tapimo 0.5.0 → 0.5.2

package/src/apps/data/routes/transfers.test.ts

@@ -271,7 +271,24 @@ describe('GET /transfers', () => {
     },
   )
 
-  test('embeds a capped total count on demand via include=totalCount', async () => {
+  test('embeds a capped unscoped total count on demand', async () => {
+    const client = TestApp.client()
+    const response = await client.v1.transfers.$get(
+      { query: { include: 'totalCount', limit: '5' } },
+      TestApp.auth,
+    )
+    const body = await TestApp.json(response, Transfers.schema.getTransfers.Response)
+
+    expect(response.status).toBe(200)
+    expect(response.headers.get('server-timing')?.includes('transfers_count;dur=')).toBe(true)
+    expect(body.meta).toBeDefined()
+    expect(Number.isInteger(body.meta?.totalCount)).toBe(true)
+    expect(body.meta!.totalCount).toBeGreaterThanOrEqual(body.data.length)
+    expect(body.meta!.totalCount).toBeLessThanOrEqual(Schema.countCap)
+    expect(body.meta!.totalCountCapped).toBe(body.meta!.totalCount >= Schema.countCap)
+  })
+
+  test('embeds a capped token-scoped total count on demand', async () => {
     const client = TestApp.client()
 
     if (Runtime.get().mode === 'localnet') expect(TestApp.token).toBeDefined()
@@ -350,6 +367,61 @@ describe('GET /transfers', () => {
     },
   )
 
+  test.skipIf(Runtime.get().mode !== 'localnet')(
+    'counts unscoped cross-token transfers',
+    async () => {
+      const crossToken = Runtime.get().fixtures?.crossTokenTransfer
+      expect(crossToken).toBeDefined()
+      if (!crossToken) return
+
+      const client = TestApp.client()
+      const response = await client.v1.transfers.$get(
+        {
+          query: {
+            address: crossToken.sender,
+            include: 'crossToken,totalCount',
+            limit: '50',
+          },
+        },
+        TestApp.auth,
+      )
+      const body = await TestApp.json(response, Transfers.schema.getTransfers.Response)
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get('server-timing')?.includes('transfers_count;dur=')).toBe(true)
+      expect(body.data.some((entry) => entry.transactionHash === crossToken.hash)).toBe(true)
+      expect(body.meta).toBeDefined()
+      expect(body.meta!.totalCount).toBeGreaterThanOrEqual(body.data.length)
+    },
+  )
+
+  test.skipIf(Runtime.get().mode !== 'localnet')(
+    'counts token-scoped cross-token transfers',
+    async () => {
+      const crossToken = Runtime.get().fixtures?.crossTokenTransfer
+      expect(crossToken).toBeDefined()
+      if (!crossToken) return
+
+      const client = TestApp.client()
+      const response = await client.v1.transfers.$get(
+        {
+          query: {
+            include: 'crossToken,totalCount',
+            limit: '50',
+            token: crossToken.destinationToken,
+          },
+        },
+        TestApp.auth,
+      )
+      const body = await TestApp.json(response, Transfers.schema.getTransfers.Response)
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get('server-timing')?.includes('transfers_count;dur=')).toBe(true)
+      expect(body.meta).toBeDefined()
+      expect(body.meta!.totalCount).toBeGreaterThanOrEqual(body.data.length)
+    },
+  )
+
   test('surfaces a 502 when transfer data is unavailable', async () => {
     // Point at an unreachable indexer so the upstream query fails deterministically.
     const client = TestApp.client({ tidx: { baseUrl: 'http://127.0.0.1:1' } })

