tapimo 0.7.1 → 0.8.0

package/src/admin/apps/api-keys.ts

@@ -1,7 +1,12 @@
 import { Hono } from 'hono'
 import * as z from 'zod/mini'
 
+import * as core_ApiKey from '../../ApiKey.js'
 import * as ApiKeys from '../../ApiKeys.js'
+import * as Db from '../../db/Db.js'
+import * as Organizations from '../../db/tables/organizations.js'
+import * as Projects from '../../db/tables/projects.js'
+import * as Users from '../../db/tables/users.js'
 import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
@@ -10,14 +15,51 @@ import type * as App from '../App.js'
 
 /** Zod schemas owned by the admin API-keys handler. */
 export namespace schema {
+  const Name = z
+    .pipe(
+      z.string(),
+      z.transform((value) => value.trim()),
+    )
+    .check(
+      z.minLength(1),
+      z.maxLength(100),
+      z.describe('Human-readable purpose of the key.'),
+      z.meta({ examples: ['Explorer testnet'] }),
+    )
+
+  const ApiKey = Schema.describe(
+    z.extend(ApiKeys.schema.Record, {
+      createdByLabel: z
+        .nullable(z.string())
+        .check(
+          z.describe('Resolved creator identity, or null when unavailable.'),
+          z.meta({ examples: ['alex@tempo.xyz'] }),
+        ),
+      organizationName: z
+        .nullable(z.string())
+        .check(
+          z.describe('Resolved organization name, or null when unattributed or unavailable.'),
+          z.meta({ examples: ['Tempo'] }),
+        ),
+      projectName: z
+        .nullable(z.string())
+        .check(
+          z.describe('Resolved project name, or null when unattributed or unavailable.'),
+          z.meta({ examples: ['Explorer'] }),
+        ),
+    }),
+    'An API key with resolved operational attribution.',
+  )
+
   /** Schemas for the createApiKey operation. */
   export namespace createApiKey {
     /**
-     * Request body for minting a key (`MintInput` minus `createdBy`, which the
-     * server sets from the verified identity so it can't be spoofed).
+     * Request body for minting a named key. The server sets `createdBy` from
+     * the verified identity so it cannot be spoofed.
      */
     export const Body = Schema.describe(
-      z.extend(z.omit(ApiKeys.schema.MintInput, { createdBy: true }), {
+      z.extend(z.omit(ApiKeys.schema.MintInput, { createdBy: true, name: true }), {
+        name: Name,
         scopes: z
           .readonly(
             z.array(
@@ -58,30 +100,36 @@ export namespace schema {
     export const Response = Schema.describe(
       z.object({
         data: z
-          .array(ApiKeys.schema.Record)
+          .array(ApiKey)
           .check(z.describe('API-key records, newest first (metadata only — never tokens).')),
       }),
       'A list of API-key records.',
     )
   }
 
-  /** Schemas for the attributeApiKey operation. */
-  export namespace attributeApiKey {
-    /** Request body re-attributing a key; omitted fields keep their value. */
+  /** Schemas for the updateApiKey operation. */
+  export namespace updateApiKey {
+    /** Request body updating a key; omitted fields keep their value. */
     export const Body = Schema.describe(
       z.object({
-        orgId: z.optional(z.string()).check(z.describe('New owning organization id (`org_…`).')),
+        allowedIps: z
+          .optional(core_ApiKey.schema.AllowedIps)
+          .check(z.describe('Replacement client IP/CIDR allowlist. An empty list clears it.')),
+        name: z.optional(Name).check(z.describe('New human-readable key name.')),
+        orgId: z
+          .optional(z.string())
+          .check(z.describe('Owning organization id to assign to an unattributed key (`org_…`).')),
         projectId: z.optional(z.string()).check(z.describe('New attributed project id (`prj_…`).')),
       }),
-      'Attribution to apply to an API key.',
+      'Metadata to apply to an API key.',
     )
 
-    /** Path parameters for attributing a key. */
+    /** Path parameters for updating a key. */
     export const Params = z
       .object({
-        id: z.string().check(z.describe('Stable id of the key to attribute.')),
+        id: z.string().check(z.describe('Stable id of the key to update.')),
       })
-      .check(z.describe('Path parameters for attributing an API key.'))
