tapimo 0.4.4 → 0.5.1

package/src/apps/composition.test.ts

@@ -25,6 +25,46 @@ async function paths(app: { request: (path: string) => Promise<Response> | Respo
   return Object.keys((await document(app)).paths)
 }
 
+describe('App.create()', () => {
+  test('publishes shared chain context without data routes', async () => {
+    const rpc = { url: () => 'https://rpc.example' }
+    const group = new Hono<App.Environment>().get('/context', (c) => {
+      const client = c.get('getClient')()
+      return c.json({
+        chainId: c.get('chainId'),
+        clientChainId: client.chain.id,
+        memoized: client === c.get('getClient')(),
+        rpc: c.get('rpc') === rpc,
+        supportedChainIds: [...c.get('supportedChainIds')].sort((a, b) => a - b),
+      })
+    })
+    const app = App.create({
+      auth: false,
+      db: TestApp.database(),
+      defaultChainId: 1337,
+      rpc,
+      supportedChainIds: [999],
+    }).route('/', group)
+
+    const response = await app.request('/context')
+
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "chainId": 1337,
+        "clientChainId": 1337,
+        "memoized": true,
+        "rpc": true,
+        "supportedChainIds": [
+          999,
+          1337,
+          4217,
+          42431,
+        ],
+      }
+    `)
+  })
+})
+
 describe('App.from()', () => {
   test('contributes external route-group metadata', async () => {
     const group = new Hono().get(
@@ -110,6 +150,43 @@ describe('data()', () => {
     const orgs = await app.request('/v1/orgs')
     expect(orgs.status).toBe(404)
   })
+
+  test('inherits shared chain context', async () => {
+    const rpc = { url: () => 'https://rpc.example' }
+    const context = new Hono<App.Environment>().get('/context', (c) =>
+      c.json({
+        chainId: c.get('chainId'),
+        clientChainId: c.get('getClient')().chain.id,
+        rpc: c.get('rpc') === rpc,
+        supportedChainIds: [...c.get('supportedChainIds')].sort((a, b) => a - b),
+      }),
+    )
+    const app = App.create({
+      auth: false,
+      db: TestApp.database(),
+      defaultChainId: 333,
+      rpc,
+      supportedChainIds: [444],
+    })
+      .route('/', data())
+      .route('/', context)
+
+    const response = await app.request('/context')
+
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "chainId": 333,
+        "clientChainId": 333,
+        "rpc": true,
+        "supportedChainIds": [
+          333,
+          444,
+          4217,
+          42431,
+        ],
+      }
+    `)
+  })
 })
 
 describe('relay()', () => {

package/src/apps/data/App.test.ts

@@ -1,4 +1,11 @@
+import { Secp256k1 } from 'ox'
+import { ZoneRpcAuthentication } from 'ox/tempo'
+import { Challenge, PaymentRequest } from 'mppx'
+import { RateLimit } from 'tapimo'
+
 import * as TestApp from '../../../test/App.js'
+import * as Tempo from '../../../test/Tempo.js'
+import * as Store from '../../internal/Store.js'
 import * as Viem from '../../internal/Viem.js'
 
 /** A supported non-mainnet chain id, exercising the sandbox testnet allowance. */
@@ -35,6 +42,346 @@ function mainnetDefaultClient() {
   })
 }
 
