tapimo 0.4.4 → 0.5.1

package/src/apps/data/routes/indexer.test.ts

@@ -1,12 +1,18 @@
-import { RateLimit, Store } from 'tapimo'
+import { Challenge } from 'mppx'
+import { sessionManager } from 'mppx/client'
+import { ZoneRpcAuthentication } from 'ox/tempo'
+import { Actions } from 'viem/tempo'
 import * as TestApp from '../../../../test/App.js'
 import * as Mppx from '../../../../test/Mppx.js'
 import * as Runtime from '../../../../test/runtime.js'
 import * as Tempo from '../../../../test/Tempo.js'
+import * as Auth from '../../../internal/Auth.js'
 import * as Tidx from '../../../internal/Tidx.js'
+import * as Viem from '../../../internal/Viem.js'
 import * as Indexer from './indexer.js'
 
-const chainId = String(Runtime.get().chainId)
+const runtime = Runtime.get()
+const chainId = String(runtime.chainId)
 
 describe('GET /indexer/query', () => {
   test('proxies a query to the upstream indexer', async () => {
@@ -54,6 +60,81 @@ describe('GET /indexer/query', () => {
     expect(body.rows[0]?.[0]).toBe(value)
   })
 
+  test('routes Zone queries to the Zone TIDX with its basic auth', async () => {
+    const zone = runtime.zone.chainId
+    const zoneReader = {
+      id: 'key_zone_indexer',
+      orgId: 'org_test',
+      scopes: ['data:read', 'indexer:query', `zone:${zone}:read`],
+      token: 'secret_zone_indexer',
+    } satisfies TestApp.kvStore.Key
+    const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ columns: [], ok: true, row_count: 0, rows: [] }), {
+        headers: { 'content-type': 'application/json' },
+      }),
+    )
+    try {
+      const client = TestApp.client({
+        auth: { keys: [zoneReader] },
+        tidx: ({ chainId }) =>
+          chainId === zone
+            ? { baseUrl: 'https://zone.tidx.test', basicAuth: 'zone-secret' }
+            : { baseUrl: 'https://public.tidx.test', basicAuth: 'public-secret' },
+        zones: [{ chainId: zone, forwardRpcUrl: runtime.zone.forwardRpcUrl }],
+      })
+      const response = await client.v1.indexer.query.$get(
+        { query: { chainId: String(zone), sql: 'select 1' } },
+        {
+          headers: {
+            authorization: `Bearer ${zoneReader.token}`,
+            [ZoneRpcAuthentication.headerName]: 'zone-rpc-secret',
+          },
+        },
+      )
+      const upstream = fetch.mock.calls[0]![0] as Request
+
+      expect(response.status).toBe(200)
+      expect(new URL(upstream.url).origin).toBe('https://zone.tidx.test')
+      expect(upstream.headers.get('authorization')).toBe('Basic em9uZS1zZWNyZXQ=')
+      expect(upstream.headers.get(ZoneRpcAuthentication.headerName)).toBeNull()
+    } finally {
+      fetch.mockRestore()
+    }
+  })
+
+  test('routes Zone queries to the Zone TIDX with its bearer auth', async () => {
+    const zone = runtime.zone.chainId
+    const zoneReader = {
+      id: 'key_zone_bearer_indexer',
+      orgId: 'org_test',
+      scopes: ['data:read', 'indexer:query', `zone:${zone}:read`],
+      token: 'secret_zone_bearer_indexer',
+    } satisfies TestApp.kvStore.Key
+    const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ columns: [], ok: true, row_count: 0, rows: [] }), {
+        headers: { 'content-type': 'application/json' },
+      }),
+    )
+    try {
+      const client = TestApp.client({
+        auth: { keys: [zoneReader] },
+        tidx: { baseUrl: 'https://zone.tidx.test', bearerAuth: 'zone-secret' },
+        zones: [{ chainId: zone, forwardRpcUrl: runtime.zone.forwardRpcUrl }],
+      })
+      const response = await client.v1.indexer.query.$get(
+        { query: { chainId: String(zone), sql: 'select 1' } },
+        { headers: { authorization: `Bearer ${zoneReader.token}` } },
+      )
+      const upstream = fetch.mock.calls[0]![0] as Request
+
+      expect(response.status).toBe(200)
+      expect(new URL(upstream.url).origin).toBe('https://zone.tidx.test')
+      expect(upstream.headers.get('authorization')).toBe('Bearer zone-secret')
+    } finally {
+      fetch.mockRestore()
+    }
+  })
+
   test('bounds and caches buffered queries', async () => {
     // Stub the upstream so the injected execution bounds are observable on the
     // outgoing request; the auth path is in-memory and never touches fetch.
@@ -115,6 +196,20 @@ describe('GET /indexer/query', () => {
     expect(response.status).toMatchInlineSnapshot(`401`)
   })
 
