tapimo 0.15.1 → 0.18.1

package/src/internal/routes/providers/squid.ts

@@ -1,11 +1,18 @@
 import { Address } from 'ox'
 import * as z from 'zod/mini'
 
+import * as Store from '../../Store.js'
 import * as RoutesChain from '../Chain.js'
 import * as RoutesProvider from '../Provider.js'
+import * as ProviderQuota from '../Quota.js'
 
 const defaultBaseUrl = 'https://v2.api.squidrouter.com/v2'
 const defaultFetch: RoutesProvider.Fetch = (input, init) => globalThis.fetch(input, init)
+// Squid documents 10 req/s across all endpoints for one integrator ID:
+// https://docs.squidrouter.com/api-and-sdk-integration/api/rate-limiting
+const rateLimit = 10
+const rateLimitWindowMs = 1_000
+const quotaStoreKey = 'routes:squid:integrator'
 
 namespace schema {
   const IntegerString = z.string().check(z.regex(/^\d+$/))
@@ -45,6 +52,7 @@ export function squid(options: squid.Options) {
   endpoint.pathname = `${endpoint.pathname.replace(/\/+$/, '')}/route`
   const fetch = options.fetch ?? defaultFetch
   const now = options.now ?? (() => new Date())
+  const rateLimitStore = options.rateLimitStore ?? Store.memory()
 
   return RoutesProvider.from({
     id: 'squid',
@@ -53,6 +61,12 @@ export function squid(options: squid.Options) {
       const destinationChainId = RoutesChain.eip155Id(route.destination.chain)
       const sourceChainId = RoutesChain.eip155Id(route.source.chain)
       try {
+        await ProviderQuota.consume(rateLimitStore, {
+          key: quotaStoreKey,
+          limit: rateLimit,
+          now: now(),
+          windowMs: rateLimitWindowMs,
+        })
         const quote = await RoutesProvider.requestJson(endpoint, {
           body: {
             fromAddress: options.userAddress,
@@ -97,6 +111,11 @@ export function squid(options: squid.Options) {
           status: 'available',
         }
       } catch (cause) {
+        await ProviderQuota.blockOnRateLimit(rateLimitStore, cause, {
+          key: quotaStoreKey,
+          now: now(),
+          windowMs: rateLimitWindowMs,
+        })
         const unavailable =
           RoutesProvider.unavailable(cause, [
             'NO_ROUTE',
@@ -127,6 +146,8 @@ export declare namespace squid {
     integratorId: string
     /** Clock override for deterministic tests. */
     now?: (() => Date) | undefined
+    /** Atomic store used to enforce the integrator-wide quota. */
+    rateLimitStore?: Store.Store | undefined
     /** Quote wallet address used as the Squid sender and recipient. */
     userAddress: string
   }

package/src/internal/routes/providers/stargate.test.ts

@@ -3,12 +3,17 @@ import { base } from 'viem/chains'
 import { tempoMainnet } from 'viem/tempo/chains'
 
 import * as Anvil from '../../../../test/Anvil.js'
+import * as TestApp from '../../../../test/App.js'
+import * as Containers from '../../../../test/containers.js'
 import * as TestRoutes from '../../../../test/Routes.js'
+import * as RoutesTransfers from '../../../db/tables/routesTransfers.js'
 
 import type * as Action from '../Action.js'
 import type * as Catalog from '../Catalog.js'
 import * as RoutesChain from '../Chain.js'
 import * as RoutesProvider from '../Provider.js'
+import * as Policy from '../Policy.js'
+import * as Transfer from '../Transfer.js'
 import * as Stargate from './stargate.js'
 
