tapimo 0.7.1 → 0.7.2

package/src/apps/data/routes/rpc.test.ts

@@ -1,6 +1,7 @@
 import { Hex, Secp256k1 } from 'ox'
 import { ZoneRpcAuthentication } from 'ox/tempo'
 
+import type * as Log from '../../../internal/Log.js'
 import type * as Viem from '../../../internal/Viem.js'
 import * as RequestListener from '../../../handlers/internal/requestListener.js'
 import * as TestApp from '../../../../test/App.js'
@@ -9,16 +10,28 @@ import * as Runtime from '../../../../test/runtime.js'
 
 const runtime = Runtime.get()
 const zone = runtime.zone.chainId
-const zoneOptions = {
+const zoneOptions = TestApp.zone({
   chainId: zone,
-  forwardRpcUrl: runtime.zone.forwardRpcUrl,
-}
+  rpcUrl: runtime.zone.publicZoneUrl,
+})
 const zoneReader = {
   id: 'key_zone_reader',
   orgId: 'org_test',
   scopes: ['data:read', `zone:${zone}:read`],
   token: 'secret_zone_reader',
 } satisfies TestApp.kvStore.Key
+const zoneReaderOtherWriter = {
+  id: 'key_zone_reader_other_writer',
+  orgId: 'org_test',
+  scopes: ['data:read', `zone:${zone}:read`, `zone:${zone + 1}:write`],
+  token: 'secret_zone_reader_other_writer',
+} satisfies TestApp.kvStore.Key
+const zoneWriter = {
+  id: 'key_zone_writer',
+  orgId: 'org_test',
+  scopes: ['data:read', `zone:${zone}:write`],
+  token: 'secret_zone_writer',
+} satisfies TestApp.kvStore.Key
 
 // Prool's default Zone dev key.
 const zonePrivateKey = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
@@ -44,9 +57,9 @@ describe('POST /rpc', () => {
     const fetch = mockRpc()
     // A resolver that routes API-key principals to the private upstream and
     // everything else (here, the keyless `auth: false` caller) to the public one.
-    const rpc = ({ principal }: Viem.resolve.Context) =>
+    const rpc = ({ principal }: Viem.resolveRpc.Context) =>
       principal?.type === 'api_key'
-        ? { basicAuth: 'rpc-secret', url: 'https://internal.rpc.test/json-rpc' }
+        ? { auth: 'rpc:secret', url: 'https://internal.rpc.test/json-rpc' }
         : { url: 'https://public.rpc.test/json-rpc' }
 
     try {
@@ -73,7 +86,7 @@ describe('POST /rpc', () => {
       expect(fetch.calls[0]?.headers['authorization']).toMatchInlineSnapshot(`null`)
       expect(fetch.calls[1]?.url).toMatchInlineSnapshot(`"https://internal.rpc.test/json-rpc"`)
       expect(fetch.calls[1]?.headers['authorization']).toMatchInlineSnapshot(
-        `"Basic cnBjLXNlY3JldA=="`,
+        `"Basic cnBjOnNlY3JldA=="`,
       )
     } finally {
       fetch.restore()
@@ -87,7 +100,7 @@ describe('POST /rpc', () => {
       const app = TestApp.create({
         auth: false,
         rpc: {
-          basicAuth: 'rpc-secret',
+          auth: 'rpc:secret',
           url: (chainId) => `https://${chainId}.rpc.test/json-rpc`,
         },
       })
@@ -123,7 +136,7 @@ describe('POST /rpc', () => {
       expect(call.body).toMatchInlineSnapshot(
         `"{"id":1,"jsonrpc":"2.0","method":"eth_chainId","params":[]}"`,
       )
-      expect(call.headers['authorization']).toMatchInlineSnapshot(`"Basic cnBjLXNlY3JldA=="`)
+      expect(call.headers['authorization']).toMatchInlineSnapshot(`"Basic cnBjOnNlY3JldA=="`)
       expect(call.headers['cookie']).toMatchInlineSnapshot(`null`)
       expect(call.headers['tempo-api-key']).toMatchInlineSnapshot(`null`)
       expect(call.headers['x-authorization-token']).toBeNull()
@@ -133,13 +146,330 @@ describe('POST /rpc', () => {
     }
   })
 
