tapimo 0.5.3 → 0.7.0

package/src/Scope.ts

@@ -49,6 +49,11 @@ export const catalog = [
     scope: 'management:write',
     selfServe: true,
   },
+  {
+    description: 'Validate and broadcast MPP payment credentials through the Tempo relay.',
+    scope: 'mpp:write',
+    selfServe: true,
+  },
   {
     description: 'Fill and submit transactions through the relay.',
     scope: 'rpc-relay:read',

package/src/admin/App.test.ts

@@ -20,6 +20,10 @@ describe('create', () => {
         new Request('http://admin/api-keys/key_x', { method: 'DELETE' }),
         new Request('http://admin/organizations'),
         new Request('http://admin/organizations/org_x'),
+        new Request('http://admin/organizations/org_x/billing-sources/stripe', { method: 'PUT' }),
+        new Request('http://admin/organizations/org_x/billing-sources/stripe', {
+          method: 'DELETE',
+        }),
         new Request('http://admin/organizations/org_x/members'),
         new Request('http://admin/organizations/org_x/projects'),
         new Request('http://admin/verified-tokens?chainId=42431', {

package/src/admin/App.ts

@@ -11,6 +11,7 @@ import type * as Store from '../internal/Store.js'
 import * as Response from '../internal/Response.js'
 
 import { apiKeys } from './apps/api-keys.js'
+import { earlyAccess } from './apps/early-access.js'
 import { organizations } from './apps/organizations.js'
 import { scopes } from './apps/scopes.js'
 import { verifiedTokens } from './apps/verified-tokens.js'
@@ -117,6 +118,8 @@ export function create(options: create.Options) {
     '/config.json',
     '/api-keys',
     '/api-keys/*',
+    '/early-access',
+    '/early-access/*',
     '/organizations',
     '/organizations/*',
     '/scopes',
@@ -152,6 +155,7 @@ export function create(options: create.Options) {
   const routed = app
     .get('/config.json', (c) => c.json(authConfig(c.get('identity')), 200))
     .route('/api-keys', apiKeys())
+    .route('/early-access', earlyAccess())
     .route('/organizations', organizations())
     .route('/scopes', scopes())
     .route('/verified-tokens', verifiedTokens())

package/src/admin/apps/early-access.test.ts

@@ -0,0 +1,125 @@
+import * as TestAdmin from '../../../test/Admin.js'
+import * as TestApp from '../../../test/App.js'
+import * as EarlyAccessApp from './early-access.js'
+
+/** Lists the table's entries. */
+async function listAdded(client: ReturnType<typeof TestAdmin.setup>['client']) {
+  const response = await client['early-access'].$get()
+  const body = await TestApp.json(response, EarlyAccessApp.schema.listEarlyAccessEntries.Response)
+  return body.data
+}
+
+describe('authentication', () => {
+  test('denied identity → 401 on every route', async () => {
+    const { app } = TestAdmin.setup({ identify: () => null })
+    const routes = [
+      new Request('http://admin/early-access'),
+      new Request('http://admin/early-access', {
+        body: JSON.stringify({ entry: 'example.org' }),
+        headers: { 'content-type': 'application/json' },
+        method: 'POST',
+      }),
+      new Request('http://admin/early-access', {
+        body: JSON.stringify({ entry: 'example.org' }),
+        headers: { 'content-type': 'application/json' },
+        method: 'DELETE',
+      }),
+    ]
+    for (const request of routes) {
+      const response = await app.request(request)
+      expect(response.status).toBe(401)
+    }
+  })
+})
+
+describe('GET /early-access', () => {
+  test('starts empty; entries are seeded through the dash, never migrations', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['early-access'].$get()
+    const body = await TestApp.json(response, EarlyAccessApp.schema.listEarlyAccessEntries.Response)
+
+    expect(response.status).toBe(200)
+    expect(body.data).toEqual([])
+  })
+})
+
+describe('POST /early-access', () => {
+  test('add → list → remove round-trip', async () => {
+    const { client } = TestAdmin.setup()
+
+    const created = await client['early-access'].$post({ json: { entry: 'a/b@example.org' } })
+    expect(created.status).toBe(200)
+    const body = await TestApp.json(created, EarlyAccessApp.schema.createEarlyAccessEntry.Response)
+    expect(body.data.entry).toBe('a/b@example.org')
+    // createdBy is the verified admin email, never client-supplied.
+    expect(body.data.createdBy).toBe(TestAdmin.identity.email)
+
+    expect((await listAdded(client)).map((record) => record.entry)).toEqual(['a/b@example.org'])
+
+    // Reserved URL characters stay in the JSON body.
+    const removed = await client['early-access'].$delete({ json: { entry: 'a/b@example.org' } })
+    expect(removed.status).toBe(200)
+    expect(await listAdded(client)).toEqual([])
+  })
+
+  test('normalizes the entry lowercase and trimmed', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['early-access'].$post({ json: { entry: '  User@Example.ORG ' } })
+    const body = await TestApp.json(response, EarlyAccessApp.schema.createEarlyAccessEntry.Response)
+
+    expect(response.status).toBe(200)
+    expect(body.data.entry).toBe('user@example.org')
+  })
+
+  test('rejects an invalid entry with 400', async () => {
+    const { client } = TestAdmin.setup()
+    for (const entry of ['', '   ', 'no spaces.org x', 'not-a-domain', '@example.org', 'user@']) {
+      const response = await client['early-access'].$post({ json: { entry } })
+      const body = (await response.json()) as { error?: { code?: string } }
+      expect(response.status).toBe(400)
+      expect(body.error?.code).toBe('body_invalid')
+    }
+  })
+
+  test('rejects a duplicate entry with 409', async () => {
+    const { client } = TestAdmin.setup()
+    await client['early-access'].$post({ json: { entry: 'example.org' } })
+    const duplicate = await client['early-access'].$post({ json: { entry: 'Example.org' } })
+    const body = (await duplicate.json()) as { error?: { code?: string } }
+
+    expect(duplicate.status).toBe(409)
+    expect(body.error?.code).toBe('entry_exists')
+  })
+})
+
+describe('DELETE /early-access', () => {
+  test('removing an unknown entry → 404', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['early-access'].$delete({
+      json: { entry: 'missing.example.org' },
+    })
+    const body = (await response.json()) as { error?: { code?: string } }
+
+    expect(response.status).toBe(404)
+    expect(body.error?.code).toBe('entry_not_found')
+  })
+})
+
+describe('audit logging', () => {
+  test('writes an audit row for allowlist mutations', async () => {
+    const { client, db } = TestAdmin.setup()
+    await client['early-access'].$post({ json: { entry: 'example.org' } })
+    const records = await db.kysely
+      .selectFrom('admin_audit_logs')
+      .selectAll()
+      .orderBy('createdAt', 'desc')
+      .execute()
+
+    expect(records[0]).toMatchObject({
+      actor: TestAdmin.identity.email,
+      method: 'POST',
+      path: '/early-access',
+      status: 200,
+    })
+  })
+})

