tapimo 0.5.0 → 0.5.2

package/src/internal/RateLimit.test.ts

@@ -130,6 +130,18 @@ describe('edge', () => {
     expect(ip.limit).toHaveBeenCalledWith({ key: '2001:db8:abcd:12' })
   })
 
+  test('normalizes equivalent IPv6 addresses to the same /64 prefix', () => {
+    expect([
+      RateLimit.normalizeIp('2001:0db8:abcd:0012::1'),
+      RateLimit.normalizeIp('2001:db8:abcd:12:ffff::2'),
+    ]).toMatchInlineSnapshot(`
+      [
+        "2001:db8:abcd:12",
+        "2001:db8:abcd:12",
+      ]
+    `)
+  })
+
   test('returns 429 when any layer denies', async () => {
     const response = await RateLimit.edge(request({ asn: 64512, ip: '203.0.113.7' }), {
       asn: binding(false),

package/src/internal/RateLimit.ts

@@ -139,12 +139,12 @@ type CfProperties = { asn?: number | undefined }
 function clientKey(request: Request): string {
   const ip = request.headers.get('cf-connecting-ip')
   if (!ip) return 'unknown'
-  if (ip.includes('.')) return ip
-  return ipv6Prefix(ip)
+  return normalizeIp(ip)
 }
 
-/** First four hextets of an IPv6 address, with `::` expanded. */
-function ipv6Prefix(ip: string): string {
+/** Normalizes an IPv4 address or IPv6 /64 prefix for per-client quotas. */
+export function normalizeIp(ip: string): string {
+  if (ip.includes('.')) return ip
   const [address = ''] = ip.split('%')
   const [head = '', tail = ''] = address.split('::')
   const left = head ? head.split(':') : []

package/src/internal/Tidx.test.ts

@@ -203,6 +203,21 @@ describe('resolve', () => {
     `)
   })
 
+  test('resolves Bearer auth', () => {
+    expect(
+      Tidx.resolve(
+        { baseUrl: 'https://internal.indexer', bearerAuth: 'zone-secret' },
+        { chainId: 4217, principal: apiKeyPrincipal },
+      ),
+    ).toMatchInlineSnapshot(`
+      {
+        "baseUrl": "https://internal.indexer",
+        "basicAuth": undefined,
+        "bearerAuth": "zone-secret",
+      }
+    `)
+  })
+
   test('the resolver form routes anonymous callers to a separate upstream', () => {
     const tidx = ({ principal }: Viem.resolve.Context) =>
       principal?.type === 'public'
@@ -243,6 +258,28 @@ describe('resolve', () => {
   })
 })
 
+describe('getClient', () => {
+  test('sends Bearer auth', async () => {
+    const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ columns: [], ok: true, row_count: 0, rows: [] }), {
+        headers: { 'content-type': 'application/json' },
+      }),
+    )
+    try {
+      const client = Tidx.getClient({
+        chainId: 4217,
+        tidx: { baseUrl: 'https://internal.indexer', bearerAuth: 'zone-secret' },
+      })
+      await client.fetch({ query: 'select 1' })
+
+      const upstream = fetch.mock.calls[0]![0] as Request
+      expect(upstream.headers.get('authorization')).toBe('Bearer zone-secret')
+    } finally {
+      fetch.mockRestore()
+    }
+  })
+})
+
 describe('createGetClient', () => {
   test('memoizes one client per resolved upstream', () => {
     const getTidx = Tidx.createGetClient({
@@ -267,6 +304,17 @@ describe('createGetClient', () => {
     expect(getTidx(4217, null)).toBe(getTidx(4217, publicPrincipal))
   })
 
