tapimo 0.5.3 → 0.7.0

package/src/admin/apps/organizations.ts

@@ -6,6 +6,7 @@ import * as ApiKeys from '../../ApiKeys.js'
 import * as core_Billing from '../../apps/management/Billing.js'
 import * as BillingSettings from '../../db/tables/billingSettings.js'
 import * as Db from '../../db/Db.js'
+import * as EnabledBillingSources from '../../db/tables/enabledBillingSources.js'
 import * as Memberships from '../../db/tables/memberships.js'
 import * as Organizations from '../../db/tables/organizations.js'
 import * as Projects from '../../db/tables/projects.js'
@@ -26,6 +27,21 @@ export namespace schema {
     .string()
     .check(z.describe('An ISO 8601 timestamp.'), z.meta({ examples: ['2026-01-01T00:00:00.000Z'] }))
 
+  const enabledBillingSources = z
+    .array(z.enum(EnabledBillingSources.sources))
+    .check(
+      z.describe('Billing-source types available for new setup.'),
+      z.meta({ examples: [['stripe', 'tempo']] }),
+    )
+
+  const organizationId = z
+    .string()
+    .check(
+      z.minLength(1),
+      z.describe('Stable organization id.'),
+      z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+    )
+
   const Organization = Schema.describe(
     z.object({
       createdAt: timestamp,
@@ -118,13 +134,7 @@ export namespace schema {
     /** Path parameters identifying an organization. */
     export const Params = z
       .object({
-        orgId: z
-          .string()
-          .check(
-            z.minLength(1),
-            z.describe('Stable organization id.'),
-            z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
-          ),
+        orgId: organizationId,
       })
       .check(z.describe('Path parameters for one organization.'))
 
@@ -252,29 +262,58 @@ export namespace schema {
     /** Detailed organization lookup response. */
     export const Response = Schema.describe(
       z.extend(listOrganizations.OrganizationSummary, {
-        billing: z.object({ production: Billing, sandbox: Billing }).check(
-          z.describe('Billing state split by environment.'),
-          z.meta({
-            examples: [
-              {
-                production: {
-                  settings: null,
-                  source: {
-                    status: 'active',
-                    stripeCustomerId: 'cus_abc123',
-                    updatedAt: '2026-01-01T00:00:00.000Z',
+        billing: z
+          .object({
+            enabledSources: enabledBillingSources,
+            production: Billing,
+            sandbox: Billing,
+          })
+          .check(
+            z.describe('Organization-wide availability and environment billing state.'),
+            z.meta({
+              examples: [
+                {
+                  enabledSources: ['stripe', 'tempo'],
+                  production: {
+                    settings: null,
+                    source: {
+                      status: 'active',
+                      stripeCustomerId: 'cus_abc123',
+                      updatedAt: '2026-01-01T00:00:00.000Z',
+                    },
                   },
+                  sandbox: { settings: null, source: null },
                 },
-                sandbox: { settings: null, source: null },
-              },
-            ],
-          }),
-        ),
+              ],
+            }),
+          ),
       }),
       'Detailed organization information for administrators.',
     )
   }
 
+  /** Schemas for the setBillingSource operation. */
+  export namespace setBillingSource {
+    /** Path parameters identifying an organization billing source. */
+    export const Params = z
+      .object({
+        orgId: organizationId,
+        source: z
+          .enum(EnabledBillingSources.sources)
+          .check(
+            z.describe('Billing-source type to enable or disable.'),
+            z.meta({ examples: ['stripe'] }),
+          ),
+      })
+      .check(z.describe('Path parameters for one organization billing source.'))
+
+    /** Current enabled billing sources. */
+    export const Response = Schema.describe(
+      z.object({ data: enabledBillingSources }),
+      'Current enabled billing sources for the organization.',
+    )
+  }
+
   /** Schemas for the listOrganizationMembers operation. */
   export namespace listOrganizationMembers {
     /** Query parameters for paginating organization members. */
@@ -502,7 +541,7 @@ export namespace schema {
   }
 }
 
-/** Read-only organization lookup routes for administrators. */
+/** Organization lookup and support routes for administrators. */
 export function organizations() {
   return new Hono<App.Environment>()
     .get(
@@ -576,17 +615,24 @@ export function organizations() {
           const organization = await Organizations.getSummary(db, orgId)
           if (!organization) return organizationNotFound(c)
 
