tapimo 0.4.4 → 0.5.1

package/src/apps/data/routes/rpc.ts

@@ -1,4 +1,5 @@
 import { Hono, type Context, type TypedResponse } from 'hono'
+import { ZoneRpcAuthentication } from 'ox/tempo'
 import * as z from 'zod/mini'
 
 import type * as App from '../../../App.js'
@@ -19,10 +20,52 @@ const strippedHeaders = new Set([
   'keep-alive',
   'proxy-authorization',
   'te',
+  'tempo-api-key',
   'trailer',
   'transfer-encoding',
   'upgrade',
-  'tempo-api-key',
+  ZoneRpcAuthentication.headerName.toLowerCase(),
+])
+
+// API-issued Zone read scopes never reach stateful or privileged RPC modules.
+const zoneReadMethods = new Set([
+  'eth_blobBaseFee',
+  'eth_blockNumber',
+  'eth_call',
+  'eth_chainId',
+  'eth_createAccessList',
+  'eth_estimateGas',
+  'eth_feeHistory',
+  'eth_fillTransaction',
+  'eth_gasPrice',
+  'eth_getBalance',
+  'eth_getBlockByHash',
+  'eth_getBlockByNumber',
+  'eth_getBlockReceipts',
+  'eth_getBlockTransactionCountByHash',
+  'eth_getBlockTransactionCountByNumber',
+  'eth_getCode',
+  'eth_getLogs',
+  'eth_getProof',
+  'eth_getRawTransactionByHash',
+  'eth_getStorageAt',
+  'eth_getTransactionByBlockHashAndIndex',
+  'eth_getTransactionByBlockNumberAndIndex',
+  'eth_getTransactionByHash',
+  'eth_getTransactionCount',
+  'eth_getTransactionReceipt',
+  'eth_getUncleByBlockHashAndIndex',
+  'eth_getUncleByBlockNumberAndIndex',
+  'eth_getUncleCountByBlockHash',
+  'eth_getUncleCountByBlockNumber',
+  'eth_maxPriorityFeePerGas',
+  'eth_simulateV1',
+  'eth_syncing',
+  'net_listening',
+  'net_peerCount',
+  'net_version',
+  'web3_clientVersion',
+  'web3_sha3',
 ])
 
 /** Never reached; carries typed passthrough response variants into Hono client inference. */
@@ -105,7 +148,7 @@ export function rpc() {
     Auth.policy({ apiKey: { scopes: ['data:read'] }, public: true }),
     OpenApi.describeRoute({
       description:
-        'Sends a single or batch Ethereum JSON-RPC request directly to Tempo. Use `/rpc/testnet`, `/rpc/mainnet`, or `/rpc/:chain` to choose a chain. This passthrough is not part of the stable API contract and is supported on a best-effort basis only. It has no compatibility, latency, availability, or data-freshness guarantees, and breaking changes may happen with limited notice.',
+        'Sends a single or batch Ethereum JSON-RPC request directly to Tempo. Use `/rpc/testnet`, `/rpc/mainnet`, or `/rpc/:chain` to choose a chain. Zone-scoped API keys may call read-only methods. A Zone token in `X-Authorization-Token` is forwarded to the authenticated Zone RPC. This passthrough is not part of the stable API contract and is supported on a best-effort basis only. It has no compatibility, latency, availability, or data-freshness guarantees, and breaking changes may happen with limited notice.',
       operationId: 'rpcRequest',
       parameters: [
         {
@@ -146,19 +189,6 @@ export function rpc() {
     async (c) => {
       if (Auth.narrowAccess) return Auth.accessError(c)
 
-      if (requiresApiKey(c)) {
-        const body = await c.req.raw
-          .clone()
-          .json()
-          .catch(() => undefined)
-        if (!isPublicRequest(body))
-          return Response.error(c, {
-            code: 'api_key_missing',
-            message: 'Missing API key',
-            status: 401,
-          })
-      }
-
       const chainId = resolveChainId(c)
       if (!chainId)
         return Response.error(c, {
@@ -167,6 +197,31 @@ export function rpc() {
           status: 400,
         })
 