+      .check(z.describe('Path parameters for updating an API key.'))
   }
 
   /** Schemas for the backfillApiKeys operation. */
@@ -119,7 +167,7 @@ export namespace schema {
  *   returning the one-time token.
  * - `GET /` lists key records (metadata only), optionally filtered by `orgId`.
  * - `DELETE /:id` revokes a key by id (`404` if absent).
- * - `PATCH /:id` re-attributes a key to an org/project (the legacy backfill path).
+ * - `PATCH /:id` updates a key's allowlist, name, or project, or assigns its first organization.
  * - `POST /backfill` rebuilds the id and org index entries for every record.
  */
 export function apiKeys() {
@@ -152,6 +200,7 @@ export function apiKeys() {
       OpenApi.describeRoute({
         operationId: 'createApiKey',
         responses: OpenApi.responses({
+          errors: { 404: 'Organization or project not found.' },
           success: {
             description: 'Minted key (includes the one-time token).',
             schema: schema.createApiKey.Response,
@@ -161,13 +210,44 @@ export function apiKeys() {
         tags: ['API keys'],
       }),
       async (c) => {
-        // `createdBy` is the verified admin email, never client-supplied.
-        // `requireAuth` guarantees identity on this gated route.
-        const { record, token } = await ApiKeys.mint(c.get('kv').store, {
-          ...c.req.valid('json'),
-          createdBy: c.get('identity')!.email,
-        })
-        return c.json(Response.validated(schema.createApiKey.Response, { ...record, token }))
+        const input = c.req.valid('json')
+        const db = Db.get(c.get('db'))
+        try {
+          const [organization, project] = await Promise.all([
+            input.orgId === undefined ? undefined : Organizations.get(db, input.orgId),
+            input.projectId === undefined ? undefined : Projects.get(db, input.projectId),
+          ])
+          if (input.orgId !== undefined && !organization)
+            return Response.error(c, {
+              code: 'not_found',
+              message: 'Organization not found.',
+              status: 404,
+            })
+          if (input.projectId !== undefined && !project)
+            return Response.error(c, {
+              code: 'not_found',
+              message: 'Project not found.',
+              status: 404,
+            })
+          if (project && input.orgId !== undefined && project.orgId !== input.orgId)
+            return Response.error(c, {
+              code: 'not_found',
+              message: 'Project not found in this organization.',
+              status: 404,
+            })
+          const orgId = input.orgId ?? project?.orgId
+
+          // `createdBy` is the verified admin email, never client-supplied.
+          // `requireAuth` guarantees identity on this gated route.
