tapimo 0.4.0 → 0.4.3

package/src/db/tables/projects.ts

@@ -81,6 +81,53 @@ export function listByOrg(db: Db.Db, orgId: string): Promise<Record[]> {
     .execute()
 }
 
+/**
+ * Lists a bounded page of an organization's projects, newest first.
+ *
+ * @param db - The database.
+ * @param orgId - The organization id.
+ * @param options - Keyset and page-size options.
+ * @returns At most `limit + 1` rows for next-cursor derivation.
+ */
+export function listByOrgPage(
+  db: Db.Db,
+  orgId: string,
+  options: listByOrgPage.Options,
+): Promise<Record[]> {
+  const cursor = options.cursor
+  let query = db.kysely.selectFrom('projects').selectAll().where('orgId', '=', orgId)
+  if (cursor)
+    query = query.where((eb) =>
+      eb.or([
+        eb('createdAt', '<', cursor.createdAt),
+        eb.and([eb('createdAt', '=', cursor.createdAt), eb('id', '<', cursor.id)]),
+      ]),
+    )
+  return query
+    .orderBy('createdAt', 'desc')
+    .orderBy('id', 'desc')
+    .limit(options.limit + 1)
+    .execute()
+}
+
+export declare namespace listByOrgPage {
+  /** Cursor fields for the last project on the previous page. */
+  type Cursor = {
+    /** Project creation time. */
+    createdAt: string
+    /** Project id, used as a deterministic tie-breaker. */
+    id: string
+  }
+
+  /** Options for {@link listByOrgPage}. */
+  type Options = {
+    /** Last project returned by the previous page. */
+    cursor?: Cursor | undefined
+    /** Requested page size. */
+    limit: number
+  }
+}
+
 /**
  * Renames a project, bumping `updatedAt`.
  *

package/src/db/tables/webhookDeliveries.ts

@@ -10,6 +10,12 @@ export type Table = db_Schema.WebhookDelivery
 /** A stored webhook-delivery row. */
 export type Record = Selectable<Table>
 
+/** A failed delivery joined to its organization-owned subscription. */
+export type OrganizationFailure = Pick<
+  Record,
+  'attempt' | 'createdAt' | 'error' | 'id' | 'responseStatus' | 'subscriptionId'
+>
+
 /** Maps a stored row to the domain delivery (null columns → absent fields). */
 export function toDelivery(row: Record): Webhooks.Delivery {
   return {
@@ -85,6 +91,83 @@ export async function list(
   return (await query.execute()).map(toDelivery)
 }
 
+/** Lists recent failed webhook deliveries across an organization. */
+export function listFailuresByOrg(
+  db: Db.Db,
+  orgId: string,
+  options: listFailuresByOrg.Options,
+): Promise<OrganizationFailure[]> {
+  return db.kysely
+    .selectFrom('webhook_deliveries')
+    .innerJoin(
+      'webhook_subscriptions',
+      'webhook_subscriptions.id',
+      'webhook_deliveries.subscriptionId',
+    )
+    .select([
+      'webhook_deliveries.attempt',
+      'webhook_deliveries.createdAt',
+      'webhook_deliveries.error',
+      'webhook_deliveries.id',
+      'webhook_deliveries.responseStatus',
+      'webhook_deliveries.subscriptionId',
+    ])
+    .where('webhook_subscriptions.ownerId', '=', orgId)
+    .where('webhook_subscriptions.ownerType', '=', 'api_key')
+    .where('webhook_deliveries.createdAt', '>=', options.from)
+    .where('webhook_deliveries.expiresAt', '>', options.now)
+    .where('webhook_deliveries.status', '=', 'failed')
+    .orderBy('webhook_deliveries.createdAt', 'desc')
+    .orderBy('webhook_deliveries.id', 'desc')
+    .limit(options.limit)
+    .execute()
+}
+
+export declare namespace listFailuresByOrg {
+  /** Bounds for the organization failure scan. */
+  type Options = {
+    /** Window start (ISO 8601), inclusive. */
+    from: string
+    /** Maximum failures to return. */
+    limit: number
+    /** ISO timestamp retention is evaluated against. */
+    now: string
+  }
+}
+
+/** Counts failed webhook deliveries across an organization in a time window. */
+export async function countFailuresByOrg(
+  db: Db.Db,
+  orgId: string,
+  options: countFailuresByOrg.Options,
+): Promise<number> {
+  const row = await db.kysely
+    .selectFrom('webhook_deliveries')
+    .innerJoin(
+      'webhook_subscriptions',
+      'webhook_subscriptions.id',
+      'webhook_deliveries.subscriptionId',
+    )
+    .select((eb) => eb.fn.countAll().as('count'))
+    .where('webhook_subscriptions.ownerId', '=', orgId)
+    .where('webhook_subscriptions.ownerType', '=', 'api_key')
+    .where('webhook_deliveries.createdAt', '>=', options.from)
+    .where('webhook_deliveries.expiresAt', '>', options.now)
+    .where('webhook_deliveries.status', '=', 'failed')
+    .executeTakeFirstOrThrow()
+  return Number(row.count)
+}
+
+export declare namespace countFailuresByOrg {
+  /** Bounds for the organization failure count. */
+  type Options = {
+    /** Window start (ISO 8601), inclusive. */
+    from: string
+    /** ISO timestamp retention is evaluated against. */
+    now: string
+  }
+}
+
 export declare namespace list {
   /** Options for {@link list}. */
   type Options = {