+      const zone = c.get('zones').get(chainId)
+      const zoneToken = getZoneToken(c)
+      const apiKeyRequired = requiresApiKey(c)
+      const inspectBody = apiKeyRequired || Boolean(zone && !zoneToken)
+      const body = inspectBody
+        ? await c.req.raw
+            .clone()
+            .json()
+            .catch(() => undefined)
+        : undefined
+
+      if (apiKeyRequired && !isPublicRequest(body))
+        return Response.error(c, {
+          code: 'api_key_missing',
+          message: 'Missing API key',
+          status: 401,
+        })
+      if (zone && !zoneToken && !isZoneReadRequest(body))
+        return Response.error(c, {
+          code: 'api_key_forbidden',
+          message:
+            'Zone API keys may only call read-only RPC methods. Pass a Zone token via `X-Authorization-Token` for other methods.',
+          status: 403,
+        })
+
       if (narrowPassthrough)
         return c.json(Response.validated(schema.ResponseBody, { jsonrpc: '2.0' }), 200)
       return passthrough(c, chainId)
@@ -180,6 +235,11 @@ function requiresApiKey(c: Context<App.Environment>) {
   return principal?.type !== 'api_key' && principal?.type !== 'super_admin'
 }
 
+function getZoneToken(c: Context<App.Environment>) {
+  const value = c.req.header(ZoneRpcAuthentication.headerName)
+  return value?.trim() ? value : undefined
+}
+
 function isPublicRequest(body: unknown): boolean {
   const requests = Array.isArray(body) ? body : [body]
   return requests.length > 0 && requests.every((request) => isPublicMethod(request))
@@ -191,13 +251,27 @@ function isPublicMethod(request: unknown): boolean {
   return typeof method === 'string' && method.startsWith('eth_')
 }
 
+function isZoneReadRequest(body: unknown): boolean {
+  const requests = Array.isArray(body) ? body : [body]
+  return requests.length > 0 && requests.every((request) => isZoneReadMethod(request))
+}
+
+function isZoneReadMethod(request: unknown): boolean {
+  if (!request || typeof request !== 'object') return false
+  const method = (request as Record<string, unknown>)['method']
+  return typeof method === 'string' && zoneReadMethods.has(method)
+}
+
 async function passthrough(
   c: Context<App.Environment>,
   chainId: z.output<typeof Schema.ChainId>,
 ): Promise<globalThis.Response & TypedResponse<never, never, never>> {
-  const rpc = c.get('rpc')
+  const zone = c.get('zones').get(chainId)
+  const zoneToken = getZoneToken(c)
+  const rpc = zone && zoneToken ? { url: () => zone.forwardRpcUrl } : c.get('rpc')
   const principal = Auth.getPrincipal(c)
-  const upstream_rpc = principal?.type === 'public' && typeof rpc !== 'function' ? undefined : rpc
+  const upstream_rpc =
+    !zone && principal?.type === 'public' && typeof rpc !== 'function' ? undefined : rpc
   // Anonymous callers use the built-in public RPC unless a resolver chooses a
   // different public upstream.
   const { basicAuth, url } = Viem.resolve(upstream_rpc, { chainId, principal })
@@ -215,6 +289,7 @@ async function passthrough(
   for (const [name, value] of c.req.raw.headers)
     if (!strippedHeaders.has(name.toLowerCase())) headers.set(name, value)
   if (basicAuth) headers.set('authorization', `Basic ${btoa(basicAuth)}`)
+  if (zone && zoneToken) headers.set(ZoneRpcAuthentication.headerName, zoneToken)
 
   // `duplex` is required when streaming a request body, but is not yet in
   // the DOM `RequestInit` type.

package/src/apps/data/routes/webhooks.test.ts

@@ -112,6 +112,27 @@ describe('access matrix', () => {
     expect(body.error?.code).toMatchInlineSnapshot(`"api_key_forbidden"`)
   })
 
