tapimo 0.5.3 → 0.6.0

package/src/db/tables/verifiedTokenRequests.ts

@@ -0,0 +1,182 @@
+import { type Selectable, sql } from 'kysely'
+
+import * as Id from '../../internal/Id.js'
+import type * as Db from '../Db.js'
+import type * as db_Schema from '../Schema.js'
+
+/** Columns of the `verified_token_requests` table. */
+export type Table = db_Schema.VerifiedTokenRequest
+/** A stored verification request. */
+export type Record = Selectable<Table>
+/** Review status of a request. */
+export type Status = Record['status']
+
+/**
+ * Inserts a pending request; `undefined` when a pending request for
+ * (chainId, address) already exists.
+ */
+export function create(db: Db.Db, input: create.Input): Promise<Record | undefined> {
+  const now = new Date().toISOString()
+  return db.kysely
+    .insertInto('verified_token_requests')
+    .values({
+      address: input.address,
+      chainId: input.chainId,
+      createdAt: now,
+      currency: input.currency,
+      decimals: input.decimals,
+      id: Id.generate('vtr'),
+      logo: input.logo ?? null,
+      logoUri: input.logoUri ?? null,
+      name: input.name,
+      note: input.note ?? null,
+      orgId: input.orgId,
+      requestedBy: input.requestedBy,
+      reviewNote: null,
+      reviewedAt: null,
+      reviewedBy: null,
+      status: 'pending',
+      symbol: input.symbol,
+      updatedAt: now,
+    })
+    .onConflict((oc) =>
+      oc
+        .columns(['chainId', 'address'])
+        // `sql.lit` keeps the predicate literal; a bound parameter would
+        // defeat partial-index inference for the conflict target.
+        .where('status', '=', sql.lit('pending'))
+        .doNothing(),
+    )
+    .returningAll()
+    .executeTakeFirst()
+}
+
+export declare namespace create {
+  /** Fields accepted when inserting a request. */
+  type Input = {
+    /** Requested token contract address (lowercase). */
+    address: string
+    /** Chain the token belongs to. */
+    chainId: number
+    /** Display currency, e.g. `USD`. */
+    currency: string
+    /** Decimal precision. */
+    decimals: number
+    /** Inline SVG logo markup uploaded by the requester. */
+    logo?: string | undefined
+    /** HTTPS logo URL from chain metadata. */
+    logoUri?: string | undefined
+    /** Display name. */
+    name: string
+    /** Requester note to reviewers. */
+    note?: string | undefined
+    /** Requesting organization id (`org_…`). */
+    orgId: string
+    /** User id that submitted the request, or `super_admin`. */
+    requestedBy: string
+    /** Ticker symbol. */
+    symbol: string
+  }
+}
+
+/** Lists an organization's requests, newest first. */
+export function list(db: Db.Db, orgId: string): Promise<Record[]> {
+  return db.kysely
+    .selectFrom('verified_token_requests')
+    .selectAll()
+    .where('orgId', '=', orgId)
+    .orderBy('createdAt', 'desc')
+    .execute()
+}
+
+/**
+ * Lists requests in one status globally, oldest first (review-queue order),
+ * with the requesting organization's current name when it still exists.
+ */
+export function listByStatus(
+  db: Db.Db,
+  status: Status,
+): Promise<(Record & { orgName: string | null })[]> {
+  return db.kysely
+    .selectFrom('verified_token_requests')
+    .leftJoin('organizations', 'organizations.id', 'verified_token_requests.orgId')
+    .selectAll('verified_token_requests')
+    .select('organizations.name as orgName')
+    .where('status', '=', status)
+    .orderBy('verified_token_requests.createdAt', 'asc')
+    .execute()
+}
+
+/** Gets a request by id. */
+export function get(db: Db.Db, id: string): Promise<Record | undefined> {
+  return db.kysely
+    .selectFrom('verified_token_requests')
+    .selectAll()
+    .where('id', '=', id)
+    .executeTakeFirst()
+}
+
+/** Counts an organization's pending requests. */
+export async function countPending(db: Db.Db, orgId: string): Promise<number> {
+  const row = await db.kysely
+    .selectFrom('verified_token_requests')
+    .select(({ fn }) => fn.countAll<string>().as('count'))
+    .where('orgId', '=', orgId)
+    .where('status', '=', 'pending')
+    .executeTakeFirstOrThrow()
+  return Number(row.count)
+}
+
+/** Hard-deletes an org-scoped request while pending; `undefined` otherwise. */
+export function remove(db: Db.Db, orgId: string, id: string): Promise<Record | undefined> {
+  return db.kysely
+    .deleteFrom('verified_token_requests')
+    .where('id', '=', id)
+    .where('orgId', '=', orgId)
+    .where('status', '=', 'pending')
+    .returningAll()
+    .executeTakeFirst()
+}
+
+/**
+ * Marks a pending request approved or denied with reviewer identity;
+ * `undefined` when absent or already reviewed.
+ */
+export function review(db: Db.Db, id: string, input: review.Input): Promise<Record | undefined> {
+  const now = new Date().toISOString()
+  return db.kysely
+    .updateTable('verified_token_requests')
+    .set({
+      reviewNote: input.reviewNote ?? null,
+      reviewedAt: now,
+      reviewedBy: input.reviewedBy,
+      status: input.status,
+      updatedAt: now,
+    })
+    .where('id', '=', id)
+    .where('status', '=', 'pending')
+    .returningAll()
+    .executeTakeFirst()
+}
+
+export declare namespace review {
+  /** Review outcome fields. */
+  type Input = {
+    /** Reviewer note shown on denial. */
+    reviewNote?: string | undefined
+    /** Reviewing admin email. */
+    reviewedBy: string
+    /** Review outcome. */
+    status: 'approved' | 'denied'
+  }
+}
+
+/** Maps a stored row to the wire shape (null `logo`/`logoUri` map to absent). */
+export function toRequest(record: Record) {
+  const { logo, logoUri, ...rest } = record
+  return {
+    ...rest,
+    ...(logo === null ? {} : { logo }),
+    ...(logoUri === null ? {} : { logoUri }),
+  }
+}

