tapimo 0.15.0 → 0.18.0

package/src/apps/routes/routes/transfers.test.ts

@@ -8,9 +8,14 @@ import * as TestApp from '../../../../test/App.js'
 import * as TestRoutes from '../../../../test/Routes.js'
 import * as RoutesIdempotencyTable from '../../../db/tables/routesIdempotency.js'
 import * as Organizations from '../../../db/tables/organizations.js'
+import * as RoutesPolicies from '../../../db/tables/routesPolicies.js'
 import * as RoutesSubsidies from '../../../db/tables/routesSubsidies.js'
+import * as RoutesTransfers from '../../../db/tables/routesTransfers.js'
 import * as StripeCustomers from '../../../db/tables/stripeCustomers.js'
 import * as Cache from '../../../internal/Cache.js'
+import * as Idempotency from '../../../internal/Idempotency.js'
+import type * as Log from '../../../internal/Log.js'
+import * as Relay from '../../../internal/routes/providers/relay.js'
 import type * as RoutesAction from '../../../internal/routes/Action.js'
 import * as RoutesCatalog from '../../../internal/routes/Catalog.js'
 import * as RoutesChain from '../../../internal/routes/Chain.js'
@@ -19,9 +24,6 @@ import * as RoutesProvider from '../../../internal/routes/Provider.js'
 import * as RoutesTransfer from '../../../internal/routes/Transfer.js'
 import * as RoutesTransferReconciliation from '../../../internal/routes/TransferReconciliation.js'
 import * as RoutesTransferSubsidy from '../../../internal/routes/TransferSubsidy.js'
-import * as Idempotency from '../../../internal/Idempotency.js'
-import type * as Log from '../../../internal/Log.js'
-import * as Relay from '../../../internal/routes/providers/relay.js'
 import * as Stargate from '../../../internal/routes/providers/stargate.js'
 import * as Webhooks from '../../../internal/Webhooks.js'
 import * as Routes from './transfers.js'
@@ -230,6 +232,18 @@ describe('GET /routes/transfers/:id', () => {
 })
 
 describe('POST /routes/transfers/:id/source-transactions', () => {
+  test('rejects unprefixed transaction IDs for EVM source chains', async () => {
+    const app = transfersApp({ routes: { async dispatchTransferReconciliation() {} } })
+    const transfer = await seedTransfer()
+    const response = await app.request(`/v1/routes/transfers/${transfer.id}/source-transactions`, {
+      body: JSON.stringify({ transactionHash: 'ab'.repeat(32) }),
+      headers: { ...as(routesWriter).headers, 'content-type': 'application/json' },
+      method: 'POST',
+    })
+    expect(response.status).toMatchInlineSnapshot(`400`)
+    expect((await response.json()).error.code).toMatchInlineSnapshot(`"source_transaction_invalid"`)
+  })
+
   test('requires routes write access and validates the transaction hash array', async () => {
     const app = transfersApp()
     const transfer = await seedTransfer()
@@ -442,10 +456,16 @@ const zoneTransferBody = {
   sourceToken: createBody.sourceToken,
 }
 
-function postTransfer(
+async function postTransfer(
   app: ReturnType<typeof create>,
-  options: { body?: unknown; idempotencyKey?: string | undefined; key?: { token: string } } = {},
+  options: {
+    body?: unknown
+    idempotencyKey?: string | undefined
+    key?: TestApp.kvStore.Key
+    policy?: boolean
+  } = {},
 ) {
+  if (options.policy) await grantRoutes(options.key ?? routesWriter)
   return app.request('/v1/routes/transfers', {
     body: JSON.stringify(options.body ?? createBody),
     headers: {
@@ -637,6 +657,103 @@ describe('POST /routes/transfers', () => {
     ).resolves.toEqual([])
   })
 