+type OpenApiDocument = {
+  paths: Record<string, Record<string, unknown>>
+}
+
+const mpp = {
+  secretKey: 'secret_test_key_0123456789abcdef',
+  session: {
+    chainId: Tempo.chain.id,
+    currency: Tempo.currency,
+    decimals: 6,
+    getClient: () => Tempo.client,
+    recipient: Tempo.accounts[2].address,
+  },
+} satisfies NonNullable<TestApp.create.Options['mpp']>
+
+describe('MPP session management', () => {
+  test('keeps generated POST routes private', async () => {
+    const app = TestApp.create({ auth: false })
+    const indexer = await app.request('/v1/indexer/query', { method: 'POST' })
+    const token = await app.request(`/v1/tokens/${TestApp.token}`, { method: 'POST' })
+    const spec = (await (await app.request('/openapi.json')).json()) as OpenApiDocument
+
+    expect(indexer.status).toBe(404)
+    expect(token.status).toBe(404)
+    expect(spec.paths['/v1/indexer/query']).not.toHaveProperty('post')
+    expect(spec.paths['/v1/tokens/{token}']).not.toHaveProperty('post')
+  })
+
+  test('matches GET scopes for static, parameterized, and hidden resources', async () => {
+    const rateLimitStore = Store.memory()
+    const app = TestApp.create({ mpp, rateLimit: { store: rateLimitStore } })
+    await exhaustPublicQuota(rateLimitStore)
+
+    for (const resource of [
+      {
+        path: `/v1/indexer/query?sql=select%201&chainId=${Tempo.chain.id}`,
+        scope: 'GET /v1/indexer/query',
+      },
+      {
+        path: `/v1/tokens/${TestApp.token}?chainId=${Tempo.chain.id}`,
+        scope: 'GET /v1/tokens/:token',
+      },
+      {
+        path: `/v1/verified-tokens?chainId=${Tempo.chain.id}`,
+        scope: 'GET /v1/verified-tokens',
+      },
+    ]) {
+      const url = new URL(resource.path, 'http://tempo-api.test')
+      const challenged = await app.fetch(new Request(url))
+      url.search = ''
+      const management = await app.fetch(new Request(url, { method: 'POST' }))
+
+      expect(challenged.status).toBe(402)
+      expect(management.status).toBe(402)
+      const expectedScope = PaymentRequest.serialize({
+        _mppx_scope: resource.scope,
+      })
+      expect(Challenge.fromHeaders(challenged.headers).opaque).toBe(expectedScope)
+      expect(Challenge.fromHeaders(management.headers).opaque).toBe(expectedScope)
+    }
+  })
+
+  test('preserves the mounted base path in session scope', async () => {
+    const rateLimitStore = Store.memory()
+    const app = TestApp.create({ mpp, path: '/api', rateLimit: { store: rateLimitStore } })
+    await exhaustPublicQuota(rateLimitStore)
+
+    const resource = new URL(
+      `/api/v1/tokens/${TestApp.token}?chainId=${Tempo.chain.id}`,
+      'http://tempo-api.test',
+    )
+    const challenged = await app.fetch(new Request(resource))
+    resource.search = ''
+    const management = await app.fetch(new Request(resource, { method: 'POST' }))
+
+    expect(challenged.status).toBe(402)
+    expect(management.status).toBe(402)
+    const expectedScope = PaymentRequest.serialize({
+      _mppx_scope: 'GET /api/v1/tokens/:token',
+    })
+    expect(Challenge.fromHeaders(challenged.headers).opaque).toBe(expectedScope)
+    expect(Challenge.fromHeaders(management.headers).opaque).toBe(expectedScope)
+  })
+
+  test('honors endpoint MPP overrides', async () => {
+    const app = TestApp.create({
+      auth: {
+        overrides: {
+          'GET /v1/scopes': { mpp: true },
+          'GET /v1/tokens/:token': { mpp: false },
+        },
+      },
+      mpp,
+    })
+    const enabled = await app.request('/v1/scopes', { method: 'POST' })
+    const disabled = await app.request(`/v1/tokens/${TestApp.token}`, { method: 'POST' })
+
+    expect(enabled.status).toBe(402)
+    expect(disabled.status).toBe(404)
+    expect(Challenge.fromHeaders(enabled.headers).opaque).toBe(
+      PaymentRequest.serialize({ _mppx_scope: 'GET /v1/scopes' }),
+    )
+  })
+})
+
+describe('zone chain gate', () => {
+  /** A consumer-supplied zone chain id (the API never derives these). */
+  const zone = 421_700_001
+  /** A second zone, isolating per-zone grants. */
+  const zoneB = 421_700_002
+
+  function zoneOptions(chainId: number) {
+    return {
+      chainId,
+      forwardRpcUrl: `https://${chainId}.rpc.test`,
+    }
+  }
+
+  /** Zone reader: holds the per-zone scope for `zone` (only). */
+  const zoneReader = {
+    id: 'key_zone',
+    orgId: 'org_test',