package/src/handlers/relay.test-d.ts

@@ -0,0 +1,8 @@
+import { Handler } from 'tapimo'
+
+describe('Handler.relay', () => {
+  test('accepts Tempo API defaults', () => {
+    expectTypeOf(Handler.relay()).toEqualTypeOf<Handler.Handler>()
+    expectTypeOf(Handler.relay({ apiKey: 'secret_api_key' })).toEqualTypeOf<Handler.Handler>()
+  })
+})

package/src/handlers/relay.test.ts

@@ -16,8 +16,8 @@ const recipient = Relay.accounts[7]!
 
 /**
  * Tokens the relay handler probes for fee-token resolution. The default
- * `resolveTokens` fetches `tokenlist.tempo.xyz`, which doesn't know about
- * the localnet chain — so tests inject this list explicitly.
+ * `resolveTokens` uses the Tempo API for mainnet and testnet, so localnet
+ * tests inject this list explicitly.
  */
 const localnetTokens = [
   {

package/src/handlers/relay.ts

@@ -16,8 +16,10 @@ import {
 import type { LocalAccount } from 'viem/accounts'
 import { simulateCalls } from 'viem/actions'
 import { Abis, Actions, Addresses, Capabilities, VirtualAddress } from 'viem/tempo'
+import { tempoMainnet, tempoTestnet } from 'viem/tempo/chains'
 
 import * as ExecutionError from './internal/executionError.js'
+import * as TempoApi from '../Client.js'
 import type * as RpcSchema from '../internal/RpcSchema.js'
 import { type Handler, from } from '../Handler.js'
 import * as Store from '../internal/Store.js'
@@ -25,6 +27,8 @@ import * as Multisig from './internal/multisig.js'
 import * as Sponsorship from './internal/sponsorship.js'
 import * as Utils from './internal/utils.js'
 
+const defaultChains = [tempoMainnet, tempoTestnet] as const
+
 /**
  * Instantiates a relay handler that proxies `eth_fillTransaction`
  * with wallet-aware enrichment (fee token resolution, simulation,
@@ -32,9 +36,9 @@ import * as Utils from './internal/utils.js'
  *
  * @example
  * ```ts
- * import { Handler } from 'tempo-api/server'
+ * import { Handler } from 'tapimo'
  *
- * const handler = Handler.relay({ getClient })
+ * const handler = Handler.relay({ apiKey: process.env.TEMPO_API_KEY })
  *
  * // Plug handler into your server framework of choice:
  * createServer(handler.listener)              // Node.js
@@ -51,10 +55,9 @@ import * as Utils from './internal/utils.js'
  *
  * ```ts
  * import { privateKeyToAccount } from 'viem/accounts'
- * import { Handler } from 'tempo-api/server'
+ * import { Handler } from 'tapimo'
  *
  * const handler = Handler.relay({
- *   getClient,
  *   feePayer: {
  *     account: privateKeyToAccount('0x...'),
  *   },
@@ -64,26 +67,26 @@ import * as Utils from './internal/utils.js'
  * @param options - Options.
  * @returns Request handler.
  */
-export function relay(options: relay.Options): Handler {
+export function relay(options: relay.Options = {}): Handler {
   const {
-    getClient,
+    apiKey,
+    getClient: getClient_,
     internal_allowUnsafeUrls = false,
     onRequest,
     path = '/',
-    resolveTokens,
+    resolveTokens: resolveTokens_,
     ...rest
   } = options
+  const getClient = getClient_ ?? defaultGetClient({ apiKey })
+  const resolveTokens = resolveTokens_ ?? defaultResolveTokens({ apiKey })
   const feePayerOptions = options.feePayer
   // Adapt the state store into the multisig operation store once, up front.
   const multisigOptions = options.multisig
     ? { ...options.multisig, store: Multisig.fromStore(options.multisig.store) }
     : undefined
 
