tapimo 0.5.2 → 0.6.0

package/src/apps/management/routes/verified-token-requests.test.ts

@@ -0,0 +1,377 @@
+import { testClient } from 'hono/testing'
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+import type * as z from 'zod/mini'
+
+import * as TestApp from '../../../../test/App.js'
+import type * as Db from '../../../db/Db.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as VerifiedTokenRequests from '../../../db/tables/verifiedTokenRequests.js'
+import * as VerifiedTokens from '../../../internal/VerifiedTokens.js'
+import type { schema } from './verified-token-requests.js'
+
+/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
+const origin = 'http://localhost'
+
+/** RPC request options carrying a session cookie. */
+function as(cookie: string) {
+  return { headers: { cookie } } as const
+}
+
+function createApp(db: Db.Source = TestApp.database()) {
+  const app = TestApp.create({ db, session: { wallet: { origin } } })
+  return { app, client: testClient(app) }
+}
+
+/** Signs in a fresh scripted account and resolves its user id. */
+async function session({ app, client }: ReturnType<typeof createApp>) {
+  const { cookie } = await TestApp.signIn(app, privateKeyToAccount(generatePrivateKey()))
+  if (!cookie) throw new Error('Sign-in did not establish a session')
+  const me = await client.v1.me.$get(undefined, as(cookie))
+  expect(me.status).toBe(200)
+  if (me.status !== 200) throw new Error(`Failed to resolve session user: ${me.status}`)
+  const { id: userId } = await me.json()
+  return { cookie, userId }
+}
+
+/** Creates an owner and organization through their public write boundaries. */
+async function setup(context: ReturnType<typeof createApp>) {
+  const owner = await session(context)
+  const response = await context.client.v1.orgs.$post({ json: { name: 'Acme' } }, as(owner.cookie))
+  expect(response.status).toBe(200)
+  if (response.status !== 200) throw new Error(`Failed to create organization: ${response.status}`)
+  const org = await response.json()
+  return { org, owner }
+}
+
+const token = {
+  address: '0x20c00000000000000000000000000000000000aa',
+  chainId: 42431,
+  currency: 'USD',
+  decimals: 6,
+  name: 'Test USD',
+  symbol: 'tUSD',
+} satisfies Partial<z.input<typeof schema.CreateBody>>
+
+describe('POST /v1/orgs/:orgId/verified-token-requests', () => {
+  test('members submit requests', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org } = await setup(context)
+    const member = await session(context)
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: member.userId })
+
+    // Checksummed input normalizes to the stored lowercase address.
+    const created = await requests.$post(
+      {
+        json: { ...token, address: '0x20C00000000000000000000000000000000000AA', note: 'We are the issuer.' }, // prettier-ignore
+        param: { orgId: org.id },
+      },
+      as(member.cookie),
+    )
+    expect(created.status).toBe(200)
+    if (created.status !== 200) throw new Error(`Failed to create request: ${created.status}`)
+    const request = await created.json()
+    expect(request.id).toMatch(/^vtr_/)
+    expect(request).toMatchObject({
+      address: token.address,
+      note: 'We are the issuer.',
+      orgId: org.id,
+      requestedBy: member.userId,
+      reviewNote: null,
+      reviewedAt: null,
+      status: 'pending',
+    })
+  })
+
+  test('rejects tokens already on the verified list', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+    await VerifiedTokens.create(db, { ...token, name: 'Listed USD' })
+
+    const byAddress = await requests.$post(
+      { json: token, param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(byAddress.status).toBe(409)
+    const addressBody = (await byAddress.json()) as { error?: { code?: string } }
+    expect(addressBody.error?.code).toBe('verified_token_exists')
+
+    // Same symbol (case-insensitive), different address.
