .leftJoin('organizations', 'organizations.id', 'verified_token_requests.orgId')
     .selectAll('verified_token_requests')
     .select('organizations.name as orgName')
     .where('status', '=', status)
+  if (cursor)
+    query = query.where((eb) =>
+      eb.or([
+        eb('verified_token_requests.createdAt', '>', cursor.createdAt),
+        eb.and([
+          eb('verified_token_requests.createdAt', '=', cursor.createdAt),
+          eb('verified_token_requests.id', '>', cursor.id),
+        ]),
+      ]),
+    )
+  return query
     .orderBy('verified_token_requests.createdAt', 'asc')
+    .orderBy('verified_token_requests.id', 'asc')
+    .limit(options.limit)
     .execute()
 }
 
+export declare namespace listByStatus {
+  /** Pagination options for the global review queue. */
+  type Options = {
+    /** Oldest-first position after which to continue. */
+    cursor?: { createdAt: string; id: string } | undefined
+    /** Maximum records to return. */
+    limit: number
+  }
+}
+
 /** Gets a request by id. */
 export function get(db: Db.Db, id: string): Promise<Record | undefined> {
   return db.kysely
@@ -116,17 +158,6 @@ export function get(db: Db.Db, id: string): Promise<Record | undefined> {
     .executeTakeFirst()
 }
 
-/** Counts an organization's pending requests. */
-export async function countPending(db: Db.Db, orgId: string): Promise<number> {
-  const row = await db.kysely
-    .selectFrom('verified_token_requests')
-    .select(({ fn }) => fn.countAll<string>().as('count'))
-    .where('orgId', '=', orgId)
-    .where('status', '=', 'pending')
-    .executeTakeFirstOrThrow()
-  return Number(row.count)
-}
-
 /** Hard-deletes an org-scoped request while pending; `undefined` otherwise. */
 export function remove(db: Db.Db, orgId: string, id: string): Promise<Record | undefined> {
   return db.kysely
@@ -180,3 +211,8 @@ export function toRequest(record: Record) {
     ...(logoUri === null ? {} : { logoUri }),
   }
 }
+
+/** The requester already has the maximum retained pending requests. */
+export class PendingLimitError extends Error {
+  override readonly name = 'VerifiedTokenRequests.PendingLimitError'
+}

package/src/db/tables/webhookQueueEvents.ts

@@ -56,7 +56,7 @@ export async function ensure(db: Db.Db, rows: readonly Insertable<Table>[]): Pro
   const values = sql.join(
     rows.map(
       (row) =>
-        sql`(${row.subscriptionId}::text, ${row.eventId}::text, ${JSON.stringify(row.envelope)}::jsonb, ${row.createdAt}::text, ${row.nextAttemptAt ?? null}::text, ${row.observedAt ?? null}::text)`,
+        sql`(${row.subscriptionId}::text, ${row.eventId}::text, ${serializeEnvelope(row.envelope)}::jsonb, ${row.createdAt}::text, ${row.nextAttemptAt ?? null}::text, ${row.observedAt ?? null}::text)`,
     ),
   )
   // The VALUES source is raw because kysely has no table constructor for it,
@@ -100,6 +100,13 @@ export async function ensure(db: Db.Db, rows: readonly Insertable<Table>[]): Pro
   return Number(result.numInsertedOrUpdatedRows ?? 0n)
 }
 
+/** Serializes an envelope after replacing strings PostgreSQL jsonb cannot store. */
+function serializeEnvelope(envelope: Webhooks.Envelope): string {
+  return JSON.stringify(envelope, (_key, value) =>
+    typeof value === 'string' ? value.replaceAll('\0', '\uFFFD') : value,
+  )
+}
+
 /** Due, unclaimed pending work: shared by {@link claim} and {@link due}. */
 function whereClaimable(
   eb: ExpressionBuilder<Db.Database, 'webhook_queue_events'>,

