tapimo 0.15.1 → 0.18.1

package/src/admin/apps/earn-vaults.test.ts

@@ -101,10 +101,9 @@ describe('getVerifiedEarnVault', () => {
         TestApp.json(response, App.schema.getVerifiedEarnVault.Response),
         TestApp.json(publicResponse, Earn.schema.getEarnVault.Response),
       ])
-      // Every field the admin include set can select is resolved identically to
-      // the public surface.
+      // Public vault fields stay identical; earnings configuration is admin-only.
       expect(publicVault.meta).toBeUndefined()
-      expect(vault).toStrictEqual(publicVault)
+      expect(vault).toStrictEqual({ ...publicVault, earnings: null })
       expect({
         description: vault.description,
         slug: vault.slug,
@@ -173,15 +172,34 @@ describe('listVerifiedEarnVaults', () => {
       expect([response.status, publicResponse.status]).toEqual([200, 200])
       const [body, publicBody] = await Promise.all([
         TestApp.json(response, App.schema.listVerifiedEarnVaults.Response),
-        TestApp.json(publicResponse, App.schema.listVerifiedEarnVaults.Response),
+        TestApp.json(publicResponse, Earn.schema.getVerifiedEarnVaults.Response),
       ])
-      expect(body).toStrictEqual(publicBody)
+      expect(body).toStrictEqual({
+        ...publicBody,
+        data: publicBody.data.map((vault) => ({ ...vault, earnings: null })),
+      })
     },
     90_000,
   )
 })
 
 describe('putVerifiedEarnVault', () => {
+  test('rejects malformed earnings counterparties before contract reads', async () => {
+    const { app } = TestAdmin.setup({ rpc: { url: () => 'http://127.0.0.1:1' } })
+    for (const earnings of [
+      { rewardDistributors: ['not-an-address'] },
+      { rewardDistributors: [], withdrawalSpenders: [] },
+      {},
+    ]) {
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({ ...input, earnings }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(400)
+    }
+  })
+
   test('rejects invalid slugs', async () => {
     const { app } = TestAdmin.setup()
     const response = await app.request('/earn/verified-vaults', {
@@ -251,6 +269,48 @@ describe('putVerifiedEarnVault', () => {
     60_000,
   )
 
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'discovers a router from its address for an existing vault',
+    async () => {
+      const { app, db } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      await core_EarnVaults.upsert(db, { ...TestEarn.zoneVerifiedVault, zones: [] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+          zoneRouter: TestEarn.zoneRoute.earnRouter,
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(200)
+      expect(
+        (await TestApp.json(response, App.schema.putVerifiedEarnVault.Response)).zones?.[0],
+      ).toMatchObject(TestEarn.zoneRoute)
+      expect(
+        await core_EarnVaults.get(db, {
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+        }),
+      ).toMatchObject({ zones: [TestEarn.zoneRoute] })
+
+      const repeated = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          chainId: zoneInput.chainId,
+          vaultAddress: zoneInput.vaultAddress,
+          zoneRouter: TestEarn.zoneRoute.earnRouter,
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(repeated.status).toBe(200)
+      expect(
+        (await TestApp.json(repeated, App.schema.putVerifiedEarnVault.Response)).zones,
+      ).toHaveLength(1)
+    },
+    90_000,
+  )
+
   test.runIf(Runtime.get().mode === 'testnet')(
     'verifies, stores, and preserves a Zone route',
     async () => {
@@ -363,13 +423,15 @@ describe('putVerifiedEarnVault', () => {
     'verifies, stores, and updates curated fields',
     async () => {
       const { app, db } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const earnings = { rewardDistributors: [asset] }
       const response = await app.request('/earn/verified-vaults', {
-        body: JSON.stringify(input),
+        body: JSON.stringify({ ...input, earnings }),
         headers: { 'content-type': 'application/json' },
         method: 'PUT',
       })
       expect(response.status).toBe(200)
       const body = await TestApp.json(response, App.schema.putVerifiedEarnVault.Response)
+      expect(body.earnings).toEqual(earnings)
       expect({
         description: body.description,
         engineType: body.engine.type,
@@ -411,6 +473,13 @@ describe('putVerifiedEarnVault', () => {
       })
       expect(updatedResponse.status).toBe(200)
       const updated = await TestApp.json(updatedResponse, App.schema.putVerifiedEarnVault.Response)
+      expect(updated.earnings).toEqual(earnings)
+      const detail = await app.request(
+        `/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}`,
+      )
+      expect(
+        (await TestApp.json(detail, App.schema.getVerifiedEarnVault.Response)).earnings,
+      ).toEqual(earnings)
       expect({
         description: updated.description,
         label: updated.label,
@@ -621,7 +690,7 @@ describe('deleteVerifiedEarnVault', () => {
         `/v1/earn/vaults/${vaultAddress}?chainId=${tempoTestnet.id}&include=zone`,
       )
       expect(publicResponse.status).toBe(200)
-      const vault = await TestApp.json(publicResponse, App.schema.getVerifiedEarnVault.Response)
+      const vault = await TestApp.json(publicResponse, Earn.schema.getEarnVault.Response)
       expect({
         description: vault.description,
         slug: vault.slug,