 const amount = 1_000_000n
@@ -43,6 +48,105 @@ type RpcRequest = {
 }
 
 describe('stargate', () => {
+  test('retains pinned financial identity through real source reorg verification and later billing', async () => {
+    const db = TestApp.database()
+    const node = await Containers.tempo({ chainId: 8453 })
+    const endpoint = node.endpoints.default
+    const sourceChain = RoutesChain.from({
+      id: 'eip155:8453',
+      name: 'Base',
+      slug: 'base',
+      rpcUrls: [`http://${endpoint.host}:${endpoint.port}`],
+    })
+    const destinationChain = TestRoutes.snapshot.chainsByKey.get('eip155:4217')!
+    try {
+      for (const subsidyPayer of ['tempo', 'enterprise'] as const) {
+        const routePolicy = {
+          maxAmount: '0.04',
+          scope: { environment: 'production', orgId: `org_reorg_${subsidyPayer}` } as const,
+          subsidyPayer,
+          versions: [1],
+        }
+        const routePolicyKey = Policy.commitmentKey(routePolicy)
+        const providerState = {
+          destinationBlockNumber: '0',
+          routeConfiguration: { poolAddress: pool },
+          routePolicy,
+          routePolicyKey,
+          // Cached evidence from a block absent from the local canonical chain.
+          stargate: {
+            guid,
+            sourceBlock: { hash: `0x${'aa'.repeat(32)}`, number: '0' },
+            sourceEid: 30_184,
+          },
+        }
+        const record = await Transfer.create(db, {
+          apiKeyId: `key_reorg_${subsidyPayer}`,
+          environment: 'production',
+          orgId: routePolicy.scope.orgId,
+          providerState,
+          snapshot: TestRoutes.transferSnapshot({
+            provider: { id: 'stargate', name: 'Stargate' },
+            subsidize: true,
+          }),
+        })
+        const registered = await Transfer.registerSourceTransactions(db, {
+          chainId: sourceChain.id,
+          id: record.id,
+          providerState,
+          transactionHashes: [sourceTransactionHash],
+        })
+        expect(registered.type).toBe('registered')
+        const evidence = await Stargate.stargate().verifySourceTransaction!(
+          {
+            destinationChain,
+            providerState,
+            sourceChain,
+            transactionHash: sourceTransactionHash,
+            transfer: record.snapshot,
+          },
+          new AbortController().signal,
+        )
+        expect(evidence.type).toBe('reorged')
+        if (evidence.type !== 'reorged') throw new Error('Expected canonical source reorg.')
+        const reopened = await Transfer.reopenSourceTransaction(db, {
+          chainId: sourceChain.id,
+          id: record.id,
+          providerState: evidence.providerState,
+          transactionHash: sourceTransactionHash,
+        })
+        if (reopened.type !== 'reopened') throw new Error('Expected reopened transfer.')
+        expect(reopened.record.providerState).not.toHaveProperty('stargate')
+        expect(reopened.record.snapshot.sourceTransactionHashes).toBeUndefined()
+        expect.soft(reopened.record.providerState).toMatchObject({ routePolicy, routePolicyKey })
+        const replacement = await Transfer.registerSourceTransactions(db, {
+          chainId: sourceChain.id,
+          id: record.id,
+          providerState: reopened.record.providerState!,
+          transactionHashes: [`0x${'ab'.repeat(32)}`],
+        })
+        if (replacement.type !== 'registered') throw new Error('Expected replacement evidence.')
+        const completed = await Transfer.transition(db, {
+          expectedVersion: replacement.record.version,
+          id: record.id,
+          status: 'completed',
+          subsidyAmount: { baseUnits: '10000', currency: 'USD', decimals: 6, formatted: '0.01' },
+          subsidyTransactionHash: `0x${'cd'.repeat(32)}`,
+        })
+        expect(completed.type).toBe('applied')
+        const billable = (await RoutesTransfers.listUnreportedSubsidies(db)).some(
+          (row) => row.id === record.id,
+        )
+        expect.soft(billable).toBe(subsidyPayer === 'enterprise')
+        expect
+          .soft(await RoutesTransfers.hasUnreportedSubsidies(db, record.orgId))
+          .toBe(subsidyPayer === 'enterprise')
+      }
+    } finally {
+      await node.stop()
+    }
+  })
+
   test('creates a credential-free quote and transfer provider', () => {
     expect(Stargate.stargate()).toMatchObject({
       getQuote: expect.any(Function),
@@ -601,7 +705,7 @@ describe.skipIf(!Anvil.available)('source and destination evidence', () => {
         sourceTokenAddress: destinationToken,
       }),
     ).resolves.toEqual({ transactionHash, type: 'verified' })
-    expect(blockTag).toBe('finalized')
+    expect(blockTag).toBe('safe')
   })
 })
 