-  // Resolves the chain's fee-token candidates through the caller-provided
-  // resolver. An unconfigured resolver (or a chain it has no list for) yields
-  // an empty candidate set.
   const getTokens = async (chainId: number | undefined): Promise<readonly Address[]> => {
-    if (!resolveTokens || chainId === undefined) return []
+    if (chainId === undefined) return []
     return await resolveTokens(chainId)
   }
 
@@ -94,7 +97,7 @@ export function relay(options: relay.Options): Handler {
 
   const features = {
     autoSwap: options.autoSwap ?? options.features === 'all',
-    feeTokenResolution: options.features === 'all' || Boolean(resolveTokens),
+    feeTokenResolution: options.features === 'all' || Boolean(resolveTokens_),
     simulate: options.features === 'all',
   }
 
@@ -175,6 +178,7 @@ export function relay(options: relay.Options): Handler {
           let filled: Awaited<ReturnType<typeof fill>>
           let sponsored = false
           let feeToken = sponsoredFeeToken
+          const tokens = getTokens(chainId)
 
           // Lazily resolve a swap source token when autoSwap needs one.
           const resolveFeeTokenForSwap = from
@@ -183,7 +187,7 @@ export function relay(options: relay.Options): Handler {
                   account: from,
                   feeToken: undefined,
                   store,
-                  tokens: (await getTokens(chainId)).filter(
+                  tokens: (await tokens).filter(
                     (t) => t.toLowerCase() !== insufficientToken.toLowerCase(),
                   ),
                 })
@@ -194,7 +198,7 @@ export function relay(options: relay.Options): Handler {
           // the transaction is calling — typically the token being
           // transferred — so a user transferring USDC.e can pay gas in
           // USDC.e even when the configured list defaults to pathUSD.
-          const configuredTokens = await getTokens(chainId)
+          const configuredTokens = await tokens
           const unsponsoredTokens = [
             ...configuredTokens,
             ...callTargetTokens(baseTx).filter(
@@ -221,7 +225,7 @@ export function relay(options: relay.Options): Handler {
             //     `validate` only governs the wallet's own fee payer).
             // Default to the chain's first token so the broadcast envelope
             // always carries a feeToken the chain can charge.
-            if (!feeToken) feeToken = (await getTokens(chainId))[0]
+            if (!feeToken) feeToken = configuredTokens[0]
             const transaction = {
               ...baseTx,
               feePayer: true,
@@ -334,8 +338,7 @@ export function relay(options: relay.Options): Handler {
           const transaction_filled = filled.transaction
           const swap = 'swap' in filled ? filled.swap : undefined
           if (!feeToken)
-            feeToken =
-              (transaction_filled.feeToken as Address | undefined) ?? (await getTokens(chainId))[0]
+            feeToken = (transaction_filled.feeToken as Address | undefined) ?? configuredTokens[0]
 
           // Parallelize: simulate, fee payer signing, and autoSwap metadata.
           const alreadySigned =
@@ -648,8 +651,46 @@ export function relay(options: relay.Options): Handler {
   return router
 }
 