package/src/apps/data/routes/transfers.ts

@@ -565,15 +565,15 @@ export declare namespace query {
 }
 
 /**
- * Context-free core of {@link query}: builds the signature-decoded `Transfer`
- * CTE query, applies keyset pagination on `(block_num, log_idx)`, and decodes
- * rows. Used by the Hono routes (via {@link query}, which adds Server-Timing +
- * memoization) and by the webhook poller (uncached, ascending, per-row cursors).
+ * Context-free core of {@link query}: reads token-scoped rows from
+ * `token_transfers`, otherwise the decoded `Transfer` CTE, then paginates and
+ * decodes them. Also used by the webhook poller.
  */
 export async function scan(deps: scan.Deps, options: scan.Options): Promise<scan.Page> {
   const { chainId, limit, order } = options
   const { tidx } = deps
   const direction = order === 'asc' ? 'ASC' : 'DESC'
+  const tokenScoped = options.token !== undefined
   // Keyset pagination: anchor the page below the previous row's `(block, log_idx)`
   // position instead of a numeric offset, so rows arriving at the head can't
   // shift items across pages. A malformed cursor falls back to the head page.
@@ -598,19 +598,17 @@ export async function scan(deps: scan.Deps, options: scan.Options): Promise<scan
     )
   const where = filters.length > 0 ? `WHERE ${filters.join(' AND ')}` : ''
 
-  // Fetch one extra row to detect `hasMore` without a separate count query. The
-  // global minimum page size (`Schema.minLimit`) keeps this at or above the
-  // indexer's floor for signature-decoded `Transfer` queries.
+  // Fetch one extra row to detect `hasMore` without a separate count query.
   const result = await tidx.fetch({
     chainId,
+    ...(tokenScoped ? { engine: 'clickhouse' } : { signatures: [signature] }),
     query: `
-      SELECT "from", "to", address, value, tx_hash, block_num, log_idx, block_timestamp
-      FROM Transfer
+      SELECT "from", "to", ${tokenScoped ? 'token AS address, amount AS value' : 'address, value'}, tx_hash, block_num, log_idx, block_timestamp
+      FROM ${tokenScoped ? 'token_transfers' : 'Transfer'}
       ${where}
       ORDER BY block_num ${direction}, log_idx ${direction}
       LIMIT ${limit + 1}${offset !== undefined ? ` OFFSET ${offset}` : ''}
-    `,
-    signatures: [signature],
+    ` as string,
   })
 
   // The next page anchors below the last fetched row's `(block, log_idx)`.
@@ -687,17 +685,14 @@ export declare namespace scan {
 }
 
 /**
- * Builds the shared `WHERE` filter clauses for the `Transfer` feed: contract /
- * subject / sender / recipient / block / timestamp predicates. Shared verbatim
- * by the page query ({@link scan}) and the capped count ({@link countScan}) so a
- * `totalCount` always matches the page it annotates; the keyset cursor clause is
- * page-only and added by {@link scan} on top of these.
+ * Builds shared transfer filters. A token predicate targets `token_transfers`'s
+ * physical `token` column; unscoped queries omit it and use the `Transfer` CTE.
  */
 function filterClauses(options: filterClauses.Options): string[] {
   const { eitherSide, fromBlock, fromTimestamp, recipient, sender, toBlock, toTimestamp, token } =
     options
   const filters: string[] = []
-  if (token !== undefined) filters.push(`address = '${token}'`)
+  if (token !== undefined) filters.push(`token = '${token}'`)
   if (eitherSide !== undefined) filters.push(`("from" = '${eitherSide}' OR "to" = '${eitherSide}')`)
   if (sender !== undefined) filters.push(`"from" = '${sender}'`)
   if (recipient !== undefined) filters.push(`"to" = '${recipient}'`)
@@ -766,12 +761,9 @@ export declare namespace count {
 }
 