package/src/internal/routes/providers/stargate.ts

@@ -62,7 +62,7 @@ const send = AbiFunction.from(
 const endpointNativeToken = AbiFunction.from('function nativeToken() view returns (address)')
 const wrap = AbiFunction.from('function wrap(address token, address to, uint256 amount)')
 const quoteTtlMs = 60_000
-const maximumLogBlockRange = 10_000n
+const maximumLogBlockRange = 2_000n
 const transferEvent = AbiEvent.from(
   'event Transfer(address indexed from, address indexed to, uint256 value)',
 )
@@ -225,7 +225,10 @@ export function stargate(options: stargate.Options = {}) {
           fetch,
           signal,
           urls: resolveRpcUrls(candidate.route.destination.chain),
-        }).getBlock({ blockTag: 'finalized', includeTransactions: false }),
+        }).getBlock({
+          blockTag: Chain.settlementBlockTag(candidate.route.destination.chain),
+          includeTransactions: false,
+        }),
       ])
       if (!isValidQuote({ amount: candidate.sourceAmount.amount, feeDetails, limit, receipt }))
         throw new RoutesProvider.ProviderUnavailableError()
@@ -345,6 +348,7 @@ export function stargate(options: stargate.Options = {}) {
       }
     },
     validateTransferAction({ action, candidate, destinationAmountMin, recipient, sender }) {
+      if (action.type !== 'evm:calls') throw new RoutesProvider.ProviderPayloadError()
       return validateAction({
         action,
         configuration: candidate.configuration,
@@ -661,8 +665,11 @@ export async function verifySourceTransaction(
     !Hex.isEqual(block.hash, receipt.blockHash)
   ) {
     if (!options.sourceBlock) return { type: 'pending' }
-    const finalized = await rpc.getBlock({ blockTag: 'finalized', includeTransactions: false })
-    if (finalized.number < options.sourceBlock.number) return { type: 'pending' }
+    const head = await rpc.getBlock({
+      blockTag: Chain.settlementBlockTag(options.sourceChain),
+      includeTransactions: false,
+    })
+    if (head.number < options.sourceBlock.number) return { type: 'pending' }
     const canonical = await rpc
       .getBlock({ blockNumber: options.sourceBlock.number, includeTransactions: false })
       .catch((cause) => {
@@ -896,8 +903,11 @@ export async function verifyDestinationDelivery(
     signal: options.signal,
     urls: options.rpcUrls ?? options.destinationChain.rpcUrls,
   })
-  // Tempo completion favors latency over reorg protection; other destinations retain finality.
-  const blockTag = options.destinationChain.id === 'eip155:4217' ? 'latest' : 'finalized'
+  // Tempo completes at inclusion; other destinations use their chain's settlement threshold.
+  const blockTag =
+    options.destinationChain.id === 'eip155:4217'
+      ? 'latest'
+      : Chain.settlementBlockTag(options.destinationChain)
   const [chainId, head] = await Promise.all([
     rpc.getChainId(),
     rpc.getBlock({ blockTag, includeTransactions: false }),
@@ -1018,16 +1028,19 @@ async function blockNumberBefore(options: blockNumberBefore.Options) {
     signal: options.signal,
     urls: options.rpcUrls ?? options.chain.rpcUrls,
   })
-  const [chainId, finalized] = await Promise.all([
+  const [chainId, head] = await Promise.all([
     rpc.getChainId(),
-    rpc.getBlock({ blockTag: 'finalized', includeTransactions: false }),
+    rpc.getBlock({
+      blockTag: Chain.settlementBlockTag(options.chain),
+      includeTransactions: false,
+    }),
   ])
   if (chainId !== Number(Chain.eip155Id(options.chain)))
     throw new RoutesProvider.ProviderConfigurationError()
 