+  test('records JSON-RPC server errors returned with HTTP 200', async () => {
+    const entries: Log.Entry[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() =>
+        Response.json({
+          error: { code: -32603, message: 'internal error' },
+          id: 1,
+          jsonrpc: '2.0',
+        }),
+      ),
+    )
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        logger: (entry) => void entries.push(entry),
+        rpc: { url: server.url },
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(await response.json()).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": -32603,
+            "message": "internal error",
+          },
+          "id": 1,
+          "jsonrpc": "2.0",
+        }
+      `)
+      expect(entries[0]).toMatchObject({
+        level: 'error',
+        route: '/rpc/:chain{(mainnet|testnet|[0-9]+)}?',
+        rpc: { code: -32603, errors: 1, serverErrors: 1 },
+        status: 200,
+      })
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('attributes non-success RPC responses to the upstream', async () => {
+    const entries: Log.Entry[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() =>
+        Response.json({ error: 'unavailable' }, { status: 503 }),
+      ),
+    )
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        logger: (entry) => void entries.push(entry),
+        rpc: { url: server.url },
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(503)
+      expect(entries[0]).toMatchObject({
+        provider: {
+          chainId: runtime.chainId,
+          failure: 'http',
+          id: 'rpc',
+          operation: 'request',
+          status: 503,
+        },
+      })
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test.each([400, 413, 415, 422])(
+    'keeps caller HTTP %s responses out of upstream alerts',
+    async (status) => {
+      const entries: Log.Entry[] = []
+      const server = await Relay.createServer(
+        RequestListener.fromFetchHandler(() =>
+          Response.json({ error: 'invalid request' }, { status }),
+        ),
+      )
+
+      try {
+        const app = TestApp.create({
+          auth: false,
+          logger: (entry) => void entries.push(entry),
+          rpc: { url: server.url },
+        })
+        const response = await app.fetch(
+          new Request('http://tempo-api.test/rpc', {
+            body: '{',
+            method: 'POST',
+          }),
+        )
+
+        expect(response.status).toBe(status)
+        expect(entries[0]?.provider).toBeUndefined()
+      } finally {
+        await server.closeAsync()
+      }
+    },
+  )
+
+  test('attributes RPC transport failures to the upstream', async () => {
+    const entries: Log.Entry[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() =>
+        Response.json({ id: 1, jsonrpc: '2.0', result: '0x1' }),
+      ),
+    )
+    const url = server.url
+    await server.closeAsync()
+
+    const app = TestApp.create({
+      auth: false,
+      logger: (entry) => void entries.push(entry),
+      rpc: { url },
+    })
+    const response = await app.fetch(
+      new Request('http://tempo-api.test/rpc', {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(502)
+    expect(entries[0]).toMatchObject({
+      provider: {
+        chainId: runtime.chainId,
+        failure: 'network',
+        id: 'rpc',
+        operation: 'request',
+      },
+    })
+  })
+
+  test.each([
+    { body: { id: 1, jsonrpc: '2.0' }, name: 'missing result' },
+    { body: [], name: 'empty batch' },
+  ])('attributes malformed JSON-RPC $name payloads to the upstream', async ({ body }) => {
+    const entries: Log.Entry[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() => Response.json(body)),
+    )
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        logger: (entry) => void entries.push(entry),
+        rpc: { url: server.url },
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(entries[0]).toMatchObject({
+        provider: {
+          chainId: runtime.chainId,
+          failure: 'payload',
+          id: 'rpc',
+          operation: 'request',
+        },
+      })
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('accepts empty responses to JSON-RPC notifications', async () => {
+    const entries: Log.Entry[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() => new Response(null, { status: 200 })),
+    )
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        logger: (entry) => void entries.push(entry),
+        rpc: { url: server.url },
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ jsonrpc: '2.0', method: 'eth_sendRawTransaction' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(entries[0]?.provider).toBeUndefined()
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('preserves large streaming request bodies during inspection', async () => {
+    const bodies: string[] = []
+    const requestBody = JSON.stringify({
+      id: 1,
+      jsonrpc: '2.0',
+      method: 'eth_call',
+      params: [`0x${'ab'.repeat(40_000)}`, 'latest'],
+    })
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(async (request) => {
+        bodies.push(await request.text())
+        return Response.json({ id: 1, jsonrpc: '2.0', result: '0x' })
+      }),
+    )
+
+    try {
+      const app = TestApp.create({ auth: false, rpc: { url: server.url } })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', { body: requestBody, method: 'POST' }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(bodies).toEqual([requestBody])
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('preserves RPC responses larger than the inspection bound', async () => {
+    const result = `0x${'ab'.repeat(40_000)}`
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() => Response.json({ id: 1, jsonrpc: '2.0', result })),
+    )
+
+    try {
+      const app = TestApp.create({ auth: false, rpc: { url: server.url } })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_getLogs' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(await response.json()).toEqual({ id: 1, jsonrpc: '2.0', result })
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('does not attribute Zone caller-auth responses to the RPC provider', async () => {
+    const entries: Log.Entry[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler(() =>
+        Response.json(
+          {
+            error: { code: -32_000, message: 'invalid zone credential' },
+            id: 1,
+            jsonrpc: '2.0',
+          },
+          { status: 401 },
+        ),
+      ),
+    )
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        logger: (entry) => void entries.push(entry),
+        zones: [TestApp.zone({ chainId: zone, rpcUrl: server.url })],
+      })
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test/rpc/${zone}`, {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          headers: { [ZoneRpcAuthentication.headerName]: 'invalid-zone-credential' },
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(401)
+      expect(entries[0]?.provider).toBeUndefined()
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('forwards inferred RPC bearer auth', async () => {
+    const fetch = mockRpc()
+
+    try {
+      const app = TestApp.create({
+        auth: false,
+        rpc: { auth: 'rpc-token', url: 'https://internal.rpc.test/json-rpc' },
+      })
+      const response = await app.fetch(
+        new Request('http://tempo-api.test/rpc', {
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(200)
+      expect(fetch.calls[0]?.headers['authorization']).toBe('Bearer rpc-token')
+    } finally {
+      fetch.restore()
+    }
+  })
+
   test('allows eth-prefixed methods anonymously', async () => {
     const fetch = mockRpc()
 