 /**
- * Context-free core of {@link count}: runs a capped `count(*)` over the
- * signature-decoded `Transfer` CTE under the shared {@link filterClauses}. The
- * inner `LIMIT Schema.countCap` bounds the scan so the aggregate can't exceed
- * the indexer's execution budget on the 10⁹-plus row table (an unbounded count
- * there blows the 5s `max_execution_time`); a result equal to the cap is a
- * lower bound, surfaced as `totalCountCapped: true`.
+ * Context-free core of {@link count}: counts token-scoped rows from
+ * `token_transfers`, otherwise the decoded `Transfer` CTE. The capped inner
+ * scan bounds work; the SQL aggregate runs on ClickHouse.
  */
 export async function countScan(
   deps: scan.Deps,
@@ -780,6 +772,7 @@ export async function countScan(
   const { chainId } = options
   const { tidx } = deps
   const filters = filterClauses(options)
+  const tokenScoped = options.token !== undefined
   const where = filters.length > 0 ? `WHERE ${filters.join(' AND ')}` : ''
 
   // Folded count: cross-token transfers collapse several `Transfer` legs into
@@ -789,14 +782,14 @@ export async function countScan(
   if (options.crossToken) {
     const result = await tidx.fetch({
       chainId,
+      ...(tokenScoped ? { engine: 'clickhouse' } : { signatures: [signature] }),
       query: `
-        SELECT tx_hash, log_idx, "from", "to", address, value
-        FROM Transfer
+        SELECT tx_hash, log_idx, "from", "to", ${tokenScoped ? 'token AS address, amount AS value' : 'address, value'}
+        FROM ${tokenScoped ? 'token_transfers' : 'Transfer'}
         ${where}
         ORDER BY block_num, log_idx
         LIMIT ${Schema.countCap}
-      `,
-      signatures: [signature],
+      ` as string,
     })
     const rawCount = result.rows.length
     let suppressed = 0
@@ -809,16 +802,17 @@ export async function countScan(
 
   const result = await tidx.fetch({
     chainId,
+    engine: 'clickhouse',
+    ...(tokenScoped ? {} : { signatures: [signature] }),
     query: `
       SELECT count(*) AS total
       FROM (
         SELECT 1
-        FROM Transfer
+        FROM ${tokenScoped ? 'token_transfers' : 'Transfer'}
         ${where}
         LIMIT ${Schema.countCap}
       ) AS capped
-    `,
-    signatures: [signature],
+    ` as string,
   })
 
   const totalCount = Value.toNumber(result.rows[0]?.['total']) ?? 0

package/src/apps/data/routes/webhooks.test.ts

@@ -50,6 +50,49 @@ const validBody = {
   eventType: 'token:transfer',
 } as const
 
+describe('log filter selectivity', () => {
+  const address = '0x0000000000000000000000000000000000000001'
+  const signature = 'event Transfer(address indexed from, address indexed to, uint256 value)'
+  const topic0 = `0x${'11'.repeat(32)}`
+  const topic1 = `0x${'22'.repeat(32)}`
+
+  test('rejects a negated address as the only firehose guard', () => {
+    const parsed = Webhooks.schema.LogFilters.safeParse({
+      address: { not: address },
+    })
+    expect(parsed.success).toBe(false)
+  })
+
+  test('accepts pushdown-capable address filters', () => {
+    expect(Webhooks.schema.LogFilters.safeParse({ address }).success).toBe(true)
+    expect(Webhooks.schema.LogFilters.safeParse({ address: { eq: address } }).success).toBe(true)
+    expect(Webhooks.schema.LogFilters.safeParse({ address: { in: [address] } }).success).toBe(true)
+  })
+
+  test('requires pushdown-capable raw topics', () => {
+    expect(Webhooks.schema.LogFilters.safeParse({ topic0, topic1 }).success).toBe(true)
+    expect(Webhooks.schema.LogFilters.safeParse({ topic0, topic1: { not: topic1 } }).success).toBe(
+      false,
+    )
+  })
+
+  test('requires a pushdown-capable indexed argument', () => {
+    expect(
+      Webhooks.schema.LogFilters.safeParse({ args: { from: address }, signature }).success,
+    ).toBe(true)
+    expect(Webhooks.schema.LogFilters.safeParse({ args: {}, signature }).success).toBe(false)
+    expect(
+      Webhooks.schema.LogFilters.safeParse({ args: { value: '0x1' }, signature }).success,
+    ).toBe(false)
+    expect(
+      Webhooks.schema.LogFilters.safeParse({
+        args: { from: { eq: { and: [{ eq: address }] } } },
+        signature,
+      }).success,
+    ).toBe(false)
+  })
+})
+
 describe('feature gate', () => {
   test('returns 404 when webhooks are disabled', async () => {
     // Routes stay mounted for a stable schema, but the resource is disabled.
@@ -631,6 +674,26 @@ describe('slack destination', () => {
 })
 