package/src/admin/apps/earn-vaults.ts

@@ -22,11 +22,22 @@ import type * as App from '../App.js'
 
 /** Zod schemas owned by the admin verified-vault handler. */
 export namespace schema {
-  /** One Earn vault, shared with the public detail API. */
-  export const Vault = Earn.schema.Vault
+  const earnings = z.object({
+    earnings: z
+      .nullable(EarnVaults.schema.Earnings)
+      .check(
+        z.describe(
+          'Additional per-vault reward distributors. Recorded campaign distributors are always included; null adds none.',
+        ),
+        z.meta({ examples: [null] }),
+      ),
+  })
+
+  /** One Earn vault with its private accounting configuration. */
+  export const Vault = z.intersection(Earn.schema.Vault, earnings)
 
-  /** One registry-curated Earn vault, shared with the public verified list. */
-  export const VerifiedVault = Earn.schema.VerifiedVault
+  /** One registry-curated Earn vault with its accounting configuration. */
+  export const VerifiedVault = z.intersection(Earn.schema.VerifiedVault, earnings)
 
   /** Schemas for the listVerifiedEarnVaults operation. */
   export namespace listVerifiedEarnVaults {
@@ -34,7 +45,10 @@ export namespace schema {
     export const Query = Earn.schema.getVerifiedEarnVaults.BaseQuery
 
     /** Paginated verified Earn vaults. */
-    export const Response = Earn.schema.getVerifiedEarnVaults.Response
+    export const Response = z.object({
+      data: z.array(VerifiedVault),
+      nextCursor: Earn.schema.getVerifiedEarnVaults.Response.shape.nextCursor,
+    })
   }
 
