tapimo 0.2.0 → 0.4.0

package/src/internal/Auth.test.ts

@@ -175,6 +175,7 @@ describe('require', () => {
       expect(entries[0]?.errorCode).toMatchInlineSnapshot(`"api_key_forbidden"`)
       expect(entries[0]?.principal).toMatchInlineSnapshot(`
         {
+          "billingActive": false,
           "environment": "production",
           "id": "key_test",
           "orgId": "org_test",
@@ -499,7 +500,15 @@ describe('require', () => {
   describe('environment', () => {
     const sandboxToken = 'secret_sandbox'
 
-    function createChainApp(options: { public?: boolean } = {}) {
+    function createChainApp(
+      options: {
+        public?: boolean
+        publicRateLimit?: RateLimit.Limit
+        rateLimit?: RateLimit.Store
+        sandboxBillingActive?: boolean
+        mpp?: Auth.Context['mpp']
+      } = {},
+    ) {
       const auth: Auth.Context = {
         apiKey: {
           resolve: TestApp.resolver({
@@ -511,27 +520,33 @@ describe('require', () => {
                 orgId: 'org_test',
                 scopes: [Scope.wildcard],
                 token: sandboxToken,
+                ...(options.sandboxBillingActive === undefined
+                  ? {}
+                  : { billingActive: options.sandboxBillingActive }),
               },
             ],
           }),
         },
-        rateLimit: RateLimit.memory(),
+        rateLimit: options.rateLimit ?? RateLimit.memory(),
+        ...(options.publicRateLimit ? { publicRateLimit: options.publicRateLimit } : {}),
+        ...(options.mpp ? { mpp: options.mpp } : {}),
       }
       const policy: Auth.require.Policy = {
         apiKey: { scopes: [Scope.wildcard] },
         ...(options.public === false ? {} : { public: { rateLimit: { perMinute: 60 } } }),
+        ...(options.mpp ? { mpp: { charge: { amount: '1' } } } : {}),
       }
       const app = new Hono<Auth.Environment>()
       app.use('*', async (c, next) => {
         c.set('auth', auth)
-        // Mirror the app default so sandbox steering toward testnet is observable.
+        // Mirror the app default (mainnet) so the effective chain is observable.
         c.set('chainId' as never, Viem.defaultChainId as never)
         await next()
       })
       app.use('/protected', Auth.require(policy))
       app.get('/protected', (c) => {
         // Mirror how real handlers resolve the effective chain: explicit query
-        // wins, else the context default (which auth may steer to testnet).
+        // wins, else the context default. Auth no longer steers this value.
         const raw = c.req.query('chainId')
         const chainId = raw ? Number(raw) : ((c.get('chainId' as never) as number | null) ?? null)
         return c.json({ chainId, principal: Auth.getPrincipal(c)?.type ?? null })
@@ -539,45 +554,39 @@ describe('require', () => {
       return app
     }
 
-    test('falls through to the public policy for a sandbox key on explicit mainnet', async () => {
+    test('rejects a sandbox key on explicit mainnet', async () => {
       const app = createChainApp()
       const response = await app.request('/protected?chainId=4217', {
         headers: { 'tempo-api-key': sandboxToken },
       })
-      expect(response.status).toMatchInlineSnapshot(`200`)
-      // Treated as anonymous (public) rather than rejected; chain stays mainnet.
+      expect(response.status).toMatchInlineSnapshot(`403`)
       expect(await response.json()).toMatchInlineSnapshot(`
         {
-          "chainId": 4217,
-          "principal": "public",
+          "error": {
+            "code": "api_key_forbidden",
+            "message": "Sandbox API keys only support testnet. Pass a testnet \`chainId\`.",
+          },
         }
       `)
     })
 
-    test('falls through to the public policy for a sandbox key on the mainnet alias', async () => {
+    test('rejects a sandbox key on the mainnet alias', async () => {
       const app = createChainApp()
       const response = await app.request('/protected?chainId=mainnet', {
         headers: { 'tempo-api-key': sandboxToken },
       })
-      expect(response.status).toMatchInlineSnapshot(`200`)
-      expect((await response.json()).principal).toMatchInlineSnapshot(`"public"`)
+      expect(response.status).toMatchInlineSnapshot(`403`)
+      expect((await response.json()).error.code).toMatchInlineSnapshot(`"api_key_forbidden"`)
     })
 