+    scopes: ['data:read', `zone:${zone}:read`],
+    token: 'secret_zone',
+  } satisfies TestApp.kvStore.Key
+
+  /** Full-access key: the wildcard covers every zone. */
+  const admin = {
+    id: 'key_admin',
+    orgId: 'org_test',
+    scopes: ['*'],
+    token: 'secret_admin',
+  } satisfies TestApp.kvStore.Key
+
+  /** Data reader without any zone grant. */
+  const outsider = {
+    id: 'key_outsider',
+    orgId: 'org_test',
+    scopes: ['data:read'],
+    token: 'secret_outsider',
+  } satisfies TestApp.kvStore.Key
+
+  /** A deployment serving two zones. */
+  function zoneApp() {
+    return TestApp.create({
+      auth: { keys: [admin, outsider, zoneReader] },
+      zones: [zoneOptions(zone), zoneOptions(zoneB)],
+    })
+  }
+
+  /** Signing key proving that a structurally valid caller token is insufficient for REST. */
+  const privateKey = Secp256k1.randomPrivateKey()
+
+  /** Signs a caller Zone token. */
+  function zoneToken(chainId: number) {
+    const issuedAt = Math.floor(Date.now() / 1000)
+    const authentication = ZoneRpcAuthentication.from({
+      chainId,
+      expiresAt: issuedAt + 300,
+      issuedAt,
+      zoneId: 1,
+    })
+    return ZoneRpcAuthentication.serialize(authentication, {
+      signature: Secp256k1.sign({
+        payload: ZoneRpcAuthentication.getSignPayload(authentication),
+        privateKey,
+      }),
+    })
+  }
+
+  test('zone chain ids are additive: unsupported ids list them as supported', async () => {
+    const app = TestApp.create({ auth: false, zones: [zoneOptions(zone)] })
+    const response = await app.request('/v1/transfers?chainId=999999')
+    const body = (await response.json()) as { error: { code: string; message: string } }
+
+    expect(response.status).toBe(400)
+    expect(body.error.code).toBe('chain_id_unsupported')
+    expect(body.error.message).toContain(String(zone))
+  })
+
+  test('a default zone still applies authorization', async () => {
+    const app = TestApp.create({
+      auth: false,
+      defaultChainId: zone,
+      rpc: { url: (chainId) => `https://${chainId}.rpc.test` },
+      zones: [zoneOptions(zone)],
+    })
+
+    const rpc = await app.request('/rpc', {
+      body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+      method: 'POST',
+    })
+    const transfers = await app.request('/v1/transfers')
+    const tokens = await app.request('/v1/tokens')
+    const scopes = await app.request('/v1/scopes')
+
+    expect(rpc.status).toBe(403)
+    expect(transfers.status).toBe(403)
+    expect(tokens.status).toBe(403)
+    expect(scopes.status).toBe(200)
+  })
+
+  test('a zone-scoped key reads Zone data', async () => {
+    const response = await zoneApp().request(`/v1/tokenlist?chainId=${zone}`, as(zoneReader))
+    expect(response.status).toBe(200)
+  })
+
+  test('zone authorization applies to every data route', async () => {
+    const app = TestApp.create({ auth: false, zones: [zoneOptions(zone)] })
+    for (const path of [
+      `/v1/tokens?chainId=${zone}`,
+      `/v1/addresses/0x0000000000000000000000000000000000000001/activities?chainId=${zone}`,
+      `/v1/transfers?chainId=${zone}&include=token`,
+    ]) {
+      const response = await app.request(path)
+      const body = (await response.json()) as { error: { code: string; message: string } }
+
+      expect(response.status).toBe(403)
+      expect(body.error.code).toBe('api_key_forbidden')
+      expect(body.error.message).toContain('zone')
+    }
+  })
+
+  test('the wildcard scope covers every zone', async () => {
+    const app = zoneApp()
+    expect((await app.request(`/v1/tokenlist?chainId=${zone}`, as(admin))).status).toBe(200)
+    expect((await app.request(`/v1/tokenlist?chainId=${zoneB}`, as(admin))).status).toBe(200)
+  })
+
+  test('a key without the zone scope is refused, naming the scope', async () => {
+    const app = zoneApp()
+    const response = await app.request(`/v1/transfers?chainId=${zone}`, as(outsider))
+    const body = (await response.json()) as { error: { code: string; message: string } }
+
+    expect(response.status).toBe(403)
+    expect(body.error.code).toBe('api_key_forbidden')
+    expect(body.error.message).toContain(`zone:${zone}:read`)
+    expect(body.error.message).not.toContain('X-Authorization-Token')
+  })
+
+  test('a zone scope does not grant another zone', async () => {
+    const app = zoneApp()
+    const response = await app.request(`/v1/transfers?chainId=${zoneB}`, as(zoneReader))