+  test('does not share clients across Bearer credentials', () => {
+    const getTidx = Tidx.createGetClient({
+      tidx: ({ principal }) => ({
+        baseUrl: 'https://internal.indexer',
+        bearerAuth: principal?.type === 'public' ? 'public-secret' : 'private-secret',
+      }),
+    })
+
+    expect(getTidx(4217, publicPrincipal)).not.toBe(getTidx(4217, apiKeyPrincipal))
+  })
+
   test('consults the resolver on every call but builds one client per upstream', () => {
     const seen: (string | undefined)[] = []
     const getTidx = Tidx.createGetClient({

package/src/internal/Tidx.ts

@@ -29,8 +29,8 @@ export type UrlResolver = (chainId: Viem.ChainId) => string | undefined
  * receives a {@link Viem.resolve.Context} (`chainId` plus the request
  * `principal`), so callers can route traffic per caller — e.g. send anonymous
  * (`principal.type === 'public'`) traffic to a separate, no-auth indexer. A
- * missing `baseUrl` falls back to the built-in public host map ({@link url}); a
- * missing `basicAuth` means no Basic auth is sent.
+ * missing `baseUrl` falls back to the built-in public host map ({@link url});
+ * missing auth fields send no Authorization header.
  */
 export function resolve(
   tidx: getClient.Tidx | undefined,
@@ -42,6 +42,7 @@ export function resolve(
       (typeof config?.baseUrl === 'function' ? config.baseUrl(context.chainId) : config?.baseUrl) ??
       url[context.chainId],
     basicAuth: config?.basicAuth,
+    ...(config?.bearerAuth ? { bearerAuth: config.bearerAuth } : {}),
   }
 }
 
@@ -56,13 +57,22 @@ export declare namespace resolve {
     baseUrl: string | undefined
     /** Basic auth credentials, or undefined to send no Basic auth. */
     basicAuth?: string | undefined
+    /** Bearer auth credential, or undefined to send no Bearer auth. */
+    bearerAuth?: string | undefined
   }
 }
 
 export function getClient(options: getClient.Options): Client {
   const { chainId = Viem.defaultChainId, principal = null, tidx } = options
-  const { baseUrl, basicAuth } = resolve(tidx, { chainId, principal })
-  return withTransientRetry(Tidx.create({ baseUrl, basicAuth, chainId }))
+  const { baseUrl, basicAuth, bearerAuth } = resolve(tidx, { chainId, principal })
+  return withTransientRetry(
+    Tidx.create({
+      baseUrl,
+      basicAuth,
+      bearerAuth,
+      chainId,
+    }),
+  )
 }
 
 /**
@@ -72,7 +82,7 @@ export function getClient(options: getClient.Options): Client {
  * output (`baseUrl` + `basicAuth` + `chainId`), not the principal, so a resolver
  * `tidx` may branch on any principal field while client cardinality stays
  * bounded by the number of distinct upstreams — callers that resolve to the same
- * upstream share a client. Shared by `App.create` (per-request reads) and
+ * upstream share a client. Shared by `data()` (per-request reads) and
  * `Webhooks.createPoller` (the scheduled poller) so the resolver logic lives in
  * one place.
  */
@@ -83,8 +93,8 @@ export function createGetClient(options: createGetClient.Options = {}): GetClien
   return (chainId = defaultChainId, principal = null) => {
     // Resolve to derive the cache key; `getClient` re-resolves to build the
     // client on a miss. `resolve` is pure and cheap, so the extra call is free.
-    const { baseUrl, basicAuth } = resolve(tidx, { chainId, principal })
-    const cacheKey = `${baseUrl}|${basicAuth ?? ''}|${chainId}`
+    const { baseUrl, basicAuth, bearerAuth } = resolve(tidx, { chainId, principal })
+    const cacheKey = `${baseUrl}|${basicAuth ?? ''}|${bearerAuth ?? ''}|${chainId}`
     const existing = clients.get(cacheKey)
     if (existing) return existing
 
@@ -218,12 +228,16 @@ export declare namespace getClient {
         baseUrl?: UrlResolver | string | undefined
         /** Basic auth credentials for TIDX requests. */
         basicAuth?: string | undefined
+        /** Bearer auth credential for TIDX requests. */
+        bearerAuth?: string | undefined
       }
     | ((context: Viem.resolve.Context) => {
         /** TIDX base URL to use; falls back to the built-in public host when omitted. */
         baseUrl?: string | undefined
         /** Basic auth credentials for TIDX requests, or undefined for none. */
         basicAuth?: string | undefined
+        /** Bearer auth credential for TIDX requests, or undefined for none. */
+        bearerAuth?: string | undefined
       })
 }
 