+          const { record, token } = await ApiKeys.mint(c.get('kv').store, {
+            ...input,
+            createdBy: c.get('identity')!.email,
+            ...(orgId === undefined ? {} : { orgId }),
+          })
+          return c.json(Response.validated(schema.createApiKey.Response, { ...record, token }))
+        } catch (cause) {
+          return Response.upstream(c, cause)
+        }
       },
     )
     .get(
@@ -186,9 +266,10 @@ export function apiKeys() {
       }),
       async (c) => {
         const { orgId } = c.req.valid('query')
-        const data = orgId
+        const records = orgId
           ? await ApiKeys.listByOrg(c.get('kv').store, orgId)
           : await ApiKeys.list(c.get('kv').store)
+        const data = await enrichKeys(Db.get(c.get('db')), records)
         return c.json(Response.validated(schema.listApiKeys.Response, { data }))
       },
     )
@@ -221,27 +302,57 @@ export function apiKeys() {
     )
     .patch(
       '/:id',
-      OpenApi.validate('param', schema.attributeApiKey.Params, {
+      OpenApi.validate('param', schema.updateApiKey.Params, {
         code: 'param_invalid',
         message: 'Invalid path parameters',
       }),
-      OpenApi.validate('json', schema.attributeApiKey.Body, {
+      OpenApi.validate('json', schema.updateApiKey.Body, {
         code: 'body_invalid',
         message: 'Invalid request body',
       }),
       OpenApi.describeRoute({
-        description: 'Re-attribute a key to an organization and/or project. The token is unchanged.', // prettier-ignore
-        operationId: 'attributeApiKey',
+        description: 'Update a key allowlist, name, or project, or assign its first organization. The token is unchanged.', // prettier-ignore
+        operationId: 'updateApiKey',
         responses: OpenApi.responses({
-          errors: { 404: 'API key not found.' },
+          errors: {
+            404: 'API key or organization not found.',
+            409: 'API key already belongs to another organization.',
+          },
           success: { description: 'The updated key record.', schema: ApiKeys.schema.Record },
         }),
-        summary: 'Attribute API key',
+        summary: 'Update API key',
         tags: ['API keys'],
       }),
       async (c) => {
         const { id } = c.req.valid('param')
-        const updated = await ApiKeys.attribute(c.get('kv').store, id, c.req.valid('json'))
+        const input = c.req.valid('json')
+        const store = c.get('kv').store
+        const record = await ApiKeys.get(store, id)
+        if (!record)
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'API key not found.',
+            status: 404,
+          })
+
+        // One-off keys use their key id as `orgId`.
+        if (input.orgId !== undefined && record.orgId !== record.id && input.orgId !== record.orgId)
+          return Response.error(c, {
+            code: 'organization_already_assigned',
+            message: 'API key already belongs to an organization.',
+            status: 409,
+          })
+        if (
+          input.orgId !== undefined &&
+          !(await Organizations.get(Db.get(c.get('db')), input.orgId))
+        )
+          return Response.error(c, {
+            code: 'not_found',
+            message: 'Organization not found.',
+            status: 404,
+          })
+
+        const updated = await ApiKeys.update(store, id, input)
         if (!updated)
           return Response.error(c, {
             code: 'not_found',
@@ -252,3 +363,34 @@ export function apiKeys() {
       },
     )
 }
+
+/** Resolves display labels without changing the authoritative key record. */
+async function enrichKeys(db: Db.Db, records: readonly ApiKeys.Record[]) {
+  const organizationIds = [
+    ...new Set(records.map(({ orgId }) => orgId).filter((id) => id.startsWith('org_'))),
+  ]
+  const projectIds = [
+    ...new Set(records.flatMap(({ projectId }) => (projectId ? [projectId] : []))),
+  ]
+  const userIds = [
+    ...new Set(
+      records.flatMap(({ createdBy }) => (createdBy?.startsWith('usr_') ? [createdBy] : [])),
+    ),
+  ]
+  const [organizations, projects, users] = await Promise.all([