+  test('selects a prepared alternative within its own subsidy cap', async () => {
+    const key = {
+      id: 'key_transfer_cap_fallback',
+      orgId: 'org_transfer_cap_fallback',
+      scopes: ['routes:write'],
+      token: 'secret_transfer_cap_fallback',
+    }
+    await Organizations.create(db, { id: key.orgId, name: 'Cap fallback' })
+    const route = {
+      destinationChainId: 'eip155:8453',
+      destinationTokenId: 'usdc',
+      sourceChainId: 'eip155:4217',
+      sourceTokenId: 'usdce',
+    }
+    await RoutesCatalog.publish(db, {
+      ...TestRoutes.data,
+      routes: [
+        ...TestRoutes.data.routes,
+        {
+          ...route,
+          capabilities: { transfer: { modes: ['exactSource'] } },
+          providerId: 'relay',
+        },
+      ],
+    })
+    try {
+      await RoutesPolicies.save(db, {
+        policy: {
+          access: null,
+          subsidyEnabled: true,
+          subsidyPayer: 'tempo',
+          terms: [
+            { ...route, maxAmount: '0.005', providerId: 'relay' },
+            { ...route, maxAmount: '0.02', providerId: 'stargate' },
+          ],
+        },
+        scope: { environment: 'production', orgId: key.orgId },
+        version: 0,
+      })
+      const request = {
+        ...createBody,
+        destinationChain: 'base',
+        destinationToken: 'usdc',
+        sourceChain: 'tempo',
+        sourceToken: 'usdce',
+        subsidize: true,
+      }
+      const attempts: string[] = []
+      const app = create({
+        auth: { keys: [key] },
+        defaultChainId: tempoMainnet.id,
+        providers: ['relay', 'stargate'].map((id) =>
+          RoutesProvider.from({
+            ...Relay.relay(),
+            id,
+            name: id,
+            async prepareTransfer({ candidate }) {
+              attempts.push(id)
+              return {
+                ...providerResponse({ sourceToken: candidate.sourceToken.address }),
+                destinationAmount: id === 'relay' ? '995000' : '990000',
+                destinationAmountMin: id === 'relay' ? '990000' : '980000',
+              }
+            },
+          }),
+        ),
+        routes: { transferSubsidy: transferSubsidy('0.05') },
+      })
+      const response = await postTransfer(app, {
+        body: request,
+        idempotencyKey: nextIdempotencyKey(),
+        key,
+      })
+      expect(response.status).toBe(200)
+      const body = await TestApp.json(response, Routes.schema.createRoutesTransfer.Response)
+      expect(body).toMatchObject({
+        destinationAmountMin: { baseUnits: '980000' },
+        provider: { id: 'stargate' },
+      })
+      expect(attempts.sort()).toEqual(['relay', 'stargate'])
+      expect((await RoutesTransfers.get(db, body.id))?.providerState).toMatchObject({
+        routePolicy: { maxAmount: '0.02', subsidyPayer: 'tempo' },
+      })
+      const restricted = await postTransfer(app, {
+        body: { ...request, provider: 'relay' },
+        idempotencyKey: nextIdempotencyKey(),
+        key,
+      })
+      expect(restricted.status).toBe(403)
+      await expect(restricted.json()).resolves.toMatchObject({
+        error: { code: 'routes_subsidy_limit_exceeded' },
+      })
+    } finally {
+      await TestRoutes.publish(db)
+    }
+  })
+
   test('requires configuration and records normalized subsidy terms', async () => {
     const request = {
       ...createBody,
@@ -661,7 +778,7 @@ describe('POST /routes/transfers', () => {
     })
     expect(unavailable.status).toBe(501)
 
-    await Organizations.create(db, { id: routesWriter.orgId, name: routesWriter.orgId })
+    await Organizations.upsert(db, { id: routesWriter.orgId, name: routesWriter.orgId })
     await RoutesSubsidies.upsertOrganization(db, {
       frequency: 'tx',
       maxAmount: '5',
@@ -732,6 +849,11 @@ describe('POST /routes/transfers', () => {
       .where('id', '=', body.id)
       .executeTakeFirstOrThrow()
     expect(row.providerState).not.toHaveProperty('transferSubsidyPolicy')
+    expect(row.providerState).not.toHaveProperty('routePolicy')
+    expect(row.providerState).not.toHaveProperty('routePolicyKey')
+    expect(
+      await RoutesPolicies.get(db, { orgId: routesWriter.orgId, environment: 'production' }),
+    ).toBeUndefined()
     expect(row).toMatchObject({
       subsidyAccount: `0x${'77'.repeat(20)}`,
       subsidyChainId: 'eip155:8453',
@@ -754,6 +876,23 @@ describe('POST /routes/transfers', () => {
       error: { code: 'idempotency_conflict' },
     })
 
+    const optedIn = await TestApp.json(
+      await postTransfer(
+        transfersApp({ providers: [outbound], routes: { transferSubsidy: transferSubsidy('5') } }),
+        { body: request, idempotencyKey: nextIdempotencyKey(), policy: true },
+      ),
+      Routes.schema.createRoutesTransfer.Response,
+    )
+    const pinned = await db.kysely
+      .selectFrom('routes_transfers')
+      .select('providerState')
+      .where('id', '=', optedIn.id)
+      .executeTakeFirstOrThrow()
+    expect(pinned.providerState).toMatchObject({
+      routePolicy: { maxAmount: '5', subsidyPayer: 'enterprise' },
+      routePolicyKey: '["enterprise","5.000000"]',
+    })
+
     await RoutesCatalog.publish(db, {
       ...TestRoutes.data,
       tokens: TestRoutes.data.tokens.map((token) =>
@@ -1157,7 +1296,12 @@ describe.skipIf(!Anvil.available)('POST /routes/transfers (forked localnet)', ()
       })
 