   const target = BigInt(Math.floor(timestamp / 1_000) - 1)
   let lower = 0n
-  let upper = finalized.number
+  let upper = head.number
   while (lower < upper) {
     const middle = (lower + upper + 1n) / 2n
     const block = await rpc.getBlock({ blockNumber: middle, includeTransactions: false })

package/src/internal/routes/providers/symbiosis.ts

@@ -4,6 +4,7 @@ import * as z from 'zod/mini'
 import * as Store from '../../Store.js'
 import * as RoutesChain from '../Chain.js'
 import * as RoutesProvider from '../Provider.js'
+import * as ProviderQuota from '../Quota.js'
 import type * as RoutesToken from '../Token.js'
 
 const defaultBaseUrl = 'https://api.symbiosis.finance/crosschain'
@@ -17,22 +18,6 @@ const quotaStoreKey = 'routes:symbiosis:quote'
 const tronChainId = 728_126_428
 const tronUsdtAddress = '0xa614f803b6fd780986a42c78ec9c7f77e6ded13c'
 
-type TenantQuota = {
-  /** Requests accepted for this tenant in the active window. */
-  count: number
-  /** Stable non-secret tenant identity. */
-  key: string
-}
-
-type Quota = {
-  /** Fixed-window number. */
-  bucket: number
-  /** Requests accepted globally in the active window. */
-  count: number
-  /** Per-tenant counters for accepted requests. */
-  tenants: readonly TenantQuota[]
-}
-
 namespace schema {
   const IntegerString = z.string().check(z.regex(/^\d+$/))
 
@@ -84,7 +69,13 @@ export function symbiosis(options: symbiosis.Options) {
       const sourceChainId = chainId(route.source.chain)
       const sourceTokenAddress = tokenAddress(route.source)
       try {
-        await consumeQuota(rateLimitStore, { now: now(), quotaKey: quotaKey ?? 'public:anonymous' })
+        await ProviderQuota.consume(rateLimitStore, {
+          key: quotaStoreKey,
+          limit: rateLimit,
+          now: now(),
+          tenant: { key: quotaKey ?? 'public:anonymous', limit: tenantRateLimit },
+          windowMs: rateLimitWindowMs,
+        })
         const quote = await RoutesProvider.requestJson(endpoint, {
           body: {
             from: options.userAddress,
@@ -159,6 +150,11 @@ export function symbiosis(options: symbiosis.Options) {
           status: 'available',
         }
       } catch (cause) {
+        await ProviderQuota.blockOnRateLimit(rateLimitStore, cause, {
+          key: quotaStoreKey,
+          now: now(),
+          windowMs: rateLimitWindowMs,
+        })
         const unavailable =
           RoutesProvider.unavailable(cause, [
             'AMOUNT_TOO_LOW',
@@ -195,36 +191,6 @@ export declare namespace symbiosis {
   }
 }
 
-async function consumeQuota(store: Store.Store, options: consumeQuota.Options) {
-  const time = options.now.getTime()
-  const bucket = Math.floor(time / rateLimitWindowMs)
-  await Store.update(store, quotaStoreKey, (current) => {
-    const stored = current === null ? undefined : (JSON.parse(current) as Quota)
-    const activeBucket = Math.max(bucket, stored?.bucket ?? bucket)
-    const quota: Quota =
-      stored?.bucket === activeBucket ? stored : { bucket: activeBucket, count: 0, tenants: [] }
-    const tenant = quota.tenants.find((entry) => entry.key === options.quotaKey)
-    if ((tenant?.count ?? 0) >= tenantRateLimit || quota.count >= rateLimit)
-      throw new RoutesProvider.ProviderRateLimitError()
-    const tenants = tenant
-      ? quota.tenants.map((entry) =>
-          entry.key === options.quotaKey ? { count: entry.count + 1, key: entry.key } : entry,
-        )
-      : [...quota.tenants, { count: 1, key: options.quotaKey }]
-    return JSON.stringify({ bucket: activeBucket, count: quota.count + 1, tenants })
-  })
-}
-
-declare namespace consumeQuota {
-  /** Tenant identity and wall clock for one quota decision. */
-  type Options = {
-    /** Current quota time. */
-    now: Date
-    /** Stable non-secret tenant identity. */
-    quotaKey: string
-  }
-}
-
 function amountUnavailable(cause: unknown) {
   if (!(cause instanceof RoutesProvider.ProviderResponseError) || cause.status !== 400)
     return undefined