-          const [productionSettings, productionSource, sandboxSettings, sandboxSource] =
-            await Promise.all([
-              BillingSettings.get(db, orgId, 'production'),
-              StripeCustomers.get(db, orgId, 'production'),
-              BillingSettings.get(db, orgId, 'sandbox'),
-              StripeCustomers.get(db, orgId, 'sandbox'),
-            ])
+          const [
+            enabledSources,
+            productionSettings,
+            productionSource,
+            sandboxSettings,
+            sandboxSource,
+          ] = await Promise.all([
+            EnabledBillingSources.listByOrg(db, orgId),
+            BillingSettings.get(db, orgId, 'production'),
+            StripeCustomers.get(db, orgId, 'production'),
+            BillingSettings.get(db, orgId, 'sandbox'),
+            StripeCustomers.get(db, orgId, 'sandbox'),
+          ])
           return c.json(
             Response.validated(schema.getOrganization.Response, {
               ...organization,
               billing: {
+                enabledSources: enabledSources.map((record) => record.source),
                 production: serializeBilling(productionSettings, productionSource),
                 sandbox: serializeBilling(sandboxSettings, sandboxSource),
               },
@@ -598,6 +644,84 @@ export function organizations() {
         }
       },
     )
+    .put(
+      '/:orgId/billing-sources/:source',
+      OpenApi.validate('param', schema.setBillingSource.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'enableAdminOrganizationBillingSource',
+        responses: OpenApi.responses({
+          errors: { 404: 'Organization not found.' },
+          success: {
+            description: 'Current enabled billing sources.',
+            schema: schema.setBillingSource.Response,
+          },
+        }),
+        summary: 'Enable billing source',
+        tags: ['Organizations'],
+      }),
+      async (c) => {
+        const { orgId, source } = c.req.valid('param')
+        const db = Db.get(c.get('db'))
+        try {
+          if (!(await Organizations.get(db, orgId))) return organizationNotFound(c)
+          await EnabledBillingSources.add(db, {
+            createdBy: c.get('identity')!.email,
+            orgId,
+            source,
+          })
+          return c.json(
+            Response.validated(schema.setBillingSource.Response, {
+              data: (await EnabledBillingSources.listByOrg(db, orgId)).map(
+                (record) => record.source,
+              ),
+            }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
+    .delete(
+      '/:orgId/billing-sources/:source',
+      OpenApi.validate('param', schema.setBillingSource.Params, {
+        code: 'param_invalid',
+        message: 'Invalid path parameters',
+      }),
+      OpenApi.describeRoute({
+        operationId: 'disableAdminOrganizationBillingSource',
+        responses: OpenApi.responses({
+          errors: { 404: 'Organization not found.' },
+          success: {
+            description: 'Current enabled billing sources.',
+            schema: schema.setBillingSource.Response,
+          },
+        }),
+        summary: 'Disable billing source',
+        tags: ['Organizations'],
+      }),
+      async (c) => {
+        const { orgId, source } = c.req.valid('param')
+        const db = Db.get(c.get('db'))
+        try {
+          if (!(await Organizations.get(db, orgId))) return organizationNotFound(c)
+          await EnabledBillingSources.remove(db, { orgId, source })
+          return c.json(
+            Response.validated(schema.setBillingSource.Response, {
+              data: (await EnabledBillingSources.listByOrg(db, orgId)).map(
+                (record) => record.source,
+              ),
+            }),
+            200,
+          )
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
+      },
+    )
     .get(
       '/:orgId/members',
       OpenApi.validate('param', schema.getOrganization.Params, {

package/src/admin/apps/scopes.test.ts

@@ -34,6 +34,11 @@ describe('GET /scopes', () => {
             "scope": "management:write",
             "selfServe": true,
           },
+          {
+            "description": "Validate and broadcast MPP payment credentials through the Tempo relay.",
+            "scope": "mpp:write",
+            "selfServe": true,
+          },
           {
             "description": "Fill and submit transactions through the relay.",
             "scope": "rpc-relay:read",

package/src/admin/apps/verified-tokens.test.ts

@@ -1,5 +1,7 @@
 import * as TestAdmin from '../../../test/Admin.js'
 import * as TestApp from '../../../test/App.js'
+import * as Organizations from '../../db/tables/organizations.js'
+import * as VerifiedTokenRequests from '../../db/tables/verifiedTokenRequests.js'
 import * as Verified from './verified-tokens.js'
 
 /** A token used for write round-trips. */
@@ -338,6 +340,205 @@ describe('PUT /verified-tokens/:address/logo', () => {
   })
 })
 