package/src/db/tables/webhookSubscriptions.ts

@@ -5,6 +5,8 @@ import type * as Webhooks from '../../internal/Webhooks.js'
 import type * as Db from '../Db.js'
 import type * as db_Schema from '../Schema.js'
 
+const subscriptionLimitLockClass = 1464353612
+
 /** Columns of the `webhook_subscriptions` table, derived from `Schema.WebhookSubscription`. */
 export type Table = db_Schema.WebhookSubscription
 
@@ -69,6 +71,35 @@ export async function insert(db: Db.Db, subscription: Webhooks.Subscription): Pr
     .execute()
 }
 
+/**
+ * Inserts a subscription when its owner remains below the configured cap.
+ * An owner-scoped transaction lock serializes the count and insert.
+ */
+export async function insertWithinLimit(
+  db: Db.Db,
+  subscription: Webhooks.Subscription,
+  options: insertWithinLimit.Options,
+): Promise<boolean> {
+  return db.transaction(async (tx) => {
+    const owner = `${subscription.owner.type}:${ownerId(subscription.owner)}`
+    await sql`select pg_advisory_xact_lock(${subscriptionLimitLockClass}, hashtext(${owner}))`.execute(tx.kysely) // prettier-ignore
+    const existing = await count(tx, subscription.owner, options.now)
+    if (existing >= options.maxPerOwner) return false
+    await insert(tx, subscription)
+    return true
+  })
+}
+
+export declare namespace insertWithinLimit {
+  /** Options for an atomic capped insert. */
+  type Options = {
+    /** Maximum live subscriptions the owner may hold. */
+    maxPerOwner: number
+    /** ISO timestamp used to exclude expired rows from the count. */
+    now: string
+  }
+}
+
 /**
  * Reads an owner's subscription by id; expired rows never match (query-time
  * expiry, same read semantics as the old store TTL).