+  test('does not expose anonymous access', () => {
+    expect(Auth.describeAccess(Indexer.indexer())['indexerQuery']).toMatchInlineSnapshot(`
+      {
+        "apiKey": true,
+        "mpp": true,
+        "public": false,
+        "scopes": [
+          "indexer:query",
+        ],
+        "session": false,
+      }
+    `)
+  })
+
   test('proxies without auth middleware', async () => {
     const client = TestApp.client({ auth: false })
     const response = await client.v1.indexer.query.$get({
@@ -126,10 +221,8 @@ describe('GET /indexer/query', () => {
     expect(body.ok).toMatchInlineSnapshot(`true`)
   })
 
-  test('completes the MPP payment lifecycle when public quota is exhausted', async () => {
-    const rateLimitStore = Store.memory()
+  test('challenges anonymous callers for MPP payment', async () => {
     const app = TestApp.create({
-      rateLimit: { store: rateLimitStore },
       mpp: {
         secretKey: 'secret_test_key_0123456789abcdef',
         session: {
@@ -141,13 +234,9 @@ describe('GET /indexer/query', () => {
         },
       },
     })
-    await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {
-      perMinute: 60,
-    })
 
-    // An unpaid over-quota request is challenged for payment. MPP challenges
-    // and receipts ride on real HTTP headers, so we drive the lifecycle
-    // through `app.fetch` rather than the typed route client.
+    // MPP challenges and receipts ride on real HTTP headers, so drive the
+    // lifecycle through `app.fetch` rather than the typed route client.
     const challenge = await app.fetch(
       new Request('http://tempo-api.test/v1/indexer/query?sql=select%201'),
     )
@@ -167,8 +256,77 @@ describe('GET /indexer/query', () => {
     expect(paid.headers.has('payment-receipt')).toMatchInlineSnapshot(`true`)
     expect(body.ok).toMatchInlineSnapshot(`true`)
   })
-})
 
-async function exhaustQuota(rateLimit: RateLimit.Store, key: string, limit: RateLimit.Limit) {
-  for (let index = 0; index < limit.perMinute; index++) await rateLimit.consume({ key, limit })
-}
+  test('rejects an unsupported chain before issuing an MPP challenge', async () => {
+    const app = TestApp.create({
+      mpp: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
+          chainId: Tempo.chain.id,
+          currency: Tempo.currency,
+          decimals: 6,
+          getClient: () => Tempo.client,
+          recipient: Tempo.accounts[2].address,
+        },
+      },
+    })
+    const response = await app.fetch(
+      new Request('http://tempo-api.test/v1/indexer/query?sql=select%201&chainId=31318'),
+    )
+    const body = (await response.json()) as { error: { code: string } }
+
+    expect(response.status).toBe(400)
+    expect(response.headers.has('www-authenticate')).toBe(false)
+    expect(body.error.code).toBe('chain_id_unsupported')
+  })
+
+  test('accepts session management POSTs', { timeout: 120_000 }, async () => {
+    const app = TestApp.create({
+      mpp: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
+          account: Tempo.accounts[2],
+          chainId: Viem.chainId.mainnet,
+          currency: Tempo.currency,
+          decimals: 6,
+          getClient: () => Tempo.client,
+          suggestedDeposit: '0.01',
+        },
+      },
+    })
+    await Actions.faucet.fundSync(Tempo.client, {
+      account: Tempo.accounts[2],
+      timeout: 60_000,
+    })
+
+    const url = `http://tempo-api.test/v1/indexer/query?sql=select%201&chainId=${chainId}`
+    const challenged = await app.fetch(new Request(url))
+    expect(challenged.status).toMatchInlineSnapshot(`402`)
+    expect(Challenge.fromHeaders(challenged.headers).request).toMatchObject({
+      amount: '100',
+      suggestedDeposit: '10000',
+    })
+
+    const manager = sessionManager({
+      account: Tempo.accounts[1],
+      client: Tempo.client,
+      fetch: async (input, init) => app.fetch(new Request(input, init)),
+    })
+    const paid = await manager.fetch(url)
+    expect(paid.status).toMatchInlineSnapshot(`200`)
+
+    const toppedUp = await manager.topUp('0.01')
+    if (!toppedUp) throw new Error('expected top-up receipt')
+    expect(toppedUp.status).toMatchInlineSnapshot(`"success"`)
+
+    const closed = await manager.close()
+    if (!closed) throw new Error('expected close receipt')
+    expect(closed.status).toMatchInlineSnapshot(`"success"`)
+    expect(closed.channelId).toBe(toppedUp.channelId)
+
+    const state = await Actions.channel.getStates(Tempo.client, {
+      channel: closed.channelId,
+    })
+    expect(state.deposit).toMatchInlineSnapshot(`0n`)
+  })
+})