+/** A stored verification request seeded through the repo write boundary. */
+const requestInput = {
+  address: '0x20c00000000000000000000000000000000000aa',
+  chainId: 42431,
+  currency: 'USD',
+  decimals: 6,
+  name: 'Requested USD',
+  orgId: 'org_1a2b3c4d5e6f7g8h9j0k1m2n',
+  requestedBy: 'usr_1a2b3c4d5e6f7g8h9j0k1m2n',
+  symbol: 'rUSD',
+} as const
+
+describe('GET /verified-tokens/requests', () => {
+  test('denied identity → 401', async () => {
+    const { client } = TestAdmin.setup({ identify: () => null })
+    const response = await client['verified-tokens'].requests.$get({ query: {} })
+    expect(response.status).toBe(401)
+  })
+
+  test('lists the queue by status with org names', async () => {
+    const { client, db } = TestAdmin.setup()
+    const org = await Organizations.create(db, { name: 'Acme' })
+    const pending = await VerifiedTokenRequests.create(db, {
+      ...requestInput,
+      logo: '<svg xmlns="http://www.w3.org/2000/svg"/>',
+      orgId: org.id,
+    })
+    const denied = await VerifiedTokenRequests.create(db, {
+      ...requestInput,
+      address: '0x20c00000000000000000000000000000000000bb',
+      symbol: 'rEUR',
+    })
+    await VerifiedTokenRequests.review(db, denied!.id, {
+      reviewedBy: 'admin@tempo.xyz',
+      status: 'denied',
+    })
+
+    const queue = await client['verified-tokens'].requests.$get({ query: {} })
+    expect(queue.status).toBe(200)
+    const queueBody = await TestApp.json(queue, Verified.schema.listVerifiedTokenRequests.Response)
+    expect(queueBody.data.map(({ id, orgName }) => ({ id, orgName }))).toEqual([
+      { id: pending!.id, orgName: 'Acme' },
+    ])
+    // The uploaded SVG surfaces to reviewers.
+    expect(queueBody.data[0]?.logo).toBe('<svg xmlns="http://www.w3.org/2000/svg"/>')
+
+    const reviewed = await client['verified-tokens'].requests.$get({ query: { status: 'denied' } })
+    const reviewedBody = await TestApp.json(reviewed, Verified.schema.listVerifiedTokenRequests.Response) // prettier-ignore
+    expect(reviewedBody.data.map(({ id }) => id)).toEqual([denied!.id])
+  })
+})
+
+describe('POST /verified-tokens/requests/:requestId/approve', () => {
+  test('publishes the token and stamps the review', async () => {
+    const { client, db } = TestAdmin.setup()
+    const org = await Organizations.create(db, { name: 'Acme' })
+    const request = await VerifiedTokenRequests.create(db, { ...requestInput, orgId: org.id })
+
+    const approved = await client['verified-tokens'].requests[':requestId'].approve.$post({
+      param: { requestId: request!.id },
+    })
+    expect(approved.status).toBe(200)
+    const body = await TestApp.json(approved, Verified.schema.reviewVerifiedTokenRequest.Response)
+    expect(body.data).toMatchObject({
+      orgName: 'Acme',
+      reviewedBy: TestAdmin.identity.email,
+      status: 'approved',
+    })
+    expect(Date.parse(body.data.reviewedAt!)).not.toBeNaN()
+
+    const listed = await client['verified-tokens'].$get({ query: { chainId } })
+    const listedBody = await TestApp.json(listed, Verified.schema.listVerifiedTokens.Response)
+    expect(listedBody.data.map(({ address }) => address)).toEqual([requestInput.address])
+
+    const repeat = await client['verified-tokens'].requests[':requestId'].approve.$post({
+      param: { requestId: request!.id },
+    })
+    expect(repeat.status).toBe(409)
+    const repeatBody = (await repeat.json()) as { error?: { code?: string } }
+    expect(repeatBody.error?.code).toBe('request_not_pending')
+  })
+
+  test('publishes an uploaded logo to the asset store', async () => {
+    const svg = '<svg xmlns="http://www.w3.org/2000/svg"/>'
+    const stored: { key: string; content: { body: ArrayBuffer; contentType: string } }[] = []
+    const { client, db } = TestAdmin.setup({
+      assets: {
+        get: async (key) => stored.find((entry) => entry.key === key)?.content,
+        put: async (key, content) => void stored.push({ content, key }),
+      },
+    })
+    const request = await VerifiedTokenRequests.create(db, { ...requestInput, logo: svg })
+
+    const approved = await client['verified-tokens'].requests[':requestId'].approve.$post({
+      param: { requestId: request!.id },
+    })
+    expect(approved.status).toBe(200)
+    expect(stored).toHaveLength(1)
+    expect(stored[0]?.key).toBe(`42431/icons/${requestInput.address}`)