package/src/internal/Viem.test.ts

@@ -113,3 +113,49 @@ describe('resolve', () => {
     `)
   })
 })
+
+describe('createGetClient', () => {
+  test('memoizes one client per resolved upstream', () => {
+    const getClient = Viem.createGetClient({
+      rpc: ({ principal }) =>
+        principal?.type === 'public'
+          ? { url: 'https://rpc.tempo.xyz' }
+          : { basicAuth: 'user:pass', url: 'https://internal.rpc' },
+    })
+
+    expect(getClient(4217, apiKeyPrincipal)).toBe(getClient(4217, apiKeyPrincipal))
+    expect(getClient(4217, publicPrincipal)).toBe(getClient(4217, publicPrincipal))
+    expect(getClient(4217, publicPrincipal)).not.toBe(getClient(4217, apiKeyPrincipal))
+    expect(getClient(4217, apiKeyPrincipal)).not.toBe(getClient(42431, apiKeyPrincipal))
+  })
+
+  test('shares a client across principals when they resolve identically', () => {
+    const getClient = Viem.createGetClient()
+
+    expect(getClient(4217, publicPrincipal)).toBe(getClient(4217, apiKeyPrincipal))
+    expect(getClient(4217, null)).toBe(getClient(4217, publicPrincipal))
+  })
+
+  test('consults the resolver on cache hits', () => {
+    const seen: (string | undefined)[] = []
+    const getClient = Viem.createGetClient({
+      rpc: ({ principal }) => {
+        seen.push(principal?.type)
+        return { url: 'https://internal.rpc' }
+      },
+    })
+
+    const first = getClient(4217, apiKeyPrincipal)
+    const second = getClient(4217, apiKeyPrincipal)
+    getClient(4217, publicPrincipal)
+
+    expect(seen).toMatchInlineSnapshot(`
+      [
+        "api_key",
+        "api_key",
+        "public",
+      ]
+    `)
+    expect(first).toBe(second)
+  })
+})

package/src/internal/Viem.ts

@@ -58,7 +58,7 @@ export type UrlResolver = (chainId: ChainId) => string | undefined
  * webhook poller). A missing `url` falls back to the built-in public host map
  * ({@link url}); a missing `basicAuth` means no Basic auth is sent.
  *
- * Memoization is keyed on the resolved output (see `App.create` and
+ * Memoization is keyed on the resolved output (see {@link createGetClient} and
  * {@link Tidx.createGetClient}), not the context, so a resolver may branch on
  * any principal field without unbounded client cardinality: callers that
  * resolve to the same upstream share a client. Pass the result to
@@ -130,6 +130,39 @@ export function getClient(options: getClient.Options): getClient.ReturnType {
     .extend(tempoActions())
 }
 
+/** Builds a memoized Tempo client resolver. */
+export function createGetClient(options: createGetClient.Options = {}): createGetClient.ReturnType {
+  const { defaultChainId: defaultChainId_option = defaultChainId, rpc } = options
+  const clients = new Map<string, getClient.ReturnType>()
+
+  return (chainId = defaultChainId_option, principal = null) => {
+    const { basicAuth, url } = resolve(rpc, { chainId, principal })
+    const cacheKey = JSON.stringify([url, basicAuth, chainId])
+    const existing = clients.get(cacheKey)
+    if (existing) return existing
+
+    const client = getClient({
+      chainId,
+      rpc: { basicAuth, url: () => url },
+    })
+    clients.set(cacheKey, client)
+    return client
+  }
+}
+
+export declare namespace createGetClient {
+  /** Options for building a memoized Tempo client resolver. */
+  type Options = {
+    /** Tempo chain id used when a caller omits one. */
+    defaultChainId?: ChainId | undefined
+    /** Tempo RPC options applied to every constructed client. */
+    rpc?: getClient.Rpc | undefined
+  }
+
+  /** Memoized Tempo client resolver. */
+  type ReturnType = (chainId?: ChainId, principal?: Auth.Principal | null) => getClient.ReturnType
+}
+
 export declare namespace getClient {
   /** Tempo viem client with public and Tempo action helpers. */
   type ReturnType = core_Client<