package/src/apps/data/routes/indexer.ts

@@ -1,4 +1,5 @@
 import { Hono, type Context, type TypedResponse } from 'hono'
+import { ZoneRpcAuthentication } from 'ox/tempo'
 import * as z from 'zod/mini'
 
 import type * as App from '../../../App.js'
@@ -25,6 +26,7 @@ const strippedHeaders = new Set([
   'transfer-encoding',
   'upgrade',
   'tempo-api-key',
+  ZoneRpcAuthentication.headerName.toLowerCase(),
 ])
 
 /** Never reached; carries typed passthrough response variants into Hono client inference. */
@@ -99,7 +101,7 @@ export function indexer() {
 
   return new Hono<App.Environment>().get(
     '/v1/indexer/query',
-    Auth.policy({ apiKey: { scopes: ['indexer:query'] }, mpp: true, public: true }),
+    Auth.policy({ apiKey: { scopes: ['indexer:query'] }, mpp: true }),
     OpenApi.describeRoute({
       description:
         'Runs a read-only SQL-style query against Tempo’s indexed chain data, with optional live streaming as new blocks arrive.',
@@ -256,7 +258,10 @@ async function passthrough(
   // Resolve the upstream for this caller. A resolver `tidx` can route by
   // principal (e.g. anonymous `type: 'public'` callers to a public, no-auth
   // indexer); a static config ignores the principal.
-  const { baseUrl, basicAuth } = Tidx.resolve(tidx, { chainId, principal: Auth.getPrincipal(c) })
+  const { baseUrl, basicAuth, bearerAuth } = Tidx.resolve(tidx, {
+    chainId,
+    principal: Auth.getPrincipal(c),
+  })
   // The chain id is syntactically valid but this deployment has no indexer
   // upstream configured for it (no `tidx` config and no built-in default).
   if (!baseUrl)
@@ -290,6 +295,7 @@ async function passthrough(
   for (const [name, value] of c.req.raw.headers)
     if (!strippedHeaders.has(name.toLowerCase())) headers.set(name, value)
   if (basicAuth) headers.set('authorization', `Basic ${btoa(basicAuth)}`)
+  else if (bearerAuth) headers.set('authorization', `Bearer ${bearerAuth}`)
 
   const method = c.req.method
 

package/src/apps/data/routes/rpc.test.ts

@@ -1,8 +1,43 @@
+import { Hex, Secp256k1 } from 'ox'
+import { ZoneRpcAuthentication } from 'ox/tempo'
+
 import type * as Viem from '../../../internal/Viem.js'
+import * as RequestListener from '../../../handlers/internal/requestListener.js'
 import * as TestApp from '../../../../test/App.js'
+import * as Relay from '../../../../test/Relay.js'
 import * as Runtime from '../../../../test/runtime.js'
 
 const runtime = Runtime.get()
+const zone = runtime.zone.chainId
+const zoneOptions = {
+  chainId: zone,
+  forwardRpcUrl: runtime.zone.forwardRpcUrl,
+}
+const zoneReader = {
+  id: 'key_zone_reader',
+  orgId: 'org_test',
+  scopes: ['data:read', `zone:${zone}:read`],
+  token: 'secret_zone_reader',
+} satisfies TestApp.kvStore.Key
+
+// Prool's default Zone dev key.
+const zonePrivateKey = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
+
+function zoneToken() {
+  const issuedAt = Math.floor(Date.now() / 1_000)
+  const authentication = ZoneRpcAuthentication.from({
+    chainId: zone,
+    expiresAt: issuedAt + 300,
+    issuedAt,
+    zoneId: 1,
+  })
+  return ZoneRpcAuthentication.serialize(authentication, {
+    signature: Secp256k1.sign({
+      payload: ZoneRpcAuthentication.getSignPayload(authentication),
+      privateKey: zonePrivateKey,
+    }),
+  })
+}
 
 describe('POST /rpc', () => {
   test('routes by principal: a resolver sees the request principal and routes accordingly', async () => {
@@ -65,6 +100,7 @@ describe('POST /rpc', () => {
             'content-type': 'application/json',
             cookie: 'session=secret',
             'tempo-api-key': 'caller-key',
+            'x-authorization-token': 'zone-secret',
             'x-client-trace': 'trace_test',
           },
           method: 'POST',
@@ -90,6 +126,7 @@ describe('POST /rpc', () => {
       expect(call.headers['authorization']).toMatchInlineSnapshot(`"Basic cnBjLXNlY3JldA=="`)
       expect(call.headers['cookie']).toMatchInlineSnapshot(`null`)
       expect(call.headers['tempo-api-key']).toMatchInlineSnapshot(`null`)
+      expect(call.headers['x-authorization-token']).toBeNull()
       expect(call.headers['x-client-trace']).toMatchInlineSnapshot(`"trace_test"`)
     } finally {
       fetch.restore()
@@ -267,6 +304,187 @@ describe('POST /rpc', () => {
     }
   })
 