package/src/db/tables/webhookSubscriptions.ts

@@ -104,19 +104,25 @@ export declare namespace insert {
   }
 }
 
-/**
- * Inserts a subscription when its owner remains below the configured cap.
- * An owner-scoped transaction lock serializes the count and insert.
- */
+/** Inserts below the direct-owner or API-key creator cap. A transaction lock serializes count and insert. */
 export async function insertWithinLimit(
   db: Db.Db,
   subscription: Webhooks.Subscription,
   options: insertWithinLimit.Options,
 ): Promise<boolean> {
   return db.transaction(async (tx) => {
-    const owner = `${subscription.owner.type}:${ownerId(subscription.owner)}`
-    await sql`select pg_advisory_xact_lock(${subscriptionLimitLockClass}, hashtext(${owner}))`.execute(tx.kysely) // prettier-ignore
-    const existing = await count(tx, subscription.owner, options.now)
+    const userId =
+      subscription.owner.type === 'api_key'
+        ? await getOrganizationUserId(tx, { orgId: subscription.owner.orgId })
+        : undefined
+    // Keep the legacy owner lock during rolling deploys, then serialize the creator-wide count.
+    const ownerScope = `${subscription.owner.type}:${ownerId(subscription.owner)}`
+    await sql`select pg_advisory_xact_lock(${subscriptionLimitLockClass}, hashtext(${ownerScope}))`.execute(tx.kysely) // prettier-ignore
+    if (userId)
+      await sql`select pg_advisory_xact_lock(${subscriptionLimitLockClass}, hashtext(${`api_key_user:${userId}`}))`.execute(tx.kysely) // prettier-ignore
+    const existing = userId
+      ? await countByOrganizationUser(tx, { now: options.now, userId })
+      : await count(tx, subscription.owner, options.now)
     if (existing >= options.maxPerOwner) return false
     await insert(
       tx,
@@ -139,6 +145,75 @@ export declare namespace insertWithinLimit {
   }
 }
 
+/** Counts subscriptions against the direct-owner or API-key creator cap. */
+export async function countForLimit(db: Db.Db, options: countForLimit.Options): Promise<number> {
+  const { now, owner } = options
+  const userId =
+    owner.type === 'api_key' ? await getOrganizationUserId(db, { orgId: owner.orgId }) : undefined
+  return userId ? countByOrganizationUser(db, { now, userId }) : count(db, owner, now)
+}
+
+export declare namespace countForLimit {
+  /** Inputs for counting subscriptions against a creation cap. */
+  type Options = {
+    /** ISO timestamp used to exclude expired rows. */
+    now: string
+    /** Owner whose direct or creator-wide cap is counted. */
+    owner: Webhooks.Owner
+  }
+}
+
+/** Resolves the creator shared by API-key-owned sibling organizations. */
+async function getOrganizationUserId(
+  db: Db.Db,
+  options: getOrganizationUserId.Options,
+): Promise<string | undefined> {
+  return db.kysely
+    .selectFrom('organizations')
+    .select('userId')
+    .where('id', '=', options.orgId)
+    .executeTakeFirst()
+    .then((organization) => organization?.userId ?? undefined)
+}
+
+declare namespace getOrganizationUserId {
+  /** Organization lookup fields. */
+  type Options = {
+    /** Organization whose creator is resolved. */
+    orgId: string
+  }
+}
+
+/** Counts live API-key subscriptions across organizations created by one user. */
+async function countByOrganizationUser(
+  db: Db.Db,
+  options: countByOrganizationUser.Options,
+): Promise<number> {
+  const { now, userId } = options
+  const row = await db.kysely
+    .selectFrom('webhook_subscriptions')
+    .select((eb) => eb.fn.countAll().as('count'))
+    .where('ownerType', '=', 'api_key')
+    .where(
+      'ownerId',
+      'in',
+      db.kysely.selectFrom('organizations').select('id').where('userId', '=', userId),
+    )
+    .where(live(now))
+    .executeTakeFirstOrThrow()
+  return Number(row.count)
+}
+
+declare namespace countByOrganizationUser {
+  /** Creator-scoped count fields. */
+  type Options = {
+    /** ISO timestamp used to exclude expired rows. */
+    now: string
+    /** Organization creator whose subscriptions are counted. */
+    userId: string
+  }
+}
+
 /**
  * Reads an owner's subscription by id; expired rows never match (query-time
  * expiry, same read semantics as the old store TTL).
@@ -305,16 +380,16 @@ export async function remove(
 }
 