package/src/admin/apps/early-access.ts

@@ -0,0 +1,176 @@
+import { Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import * as Db from '../../db/Db.js'
+import * as db_Schema from '../../db/Schema.js'
+import * as EarlyAccess from '../../db/tables/earlyAccess.js'
+import * as OpenApi from '../../internal/OpenApi.js'
+import * as Response from '../../internal/Response.js'
+import * as Schema from '../../internal/Schema.js'
+import type * as App from '../App.js'
+
+// A bare domain (`example.org`) or a full email (`user@example.org`), matched
+// after the trim/lowercase transforms below.
+const entryPattern =
+  /^(?:[^\s@]+@)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/
+
+/** Zod schemas owned by the admin early-access handler. */
+export namespace schema {
+  /** A stored early-access allowlist entry (the `early_access` row shape). */
+  export const Entry = Schema.describe(
+    db_Schema.EarlyAccessEntry,
+    'A stored early-access allowlist entry.',
+  )
+
+  /** Schemas for the listEarlyAccessEntries operation. */
+  export namespace listEarlyAccessEntries {
+    /** Response body: all allowlist entries. */
+    export const Response = Schema.describe(
+      z.object({
+        data: z.array(Entry).check(z.describe('Allowlist entries, ordered by entry.')),
+      }),
+      'Accounts whose new organizations receive early access features by default.',
+    )
+  }
+
+  /** Schemas for the createEarlyAccessEntry operation. */
+  export namespace createEarlyAccessEntry {
+    /** Request body for adding an allowlist entry. */
+    export const Body = z
+      .object({
+        entry: z.string().check(
+          z.trim(),
+          z.toLowerCase(),
+          z.regex(entryPattern, 'Must be a bare domain (example.org) or a full email (user@example.org).'), // prettier-ignore
+          z.describe('Domain or exact email whose new organizations receive early access features; normalized lowercase.'), // prettier-ignore
+        ),
+      })
+      .check(z.describe('Request body for adding an allowlist entry.'))
+
+    /** Response body: the stored entry. */
+    export const Response = Schema.describe(
+      z.object({ data: Entry }),
+      'The stored allowlist entry.',
+    )
+  }
+
+  /** Schemas for the deleteEarlyAccessEntry operation. */
+  export namespace deleteEarlyAccessEntry {
+    /** Request body addressing one allowlist entry. */
+    export const Body = z
+      .object({
+        entry: z.string().check(
+          z.trim(),
+          z.toLowerCase(),
+          z.regex(entryPattern, 'Must be a bare domain (example.org) or a full email (user@example.org).'), // prettier-ignore
+          z.describe('The allowlist entry to remove; normalized lowercase.'),
+        ),
+      })
+      .check(z.describe('Request body for removing an allowlist entry.'))
+
+    /** Response body: the removed entry. */
+    export const Response = Schema.describe(
+      z.object({ data: Entry }),
+      'The removed allowlist entry.',
+    )
+  }
+}
+
+/**
+ * Management routes for the early-access allowlist (`early_access` table).
+ * Matching users receive Stripe by default when they create an organization.
+ *
+ * - `GET /` lists entries.
+ * - `POST /` adds an entry (`409` on a duplicate).
+ * - `DELETE /` removes an entry (`404` if absent).
+ */
+export function earlyAccess() {
+  return new Hono<App.Environment>()
+    .get(
+      '/',
+      OpenApi.describeRoute({
+        operationId: 'listEarlyAccessEntries',
+        responses: OpenApi.responses({
+          success: {
+            description:
+              'Accounts whose new organizations receive early access features by default.',
+            schema: schema.listEarlyAccessEntries.Response,
+          },
+        }),
+        summary: 'List early access',
+        tags: ['Early Access'],
+      }),
+      async (c) => {
+        const db = Db.get(c.get('db'))
+        return c.json(
+          Response.validated(schema.listEarlyAccessEntries.Response, {
+            data: await EarlyAccess.list(db),