+function defaultGetClient(options: { apiKey?: string | undefined }) {
+  const clients = new Map<number, Client>()
+  for (const chain of defaultChains) {
+    const transport = options.apiKey
+      ? http(new URL(`/rpc/${chain.id}`, TempoApi.defaultUrl).toString(), {
+          fetchOptions: { headers: { 'tempo-api-key': options.apiKey } },
+        })
+      : http()
+    clients.set(
+      chain.id,
+      createClient({ batch: { multicall: { deployless: true } }, chain, transport }),
+    )
+  }
+
+  return (chainId: number = tempoMainnet.id): Client => {
+    const client = clients.get(chainId)
+    if (!client) throw new Error(`Chain ${chainId} not configured`)
+    return client
+  }
+}
+
+function defaultResolveTokens(options: { apiKey?: string | undefined }) {
+  const client = TempoApi.create({ apiKey: options.apiKey })
+
+  return async (chainId: number): Promise<readonly Address[]> => {
+    if (!defaultChains.some((chain) => chain.id === chainId)) return []
+    const response = await client.v1.tokenlist.$get({ query: { chainId: String(chainId) } })
+    if (response.status !== 200) return []
+    const { tokens } = await response.json()
+    return tokens.map((token) => token.address)
+  }
+}
+
 export namespace relay {
   export type Options = from.Options & {
+    /**
+     * Tempo API key used by the default RPC clients and token resolver. When
+     * omitted, RPC clients use each chain's default transport.
+     */
+    apiKey?: string | undefined
     /**
      * Auto-swap options.
      */
@@ -663,9 +704,9 @@ export namespace relay {
     /**
      * Resolves a viem client for a chain id. The handler resolves the client
      * from the `chainId` in the incoming transaction (falling back to the
-     * client's default chain). Called with no argument for the default client.
+     * client's default chain). Defaults to Tempo mainnet and testnet clients.
      */
-    getClient: (chainId?: number) => Client
+    getClient?: ((chainId?: number) => Client) | undefined
     /**
      * Fee payer / sponsor configuration. When provided, the relay will
      * sign `feePayerSignature` on the filled transaction.
@@ -721,9 +762,8 @@ export namespace relay {
     /** Path to use for the handler. @default "/" */
     path?: string | undefined
     /**
-     * Resolves the known fee-token candidates for a chain. The relay checks
-     * the caller's balance for each candidate and picks the highest during
-     * fee-token resolution. Omit to disable fee-token resolution.
+     * Resolves the known fee-token candidates for a chain. Defaults to the
+     * Tempo API verified token list for mainnet and testnet.
      */
     resolveTokens?:
       | ((chainId: number) => readonly Address[] | Promise<readonly Address[]>)

package/src/internal/Auth.test.ts

@@ -1,8 +1,13 @@
-import { Hono } from 'hono'
+import { Hono, type Context } from 'hono'
 import { requestId } from 'hono/request-id'
 import { Mppx, tempo } from 'mppx/hono'
 import { RateLimit } from 'tapimo'
 import * as ApiKey from '../ApiKey.js'
+import type * as Db from '../db/Db.js'
+import * as Memberships from '../db/tables/memberships.js'
+import * as Organizations from '../db/tables/organizations.js'
+import * as Projects from '../db/tables/projects.js'
+import * as Users from '../db/tables/users.js'
 import * as Auth from './Auth.js'
 import * as Log from './Log.js'
 import * as Scope from '../Scope.js'
@@ -75,12 +80,13 @@ describe('require', () => {
       `)
     })
 
-    test('accepts API key from deprecated key query param', async () => {
+    test('accepts API key from key query param', async () => {
       const app = createApp()
       const response = await app.request(`/protected?key=${token}`)
       const body = await response.json()
 
       expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(response.headers.get('cache-control')).toMatchInlineSnapshot(`"private"`)
       expect(body).toMatchInlineSnapshot(`
         {
           "id": "key_test",
@@ -90,11 +96,30 @@ describe('require', () => {
       `)
     })
 
-    test('strips the deprecated key query param before route validation', async () => {
-      // Regression: route query schemas are strict (`z.strictObject`), so the
-      // `key` auth param must be removed from the URL once consumed — otherwise
-      // the downstream validator rejects it as `query_invalid` and the legacy
-      // `?key=...` lane breaks on every strict-query endpoint.
+    test('keeps query-authenticated responses private after downstream caching', async () => {
+      const auth = {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+      }
+      const app = new Hono<Auth.Environment>()
+      app.use('*', async (c, next) => {
+        c.set('auth', auth)
+        await next()
+      })
+      app.use('/cached', Auth.require({ apiKey: { scopes: ['data:read'] } }))
+      app.get('/cached', (c) => {
+        c.header('Cache-Control', 'public, max-age=86400')
+        return c.json({ ok: true })
+      })
+
+      const response = await app.request(`/cached?key=${token}`)
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(response.headers.get('cache-control')).toMatchInlineSnapshot(`"private"`)
+    })
+
+    test('strips the key query param before route validation', async () => {
+      // Auth owns `key`, so strict route schemas must not see it.
       const auth = {
         apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
         rateLimit: RateLimit.memory(),
@@ -1298,6 +1323,87 @@ describe('require', () => {
   })
 })
 