package/src/providers/index.test.ts

@@ -4,6 +4,8 @@ test('exports provider factories', () => {
   expect(Object.keys(Providers)).toMatchInlineSnapshot(`
     [
       "across",
+      "legacyMesh",
+      "propAmm",
       "relay",
       "rhino",
       "squid",

package/src/providers/index.ts

@@ -1,5 +1,7 @@
 import * as Uniswap from '../internal/exchange/providers/uniswap.js'
 import * as Across from '../internal/routes/providers/across.js'
+import * as LegacyMesh from '../internal/routes/providers/legacyMesh.js'
+import * as PropAmm from '../internal/routes/providers/propAmm.js'
 import * as Relay from '../internal/routes/providers/relay.js'
 import * as Rhino from '../internal/routes/providers/rhino.js'
 import * as Squid from '../internal/routes/providers/squid.js'
@@ -14,6 +16,22 @@ export declare namespace across {
   type Options = Across.across.Options
 }
 
+/** Creates a Tron to Tempo USDT0 Legacy Mesh route provider. */
+export const legacyMesh = LegacyMesh.legacyMesh
+
+export declare namespace legacyMesh {
+  /** Legacy Mesh provider configuration. */
+  type Options = LegacyMesh.legacyMesh.Options
+}
+
+/** Creates a same-chain PropAMM quote and transfer preparation provider. */
+export const propAmm = PropAmm.propAmm
+
+export declare namespace propAmm {
+  /** PropAMM provider configuration. */
+  type Options = PropAmm.propAmm.Options
+}
+
 /** Creates a Relay route provider. */
 export const relay = Relay.relay
 

package/dist/admin/Access.d.ts

@@ -1,39 +0,0 @@
-/**
- * The default {@link App.create.Options.identify} hook: verifies a Cloudflare
- * Access JWT in-worker, so a request sent directly to the worker URL (bypassing
- * the edge gate) still can't reach the admin routes (defense in depth).
- *
- * The only admin module that imports `jose`, keeping that dependency out of the
- * IdP-agnostic core. Self-hosters not on Access supply their own `identify`.
- */
-import type * as App from './App.js';
-/**
- * Builds an {@link App.create.Options.identify} hook that verifies the Cloudflare
- * Access JWT against the team-domain JWKS (fetched lazily, cached by `jose`). Any
- * verification failure resolves to `null` (deny) rather than throwing.
- *
- * Verifies the signature and issuer (the team domain). The audience (`aud`) is
- * not checked, so any token minted for any app in the team's org is accepted —
- * fine when everyone with org access is trusted.
- *
- * @example
- * ```ts
- * import { App, Access } from 'tapimo/admin'
- *
- * App.create({
- *   // ...
- *   identify: Access.cloudflareAccess({
- *     teamDomain: 'https://tempo.cloudflareaccess.com',
- *   }),
- * })
- * ```
- */
-export declare function cloudflareAccess(options: cloudflareAccess.Options): (request: Request) => Promise<App.Identity | null>;
-export declare namespace cloudflareAccess {
-    /** Options for {@link cloudflareAccess}. */
-    type Options = {
-        /** Team domain (e.g. `https://<team>.cloudflareaccess.com`); the token issuer and JWKS host. */
-        teamDomain: string;
-    };
-}
-//# sourceMappingURL=Access.d.ts.map

package/dist/admin/Access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"Access.d.ts","sourceRoot":"","sources":["../../src/admin/Access.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,KAAK,GAAG,MAAM,UAAU,CAAA;AAOpC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,CAAC,OAAO,GAChC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,CAmBpD;AAED,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACxC,4CAA4C;IAC5C,KAAK,OAAO,GAAG;QACb,gGAAgG;QAChG,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF"}