+    const bySymbol = await requests.$post(
+      {
+        json: { ...token, address: '0x20c00000000000000000000000000000000000bb', symbol: 'TUSD' },
+        param: { orgId: org.id },
+      },
+      as(owner.cookie),
+    )
+    expect(bySymbol.status).toBe(409)
+    const symbolBody = (await bySymbol.json()) as { error?: { code?: string } }
+    expect(symbolBody.error?.code).toBe('verified_symbol_exists')
+  })
+
+  test('rejects a token with a pending request from any org', async () => {
+    const context = createApp()
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const first = await setup(context)
+    const second = await setup(context)
+
+    const created = await requests.$post(
+      { json: token, param: { orgId: first.org.id } },
+      as(first.owner.cookie),
+    )
+    expect(created.status).toBe(200)
+
+    const duplicate = await requests.$post(
+      { json: token, param: { orgId: second.org.id } },
+      as(second.owner.cookie),
+    )
+    expect(duplicate.status).toBe(409)
+    const body = (await duplicate.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('request_pending_exists')
+  })
+
+  test('caps pending requests per organization', async () => {
+    const context = createApp()
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+
+    for (let index = 0; index < 10; index++) {
+      const created = await requests.$post(
+        {
+          json: {
+            ...token,
+            address: `0x20c${(index + 1).toString(16).padStart(37, '0')}` as `0x${string}`,
+            symbol: `tUSD${index}`,
+          },
+          param: { orgId: org.id },
+        },
+        as(owner.cookie),
+      )
+      expect(created.status).toBe(200)
+    }
+
+    const overflow = await requests.$post(
+      {
+        json: { ...token, address: `0x20c${'f'.padStart(37, '0')}` as `0x${string}`, symbol: 'tOVER' }, // prettier-ignore
+        param: { orgId: org.id },
+      },
+      as(owner.cookie),
+    )
+    expect(overflow.status).toBe(409)
+    const body = (await overflow.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('request_limit_reached')
+  })
+
+  test('accepts an SVG logo and echoes it back', async () => {
+    const context = createApp()
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+
+    const created = await requests.$post(
+      {
+        json: { ...token, logo: '<svg xmlns="http://www.w3.org/2000/svg"/>' },
+        param: { orgId: org.id },
+      },
+      as(owner.cookie),
+    )
+    expect(created.status).toBe(200)
+    if (created.status !== 200) throw new Error(`Failed to create request: ${created.status}`)
+    // The org sees its own uploaded logo (the console list previews it).
+    expect((await created.json()).logo).toBe('<svg xmlns="http://www.w3.org/2000/svg"/>')
+
+    const invalid = await requests.$post(
+      {
+        json: { ...token, address: '0x20c00000000000000000000000000000000000bb', logo: 'not svg', symbol: 'tEUR' }, // prettier-ignore
+        param: { orgId: org.id },
+      },
+      as(owner.cookie),
+    )
+    expect(invalid.status).toBe(400)
+
+    const oversized = await requests.$post(
+      {
+        json: {
+          ...token,
+          address: '0x20c00000000000000000000000000000000000cc',
+          logo: `<svg xmlns="http://www.w3.org/2000/svg">${'a'.repeat(256 * 1024)}</svg>`,
+          symbol: 'tGBP',
+        },
+        param: { orgId: org.id },
+      },
+      as(owner.cookie),
+    )
+    expect(oversized.status).toBe(400)
+  })
+
+  test('caps free-text field lengths', async () => {
+    const context = createApp()
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+
+    const oversized = [
+      { name: 'x'.repeat(101) },
+      { note: 'x'.repeat(501) },
+      { symbol: 'x'.repeat(21) },
+    ]
+    for (const fields of oversized) {
+      const response = await requests.$post(
+        { json: { ...token, ...fields }, param: { orgId: org.id } },
+        as(owner.cookie),
+      )
+      expect(response.status).toBe(400)
+      const body = (await response.json()) as { error?: { code?: string } }
+      expect(body.error?.code).toBe('body_invalid')
+    }
+  })
+})
+
+describe('GET /v1/orgs/:orgId/verified-token-requests', () => {
+  test('lists only the organization requests', async () => {
+    const context = createApp()
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+    const foreign = await setup(context)
+
+    const created = await requests.$post(
+      { json: token, param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(created.status).toBe(200)
+    if (created.status !== 200) throw new Error(`Failed to create request: ${created.status}`)
+    const request = await created.json()
+
+    const listed = await requests.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(listed.status).toBe(200)
+    if (listed.status !== 200) throw new Error(`Failed to list requests: ${listed.status}`)
+    expect((await listed.json()).data.map(({ id }) => id)).toEqual([request.id])
+
+    // A non-member resolves neither the org nor its requests.