+    Organizations.listByIds(db, organizationIds),
+    Projects.listByIds(db, projectIds),
+    Users.listByIds(db, userIds),
+  ])
+  const organizationNames = new Map(organizations.map(({ id, name }) => [id, name]))
+  const projectNames = new Map(projects.map(({ id, name }) => [id, name]))
+  const userLabels = new Map(users.map(({ address, email, id }) => [id, email ?? address ?? id]))
+  return records.map((record) => ({
+    ...record,
+    createdByLabel: record.createdBy
+      ? (userLabels.get(record.createdBy) ?? record.createdBy)
+      : null,
+    organizationName: organizationNames.get(record.orgId) ?? null,
+    projectName: record.projectId ? (projectNames.get(record.projectId) ?? null) : null,
+  }))
+}

package/src/admin/apps/earn-vaults.test.ts

@@ -0,0 +1,338 @@
+import { Hono } from 'hono'
+import { tempoTestnet } from 'viem/tempo/chains'
+
+import * as TestAdmin from '../../../test/Admin.js'
+import * as TestApp from '../../../test/App.js'
+import * as TestEarn from '../../../test/Earn.js'
+import * as Runtime from '../../../test/runtime.js'
+import * as Earn from '../../apps/data/routes/earn.js'
+import * as core_EarnVaults from '../../db/tables/earnVaults.js'
+import * as App from './earn-vaults.js'
+
+const asset = TestEarn.assetTokenAddress
+const vaultAddress = TestEarn.vaultAddress
+
+const input = {
+  chainId: tempoTestnet.id,
+  description: 'Bridge test PATHUSD deposited into the canonical Earn v1 stack.',
+  label: 'btPATHUSD Earn',
+  privateInputTokens: [],
+  privateOutputTokens: [],
+  slug: 'btpathusd-earn',
+  vaultAddress,
+} as const
+
+describe('authentication', () => {
+  test('denied identity returns 401', async () => {
+    const { app } = TestAdmin.setup({ identify: () => null })
+    const [detail, list, put, remove] = await Promise.all([
+      app.request(`/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}`),
+      app.request(`/earn/verified-vaults?chainId=${tempoTestnet.id}`),
+      app.request('/earn/verified-vaults', {
+        body: JSON.stringify(input),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      }),
+      app.request(`/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}`, {
+        method: 'DELETE',
+      }),
+    ])
+    expect([detail.status, list.status, put.status, remove.status]).toEqual([401, 401, 401, 401])
+  })
+})
+
+describe('getVerifiedEarnVault', () => {
+  test('rejects malformed vault addresses', async () => {
+    const { app } = TestAdmin.setup()
+    const response = await app.request(`/earn/verified-vaults/invalid?chainId=${tempoTestnet.id}`)
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'vault_id_invalid' } })
+  })
+
+  // This surface cannot measure rates or value assets, so it rejects both
+  // fields instead of answering with a null that reads as unmeasurable.
+  test('rejects rate and valuation includes', async () => {
+    const { app } = TestAdmin.setup()
+    const response = await app.request(
+      `/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}&include=apy,tvl`,
+    )
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'query_invalid' } })
+  })
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'resolves an unverified vault for registry entry',
+    async () => {
+      const db = TestApp.database()
+      const { app } = TestAdmin.setup({ db, zones: [TestEarn.zone] })
+      const publicApp = TestApp.create({ auth: false, db, zones: [TestEarn.zone] })
+      const query = `?chainId=${tempoTestnet.id}&include=access,capabilities,zone`
+      const [response, publicResponse] = await Promise.all([
+        app.request(`/earn/verified-vaults/${vaultAddress}${query}`),
+        publicApp.request(`/v1/earn/vaults/${vaultAddress}${query}`),
+      ])
+      expect([response.status, publicResponse.status]).toEqual([200, 200])
+      const [vault, publicVault] = await Promise.all([
+        TestApp.json(response, App.schema.getVerifiedEarnVault.Response),
+        TestApp.json(publicResponse, Earn.schema.getEarnVault.Response),
+      ])
+      // Every field the admin include set can select is resolved identically to
+      // the public surface.