package/dist/admin/Access.js

@@ -1,73 +0,0 @@
-/**
- * The default {@link App.create.Options.identify} hook: verifies a Cloudflare
- * Access JWT in-worker, so a request sent directly to the worker URL (bypassing
- * the edge gate) still can't reach the admin routes (defense in depth).
- *
- * The only admin module that imports `jose`, keeping that dependency out of the
- * IdP-agnostic core. Self-hosters not on Access supply their own `identify`.
- */
-import * as jose from 'jose';
-/** Header Cloudflare Access sets with the signed identity assertion (a JWT). */
-const headerName = 'cf-access-jwt-assertion';
-/** Cookie Cloudflare Access sets as a fallback carrier for the same JWT. */
-const cookieName = 'CF_Authorization';
-/**
- * Builds an {@link App.create.Options.identify} hook that verifies the Cloudflare
- * Access JWT against the team-domain JWKS (fetched lazily, cached by `jose`). Any
- * verification failure resolves to `null` (deny) rather than throwing.
- *
- * Verifies the signature and issuer (the team domain). The audience (`aud`) is
- * not checked, so any token minted for any app in the team's org is accepted —
- * fine when everyone with org access is trusted.
- *
- * @example
- * ```ts
- * import { App, Access } from 'tapimo/admin'
- *
- * App.create({
- *   // ...
- *   identify: Access.cloudflareAccess({
- *     teamDomain: 'https://tempo.cloudflareaccess.com',
- *   }),
- * })
- * ```
- */
-export function cloudflareAccess(options) {
-    const { teamDomain } = options;
-    // Created once and reused: `jose` caches keys and refetches on unknown `kid`.
-    const issuer = teamDomain.replace(/\/+$/, '');
-    const jwks = jose.createRemoteJWKSet(new URL(`${issuer}/cdn-cgi/access/certs`));
-    return async (request) => {
-        const token = readToken(request);
-        if (!token)
-            return null;
-        try {
-            const { payload } = await jose.jwtVerify(token, jwks, { issuer });
-            const email = payload['email'];
-            return typeof email === 'string' && email ? { email } : null;
-        }
-        catch {
-            // Any verification failure is a denial, not an error to surface.
-            return null;
-        }
-    };
-}
-/**
- * Extracts the Access JWT: the `Cf-Access-Jwt-Assertion` header, falling back to
- * the `CF_Authorization` cookie. Returns `undefined` when neither is present.
- */
-function readToken(request) {
-    const header = request.headers.get(headerName);
-    if (header)
-        return header;
-    const cookie = request.headers.get('cookie');
-    if (!cookie)
-        return undefined;
-    for (const part of cookie.split(';')) {
-        const [name, ...rest] = part.trim().split('=');
-        if (name === cookieName && rest.length)
-            return rest.join('=');
-    }
-    return undefined;
-}
-//# sourceMappingURL=Access.js.map

package/dist/admin/Access.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"Access.js","sourceRoot":"","sources":["../../src/admin/Access.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAI5B,gFAAgF;AAChF,MAAM,UAAU,GAAG,yBAAyB,CAAA;AAC5C,4EAA4E;AAC5E,MAAM,UAAU,GAAG,kBAAkB,CAAA;AAErC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiC;IAEjC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAE9B,8EAA8E;IAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,uBAAuB,CAAC,CAAC,CAAA;IAE/E,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;YAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAUD;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/src/admin/Access.test.ts