       function createTransfer(idempotencyKey: string) {
-        const app = transfersApp({ providers: [executable.create(sender.address)] })
+        const app = transfersApp({
+          logger(entry) {
+            if (entry.level === 'error') console.error(entry)
+          },
+          providers: [executable.create(sender.address)],
+        })
         return postTransfer(app, {
           body: {
             ...createBody,
@@ -1254,13 +1398,28 @@ describe.skipIf(!Anvil.available)('POST /routes/transfers (forked localnet)', ()
 
       if (executable.id === 'stargate')
         test('registers non-atomic calls and reopens them after an execution reorg', async () => {
+          // Keep destination head and log reads on the same fork during source reorg verification.
+          const destination = await Anvil.start({
+            chain: tempoMainnet,
+            forkUrl: tempoMainnet.rpcUrls.default.http[0]!,
+          })
+          onTestFinished(async () => {
+            await TestRoutes.publish(db)
+            await destination.stop()
+          })
+          const chains = TestRoutes.data.chains.map((chain) =>
+            chain.id === `eip155:${tempoMainnet.id}`
+              ? { ...chain, rpcUrls: [destination.rpcUrl] }
+              : chain,
+          )
+          await RoutesCatalog.publish(db, { ...TestRoutes.data, chains })
           await Anvil.setErc20Balance(anvil.client, {
             address: sender.address,
             amount,
             slot: fiatTokenBalanceSlot,
             token: usdc.address as `0x${string}`,
           })
-          const response = await createTransfer(`bridge_reorg_${sender.address}`)
+          const response = await createTransfer(Hex.random(16))
           expect(response.status).toBe(200)
           const transfer = await TestApp.json(response, Routes.schema.createRoutesTransfer.Response)
           expect(transfer.action.type).toBe('evm:calls')
@@ -1288,7 +1447,7 @@ describe.skipIf(!Anvil.available)('POST /routes/transfers (forked localnet)', ()
             const transactionHash = sourceReceipt.transactionHash
             await RoutesCatalog.publish(db, {
               ...TestRoutes.data,
-              chains: TestRoutes.data.chains.map((chain) =>
+              chains: chains.map((chain) =>
                 chain.id === 'eip155:8453' ? { ...chain, rpcUrls: [anvil.rpcUrl] } : chain,
               ),
             })
@@ -1375,7 +1534,6 @@ describe.skipIf(!Anvil.available)('POST /routes/transfers (forked localnet)', ()
             ).toEqual([])
           } finally {
             if (!reverted) await anvil.client.revert({ id: checkpoint })
-            await TestRoutes.publish(db)
           }
         })
 