+          }),
+        )
+      },
+    )
+    .post(
+      '/',
+      OpenApi.validate('json', schema.createEarlyAccessEntry.Body, {
+        code: 'body_invalid',
+        message: 'Invalid request body',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'createEarlyAccessEntry',
+        responses: OpenApi.responses({
+          errors: { 409: 'Entry already exists.' },
+          success: {
+            description: 'The stored allowlist entry.',
+            schema: schema.createEarlyAccessEntry.Response,
+          },
+        }),
+        summary: 'Add early-access entry',
+        tags: ['Early Access'],
+      }),
+      async (c) => {
+        const db = Db.get(c.get('db'))
+        const { entry } = c.req.valid('json')
+        // `createdBy` is the verified admin email; `requireAuth` guarantees
+        // identity on this gated route.
+        const record = await EarlyAccess.add(db, { createdBy: c.get('identity')!.email, entry })
+        if (!record)
+          return Response.error(c, {
+            code: 'entry_exists',
+            message: 'Entry already exists.',
+            status: 409,
+          })
+        return c.json(Response.validated(schema.createEarlyAccessEntry.Response, { data: record }))
+      },
+    )
+    .delete(
+      '/',
+      OpenApi.validate('json', schema.deleteEarlyAccessEntry.Body, {
+        code: 'body_invalid',
+        message: 'Invalid request body',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'deleteEarlyAccessEntry',
+        responses: OpenApi.responses({
+          errors: { 404: 'Entry not found.' },
+          success: {
+            description: 'The removed allowlist entry.',
+            schema: schema.deleteEarlyAccessEntry.Response,
+          },
+        }),
+        summary: 'Remove early-access entry',
+        tags: ['Early Access'],
+      }),
+      async (c) => {
+        const db = Db.get(c.get('db'))
+        const { entry } = c.req.valid('json')
+        const record = await EarlyAccess.remove(db, entry)
+        if (!record)
+          return Response.error(c, {
+            code: 'entry_not_found',
+            message: 'Entry not found.',
+            status: 404,
+          })
+        return c.json(Response.validated(schema.deleteEarlyAccessEntry.Response, { data: record }))
+      },
+    )
+}

package/src/admin/apps/organizations.test.ts

@@ -1,6 +1,7 @@
 import type * as Analytics from '../../analytics/Analytics.js'
 import * as ApiKeys from '../../ApiKeys.js'
 import * as BillingSettings from '../../db/tables/billingSettings.js'
+import * as EnabledBillingSources from '../../db/tables/enabledBillingSources.js'
 import * as Memberships from '../../db/tables/memberships.js'
 import * as Organizations from '../../db/tables/organizations.js'
 import * as Projects from '../../db/tables/projects.js'
@@ -134,6 +135,16 @@ describe('GET /organizations/:orgId', () => {
     })
     await Users.setEmail(db, user.id, 'owner@tempo.xyz')
     const organization = await Organizations.createOwned(db, { name: 'Tempo', userId: user.id })
+    await EnabledBillingSources.add(db, {
+      createdBy: TestAdmin.identity.email,
+      orgId: organization.id,
+      source: 'stripe',
+    })
+    await EnabledBillingSources.add(db, {
+      createdBy: TestAdmin.identity.email,
+      orgId: organization.id,
+      source: 'tempo',
+    })
     await Projects.create(db, { name: 'API', orgId: organization.id })
     await BillingSettings.upsert(db, {
       environment: 'production',
@@ -161,6 +172,7 @@ describe('GET /organizations/:orgId', () => {
     expect(response.status).toBe(200)
     expect(body.memberCount).toBe(1)
     expect(body.projectCount).toBe(1)
+    expect(body.billing.enabledSources).toEqual(['stripe', 'tempo'])
     expect(body.billing.production).toMatchObject({
       settings: { spendLimit: '250', txFeeLimit: '0.50' },
       source: { status: 'active', stripeCustomerId: 'cus_admin_lookup' },
@@ -182,6 +194,7 @@ describe('GET /organizations/:orgId', () => {
 