 describe('betterstack destination', () => {
+  test('separates redacted read destinations from write destinations', () => {
+    const slack = { type: 'slack', url: 'https://hooks.slack.com/…' } as const
+    const betterstack = {
+      token: '[redacted]',
+      type: 'betterstack',
+      url: 'https://s1234567.eu-nbg-2.betterstackdata.com',
+    } as const
+
+    expect(Webhooks.schema.getWebhook.Response.shape.destination.safeParse(slack).success).toBe(
+      true,
+    )
+    expect(
+      Webhooks.schema.getWebhook.Response.shape.destination.safeParse(betterstack).success,
+    ).toBe(true)
+    expect(Webhooks.schema.updateWebhook.Body.safeParse({ destination: slack }).success).toBe(false)
+    expect(Webhooks.schema.updateWebhook.Body.safeParse({ destination: betterstack }).success).toBe(
+      false,
+    )
+  })
+
   test('creates a subscription with a Better Stack source', async () => {
     const app = TestApp.client({
       auth: { keys: [writer] },
@@ -659,6 +722,109 @@ describe('betterstack destination', () => {
     `)
   })
 
+  test('redacts destination bearer credentials from read responses', async () => {
+    const app = TestApp.client({ auth: { keys: [writer, reader] } })
+    const slack = await app.v1.webhooks.$post(
+      {
+        json: {
+          destination: {
+            type: 'slack',
+            url: 'https://hooks.slack.com/services/T000/B000/secret',
+          },
+          eventType: 'token:transfer',
+        },
+      },
+      as(writer),
+    )
+    const betterstack = await app.v1.webhooks.$post(
+      {
+        json: {
+          destination: {
+            token: 'src_secret',
+            type: 'betterstack',
+            url: 'https://s1234567.eu-nbg-2.betterstackdata.com',
+          },
+          eventType: 'token:transfer',
+        },
+      },
+      as(writer),
+    )
+    const slackCreated = await TestApp.json(slack, Webhooks.schema.createWebhook.Response)
+    const betterstackCreated = await TestApp.json(
+      betterstack,
+      Webhooks.schema.createWebhook.Response,
+    )
+    expect(slackCreated.destination).toStrictEqual({
+      type: 'slack',
+      url: 'https://hooks.slack.com/services/T000/B000/secret',
+    })
+    expect(betterstackCreated.destination).toStrictEqual({
+      token: 'src_secret',
+      type: 'betterstack',
+      url: 'https://s1234567.eu-nbg-2.betterstackdata.com',
+    })
+
+    const slackRead = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$get(
+      { param: { id: slackCreated.id } },
+      as(reader),
+    )
+    const betterstackRead = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$get(
+      { param: { id: betterstackCreated.id } },
+      as(reader),
+    )
+    const slackBody = await TestApp.json(slackRead, Webhooks.schema.getWebhook.Response)
+    const betterstackBody = await TestApp.json(betterstackRead, Webhooks.schema.getWebhook.Response)
+
+    expect(slackBody.destination).toStrictEqual({
+      type: 'slack',
+      url: 'https://hooks.slack.com/…',
+    })
+    expect(betterstackBody.destination).toStrictEqual({
+      token: '[redacted]',
+      type: 'betterstack',
+      url: 'https://s1234567.eu-nbg-2.betterstackdata.com',
+    })
+
+    const listed = await app.v1.webhooks.$get({ query: {} }, as(reader))
+    const listedBody = await TestApp.json(listed, Webhooks.schema.listWebhooks.Response)
+    expect(
+      listedBody.data.find((subscription) => subscription.id === slackCreated.id)?.destination,
+    ).toStrictEqual(slackBody.destination)
+    expect(
+      listedBody.data.find((subscription) => subscription.id === betterstackCreated.id)
+        ?.destination,
+    ).toStrictEqual(betterstackBody.destination)
+
+    const slackUpdated = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$patch(
+      { json: { status: 'paused' }, param: { id: slackCreated.id } },
+      as(writer),
+    )
+    const betterstackUpdated = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$patch(
+      { json: { status: 'paused' }, param: { id: betterstackCreated.id } },
+      as(writer),
+    )
+    expect(
+      (await TestApp.json(slackUpdated, Webhooks.schema.updateWebhook.Response)).destination,
+    ).toStrictEqual(slackBody.destination)
+    expect(
+      (await TestApp.json(betterstackUpdated, Webhooks.schema.updateWebhook.Response)).destination,
+    ).toStrictEqual(betterstackBody.destination)
+
+    const slackRoundTrip = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$patch(
+      { json: { destination: slackBody.destination }, param: { id: slackCreated.id } },
+      as(writer),
+    )
+    const betterstackRoundTrip = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$patch(
+      {
+        json: { destination: betterstackBody.destination },
+        param: { id: betterstackCreated.id },
+      },
+      as(writer),
+    )
+    expect(slackRoundTrip.status).toBe(400)
+    expect(betterstackRoundTrip.status).toBe(400)
+  })
+
   test('rejects a Better Stack destination whose host is not betterstackdata.com', async () => {
     const app = TestApp.client({
       auth: { keys: [writer] },
@@ -1570,6 +1736,38 @@ describe.skipIf(Runtime.get().mode === 'localnet')('poll', () => {
     expect(tx?.sender).toBe(windowSender)
   })
 