 function privateResourceAccess(access: Webhooks.Access) {
-  const fundingRead = access.scopes.some(
-    (scope) => scope === Scope.wildcard || scope === 'funding:read',
+  const routesRead = access.scopes.some(
+    (scope) => scope === Scope.wildcard || scope === 'routes:read',
   )
   return (eb: ExpressionBuilder<Db.Database, 'webhook_subscriptions'>) =>
     eb.or([
-      sql<boolean>`${eb.ref('eventType')} not like ${'funding:%'}`,
-      ...(fundingRead
+      sql<boolean>`${eb.ref('eventType')} not like ${'routes:%'}`,
+      ...(routesRead
         ? [
             eb.and([
-              sql<boolean>`${eb.ref('eventType')} like ${'funding:%'}`,
+              sql<boolean>`${eb.ref('eventType')} like ${'routes:%'}`,
               eb('environment', '=', access.environment),
               ...(access.projectId === undefined ? [] : [eb('projectId', '=', access.projectId)]),
             ]),
@@ -390,10 +465,10 @@ export declare namespace listActiveForChain {
   }
 }
 
-/** Lists live funding subscriptions visible to one resource owner. */
-export async function listActiveForFundingEvent(
+/** Lists live routes subscriptions visible to one resource owner. */
+export async function listActiveForRoutesEvent(
   db: Db.Db,
-  options: listActiveForFundingEvent.Options,
+  options: listActiveForRoutesEvent.Options,
 ): Promise<Webhooks.Subscription[]> {
   let query = db.kysely
     .selectFrom('webhook_subscriptions')
@@ -416,8 +491,8 @@ export async function listActiveForFundingEvent(
   return (await query.orderBy('id').forKeyShare().execute()).map(toSubscription)
 }
 
-export declare namespace listActiveForFundingEvent {
-  /** Ownership scope and chain for a funding resource event. */
+export declare namespace listActiveForRoutesEvent {
+  /** Ownership scope and chain for a route resource event. */
   type Options = {
     /** Destination Tempo chain id. */
     chainId: number
@@ -425,13 +500,13 @@ export declare namespace listActiveForFundingEvent {
     environment: 'production' | 'sandbox'
     /** Event timestamp used to keep subscriptions future-only, when supplied. */
     eventCreatedAt?: string | undefined
-    /** Funding event type to match. */
-    eventType: Extract<Webhooks.EventType, `funding:${string}`>
+    /** Routes event type to match. */
+    eventType: Extract<Webhooks.EventType, `routes:${string}`>
     /** ISO timestamp used to exclude expired subscriptions. */
     now: string
     /** Owning organization id. */
     orgId: string
-    /** Attributed funding resource project, when present. */
+    /** Attributed route resource project, when present. */
     projectId?: string | undefined
   }
 }

package/src/handlers/internal/executionError.ts

@@ -3,7 +3,7 @@ import { Abis } from 'viem/tempo'
 
 import type { OneOf, UnionOmit } from './types.js'
 
-type AllAbis = typeof Abis.abis
+type AllAbis = typeof Abis.core
 type AbiErrorName = Extract<AllAbis[number], { type: 'error' }>['name']
 
 /** Decoded execution error from a Tempo precompile revert. */
@@ -19,7 +19,7 @@ export type ExecutionError = OneOf<
 export type Rpc = UnionOmit<ExecutionError, 'args'>
 
 /** Human-readable messages keyed by ABI error name. */
-export const messages: Record<AbiErrorName, string> = {
+export const messages: Partial<Record<AbiErrorName, string>> = {
   AddressAlreadyHasValidator: 'This address already has a validator.',
   AddressNotReserved: 'Address is not reserved.',
   AddressReserved: 'Address is reserved.',
@@ -34,7 +34,6 @@ export const messages: Record<AbiErrorName, string> = {
   ChannelNotFound: 'Channel not found.',
   CloseNotReady: 'Channel is not ready to close.',
   ContractPaused: 'Contract is paused.',
-  DelegateCallNotAllowed: 'Delegate call is not allowed.',
   DepositOverflow: 'Deposit overflow.',
   DivisionByZero: 'Division by zero.',
   EmptyV1ValidatorSet: 'Validator set is empty.',
@@ -156,7 +155,7 @@ export function parse(error: Error): ExecutionError {
   const data = extractRevertData(error)
   if (data) {
     try {
-      const decoded = decodeErrorResult({ abi: Abis.abis, data })
+      const decoded = decodeErrorResult({ abi: Abis.core, data })
       const template = messages[decoded.errorName as AbiErrorName]
       return {
         ...decoded,