+    const denied = await requests.$get({ param: { orgId: org.id } }, as(foreign.owner.cookie))
+    expect(denied.status).toBe(404)
+
+    const empty = await requests.$get({ param: { orgId: foreign.org.id } }, as(foreign.owner.cookie)) // prettier-ignore
+    expect(empty.status).toBe(200)
+    if (empty.status !== 200) throw new Error(`Failed to list requests: ${empty.status}`)
+    expect((await empty.json()).data).toEqual([])
+  })
+
+  test('review fields surface without reviewer identity', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+
+    const created = await requests.$post(
+      { json: token, param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(created.status).toBe(200)
+    if (created.status !== 200) throw new Error(`Failed to create request: ${created.status}`)
+    const request = await created.json()
+    await VerifiedTokenRequests.review(db, request.id, {
+      reviewNote: 'Logo unreachable.',
+      reviewedBy: 'admin@tempo.xyz',
+      status: 'denied',
+    })
+
+    const listed = await requests.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(listed.status).toBe(200)
+    if (listed.status !== 200) throw new Error(`Failed to list requests: ${listed.status}`)
+    const [row] = (await listed.json()).data
+    expect(row).toMatchObject({ reviewNote: 'Logo unreachable.', status: 'denied' })
+    expect(row?.reviewedAt).toBeTruthy()
+    // Reviewer identity stays on the admin surface.
+    expect(row && 'reviewedBy' in row).toBe(false)
+  })
+
+  test('requires a session', async () => {
+    const context = createApp()
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const response = await requests.$get({ param: { orgId: 'org_1a2b3c4d5e6f7g8h9j0k1m2n' } })
+    expect(response.status).toBe(401)
+  })
+})
+
+describe('DELETE /v1/orgs/:orgId/verified-token-requests/:requestId', () => {
+  test('members cancel pending requests', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+    const member = await session(context)
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: member.userId })
+
+    const created = await requests.$post(
+      { json: token, param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(created.status).toBe(200)
+    if (created.status !== 200) throw new Error(`Failed to create request: ${created.status}`)
+    const request = await created.json()
+
+    const canceled = await requests[':requestId{vtr_[A-Za-z0-9_-]+}'].$delete(
+      { param: { orgId: org.id, requestId: request.id } },
+      as(member.cookie),
+    )
+    expect(canceled.status).toBe(200)
+    if (canceled.status !== 200) throw new Error(`Failed to cancel request: ${canceled.status}`)
+    expect(await canceled.json()).toEqual({ id: request.id })
+
+    const repeat = await requests[':requestId{vtr_[A-Za-z0-9_-]+}'].$delete(
+      { param: { orgId: org.id, requestId: request.id } },
+      as(member.cookie),
+    )
+    expect(repeat.status).toBe(404)
+  })
+
+  test('is org-scoped', async () => {
+    const context = createApp()
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+    const foreign = await setup(context)
+
+    const created = await requests.$post(
+      { json: token, param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(created.status).toBe(200)
+    if (created.status !== 200) throw new Error(`Failed to create request: ${created.status}`)
+    const request = await created.json()
+
+    const crossCancel = await requests[':requestId{vtr_[A-Za-z0-9_-]+}'].$delete(
+      { param: { orgId: foreign.org.id, requestId: request.id } },
+      as(foreign.owner.cookie),
+    )
+    expect(crossCancel.status).toBe(404)
+  })
+
+  test('rejects reviewed requests with 409', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const requests = context.client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['verified-token-requests']
+    const { org, owner } = await setup(context)
+
+    const created = await requests.$post(
+      { json: token, param: { orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(created.status).toBe(200)
+    if (created.status !== 200) throw new Error(`Failed to create request: ${created.status}`)
+    const request = await created.json()
+    await VerifiedTokenRequests.review(db, request.id, {
+      reviewedBy: 'admin@tempo.xyz',
+      status: 'denied',
+    })
+
+    const canceled = await requests[':requestId{vtr_[A-Za-z0-9_-]+}'].$delete(
+      { param: { orgId: org.id, requestId: request.id } },
+      as(owner.cookie),
+    )
+    expect(canceled.status).toBe(409)
+    const body = (await canceled.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('request_not_pending')
+  })
+})