+  test('transaction:included matches exact empty calldata through the poller', async () => {
+    const db = TestApp.database()
+    const subscription = await Core.createSubscription(db, {
+      chainId: 42431,
+      eventType: 'transaction:included',
+      filters: { input: { eq: '0x' } },
+      owner: { orgId: 'org_test', type: 'api_key' },
+      destination: { type: 'url', url: 'https://hooks.example.com/x' },
+    })
+    await Core.setCursor(db, subscription.id, windowCursor)
+
+    const dispatched: Webhooks.poll.Dispatchable[] = []
+    const result = await Webhooks.poll({
+      chainId: 42431,
+      dispatch: async (input) => {
+        dispatched.push(input)
+        return { ok: true }
+      },
+      eventTypes: ['transaction:included'],
+      headBlockNumber: windowHead,
+      client,
+      db,
+      tidx: realTidx,
+    })
+
+    expect(result.scanned).toMatchInlineSnapshot(`1`)
+    expect(dispatched[0]?.envelope.data).toMatchObject({
+      hash: '0x359a47d5a7a582ae412e8ba8bb729b326464f2e97d00bcabf28694e919327f33',
+      input: '0x',
+    })
+  })
+
   test('transaction:included routes a status filter through receipts', async () => {
     const db = TestApp.database()
     const subscription = await Core.createSubscription(db, {
@@ -1882,6 +2080,11 @@ describe('matchesOperator', () => {
     expect(Webhooks.matchesOperator(addr, { eq: addr })).toBe(true)
   })
 
+  test('bytes equality handles empty calldata without numeric conversion', () => {
+    expect(Webhooks.matchesOperator('0x', { eq: '0x' })).toBe(true)
+    expect(Webhooks.matchesOperator('0x', { eq: '0x00' })).toBe(false)
+  })
+
   test('{ in } matches membership', () => {
     expect(Webhooks.matchesOperator(addr, { in: [addr2, addr] })).toBe(true)
     expect(Webhooks.matchesOperator(addr, { in: [addr2] })).toBe(false)