+describe('ensureProject', () => {
+  test('authorizes a flat project route against the API key organization', async () => {
+    const db = TestApp.database()
+    const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(db, apiKeyPrincipal(organization.id)).request(
+      `/v1/projects/${project.id}/resource`,
+    )
+
+    expect(response.status).toMatchInlineSnapshot(`200`)
+    expect(await response.json()).toEqual({
+      membership: null,
+      orgId: organization.id,
+      projectId: project.id,
+    })
+  })
+
+  test('hides a flat project from an API key in another organization', async () => {
+    const db = TestApp.database()
+    const organization = await Organizations.create(db, { id: key.orgId, name: 'Test org' })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(db, apiKeyPrincipal('org_foreign')).request(
+      `/v1/projects/${project.id}/resource`,
+    )
+
+    expect(response.status).toMatchInlineSnapshot(`404`)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
+  })
+
+  test('resolves session membership for a flat project route', async () => {
+    const db = TestApp.database()
+    const user = await Users.upsertByAddress(db, {
+      address: '0x0000000000000000000000000000000000000001',
+    })
+    const organization = await Organizations.create(db, { name: 'Test org' })
+    await Memberships.create(db, { orgId: organization.id, role: 'member', userId: user.id })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createProjectGuardApp(db, sessionPrincipal(user.id)).request(
+      `/v1/projects/${project.id}/resource`,
+    )
+    const body = (await response.json()) as Record<string, unknown>
+
+    expect(response.status).toMatchInlineSnapshot(`200`)
+    expect(body).toEqual({
+      membership: 'member',
+      orgId: organization.id,
+      projectId: project.id,
+    })
+  })
+
+  test('preserves nested organization role authorization', async () => {
+    const db = TestApp.database()
+    const user = await Users.upsertByAddress(db, {
+      address: '0x0000000000000000000000000000000000000001',
+    })
+    const organization = await Organizations.create(db, { name: 'Test org' })
+    await Memberships.create(db, { orgId: organization.id, role: 'member', userId: user.id })
+    const project = await Projects.create(db, { name: 'Test project', orgId: organization.id })
+    const response = await createNestedProjectGuardApp(db, sessionPrincipal(user.id)).request(
+      `/v1/orgs/${organization.id}/projects/${project.id}/resource`,
+    )
+
+    expect(response.status).toMatchInlineSnapshot(`403`)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "forbidden",
+          "message": "Requires the admin role",
+        },
+      }
+    `)
+  })
+})
+
 function createScopedApp(options: {
   auth?: Auth.Context | undefined
   routes: readonly { path: string; policy: Auth.require.Policy }[]
@@ -1322,6 +1428,67 @@ function createScopedApp(options: {
   return app
 }
 
+type GuardEnvironment = {
+  Variables: Auth.Variables & { db: Db.Source }
+}
+
+function createProjectGuardApp(db: Db.Source, principal: Auth.Principal) {
+  const app = new Hono<GuardEnvironment>()
+  app.use('*', async (c, next) => {
+    c.set('db', db)
+    c.set('principal', principal)
+    await next()
+  })
+  app.get('/v1/projects/:projectId/resource', Auth.ensureProject(), projectGuardHandler)
+  return app
+}
+
+function createNestedProjectGuardApp(db: Db.Source, principal: Auth.Principal) {
+  const app = new Hono<GuardEnvironment>()
+  app.use('*', async (c, next) => {
+    c.set('db', db)
+    c.set('principal', principal)
+    await next()
+  })
+  app.get(
+    '/v1/orgs/:orgId/projects/:projectId/resource',
+    Auth.ensureOrg({ role: 'admin' }),
+    Auth.ensureProject(),
+    projectGuardHandler,
+  )
+  return app
+}
+
+function projectGuardHandler(c: Context<GuardEnvironment>) {
+  return c.json({
+    membership: Auth.membership(c)?.role ?? null,
+    orgId: Auth.org(c).id,
+    projectId: Auth.project(c).id,
+  })
+}
+
+function apiKeyPrincipal(orgId: string): Auth.Principal {
+  const apiKey = { ...key, orgId }
+  return {
+    apiKey,
+    environment: apiKey.environment,
+    id: apiKey.id,
+    orgId,
+    type: 'api_key',
+  }
+}
+
+function sessionPrincipal(id: string): Auth.Principal {
+  return {
+    id,
+    identity: {
+      provider: 'wallet',
+      subject: '0x0000000000000000000000000000000000000001',
+    },
+    type: 'session',
+  }
+}
+
 type Options = {
   auth?: Auth.Context | undefined
   logger?: Log.Emit | undefined