tapimo 0.19.0 → 0.20.0

package/src/apps/mpp/internal/Policy.ts

@@ -43,12 +43,18 @@ export declare namespace assertFeeMarketAdmission {
 }
 
 /** Refuses unsupported chains, unauthorized Zones, and sandbox access to mainnet, recording the Zone decision. */
-export function assertChainAccess<environment extends ZoneAccess.Environment>(
+export async function assertChainAccess<environment extends ZoneAccess.Environment>(
   c: Context<environment>,
   options: assertChainAccess.Options,
 ) {
   try {
-    chainAccess(c, options, ZoneAccess.authorize)
+    // Validating and broadcasting Zone credentials both require broadcast access.
+    const zone = supportedZone(options)
+    if (zone) {
+      const access = await ZoneAccess.authorize(c, { chainId: options.chainId, verb: 'write' })
+      if (!access.allowed) throw denial(access.error)
+    }
+    sandboxAccess(c, options)
   } catch (cause) {
     // The sandbox refusal follows the recorded Zone grant.
     ZoneAccess.deny(c)
@@ -61,27 +67,32 @@ export function checkChainAccess<environment extends ZoneAccess.Environment>(
   c: Context<environment>,
   options: assertChainAccess.Options,
 ) {
-  chainAccess(c, options, ZoneAccess.check)
+  const zone = supportedZone(options)
+  if (zone) {
+    const access = ZoneAccess.check(c, { chainId: options.chainId, verb: 'write' })
+    if (!access.allowed) throw denial(access.error)
+  }
+  sandboxAccess(c, options)
+}
+
+/** Refuses chains this deployment does not serve and returns the Zone, when the chain is one. */
+function supportedZone(options: assertChainAccess.Options) {
+  const { chainId, supportedChainIds, zones } = options
+  if (!supportedChainIds.has(chainId)) throw new UnsupportedChainError(chainId)
+  return zones.get(chainId)
 }
 
-function chainAccess<environment extends ZoneAccess.Environment>(
+/** Refuses sandbox keys on mainnet and mainnet Zones. */
+function sandboxAccess<environment extends ZoneAccess.Environment>(
   c: Context<environment>,
   options: assertChainAccess.Options,
-  decide: typeof ZoneAccess.check,
 ) {
-  const { chainId, supportedChainIds, zones } = options
+  const { chainId, zones } = options
   const principal = Auth.getPrincipal(c) ?? undefined
-  if (!supportedChainIds.has(chainId)) throw new UnsupportedChainError(chainId)
-  const zone = zones.get(chainId)
-  if (zone) {
-    // Validating and broadcasting Zone credentials both require broadcast access.
-    const access = decide(c, { chainId, verb: 'write' })
-    if (!access.allowed) throw new PolicyDeniedError(access.error.message)
-  }
   if (
     principal?.type === 'api_key' &&
     principal.environment === 'sandbox' &&
-    Viem.isMainnet(zone?.sourceId ?? chainId)
+    Viem.isMainnet(zones.get(chainId)?.sourceId ?? chainId)
   )
     throw new PolicyDeniedError('Sandbox API keys only support testnet. Use a testnet challenge.')
 }
@@ -157,7 +168,19 @@ export class UnsupportedChainError extends Error {
   }
 }
 
+/** A Zone refusal as an MPP error: unreadable delegations stay retriable, missing grants are policy denials. */
+function denial(error: ZoneAccess.check.Denial): Error {
+  return error.status === 503
+    ? new AccessUnavailableError(error.message)
+    : new PolicyDeniedError(error.message)
+}
+
 /** Raised when an MPP credential violates chain access or sponsorship policy. */
 export class PolicyDeniedError extends Error {
   override name = 'Mpp.Policy.PolicyDeniedError'
 }
+
+/** Raised when Zone access could not be verified because delegations could not be read; retrying may succeed. */
+export class AccessUnavailableError extends Error {
+  override name = 'Mpp.Policy.AccessUnavailableError'
+}

package/src/apps/relay/App.sandbox.test.ts

@@ -1,5 +1,5 @@
 import { Hex, Json } from 'ox'
-import { MultisigOperation, SignatureEnvelope, TxEnvelopeTempo } from 'ox/tempo'
+import { AccountOperation, SignatureEnvelope, TxEnvelopeTempo } from 'ox/tempo'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 import { Account as TempoAccount } from 'viem/tempo'
 