+  test('rejects Zone webhook subscriptions', async () => {
+    const zone = 421_700_001
+    const app = TestApp.client({
+      auth: { keys: [writer] },
+      zones: [
+        {
+          chainId: zone,
+          forwardRpcUrl: 'https://zone.rpc.test',
+        },
+      ],
+    })
+    const response = await app.v1.webhooks.$post(
+      { json: { ...validBody, chainId: zone } },
+      as(writer),
+    )
+    const body = (await response.json()) as { error?: { code?: string } }
+
+    expect(response.status).toBe(400)
+    expect(body.error?.code).toBe('chain_id_unsupported')
+  })
+
   test('lists event types without authentication (public catalog)', async () => {
     // `GET /webhooks/event-types` is intentionally public: anonymous callers are
     // served within the public quota, no key or scope required.

package/src/apps/data/routes/webhooks.ts

@@ -1294,7 +1294,13 @@ export function webhooks(options: webhooks.Options = {}) {
           hide: hidden,
           operationId: 'createWebhook',
           responses: OpenApi.responses({
-            errors: { 403: 'You have reached the webhook subscription limit.' },
+            errors: {
+              400: {
+                codes: ['chain_id_unsupported'],
+                description: 'Webhook subscriptions do not support Zone chains.',
+              },
+              403: 'You have reached the webhook subscription limit.',
+            },
             success: {
               description:
                 'The created webhook subscription, including the one-time signing secret.',
@@ -1320,6 +1326,12 @@ export function webhooks(options: webhooks.Options = {}) {
 
           const body = c.req.valid('json')
           const chainId = body.chainId ?? c.get('chainId')
+          if (c.get('zones').has(chainId))
+            return Response.error(c, {
+              code: 'chain_id_unsupported',
+              message: 'Webhook subscriptions do not support Zone chains.',
+              status: 400,
+            })
 
           try {
             const subscription = await Webhooks.createSubscription(

package/src/apps/index.ts

@@ -1,4 +1,4 @@
-export { data, FundingRouteProviders } from './data/index.js'
+export { data, FundingQuoteProviders } from './data/index.js'
 export { management } from './management/index.js'
 export { mcp } from './mcp.js'
 export { relay } from './relay/index.js'

package/src/apps/management/App.ts

@@ -7,6 +7,7 @@ import * as Metadata from '../metadata.js'
 import { apiKeys } from './routes/api-keys.js'
 import { billing } from './routes/billing.js'
 import { invitations } from './routes/invitations.js'
+import { inviteLinks } from './routes/invite-links.js'
 import { me } from './routes/me.js'
 import { members } from './routes/members.js'
 import { orgs } from './routes/orgs.js'
@@ -105,6 +106,7 @@ export function management(options: management.Options = {}) {
     .route('/', apiKeys({ enabled: options.apiKeys !== false }))
     .route('/', billing())
     .route('/', invitations())
+    .route('/', inviteLinks())
     .route('/', me())
     .route('/', members())
     .route('/', orgs())
@@ -144,6 +146,7 @@ const openapi = {
     { name: 'API Keys', description: 'Credentials for accessing the Tempo API.' },
     { name: 'Billing', description: 'Organization billing backed by Stripe.' },
     { name: 'Invitations', description: 'Pending organization invitations.' },
+    { name: 'Invite Links', description: 'Reusable organization invite links.' },
     { name: 'Members', description: 'Organization team membership.' },
     { name: 'Organizations', description: 'Teams that own application workspaces and members.' },
     { name: 'Projects', description: 'Application workspaces within an organization.' },
@@ -158,6 +161,7 @@ const openapi = {
         'Authentication',
         'Billing',
         'Invitations',
+        'Invite Links',
         'Members',
         'Organizations',
         'Projects',

package/src/apps/management/Billing.test.ts

@@ -1,7 +1,7 @@
 import { nanoid } from 'nanoid'
 import type Stripe from 'stripe'
 