package/src/internal/Auth.ts

@@ -6,7 +6,6 @@ import { createMiddleware } from 'hono/factory'
 import { matchedRoutes } from 'hono/route'
 import type { MergePath, RouterRoute, Schema as core_Schema } from 'hono/types'
 import { findTargetHandler } from 'hono/utils/handler'
-import { decodeJwt } from 'jose'
 import { Challenge, Credential, type Method } from 'mppx'
 import { Mppx, tempo } from 'mppx/hono'
 import { Addresses } from 'viem/tempo'
@@ -17,6 +16,7 @@ import * as ApiKey from '../ApiKey.js'
 import * as ApiKeys from '../ApiKeys.js'
 import * as Db from '../db/Db.js'
 import type * as Store from './Store.js'
+import * as EarlyAccess from '../db/tables/earlyAccess.js'
 import * as Invitations from '../db/tables/invitations.js'
 import * as Memberships from '../db/tables/memberships.js'
 import * as Metadata from '../apps/metadata.js'
@@ -159,6 +159,8 @@ export type PolicyOverride = {
     | undefined
   /** Session lane: `true` allows signed-in wallet sessions, `false` disables. */
   session?: boolean | undefined
+  /** Temporary early-access gate: `true` rejects sessions without early access ({@link tmp_earlyAccess}). TODO: remove after GA. */
+  tmp_earlyAccess?: boolean | undefined
 }
 
 /** Authenticated or anonymous caller. */
@@ -227,6 +229,8 @@ export type Variables = {
   principal?: Principal | undefined
   /** Project resolved by {@link ensureProject} for the current request. */
   project?: Projects.Record | undefined
+  /** Temporary early-access gate toggle; unset or false grants everyone early access. TODO: remove after GA. */
+  tmp_earlyAccess?: boolean | undefined
 }
 
 /** Reads the authenticated principal from a Hono context. */
@@ -346,6 +350,9 @@ export function ensureProject(): MiddlewareHandler {
  */
 export const narrowScope = false as boolean
 
+/** Always false at runtime; lets handlers include organization role errors in inferred response unions. */
+export const narrowOrgRole = false as boolean
+
 /** Typed org-scope error response for Hono client inference. Never reached at runtime. */
 export function ensureOrgError(c: hono_Context) {
   return Response.error(c, {
@@ -355,6 +362,15 @@ export function ensureOrgError(c: hono_Context) {
   })
 }
 
+/** Typed organization-role error response for Hono client inference. Never reached at runtime. */
+export function ensureOrgRoleError(c: hono_Context) {
+  return Response.error(c, {
+    code: 'forbidden',
+    message: 'Insufficient organization role',
+    status: 403,
+  })
+}
+
 /** Typed project-scope error response for Hono client inference. Never reached at runtime. */
 export function ensureProjectError(c: hono_Context) {
   // Nested project routes run the org scope first, so either not-found can surface.
@@ -369,6 +385,42 @@ export function ensureProjectError(c: hono_Context) {
   })
 }
 