+    expect(new TextDecoder().decode(stored[0]?.content.body)).toBe(svg)
+
+    const listed = await client['verified-tokens'].$get({ query: { chainId } })
+    const listedBody = await TestApp.json(listed, Verified.schema.listVerifiedTokens.Response)
+    expect(listedBody.data.map(({ address }) => address)).toEqual([requestInput.address])
+  })
+
+  test('rejects an uploaded logo without an asset writer, keeping the request pending', async () => {
+    const { client, db } = TestAdmin.setup()
+    const request = await VerifiedTokenRequests.create(db, {
+      ...requestInput,
+      logo: '<svg xmlns="http://www.w3.org/2000/svg"/>',
+    })
+
+    const approved = await client['verified-tokens'].requests[':requestId'].approve.$post({
+      param: { requestId: request!.id },
+    })
+    expect(approved.status).toBe(404)
+    const body = (await approved.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('assets_not_enabled')
+
+    const record = await VerifiedTokenRequests.get(db, request!.id)
+    expect(record?.status).toBe('pending')
+  })
+
+  test('converges when the token is already verified', async () => {
+    const { client, db } = TestAdmin.setup()
+    const request = await VerifiedTokenRequests.create(db, requestInput)
+    await client['verified-tokens'].$post({
+      json: { ...novel, address: requestInput.address, chainId: 42431, symbol: requestInput.symbol }, // prettier-ignore
+    })
+
+    const approved = await client['verified-tokens'].requests[':requestId'].approve.$post({
+      param: { requestId: request!.id },
+    })
+    expect(approved.status).toBe(200)
+    const body = await TestApp.json(approved, Verified.schema.reviewVerifiedTokenRequest.Response)
+    expect(body.data.status).toBe('approved')
+
+    // The pre-existing entry survives untouched; nothing was re-created.
+    const listed = await client['verified-tokens'].$get({ query: { chainId } })
+    const listedBody = await TestApp.json(listed, Verified.schema.listVerifiedTokens.Response)
+    expect(listedBody.data).toHaveLength(1)
+  })
+
+  test('rejects a symbol conflict and keeps the request pending', async () => {
+    const { client, db } = TestAdmin.setup()
+    // Same symbol already verified under a different address.
+    await client['verified-tokens'].$post({
+      json: { ...novel, chainId: 42431, symbol: requestInput.symbol },
+    })
+    const request = await VerifiedTokenRequests.create(db, requestInput)
+
+    const approved = await client['verified-tokens'].requests[':requestId'].approve.$post({
+      param: { requestId: request!.id },
+    })
+    expect(approved.status).toBe(409)
+    const body = (await approved.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('duplicate_symbol')
+
+    const record = await VerifiedTokenRequests.get(db, request!.id)
+    expect(record?.status).toBe('pending')
+  })
+})
+
+describe('POST /verified-tokens/requests/:requestId/deny', () => {
+  test('records the review note', async () => {
+    const { client, db } = TestAdmin.setup()
+    const request = await VerifiedTokenRequests.create(db, requestInput)
+
+    const denied = await client['verified-tokens'].requests[':requestId'].deny.$post({
+      json: { reviewNote: 'Logo unreachable.' },
+      param: { requestId: request!.id },
+    })
+    expect(denied.status).toBe(200)
+    const body = await TestApp.json(denied, Verified.schema.reviewVerifiedTokenRequest.Response)
+    expect(body.data).toMatchObject({
+      reviewNote: 'Logo unreachable.',
+      reviewedBy: TestAdmin.identity.email,
+      status: 'denied',
+    })
+
+    // Nothing was published.
+    const listed = await client['verified-tokens'].$get({ query: { chainId } })
+    const listedBody = await TestApp.json(listed, Verified.schema.listVerifiedTokens.Response)
+    expect(listedBody.data).toEqual([])
+  })
+
+  test('unknown request id → 404', async () => {
+    const { client } = TestAdmin.setup()
+    const response = await client['verified-tokens'].requests[':requestId'].deny.$post({
+      json: {},
+      param: { requestId: 'vtr_1a2b3c4d5e6f7g8h9j0k1m2n' },
+    })
+    expect(response.status).toBe(404)
+    const body = (await response.json()) as { error?: { code?: string } }
+    expect(body.error?.code).toBe('verified_token_request_not_found')
+  })
+})
+
 describe('GET /verified-tokens/:address/logo', () => {
   const svg = '<svg xmlns="http://www.w3.org/2000/svg"/>'