+      expect(publicVault.meta).toBeUndefined()
+      expect(vault).toStrictEqual(publicVault)
+      expect({
+        description: vault.description,
+        slug: vault.slug,
+        vaultAddress: vault.vaultAddress,
+        verified: vault.verified,
+      }).toMatchInlineSnapshot(`
+        {
+          "description": null,
+          "slug": null,
+          "vaultAddress": "0xf4ae63687d6753a78e7f551d2eda1d0d31a5ea3a",
+          "verified": false,
+        }
+      `)
+    },
+    90_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'returns token logo URLs under the app mount',
+    async () => {
+      const { app } = TestAdmin.setup({
+        assets: {
+          get: async (key) =>
+            key === `${tempoTestnet.id}/icons/${asset}`
+              ? { body: new ArrayBuffer(0), contentType: 'image/svg+xml' }
+              : undefined,
+        },
+        zones: [TestEarn.zone],
+      })
+      const mounted = new Hono().route('/admin', app)
+      const response = await mounted.request(
+        `http://host/admin/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}&include=token.logoUri`,
+      )
+      const vault = await TestApp.json(response, App.schema.getVerifiedEarnVault.Response)
+      expect(vault.assetToken.logoUri).toBe(
+        `http://host/admin/verified-tokens/${asset}/logo?chainId=${tempoTestnet.id}`,
+      )
+      expect((await mounted.request(vault.assetToken.logoUri!)).status).toBe(200)
+    },
+    90_000,
+  )
+})
+
+describe('listVerifiedEarnVaults', () => {
+  test('rejects rate and valuation includes', async () => {
+    const { app } = TestAdmin.setup()
+    const response = await app.request(
+      `/earn/verified-vaults?chainId=${tempoTestnet.id}&include=apy,tvl`,
+    )
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'query_invalid' } })
+  })
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'matches the public verified collection',
+    async () => {
+      const db = TestApp.database()
+      await core_EarnVaults.upsert(db, TestEarn.verifiedVault)
+      const { app } = TestAdmin.setup({ db, zones: [TestEarn.zone] })
+      const publicApp = TestApp.create({ auth: false, db, zones: [TestEarn.zone] })
+      const query = `?chainId=${tempoTestnet.id}&include=access,capabilities,zone&limit=5`
+      const [response, publicResponse] = await Promise.all([
+        app.request(`/earn/verified-vaults${query}`),
+        publicApp.request(`/v1/earn/vaults/verified${query}`),
+      ])
+      expect([response.status, publicResponse.status]).toEqual([200, 200])
+      const [body, publicBody] = await Promise.all([
+        TestApp.json(response, App.schema.listVerifiedEarnVaults.Response),
+        TestApp.json(publicResponse, App.schema.listVerifiedEarnVaults.Response),
+      ])
+      expect(body).toStrictEqual(publicBody)
+    },
+    90_000,
+  )
+})
+
+describe('putVerifiedEarnVault', () => {
+  test('rejects invalid slugs', async () => {
+    const { app } = TestAdmin.setup()
+    const response = await app.request('/earn/verified-vaults', {
+      body: JSON.stringify({ ...input, slug: 'Not a slug' }),
+      headers: { 'content-type': 'application/json' },
+      method: 'PUT',
+    })
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+  })
+
+  test('rejects derived fields', async () => {
+    const { app } = TestAdmin.setup()
+    const response = await app.request('/earn/verified-vaults', {
+      body: JSON.stringify({ ...input, engine: { type: 'erc4626' } }),
+      headers: { 'content-type': 'application/json' },
+      method: 'PUT',
+    })
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+  })
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'rejects private tokens without a configured router',
+    async () => {
+      const { app } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          ...input,
+          privateInputTokens: [asset],
+          privateOutputTokens: [asset],
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(409)
+      expect(await response.json()).toMatchObject({
+        error: { code: 'earn_vault_verification_failed' },
+      })
+    },
+    90_000,
+  )
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'verifies, stores, and updates curated fields',
+    async () => {