     try {
       const app = TestApp.create({
         rpc: {
-          basicAuth: 'rpc-secret',
+          auth: 'rpc:secret',
           url: (chainId) => `https://${chainId}.rpc.test/json-rpc`,
         },
       })
@@ -310,7 +640,8 @@ describe('POST /rpc', () => {
     try {
       const app = TestApp.create({
         auth: false,
-        zones: [{ chainId: zone, forwardRpcUrl: `https://${zone}.rpc.test` }],
+        rpc: { auth: 'rpc:secret', url: () => 'https://internal.rpc.test' },
+        zones: [TestApp.zone({ chainId: zone, rpcUrl: `https://${zone}.rpc.test` })],
       })
 
       const response = await app.fetch(
@@ -327,10 +658,9 @@ describe('POST /rpc', () => {
 
       expect(response.status).toMatchInlineSnapshot(`200`)
       expect(call.url).toBe(`https://${zone}.rpc.test/`)
-      // Zone RPC auth: the caller's signed token passes through; the API's own
-      // credentials do not leak upstream.
+      // Public Zone URLs receive only the caller's token.
       expect(call.headers['x-authorization-token']).toMatchInlineSnapshot(`"zone-token"`)
-      expect(call.headers['authorization']).toBeNull()
+      expect(call.headers['authorization']).toMatchInlineSnapshot(`null`)
       expect(call.headers['tempo-api-key']).toMatchInlineSnapshot(`null`)
     } finally {
       fetch.restore()
@@ -343,7 +673,7 @@ describe('POST /rpc', () => {
     try {
       const app = TestApp.create({
         auth: false,
-        zones: [{ chainId: zone, forwardRpcUrl: `https://${zone}.rpc.test` }],
+        zones: [TestApp.zone({ chainId: zone, rpcUrl: `https://${zone}.rpc.test` })],
       })
 
       const response = await app.fetch(
@@ -391,42 +721,114 @@ describe('POST /rpc', () => {
     expect(response.status).toBe(200)
   })
 