@@ -1951,7 +2109,8 @@ describe('route transfers OpenAPI', () => {
           spec.components.schemas.ApiKeyMalformedOrBodyInvalidOrIdempotencyKeyRequiredError
             .properties.error.properties.code.enum,
         idempotencyConflict:
-          spec.components.schemas.IdempotencyConflictOrIdempotencyInProgressError.properties.error
+          spec.components.schemas
+            .IdempotencyConflictOrIdempotencyInProgressOrRoutePolicyChangedError.properties.error
             .properties.code.enum,
         notImplemented:
           spec.components.schemas.NotImplemented501Error.properties.error.properties.code.enum,
@@ -1994,6 +2153,9 @@ describe('route transfers OpenAPI', () => {
             {
               "$ref": "#/components/schemas/RoutesEvmCallsAction",
             },
+            {
+              "$ref": "#/components/schemas/RoutesTronCallsAction",
+            },
           ],
           "createdAction": {
             "$ref": "#/components/schemas/RoutesAction",
@@ -2023,6 +2185,7 @@ describe('route transfers OpenAPI', () => {
           "idempotencyConflict": [
             "idempotency_conflict",
             "idempotency_in_progress",
+            "route_policy_changed",
           ],
           "notImplemented": [
             "not_implemented",
@@ -2052,13 +2215,13 @@ describe('route transfers OpenAPI', () => {
                 "$ref": "#/components/schemas/AuthenticationError",
               },
               "403": {
-                "$ref": "#/components/schemas/ApiKeyForbiddenOrApiKeyIpForbiddenOrBillingPastDueOrBillingRequiredOrForbiddenOrRoutesSubsidyLimitExceededOrRoutesSubsidyNotEnabledError",
+                "$ref": "#/components/schemas/ApiKeyForbiddenOrApiKeyIpForbiddenOrBillingPastDueOrBillingRequiredOrForbiddenOrRoutesNotAllowedOrRoutesSubsidyLimitExceededOrRoutesSubsidyNotAllowedOrRoutesSubsidyNotEnabledOrRoutesSuspendedError",
               },
               "404": {
                 "$ref": "#/components/schemas/QuoteNotAvailableError",
               },
               "409": {
-                "$ref": "#/components/schemas/IdempotencyConflictOrIdempotencyInProgressError",
+                "$ref": "#/components/schemas/IdempotencyConflictOrIdempotencyInProgressOrRoutePolicyChangedError",
               },
               "429": "#/components/responses/RateLimited",
               "500": "#/components/responses/InternalError",
@@ -2269,7 +2432,7 @@ describe('route transfers OpenAPI', () => {
         sourceChain: ['tempo', 'base', 'ethereum', 'eip155:4217'],
         sourceToken: ['usdce', 'usdc'],
         subsidyDescription:
-          'Guarantees normalized 1:1 delivery for exact-source Tempo USD transfers to Base or Ethereum. A Tempo Admin must enable subsidies for the organization.',
+          'Guarantees normalized 1:1 USD delivery for exact-source transfers to Tempo or from Tempo to Base, Ethereum, Solana, or Tron. Requires organization subsidy approval.',
         subsidize: [true],
       },
       response: expect.objectContaining({
@@ -2517,7 +2680,7 @@ describe('route transfers OpenAPI', () => {
             "summary": "Get providers",
           },
           "quotes": {
-            "description": "Returns live quotes for transferring stablecoins between supported chains.",
+            "description": "Returns live stablecoin transfer quotes, or an actionable error when none are available.",
             "summary": "Get quotes",
           },
           "sourceTransaction": {
@@ -2572,6 +2735,29 @@ describe('route transfers OpenAPI', () => {
     const spec = (await (await app.request('/openapi.json')).json()) as Spec
     const creationSchema = (path: string) =>
       dereference(spec, spec.paths[path]!.post!.requestBody.content['application/json']!.schema)
+    expect(
+      ['/v1/routes/transfers', '/v1/routes/transfers/vault', '/v1/routes/transfers/zone'].map(
+        (path) => ({
+          description: creationSchema(path).properties!['sourceChain']!.description,
+          required: creationSchema(path).required?.includes('sourceChain') ?? false,
+        }),
+      ),
+    ).toMatchInlineSnapshot(`
+      [
+        {
+          "description": "Source chain CAIP-2 id, slug, or alias. Defaults to the destination chain.",
+          "required": false,
+        },
+        {
+          "description": "Source chain CAIP-2 id, slug, or alias.",
+          "required": true,
+        },
+        {
+          "description": "Source chain CAIP-2 id, slug, or alias.",
+          "required": true,
+        },
+      ]
+    `)
     expect(
       creationSchema('/v1/routes/deposit-addresses').required?.includes('subsidize') ?? false,
     ).toMatchInlineSnapshot(`false`)
@@ -2861,6 +3047,18 @@ function as(key: { token: string }) {
   return { headers: { authorization: `Bearer ${key.token}` } } as const
 }
 
+async function grantRoutes(key: TestApp.kvStore.Key) {
+  await Organizations.upsert(db, { id: key.orgId, name: key.orgId })
+  const scope = { environment: 'production' as const, orgId: key.orgId }
+  const current = await RoutesPolicies.get(db, scope)
+  if (current?.policy.access === null) return
+  await RoutesPolicies.save(db, {
+    policy: { ...current?.policy, access: null },
+    scope,
+    version: current?.version ?? 0,
+  })
+}
+
 let seedSecond = 0
 
 function seedTransfer(input: Partial<RoutesTransfer.create.Input> = {}) {
@@ -2874,3 +3072,42 @@ function seedTransfer(input: Partial<RoutesTransfer.create.Input> = {}) {
     ...input,
   })
 }
+
+describe('schema.registerRoutesTransferSourceTransaction.Body', () => {
+  test('accepts native Tron IDs without losing the source-chain validation marker', () => {
+    expect(
+      Routes.schema.registerRoutesTransferSourceTransaction.Body.parse({
+        transactionHash: 'AB'.repeat(32),
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "transactionHash": "abababababababababababababababababababababababababababababababab",
+      }
+    `)
+  })
+
+  test('preserves the EVM prefix and rejects malformed transaction IDs', () => {
+    expect(
+      Routes.schema.registerRoutesTransferSourceTransaction.Body.parse({
+        transactionHash: `0x${'AB'.repeat(32)}`,
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "transactionHash": "0xabababababababababababababababababababababababababababababababab",
+      }
+    `)
+    expect(
+      ['aa'.repeat(31), 'zz'.repeat(32), `0x${'aa'.repeat(33)}`].map(
+        (transactionHash) =>
+          Routes.schema.registerRoutesTransferSourceTransaction.Body.safeParse({ transactionHash })
+            .success,
+      ),
+    ).toMatchInlineSnapshot(`
+      [
+        false,
+        false,
+        false,
+      ]
+    `)
+  })
+})