+/** Whether the caller can grant early access, independent of the temporary route gate. TODO: remove after GA. */
+export async function tmp_earlyAccessGrant(c: hono_Context): Promise<boolean> {
+  const principal = getPrincipal(c)
+  // Trust chain: `management:write` keys are only mintable by early-access owners.
+  if (principal?.type === 'api_key' || principal?.type === 'super_admin') return true
+  if (principal?.type !== 'session' || !principal.email) return false
+  const email = principal.email.trim().toLowerCase()
+  const db = Db.get(contextDb(c))
+  if (await EarlyAccess.matches(db, email)) return true
+  return Invitations.hasEarlyAccessGrant(db, email)
+}
+
+/** Whether the caller has effective early access, including a dormant temporary gate. TODO: remove after GA. */
+export async function tmp_earlyAccess(c: hono_Context): Promise<boolean> {
+  const enabled = (c.get as (key: string) => unknown)('tmp_earlyAccess') as boolean | undefined
+  if (!enabled) return true
+  return tmp_earlyAccessGrant(c)
+}
+
+/**
+ * Always false at runtime, but typed as `boolean` so handlers can include a
+ * never-reached early-access-error branch in Hono's inferred response union
+ * (the `tmp_earlyAccess` policy flag produces this `403` before the handler
+ * runs). TODO: remove after GA.
+ */
+export const tmp_narrowEarlyAccess = false as boolean
+
+/** Typed early-access error response for Hono client inference; also the live gate rejection. TODO: remove after GA. */
+export function tmp_ensureEarlyAccessError(c: hono_Context) {
+  return Response.error(c, {
+    code: 'early_access_required',
+    message: 'Requires early access. Ask a teammate with access to invite you by email, or contact Tempo.', // prettier-ignore
+    status: 403,
+  })
+}
+
 /** Reads the caller's membership resolved by the organization or project guard; `undefined` for API keys and `super_admin`. */
 export function membership<environment extends Environment>(
   c: hono_Context<environment>,
@@ -577,6 +629,9 @@ export function middleware<
     if (management && (!auth.mpp || !endpointPolicy.mpp)) return next()
 
     c.set('auth', auth)
+    // Consumed by `tmp_earlyAccess`; absent (or false) leaves the gate dormant.
+    // TODO: remove after GA.
+    c.set('tmp_earlyAccess', options.tmp_earlyAccess)
     return require<environment>(endpointPolicy)(c, next)
   })
 }
@@ -632,6 +687,12 @@ export declare namespace middleware {
      * checks — before the key lookup runs. Omit to disable the entry entirely.
      */
     superAdmin?: { secret: string } | undefined
+    /**
+     * Temporary invite-only gate for routes flagged via {@link policy}.
+     * Allowlist entries live in the `early_access` table (admin dash); unset
+     * grants everyone early access. TODO: remove after GA.
+     */
+    tmp_earlyAccess?: boolean | undefined
   }
 
   /** Resolve-cache tuning for API-key resolution. */
@@ -764,12 +825,6 @@ export function install(options: install.Options) {
     if (!options_session || !kv) return undefined
     const { issuer, origin, requireEmail, ttl } =
       (typeof options_session === 'object' ? options_session.wallet : undefined) ?? {}
-    // Case-insensitive exact-match email-domain allowlist for new-user sign-ups.
-    const emailAllowlist = (
-      typeof options_session === 'object' ? options_session.emailAllowlist : undefined
-    )
-      ?.map((domain) => domain.trim().toLowerCase())
-      .filter(Boolean)
 
     const handler = Accounts.Handler.auth({
       ...(issuer || requireEmail
@@ -834,38 +889,6 @@ export function install(options: install.Options) {
     const policy_session = policy({ public: true, session: true })
     const describe = OpenApi.describeRoute({ hide: true })
 