@@ -1,130 +0,0 @@
-import * as jose from 'jose'
-
-import * as Access from './Access.js'
-
-const teamDomain = 'https://tempo.cloudflareaccess.com'
-const certsUrl = `${teamDomain}/cdn-cgi/access/certs`
-const kid = 'test-key-1'
-
-/** Generates an ES256 keypair and the JWKS the team domain would serve. */
-async function makeKeys() {
-  const { privateKey, publicKey } = await jose.generateKeyPair('ES256', { extractable: true })
-  const jwk = { ...(await jose.exportJWK(publicKey)), kid }
-  return { jwks: { keys: [jwk] }, privateKey }
-}
-
-/** Signs an Access-style JWT with the given claims/overrides. */
-async function sign(
-  privateKey: jose.CryptoKey,
-  options: {
-    audience?: string | undefined
-    email?: string | undefined
-    expirationTime?: string | number | undefined
-    issuer?: string | undefined
-  } = {},
-) {
-  const payload = options.email === undefined ? {} : { email: options.email }
-  return new jose.SignJWT(payload)
-    .setProtectedHeader({ alg: 'ES256', kid })
-    .setIssuer(options.issuer ?? teamDomain)
-    .setAudience(options.audience ?? 'test-access-aud-tag')
-    .setIssuedAt()
-    .setExpirationTime(options.expirationTime ?? '1h')
-    .sign(privateKey)
-}
-
-describe('cloudflareAccess', () => {
-  let privateKey: jose.CryptoKey
-  let jwks: { keys: readonly unknown[] }
-
-  beforeEach(async () => {
-    ;({ jwks, privateKey } = await makeKeys())
-    // Serve the public JWKS from the team-domain certs URL.
-    vi.stubGlobal(
-      'fetch',
-      vi.fn(async (input: string | URL | Request) => {
-        const url =
-          typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
-        if (url === certsUrl) return new Response(JSON.stringify(jwks))
-        throw new Error(`unexpected fetch: ${url}`)
-      }),
-    )
-  })
-
-  afterEach(() => {
-    vi.unstubAllGlobals()
-  })
-
-  test('valid JWT in header → identity', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const token = await sign(privateKey, { email: 'admin@tempo.xyz' })
-    const request = new Request('https://admin.tempo.xyz/api-keys', {
-      headers: { 'cf-access-jwt-assertion': token },
-    })
-    expect(await identify(request)).toEqual({ email: 'admin@tempo.xyz' })
-  })
-
-  test('valid JWT in CF_Authorization cookie → identity', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const token = await sign(privateKey, { email: 'admin@tempo.xyz' })
-    const request = new Request('https://admin.tempo.xyz/api-keys', {
-      headers: { cookie: `foo=bar; CF_Authorization=${token}` },
-    })
-    expect(await identify(request)).toEqual({ email: 'admin@tempo.xyz' })
-  })
-
-  test('missing assertion → null', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const request = new Request('https://admin.tempo.xyz/api-keys')
-    expect(await identify(request)).toBeNull()
-  })
-
-  test('any audience accepted (issuer still enforced)', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const token = await sign(privateKey, { audience: 'some-other-aud', email: 'admin@tempo.xyz' })
-    const request = new Request('https://admin.tempo.xyz/api-keys', {
-      headers: { 'cf-access-jwt-assertion': token },
-    })
-    expect(await identify(request)).toEqual({ email: 'admin@tempo.xyz' })
-  })
-
-  test('wrong issuer → null', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const token = await sign(privateKey, {
-      email: 'admin@tempo.xyz',
-      issuer: 'https://evil.cloudflareaccess.com',
-    })
-    const request = new Request('https://admin.tempo.xyz/api-keys', {
-      headers: { 'cf-access-jwt-assertion': token },
-    })
-    expect(await identify(request)).toBeNull()
-  })
-
-  test('expired JWT → null', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const token = await sign(privateKey, { email: 'admin@tempo.xyz', expirationTime: '-1h' })
-    const request = new Request('https://admin.tempo.xyz/api-keys', {
-      headers: { 'cf-access-jwt-assertion': token },
-    })
-    expect(await identify(request)).toBeNull()
-  })
-
-  test('valid signature but no email claim → null', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const token = await sign(privateKey)
-    const request = new Request('https://admin.tempo.xyz/api-keys', {
-      headers: { 'cf-access-jwt-assertion': token },
-    })
-    expect(await identify(request)).toBeNull()
-  })
-
-  test('signature from an unknown key → null', async () => {
-    const identify = Access.cloudflareAccess({ teamDomain })
-    const other = await makeKeys()
-    const token = await sign(other.privateKey, { email: 'admin@tempo.xyz' })
-    const request = new Request('https://admin.tempo.xyz/api-keys', {
-      headers: { 'cf-access-jwt-assertion': token },
-    })
-    expect(await identify(request)).toBeNull()
-  })
-})