     expect(body).toMatchObject({
       billing: {
+        enabledSources: [],
         production: { settings: null, source: null },
         sandbox: { settings: null, source: null },
       },
@@ -202,6 +215,78 @@ describe('GET /organizations/:orgId', () => {
   })
 })
 
+describe('PUT/DELETE /organizations/:orgId/billing-sources/:source', () => {
+  test('enables and disables sources idempotently', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Billing sources' })
+
+    for (const source of ['tempo', 'stripe', 'stripe'] as const) {
+      const response = await client.organizations[':orgId']['billing-sources'][':source'].$put({
+        param: { orgId: organization.id, source },
+      })
+      const body = await TestApp.json(response, AdminOrganizations.schema.setBillingSource.Response)
+      expect(response.status).toBe(200)
+      expect(body.data).toEqual(source === 'tempo' ? ['tempo'] : ['stripe', 'tempo'])
+    }
+
+    expect(await EnabledBillingSources.listByOrg(db, organization.id)).toMatchObject([
+      { createdBy: TestAdmin.identity.email, source: 'stripe' },
+      { createdBy: TestAdmin.identity.email, source: 'tempo' },
+    ])
+
+    for (const source of ['stripe', 'stripe'] as const) {
+      const response = await client.organizations[':orgId']['billing-sources'][':source'].$delete({
+        param: { orgId: organization.id, source },
+      })
+      const body = await TestApp.json(response, AdminOrganizations.schema.setBillingSource.Response)
+      expect(response.status).toBe(200)
+      expect(body.data).toEqual(['tempo'])
+    }
+
+    const detailResponse = await client.organizations[':orgId'].$get({
+      param: { orgId: organization.id },
+    })
+    const detail = await TestApp.json(
+      detailResponse,
+      AdminOrganizations.schema.getOrganization.Response,
+    )
+    expect(detail.billing.enabledSources).toEqual(['tempo'])
+  })
+
+  test('rejects unsupported sources and unknown organizations', async () => {
+    const { app, client } = TestAdmin.setup()
+    const invalid = await app.request('/organizations/org_example/billing-sources/card', {
+      method: 'PUT',
+    })
+    expect(invalid.status).toBe(400)
+
+    const missing = await client.organizations[':orgId']['billing-sources'][':source'].$put({
+      param: { orgId: 'org_missing', source: 'stripe' },
+    })
+    expect(missing.status).toBe(404)
+  })
+
+  test('records billing-source mutations in the admin audit log', async () => {
+    const { client, db } = TestAdmin.setup()
+    const organization = await Organizations.create(db, { name: 'Audited billing' })
+    await client.organizations[':orgId']['billing-sources'][':source'].$put({
+      param: { orgId: organization.id, source: 'tempo' },
+    })
+
+    const records = await db.kysely
+      .selectFrom('admin_audit_logs')
+      .selectAll()
+      .orderBy('createdAt', 'desc')
+      .execute()
+    expect(records[0]).toMatchObject({
+      actor: TestAdmin.identity.email,
+      method: 'PUT',
+      path: `/organizations/${organization.id}/billing-sources/tempo`,
+      status: 200,
+    })
+  })
+})
+
 describe('GET /organizations/:orgId/members', () => {
   test('returns a bounded cursor page without duplicates', async () => {
     const { client, db } = TestAdmin.setup()
@@ -444,8 +529,7 @@ const usageAnalytics: Analytics.Analytics = {
   async insert() {},
   async migrate() {},
   async query(sql) {
-    if (sql.includes('GROUP BY error_code'))
-      return [{ code: 'upstream_error', requests: 2 }] as never[]
+    if (sql.includes('GROUP BY code')) return [{ code: 'upstream_error', requests: 2 }] as never[]
     if (sql.includes('GROUP BY route'))
       return [{ averageDurationMs: 12.5, errors: 2, requests: 20, route: '/v1/tokens' }] as never[]
     if (sql.includes('GROUP BY status')) return [{ requests: 2, status: 500 }] as never[]