   /** Schemas for the getVerifiedEarnVault operation. */
@@ -69,6 +83,13 @@ export namespace schema {
             ),
           )
           .check(z.describe('Curated vault description, or null when absent.')),
+        earnings: z
+          .optional(earnings.shape.earnings)
+          .check(
+            z.describe(
+              'Omit to preserve additional distributors, supply a list to replace the additions, or null to clear them. Recorded campaign history is always retained.',
+            ),
+          ),
         label: z
           .optional(
             z
@@ -102,6 +123,9 @@ export namespace schema {
           z.describe('Earn vault contract address.'),
           z.meta({ examples: ['0x4f94590b636f5878bce585e82379de81e1ec174f'] }),
         ),
+        zoneRouter: z
+          .optional(Schema.Address)
+          .check(z.describe('Parent-chain Earn router to discover and add to this vault.')),
         zones: z
           .optional(z.array(EarnVaults.schema.ZoneRoute))
           .check(z.describe('Curated private Zone routes.')),
@@ -772,7 +796,20 @@ export function earnVaults() {
           const privateInputTokens = input.privateInputTokens ?? existing?.privateInputTokens ?? []
           const privateOutputTokens =
             input.privateOutputTokens ?? existing?.privateOutputTokens ?? []
-          const zoneRoutes = input.zones ?? existing?.zones ?? []
+          const zoneRoutes = [...(input.zones ?? existing?.zones ?? [])]
+          if (input.zoneRouter) {
+            const route = await EarnVaults.discoverZoneRoute({
+              discovery,
+              earnRouter: input.zoneRouter,
+              getClient: c.get('getClient'),
+              zones: c.get('zones'),
+            })
+            const index = zoneRoutes.findIndex(
+              (candidate) => candidate.earnRouter === route.earnRouter,
+            )
+            if (index === -1) zoneRoutes.push(route)
+            else zoneRoutes[index] = route
+          }
           const hasPrivateInputs = privateInputTokens.length > 0
           const hasPrivateOutputs = privateOutputTokens.length > 0
           if (hasPrivateInputs !== hasPrivateOutputs)
@@ -794,6 +831,7 @@ export function earnVaults() {
             chainId: input.chainId,
             description:
               input.description === undefined ? (existing?.description ?? null) : input.description,
+            earnings: input.earnings,
             label: input.label ?? existing?.label ?? discovery.shareToken.name,
             privateInputTokens,
             privateOutputTokens,
@@ -1159,12 +1197,12 @@ declare namespace resolveVaultRoutes {
 async function serializeVault(
   c: Context<App.Environment>,
   options: serializeVault.Options,
-): Promise<z.output<typeof Earn.schema.Vault>> {
+): Promise<z.output<typeof schema.Vault>> {
   const [assetToken, shareToken] = await Promise.all([
     serializeToken(c, { ...options, metadata: options.discovery.assetToken }),
     serializeToken(c, { ...options, metadata: options.discovery.shareToken }),
   ])
-  return Earn.serializeVault({
+  const vault = Earn.serializeVault({
     // Rate and valuation enrichment need indexer and FX access the admin app
     // does not carry, so its query schema cannot select either field.
     apy: null,
@@ -1178,6 +1216,7 @@ async function serializeVault(
     zoneRoutes: options.zoneRoutes,
     zones: c.get('zones'),
   })
+  return { ...vault, earnings: options.record?.earnings ?? null }
 }
 
 declare namespace serializeVault {

package/src/admin/apps/organizations.test.ts

@@ -1,4 +1,7 @@
-import type * as Analytics from '../../analytics/Analytics.js'
+import { sql } from 'kysely'
+
+import * as Analytics from '../../analytics/Analytics.js'
+import * as RoutesAccess from '../../apps/routes/Access.js'
 import * as ApiKeys from '../../ApiKeys.js'
 import * as InvitationsApp from '../../apps/management/routes/invitations.js'
 import * as BillingSettings from '../../db/tables/billingSettings.js'
@@ -6,6 +9,7 @@ import * as EnabledBillingSources from '../../db/tables/enabledBillingSources.js
 import * as Memberships from '../../db/tables/memberships.js'
 import * as Organizations from '../../db/tables/organizations.js'
 import * as Projects from '../../db/tables/projects.js'
+import * as RoutesPolicies from '../../db/tables/routesPolicies.js'
 import * as RoutesSubsidies from '../../db/tables/routesSubsidies.js'
 import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
 import * as StripeCustomers from '../../db/tables/stripeCustomers.js'
@@ -21,6 +25,7 @@ import * as DepositAddress from '../../internal/routes/DepositAddress.js'
 
 import * as TestAdmin from '../../../test/Admin.js'
 import * as TestApp from '../../../test/App.js'
+import * as Containers from '../../../test/containers.js'
 import * as TestRoutes from '../../../test/Routes.js'
 import * as AdminOrganizations from './organizations.js'
 