-    // Sign-up gate: new addresses need an allowlisted identity email domain
-    // or a pending invitation; existing users pass. The claim decodes
-    // unverified; the mounted handler verifies the token before any session
-    // or user is created, so a forged claim never authenticates.
-    const gate_signup = createMiddleware<App.Environment>(async (c, next) => {
-      if (!emailAllowlist?.length) return next()
-      const { address, idToken } = (await c.req.json()) as z.output<typeof schema.verify.Body>
-      const database = Db.get(db)
-      const user = await Users.getByAddress(database, address)
-      if (!user) {
-        const email = (() => {
-          if (!idToken) return undefined
-          try {
-            const { email } = decodeJwt<{ email?: string }>(idToken)
-            return typeof email === 'string' ? email.toLowerCase() : undefined
-          } catch {
-            return undefined
-          }
-        })()
-        const allowed = await (async () => {
-          if (!email) return false
-          const at = email.lastIndexOf('@')
-          if (at > 0 && emailAllowlist.includes(email.slice(at + 1))) return true
-          // A pending invitation admits the email regardless of domain.
-          return (await Invitations.listByEmail(database, email)).length > 0
-        })()
-        if (!allowed)
-          return c.json({ error: 'sign-ups are restricted to approved email domains or invited emails' }, 403) // prettier-ignore
-      }
-      return next()
-    })
-
     const app = new Hono<App.Environment>()
       .use('/v1/auth/siwe', policy_public, describe)
       .use('/v1/auth/siwe/*', policy_public, describe)
@@ -906,7 +929,6 @@ export function install(options: install.Options) {
         code: 'body_invalid',
         message: 'Invalid request body',
       }),
-      gate_signup,
       OpenApi.describeRoute({
         description:
           'Verifies the signed challenge and establishes a session. Sets a session cookie by default; pass `returnToken` to receive a bearer token instead.',
@@ -926,9 +948,6 @@ export function install(options: install.Options) {
           },
           400: handlerError('Invalid, expired, or mismatched challenge message; or a required identity token is missing.'), // prettier-ignore
           401: handlerError('Signature or identity verification failed.'),
-          ...(emailAllowlist?.length
-            ? { 403: handlerError('Sign-up rejected: the identity email is neither on an allowlisted domain nor pending an invitation.') } // prettier-ignore
-            : {}),
           409: handlerError('Challenge nonce already used or unknown.'),
           429: OpenApi.standardError(429, 'Rate limited.'),
           500: OpenApi.standardError(500, 'Internal server error.'),
@@ -997,8 +1016,6 @@ export declare namespace install {
   type Session =
     | boolean
     | {
-        /** Restrict new-user sign-ups to verified emails on these domains (case-insensitive exact match); invited emails and existing users sign in unaffected. */
-        emailAllowlist?: readonly string[] | undefined
         /** SIWE wallet sign-in configuration. */
         wallet?: Wallet | undefined
       }
@@ -1179,6 +1196,7 @@ function resolvePolicy(
   let mpp = base.mpp
   let public_ = base.public
   let session = base.session
+  let tmp_earlyAccess = base.tmp_earlyAccess
 
   for (const override of overrides) {
     if (override === false) return undefined
@@ -1187,6 +1205,7 @@ function resolvePolicy(
     mpp = resolveMppLane(mpp, override.mpp, defaults.mpp)
     public_ = resolvePublicLane(public_, override.public, defaults.public)
     session = resolveSessionLane(session, override.session, defaults.session)
+    tmp_earlyAccess = override.tmp_earlyAccess ?? tmp_earlyAccess
   }
 
   // The OpenAPI summary/description rides along as the payment-challenge
@@ -1202,6 +1221,7 @@ function resolvePolicy(
     ...(mpp ? { mpp } : {}),
     ...(public_ ? { public: public_ } : {}),
     ...(session ? { session } : {}),
+    ...(tmp_earlyAccess ? { tmp_earlyAccess } : {}),
   }
 }
 
@@ -1424,6 +1444,12 @@ export function require<environment extends Environment = Environment>(
     )
       return Response.unsupportedChainId(c, chainId, supportedChainIds)
     const proceed = async () => {
+      // Runs after principal resolution, so api_key and super_admin pass by
+      // type; only gated sessions are rejected. TODO: remove after GA.
+      if (policy.tmp_earlyAccess && !(await tmp_earlyAccess(c))) {
+        c.res = tmp_ensureEarlyAccessError(c)
+        return
+      }
       await next()
       // Query credential responses must not enter shared caches.
       const cacheControl = c.res.headers.get('Cache-Control')?.toLowerCase()
@@ -1659,6 +1685,8 @@ export declare namespace require {
       | undefined
     /** Session access policy: `true` allows signed-in wallet sessions. */
     session?: boolean | undefined
+    /** Temporary early-access gate for this route; see {@link tmp_earlyAccess}. TODO: remove after GA. */
+    tmp_earlyAccess?: boolean | undefined
   }
 }