@@ -209,8 +209,9 @@ describe('behavior: sandbox keys on the effective relay chain', () => {
             environment: 'sandbox',
             id: 'key_zone',
             orgId: 'org_sandbox',
-            scopes: ['rpc-relay:read', `zone:${zone}:read`],
+            scopes: ['rpc-relay:read', 'zone:read'],
             token: 'sandbox',
+            zoneTags: [zone],
           },
         ],
       },
@@ -337,18 +338,18 @@ describe('behavior: sandbox keys on the effective relay chain', () => {
     `)
   })
 
-  test('authorizes a stored multisig operation on its signed chain', async () => {
+  test('authorizes a stored configurable account operation on its signed chain', async () => {
     for (const [chainId, expected] of [
       [mainnet, { error: { data: { code: 'api_key_forbidden' } } }],
       [testnet, { result: { status: 'pending', type: 'transaction' } }],
     ] as const) {
       const { hash, store } = await operation({ chainId })
-      const { app } = setup({ multisig: { store } })
+      const { app } = setup({ accounts: { store } })
       const response = await app.request('/rpc/relay', {
         body: JSON.stringify({
           id: 1,
           jsonrpc: '2.0',
-          method: 'multisig_getOperation',
+          method: 'account_getOperation',
           params: [hash],
         }),
         headers: { 'content-type': 'application/json', 'tempo-api-key': 'sandbox' },
@@ -379,7 +380,7 @@ function setup(options: setup.Options = {}) {
     logger: (entry) => void entries.push(entry),
     relay: {
       feePayer: { account: Tempo.accounts[10]! },
-      ...(options.multisig ? { multisig: options.multisig } : {}),
+      ...(options.accounts ? { accounts: options.accounts } : {}),
     },
     supportedChainIds: options.supportedChainIds ?? [mainnet, testnet],
   })
@@ -389,8 +390,8 @@ function setup(options: setup.Options = {}) {
 declare namespace setup {
   /** Test app overrides. */
   type Options = {
-    /** Native multisig coordination store. */
-    multisig?: { store: Store.State } | undefined
+    /** Configurable account coordination store. */
+    accounts?: { store: Store.State } | undefined
     /** Chains the app serves. */
     supportedChainIds?: readonly number[] | undefined
   }
@@ -458,9 +459,9 @@ declare namespace sign {
   }
 }
 
-/** Stores a pending multisig transaction operation signed for the given chain. */
+/** Stores a pending configurable account transaction operation signed for the given chain. */
 async function operation(options: operation.Options) {
-  const account = TempoAccount.fromMultisig({
+  const account = TempoAccount.fromConfig({
     owners: [Tempo.accounts[0]!.address, Tempo.accounts[1]!.address],
     salt: Hex.random(32),
     threshold: 2,
@@ -480,11 +481,11 @@ async function operation(options: operation.Options) {
     ),
     type: 'transaction' as const,
   }
-  const hash = MultisigOperation.getHash(payload)
+  const hash = AccountOperation.getHash(payload)
   const approvals = [
     SignatureEnvelope.serialize(SignatureEnvelope.from(await Tempo.accounts[0]!.sign({ hash }))),
   ]
-  const stored = MultisigOperation.from({
+  const stored = AccountOperation.from({
     ...payload,
     approvals,
     createdAt: 1,
@@ -496,12 +497,12 @@ async function operation(options: operation.Options) {
     weight: approvals.length,
   })
   const store = Store.memory()
-  await store.put(`multisig:v2:multisig:operation:${hash}`, Json.stringify(stored))
+  await store.put(`accounts:v1:configurableAccount:operation:${hash}`, Json.stringify(stored))
   return { hash, store }
 }
 
 declare namespace operation {
-  /** Inputs for one stored multisig operation. */
+  /** Inputs for one stored configurable account operation. */
   type Options = {
     /** Chain the stored transaction is signed for. */
     chainId: number