+    const body = (await response.json()) as { error: { code: string; message: string } }
+
+    expect(response.status).toBe(403)
+    expect(body.error.message).toContain(`zone:${zoneB}:read`)
+  })
+
+  test('a caller-signed Zone token cannot authorize REST data', async () => {
+    const response = await zoneApp().request(`/v1/tokenlist?chainId=${zone}`, {
+      headers: { [ZoneRpcAuthentication.headerName]: zoneToken(zone) },
+    })
+    expect(response.status).toBe(403)
+  })
+
+  test('an empty Zone token cannot authorize raw RPC', async () => {
+    const response = await zoneApp().request(`/rpc/${zone}`, {
+      body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+      headers: { [ZoneRpcAuthentication.headerName]: '' },
+      method: 'POST',
+    })
+    expect(response.status).toBe(403)
+  })
+
+  test('path chain selectors require Zone authorization', async () => {
+    const app = TestApp.create({ auth: false, zones: [zoneOptions(zone)] })
+    const gecko = await app.request(`/gecko/${zone}/pairs`)
+    const block = await app.request(`/chains/${zone}/blocks/by-timestamp?timestamp=1767225600`)
+
+    expect(gecko.status).toBe(403)
+    expect(block.status).toBe(403)
+  })
+
+  test('applies Zone authorization under a base path', async () => {
+    const app = TestApp.create({ auth: false, path: '/api', zones: [zoneOptions(zone)] })
+
+    expect((await app.request(`/api/v1/tokenlist?chainId=${zone}`)).status).toBe(403)
+    expect((await app.request(`/api/gecko/${zone}/pairs`)).status).toBe(403)
+  })
+
+  test('rejects conflicting path and query Zone selectors', async () => {
+    const response = await zoneApp().request(
+      `/gecko/${zoneB}/pairs?chainId=${zone}`,
+      as(zoneReader),
+    )
+    const body = (await response.json()) as { error: { code: string; message: string } }
+
+    expect(response.status).toBe(400)
+    expect(body.error.code).toBe('chain_id_invalid')
+    expect(body.error.message).toBe('Conflicting chain ids')
+  })
+
+  test('rejects conflicting query aliases', async () => {
+    const response = await zoneApp().request(
+      `/v1/tokenlist?chainId=${zone}&chain_id=${zoneB}`,
+      as(admin),
+    )
+    expect(response.status).toBe(400)
+  })
+
+  test('does not apply the data gate to management routes', async () => {
+    const response = await zoneApp().request(`/v1/scopes?chainId=${zone}`)
+    expect(response.status).toBe(200)
+  })
+
+  test('Zone responses never seed the anonymous edge cache', async () => {
+    const app = zoneApp()
+    const path = `/v1/tokenlist?chainId=${zone}`
+    expect((await app.request(path, as(zoneReader))).status).toBe(200)
+    expect((await app.request(path)).status).toBe(403)
+  })
+
+  test('bypasses stale edge entries after a chain becomes a Zone', async () => {
+    const store = Store.memory()
+    const path = `/v1/tokenlist?chainId=${zone}`
+    const publicApp = TestApp.create({
+      auth: false,
+      cache: { store },
+      supportedChainIds: [zone],
+    })
+    expect((await publicApp.request(path)).status).toBe(200)
+
+    const privateApp = TestApp.create({ auth: false, cache: { store }, zones: [zoneOptions(zone)] }) // prettier-ignore
+    expect((await privateApp.request(path)).status).toBe(403)
+  })
+
+  test('public chains remain edge-cacheable on a Zone deployment', async () => {
+    const store = Store.memory()
+    const app = TestApp.create({ auth: false, cache: { store }, zones: [zoneOptions(zone)] })
+    const path = `/v1/tokenlist?chainId=${Viem.chainId.testnet}`
+
+    const first = await app.request(path)
+    const second = await app.request(path)
+    expect(first.status).toBe(200)
+    expect(second.status).toBe(200)
+    expect(second.headers.get('cache-control')).toContain('public')
+  })
+})
+
 describe('sandbox chain guard', () => {
   test('rejects a sandbox key that omits `chainId` on a mainnet-default deployment', async () => {
     const response = await mainnetDefaultClient().v1.tokenlist.$get({ query: {} }, as(sandbox))
@@ -70,3 +417,10 @@ describe('sandbox chain guard', () => {
     expect(response.status).toBe(200)
   })
 })
+
+async function exhaustPublicQuota(store: Store.Store) {
+  const limit = { perMinute: 60 }
+  const rateLimit = RateLimit.memory({ store })
+  for (let index = 0; index < limit.perMinute; index++)
+    await rateLimit.consume({ key: 'public:anonymous', limit })
+}