+  test('proxies zone chain ids and forwards the caller zone auth token', async () => {
+    const fetch = mockRpc()
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        zones: [{ chainId: zone, forwardRpcUrl: `https://${zone}.rpc.test` }],
+      })
+
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${zone}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_getBalance' }),
+          headers: {
+            authorization: 'Bearer caller-secret',
+            'x-authorization-token': 'zone-token',
+          },
+          method: 'POST',
+        }),
+      )
+      const call = fetch.calls[0]!
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(call.url).toBe(`https://${zone}.rpc.test/`)
+      // Zone RPC auth: the caller's signed token passes through; the API's own
+      // credentials do not leak upstream.
+      expect(call.headers['x-authorization-token']).toMatchInlineSnapshot(`"zone-token"`)
+      expect(call.headers['authorization']).toBeNull()
+      expect(call.headers['tempo-api-key']).toMatchInlineSnapshot(`null`)
+    } finally {
+      fetch.restore()
+    }
+  })
+
+  test('refuses a zone rpc call without a zone scope or auth token', async () => {
+    const fetch = mockRpc()
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        zones: [{ chainId: zone, forwardRpcUrl: `https://${zone}.rpc.test` }],
+      })
+
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${zone}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_getBalance' }),
+          method: 'POST',
+        }),
+      )
+      const body = (await response.json()) as { error: { code: string; message: string } }
+
+      expect(response.status).toBe(403)
+      expect(body.error.code).toBe('api_key_forbidden')
+      expect(body.error.message).toContain(`zone:${zone}:read`)
+      // Refused before any upstream round-trip.
+      expect(fetch.calls).toHaveLength(0)
+    } finally {
+      fetch.restore()
+    }
+  })
+
+  test('routes Zone-scoped reads to the internal RPC', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchObject({ result: Hex.fromNumber(zone) })
+  })
+
+  test('allows Zone-scoped eth_fillTransaction calls', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_fillTransaction' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+  })
+
+  test('forwards RPC basic auth to the internal Zone RPC', async () => {
+    const authorization: (string | null)[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        authorization.push(request.headers.get('authorization'))
+        return Response.json({ id: 1, jsonrpc: '2.0', result: Hex.fromNumber(zone) })
+      }),
+    )
+    try {
+      const app = TestApp.create({
+        auth: { keys: [zoneReader] },
+        rpc: ({ chainId }) =>
+          chainId === zone ? { basicAuth: 'rpc-secret', url: server.url } : {},
+        zones: [zoneOptions],
+      })
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${zone}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(authorization).toEqual(['Basic cnBjLXNlY3JldA=='])
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('rejects Zone-scoped writes before the internal RPC', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_sendRawTransaction' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
+  })
+
+  test('rejects a Zone-scoped batch containing a write', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify([
+          { id: 1, jsonrpc: '2.0', method: 'eth_chainId' },
+          { id: 2, jsonrpc: '2.0', method: 'eth_sendRawTransaction' },
+        ]),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
+  })
+
+  test('routes caller Zone tokens to the private RPC', async () => {
+    const app = TestApp.create({ auth: false, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: {
+          'content-type': 'application/json',
+          [ZoneRpcAuthentication.headerName]: zoneToken(),
+        },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchObject({ result: Hex.fromNumber(zone) })
+  })
+
+  test('rejects invalid Zone tokens at the private RPC', async () => {
+    const app = TestApp.create({ auth: false, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: {
+          'content-type': 'application/json',
+          [ZoneRpcAuthentication.headerName]: 'invalid',
+        },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+  })
+
   test('rejects invalid chain ids before proxying upstream', async () => {
     const fetch = mockRpc()
 
@@ -520,6 +738,7 @@ function mockRpc() {
         authorization: request.headers.get('authorization'),
         cookie: request.headers.get('cookie'),
         'tempo-api-key': request.headers.get('tempo-api-key'),
+        'x-authorization-token': request.headers.get('x-authorization-token'),
         'x-client-trace': request.headers.get('x-client-trace'),
       },
       method: request.method,