-import { postgresUrl } from '../../../test/containers.js'
+import * as Runtime from '../../../test/runtime.js'
 import * as ApiKeys from '../../ApiKeys.js'
 import * as Db from '../../db/Db.js'
 import * as RequestUsage from '../../db/tables/requestUsage.js'
@@ -11,7 +11,7 @@ import * as Store from '../../internal/Store.js'
 import * as Viem from '../../internal/Viem.js'
 import * as Billing from './Billing.js'
 
-const create = () => Db.postgres({ connectionString: postgresUrl, schema: `t_${nanoid()}` })
+const create = () => Db.postgres({ connectionString: Runtime.postgresUrl, schema: `t_${nanoid()}` })
 
 /** Baseline billable mainnet sponsorship input; tests override per case. */
 const input = {

package/src/apps/management/routes/api-keys.test.ts

@@ -111,7 +111,20 @@ describe('keys', () => {
     expect(write.status).toBe(200)
   })
 
-  test('lets management keys manage org credentials without delegating issuance', async () => {
+  test('zone scopes are never self-serve', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+
+    // Even the org owner cannot self-mint zone access: membership is
+    // controlled zone-side, so zone scopes are super-admin-issued.
+    const denied = await app.request(base, json('POST', owner, { scopes: ['zone:421700001:read'] }))
+    expect(denied.status).toBe(403)
+    expect(await denied.json()).toMatchObject({ error: { code: 'scope_not_issuable' } })
+  })
+
+  test('restricts project management keys without delegating issuance', async () => {
     const app = createApp()
     const cookie = await session(app)
     const { org, project } = await fixture(app, cookie)
@@ -135,10 +148,28 @@ describe('keys', () => {
       Keys.schema.createApiKey.Response,
     )
 
+    const own = await app.request(base, {
+      headers: { 'tempo-api-key': manager.token },
+    })
+    expect(own.status).toMatchInlineSnapshot(`200`)
+
     const listed = await app.request(siblingBase, {
       headers: { 'tempo-api-key': manager.token },
     })
-    expect(listed.status).toBe(200)
+    const { requestId: listedRequestId, ...listedBody } = (await listed.json()) as {
+      requestId?: string
+    }
+
+    expect(listed.status).toMatchInlineSnapshot(`404`)
+    expect(listedRequestId).toBeDefined()
+    expect(listedBody).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
 
     const delegated = await app.request(base, {
       body: JSON.stringify({ scopes: ['management:read'] }),
@@ -151,7 +182,20 @@ describe('keys', () => {
       headers: { 'tempo-api-key': manager.token },
       method: 'DELETE',
     })
-    expect(revoked.status).toBe(200)
+    const { requestId: revokedRequestId, ...revokedBody } = (await revoked.json()) as {
+      requestId?: string
+    }
+
+    expect(revoked.status).toMatchInlineSnapshot(`404`)
+    expect(revokedRequestId).toBeDefined()
+    expect(revokedBody).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "project_not_found",
+          "message": "Project not found",
+        },
+      }
+    `)
   })
 
   test('mints, lists, authenticates, and revokes a project key', async () => {

package/src/apps/management/routes/api-keys.ts

@@ -60,7 +60,7 @@ export namespace schema {
         .array(z.string().check(z.minLength(1)))
         .check(
           z.describe(
-            "Granted scopes. '*' (grant-all) appears only on keys minted by the super admin.",
+            "Granted scopes. '*' and non-self-serve scopes appear only on keys minted by the super admin.",
           ),
           z.meta({ examples: [['data:read']] }),
         ),
@@ -218,7 +218,7 @@ export namespace schema {
 }
 
 /**
- * Mounts project-attributed API key mint, list, and revoke routes plus the org-wide list. Access follows the caller's organization ownership.
+ * Mounts project-attributed API key mint, list, and revoke routes plus the org-wide list. Project routes enforce caller organization and project attribution.
  */
 export function apiKeys(options: apiKeys.Options = {}) {
   const hidden = !options.enabled