@@ -309,6 +314,84 @@ describe('GET /organizations/:orgId/subsidies', () => {
 })
 
 describe('PUT /organizations/:orgId/subsidies/routes', () => {
+  test.each([
+    { enabled: false } as const,
+    { enabled: true, frequency: 'tx', maxAmount: '0.01' } as const,
+  ])('serializes legacy changes with accepted policy commitments: %j', async (json) => {
+    const database = TestApp.databaseFactory()
+    const db = database()
+    const { client } = TestAdmin.setup({ db: database() })
+    const organization = await Organizations.create(db, { name: 'Legacy acceptance race' })
+    const scope = { environment: 'production', orgId: organization.id } as const
+    await RoutesSubsidies.upsertOrganization(db, {
+      frequency: 'tx',
+      maxAmount: '0.05',
+      orgId: organization.id,
+    })
+    await RoutesPolicies.save(db, {
+      policy: { access: null, subsidyPayer: 'tempo' },
+      scope,
+      version: 0,
+    })
+    const loaded = await RoutesPolicies.load(db, scope)
+    const context = {
+      scope,
+      legacy: loaded.legacy,
+      layers: loaded.layers.map((layer) => layer.policy),
+      versions: loaded.layers.map((layer) => layer.version),
+    }
+    const accepted = Promise.withResolvers<void>()
+    const release = Promise.withResolvers<void>()
+    const acceptance = database().transaction(async (tx) => {
+      await RoutesAccess.assertPolicy(tx, context)
+      accepted.resolve()
+      await release.promise
+      return RoutesAccess.commitment(
+        tx,
+        context,
+        {
+          destinationChainId: 'eip155:4217',
+          destinationTokenId: 'usdce',
+          providerId: 'relay',
+          sourceChainId: 'eip155:8453',
+          sourceTokenId: 'usdc',
+        },
+        '1',
+      )
+    })
+    await accepted.promise
+    let finished = false
+    const write = client.organizations[':orgId'].subsidies.routes
+      .$put({ json, param: { orgId: organization.id } })
+      .then((response) => {
+        finished = true
+        return response
+      })
+    try {
+      await expect
+        .poll(async () => {
+          const { rows } = await sql<{ waiting: boolean }>`select exists (
+            select 1 from pg_locks where locktype = 'advisory' and not granted
+            and classid::bigint = ((hashtextextended(${`routes-subsidy:${organization.id}`}, 0) >> 32) & 4294967295)
+            and objid::bigint = (hashtextextended(${`routes-subsidy:${organization.id}`}, 0) & 4294967295)
+          ) as waiting`.execute(db.kysely)
+          return finished || rows[0]!.waiting
+        })
+        .toBe(true)
+      expect(finished).toBe(false)
+      expect((await RoutesPolicies.load(db, scope)).legacy.maxAmount).toBe('0.05')
+    } finally {
+      release.resolve()
+      await acceptance
+      await write
+    }
+    expect((await write).status).toBe(200)
+    expect(await acceptance).toMatchObject({ maxAmount: '0.05', subsidyPayer: 'tempo' })
+    await expect(
+      db.transaction((tx) => RoutesAccess.assertPolicy(tx, context)),
+    ).rejects.toMatchObject({ code: 'route_policy_changed' })
+  })
+
   test('enables and disables a maximum subsidy amount', async () => {
     const { client, db } = TestAdmin.setup()
     const organization = await Organizations.create(db, { name: 'Routes' })
@@ -661,24 +744,70 @@ describe('GET /organizations/:orgId/api-keys', () => {
 