-    test('a sandbox key on mainnet with no public lane is rejected as missing', async () => {
+    test('rejects a sandbox key on explicit mainnet even with no public lane', async () => {
       const app = createChainApp({ public: false })
       const response = await app.request('/protected?chainId=4217', {
         headers: { 'tempo-api-key': sandboxToken },
       })
-      // With no public lane, the public policy closes to "missing API key".
-      expect(response.status).toMatchInlineSnapshot(`401`)
-      expect(await response.json()).toMatchInlineSnapshot(`
-        {
-          "error": {
-            "code": "api_key_missing",
-            "message": "Missing API key",
-          },
-        }
-      `)
+      // A resolved-but-forbidden key is a 403, not anonymous fall-through.
+      expect(response.status).toMatchInlineSnapshot(`403`)
+      expect((await response.json()).error.code).toMatchInlineSnapshot(`"api_key_forbidden"`)
     })
 
     test('uses a sandbox key on an explicit non-mainnet chain', async () => {
@@ -594,15 +603,17 @@ describe('require', () => {
       `)
     })
 
-    test('defaults a sandbox key with no chain to testnet', async () => {
+    test('authenticates a sandbox key with no query chain without steering', async () => {
       const app = createChainApp()
       const response = await app.request('/protected', {
         headers: { 'tempo-api-key': sandboxToken },
       })
+      // Auth no longer mutates `chainId`; the mainnet default is left for the
+      // data group's own sandbox chain guard to reject.
       expect(response.status).toMatchInlineSnapshot(`200`)
       expect(await response.json()).toMatchInlineSnapshot(`
         {
-          "chainId": 42431,
+          "chainId": 4217,
           "principal": "api_key",
         }
       `)
@@ -621,6 +632,85 @@ describe('require', () => {
         }
       `)
     })
+
+    test('throttles a sandbox key to the public quota when billing is inactive', async () => {
+      const app = createChainApp({
+        public: true, // policy.public.rateLimit is { perMinute: 60 }
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      // The public ceiling (60), not the API-key default (100).
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
+    })
+
+    test('grants a sandbox key the full API-key quota when billing is active', async () => {
+      const app = createChainApp({
+        public: true,
+        sandboxBillingActive: true,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      // The API-key default (100), not the public ceiling (60).
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"100"`)
+    })
+
+    test('throttles a sandbox key to the public quota when billing is unknown', async () => {
+      // A sandbox key minted before billing was ever active carries no
+      // `billingActive` flag; it falls back to the public quota.
+      const app = createChainApp({ public: true })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
+    })
+
+    test('throttles to the configured public default on API-key-only routes', async () => {
+      const app = createChainApp({
+        public: false, // no per-route public lane
+        publicRateLimit: { perMinute: 7 },
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      expect(response.status).toBe(200)
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"7"`)
+    })
+
+    test('returns 429 (never a payment challenge) for a throttled sandbox key over quota', async () => {
+      const app = createChainApp({
+        mpp: createMppServer(),
+        rateLimit: overQuota(),
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken },
+      })
+      // A throttled sandbox key must activate billing, not pay per request, so
+      // the over-quota response is a plain 429 rather than a 402 MPP challenge.
+      expect(response.status).toMatchInlineSnapshot(`429`)
+      expect((await response.json()).error.code).toMatchInlineSnapshot(`"rate_limit_exceeded"`)
+    })
+
+    test('ignores a payment credential for a throttled sandbox key under quota', async () => {
+      const app = createChainApp({
+        mpp: createMppServer(),
+        sandboxBillingActive: false,
+      })
+      const response = await app.request('/protected?chainId=42431', {
+        headers: { 'tempo-api-key': sandboxToken, authorization: 'Payment paid' },
+      })
+      // The payment lane can't buy past the throttle; the request runs on the
+      // public quota instead of being charged.
+      expect(response.status).toBe(200)
+      expect(response.headers.get('RateLimit-Limit')).toMatchInlineSnapshot(`"60"`)
+    })
   })
 
   describe('mpp', () => {
@@ -921,6 +1011,65 @@ describe('require', () => {
         error.mockRestore()
       }
     })
+
+    test('fails open (at warn) when the rate-limit Durable Object errors retryably', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            rateLimit: {
+              async consume() {
+                // A transient transport fault whose single retry also failed.
+                throw Object.assign(new Error('Network connection lost.'), { retryable: true })
+              },
+            },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const response = await app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
+
+    test('fails open (at warn) on a redacted Durable Object internal error', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            rateLimit: {
+              async consume() {
+                throw new Error(`internal error; reference = ${'ab12'.repeat(6)}`)
+              },
+            },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const response = await app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
   })
 
   describe('rateLimit per-scope', () => {
@@ -1113,6 +1262,7 @@ describe('require', () => {
       expect(response.headers.get('ratelimit-limit')).toMatchInlineSnapshot(`"1"`)
       expect(entries[0]?.principal).toMatchInlineSnapshot(`
         {
+          "billingActive": false,
           "environment": "production",
           "id": "key_test",
           "orgId": "org_test",