-  test('forwards RPC basic auth to the internal Zone RPC', async () => {
+  test('allows Zone-scoped metadata reads with internal RPC auth', async () => {
     const authorization: (string | null)[] = []
+    const bodies: string[] = []
     const server = await Relay.createServer(
       RequestListener.fromFetchHandler(async (request) => {
         authorization.push(request.headers.get('authorization'))
-        return Response.json({ id: 1, jsonrpc: '2.0', result: Hex.fromNumber(zone) })
+        bodies.push(await request.text())
+        return Response.json({ id: 1, jsonrpc: '2.0', result: {} })
       }),
     )
     try {
       const app = TestApp.create({
         auth: { keys: [zoneReader] },
-        rpc: ({ chainId }) =>
-          chainId === zone ? { basicAuth: 'rpc-secret', url: server.url } : {},
+        rpc: ({ chainId }) => (chainId === zone ? { auth: 'rpc:secret', url: server.url } : {}),
         zones: [zoneOptions],
       })
+      for (const method of ['zone_getEncryptionKey', 'zone_getZoneInfo']) {
+        const response = await app.fetch(
+          new Request(`http://tempo-api.test/rpc/${zone}`, {
+            body: JSON.stringify({ id: 1, jsonrpc: '2.0', method }),
+            headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+            method: 'POST',
+          }),
+        )
+
+        expect(response.status).toBe(200)
+      }
+      expect(authorization).toEqual(['Basic cnBjOnNlY3JldA==', 'Basic cnBjOnNlY3JldA=='])
+      expect(bodies).toEqual([
+        '{"id":1,"jsonrpc":"2.0","method":"zone_getEncryptionKey"}',
+        '{"id":1,"jsonrpc":"2.0","method":"zone_getZoneInfo"}',
+      ])
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
+  test('blocks caller-authenticated Zone methods for Zone read scopes', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({
+          id: 1,
+          jsonrpc: '2.0',
+          method: 'zone_getAuthorizationTokenInfo',
+        }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
+  })
+
+  test('rejects writes without the matching Zone write scope', async () => {
+    for (const key of [zoneReader, zoneReaderOtherWriter]) {
+      const app = TestApp.create({ auth: { keys: [key] }, zones: [zoneOptions] })
       const response = await app.fetch(
         new Request(`http://tempo-api.test/rpc/${zone}`, {
-          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
-          headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+          body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_sendRawTransaction' }),
+          headers: { 'content-type': 'application/json', 'tempo-api-key': key.token },
           method: 'POST',
         }),
       )
 
-      expect(response.status).toBe(200)
-      expect(authorization).toEqual(['Basic cnBjLXNlY3JldA=='])
-    } finally {
-      await server.closeAsync()
+      expect(response.status).toBe(403)
+      expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
     }
   })
 
-  test('rejects Zone-scoped writes before the internal RPC', async () => {
-    const app = TestApp.create({ auth: { keys: [zoneReader] }, zones: [zoneOptions] })
+  test('allows Zone-scoped signed transaction broadcasts', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneWriter] }, zones: [zoneOptions] })
     const response = await app.fetch(
       new Request(`http://tempo-api.test/rpc/${zone}`, {
-        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_sendRawTransaction' }),
-        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneReader.token },
+        body: JSON.stringify({
+          id: 1,
+          jsonrpc: '2.0',
+          method: 'eth_sendRawTransactionSync',
+          params: ['0x76'],
+        }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneWriter.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+  })
+
+  test('allows Zone write scopes to read', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneWriter] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneWriter.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+  })
+
+  test('keeps unlocked-account methods blocked for Zone write scopes', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneWriter] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_sendTransaction' }),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneWriter.token },
         method: 'POST',
       }),
     )
@@ -452,6 +854,22 @@ describe('POST /rpc', () => {
     expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
   })
 
+  test('allows a Zone write scope to batch reads and signed broadcasts', async () => {
+    const app = TestApp.create({ auth: { keys: [zoneWriter] }, zones: [zoneOptions] })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test/rpc/${zone}`, {
+        body: JSON.stringify([
+          { id: 1, jsonrpc: '2.0', method: 'eth_chainId' },
+          { id: 2, jsonrpc: '2.0', method: 'eth_sendRawTransaction', params: ['0x76'] },
+        ]),
+        headers: { 'content-type': 'application/json', 'tempo-api-key': zoneWriter.token },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(200)
+  })
+
   test('routes caller Zone tokens to the private RPC', async () => {
     const app = TestApp.create({ auth: false, zones: [zoneOptions] })
     const response = await app.fetch(