 describe('GET /organizations/:orgId/usage', () => {
   test('returns recent totals and error breakdowns from analytics', async () => {
-    const { client, db } = TestAdmin.setup({ analytics: usageAnalytics })
-    const organization = await Organizations.create(db, { name: 'Usage' })
-    const response = await client.organizations[':orgId'].usage.$get({
-      param: { orgId: organization.id },
-      query: { period: '7d' },
-    })
-    const body = await TestApp.json(
-      response,
-      AdminOrganizations.schema.getOrganizationUsage.Response,
-    )
+    const stack = await Containers.start()
+    try {
+      const analytics = Analytics.clickhouse({
+        database: 'tempo_api',
+        password: 'clickhouse',
+        url: `http://${stack.endpoints.clickhouse.host}:${stack.endpoints.clickhouse.port}`,
+        user: 'clickhouse',
+      })
+      await analytics.migrate()
+      const { client, db } = TestAdmin.setup({ analytics })
+      const organization = await Organizations.create(db, { name: 'Usage' })
+      await analytics.insert(
+        'request_events',
+        Array.from({ length: 25 }, (_, index) => ({
+          billing_active: null,
+          chain_id: null,
+          duration_ms: index < 20 ? 12.5 : 2.5,
+          environment: 'production',
+          error_code: index < 2 ? 'upstream_error' : null,
+          key_environment: 'production' as const,
+          key_id: null,
+          method: 'GET',
+          org_id: organization.id,
+          principal_type: 'api_key' as const,
+          project_id: null,
+          query: '',
+          rate_limit_scope: null,
+          request_id: null,
+          route: index < 20 ? '/v1/tokens' : '/v1/tokenlist',
+          rpc_error_code: null,
+          rpc_error_count: 0,
+          rpc_error_data_code: null,
+          service: 'api',
+          status: index < 2 ? 500 : 200,
+          timestamp: new Date(Date.now() - 60_000).toISOString().replace('T', ' ').replace('Z', ''),
+          timings: {},
+        })),
+      )
+      const response = await client.organizations[':orgId'].usage.$get({
+        param: { orgId: organization.id },
+        query: { period: '7d' },
+      })
+      const body = await TestApp.json(
+        response,
+        AdminOrganizations.schema.getOrganizationUsage.Response,
+      )
 
-    expect(body).toMatchObject({
-      byError: [{ code: 'upstream_error', requests: 2 }],
-      byRoute: [{ averageDurationMs: 12.5, errors: 2, requests: 20, route: '/v1/tokens' }],
-      byStatus: [{ requests: 2, status: 500 }],
-      period: '7d',
-      totals: { averageDurationMs: 10.5, errors: 2, requests: 25 },
-    })
+      expect(response.status).toBe(200)
+      expect(body).toMatchObject({
+        byError: [{ code: 'upstream_error', requests: 2 }],
+        byRoute: [
+          { averageDurationMs: 12.5, errors: 2, requests: 20, route: '/v1/tokens' },
+          { averageDurationMs: 2.5, errors: 0, requests: 5, route: '/v1/tokenlist' },
+        ],
+        byStatus: [
+          { requests: 23, status: 200 },
+          { requests: 2, status: 500 },
+        ],
+        period: '7d',
+        totals: { averageDurationMs: 10.5, errors: 2, requests: 25 },
+      })
+    } finally {
+      await stack.stop()
+    }
   })
 })
 
@@ -865,16 +994,3 @@ describe('GET /organizations/:orgId/webhooks', () => {
     expect(body.failuresTruncated).toBe(true)
   })
 })
-
-const usageAnalytics: Analytics.Analytics = {
-  async insert() {},
-  async migrate() {},
-  async query(sql) {
-    if (sql.includes('GROUP BY code')) return [{ code: 'upstream_error', requests: 2 }] as never[]
-    if (sql.includes('GROUP BY route'))
-      return [{ averageDurationMs: 12.5, errors: 2, requests: 20, route: '/v1/tokens' }] as never[]
-    if (sql.includes('GROUP BY status')) return [{ requests: 2, status: 500 }] as never[]
-    if (sql.includes('GROUP BY key_id') || sql.includes('GROUP BY toStartOf')) return []
-    return [{ averageDurationMs: 10.5, errors: 2, requests: 25 }] as never[]
-  },
-}

package/src/admin/apps/organizations.ts

@@ -858,17 +858,18 @@ export function organizations() {
         try {
           const organization = await Organizations.get(db, orgId)
           if (!organization) return organizationNotFound(c)
-          const subsidy = await (async () => {
+          const subsidy = await db.transaction(async (tx) => {
+            await RoutesSubsidies.lockOrganization(tx, orgId)
             if (!policy.enabled) {
-              await RoutesSubsidies.removeOrganization(db, orgId)
+              await RoutesSubsidies.removeOrganization(tx, orgId)
               return undefined
             }
-            return RoutesSubsidies.upsertOrganization(db, {
+            return RoutesSubsidies.upsertOrganization(tx, {
               frequency: policy.frequency,
               maxAmount: policy.maxAmount,
               orgId,
             })
-          })()
+          })
           return c.json(
             Response.validated(
               schema.setOrganizationRoutesSubsidy.Response,