+      const { app, db } = TestAdmin.setup({ zones: [TestEarn.zone] })
+      const response = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify(input),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(response.status).toBe(200)
+      const body = await TestApp.json(response, App.schema.putVerifiedEarnVault.Response)
+      expect({
+        description: body.description,
+        engineType: body.engine.type,
+        gatewayExposed: 'gateway' in body,
+        id: body.id,
+        label: body.label,
+        slug: body.slug,
+        vaultAddress: body.vaultAddress,
+        verified: body.verified,
+        zone: body.zone,
+      }).toMatchInlineSnapshot(`
+        {
+          "description": "Bridge test PATHUSD deposited into the canonical Earn v1 stack.",
+          "engineType": "erc4626",
+          "gatewayExposed": false,
+          "id": "0xf4ae63687d6753a78e7f551d2eda1d0d31a5ea3a",
+          "label": "btPATHUSD Earn",
+          "slug": "btpathusd-earn",
+          "vaultAddress": "0xf4ae63687d6753a78e7f551d2eda1d0d31a5ea3a",
+          "verified": true,
+          "zone": null,
+        }
+      `)
+
+      const created = await core_EarnVaults.get(db, {
+        chainId: tempoTestnet.id,
+        vaultAddress,
+      })
+      const updatedResponse = await app.request('/earn/verified-vaults', {
+        body: JSON.stringify({
+          chainId: tempoTestnet.id,
+          description: null,
+          label: 'Updated btPATHUSD Earn',
+          slug: 'updated-btpathusd-earn',
+          vaultAddress,
+        }),
+        headers: { 'content-type': 'application/json' },
+        method: 'PUT',
+      })
+      expect(updatedResponse.status).toBe(200)
+      const updated = await TestApp.json(updatedResponse, App.schema.putVerifiedEarnVault.Response)
+      expect({
+        description: updated.description,
+        label: updated.label,
+        slug: updated.slug,
+        zone: updated.zone,
+      }).toMatchInlineSnapshot(`
+        {
+          "description": null,
+          "label": "Updated btPATHUSD Earn",
+          "slug": "updated-btpathusd-earn",
+          "zone": null,
+        }
+      `)
+
+      const stored = await core_EarnVaults.get(db, {
+        chainId: tempoTestnet.id,
+        vaultAddress,
+      })
+      expect(stored).toMatchObject({
+        privateInputTokens: [],
+        privateOutputTokens: [],
+        slug: 'updated-btpathusd-earn',
+      })
+      expect(stored?.createdAt).toBe(created?.createdAt)
+    },
+    90_000,
+  )
+})
+
+describe('deleteVerifiedEarnVault', () => {
+  test('physically removes the row without reading contracts', async () => {
+    const { app, db } = TestAdmin.setup({ rpc: { url: () => 'http://127.0.0.1:1' } })
+    await core_EarnVaults.upsert(db, input)
+
+    const response = await app.request(
+      `/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}`,
+      { method: 'DELETE' },
+    )
+    expect(response.status).toBe(204)
+    expect(
+      await core_EarnVaults.get(db, { chainId: tempoTestnet.id, vaultAddress }),
+    ).toBeUndefined()
+
+    const missing = await app.request(
+      `/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}`,
+      { method: 'DELETE' },
+    )
+    expect(missing.status).toBe(404)
+  })
+
+  test.runIf(Runtime.get().mode === 'testnet')(
+    'leaves the public vault available as unverified',
+    async () => {
+      const db = TestApp.database()
+      await core_EarnVaults.upsert(db, TestEarn.verifiedVault)
+      const { app } = TestAdmin.setup({ db, zones: [TestEarn.zone] })
+      const publicApp = TestApp.create({ auth: false, db, zones: [TestEarn.zone] })
+
+      const response = await app.request(
+        `/earn/verified-vaults/${vaultAddress}?chainId=${tempoTestnet.id}`,
+        { method: 'DELETE' },
+      )
+      expect(response.status).toBe(204)
+
+      const publicResponse = await publicApp.request(
+        `/v1/earn/vaults/${vaultAddress}?chainId=${tempoTestnet.id}&include=zone`,
+      )
+      expect(publicResponse.status).toBe(200)
+      const vault = await TestApp.json(publicResponse, App.schema.getVerifiedEarnVault.Response)
+      expect({
+        description: vault.description,
+        slug: vault.slug,
+        verified: vault.verified,
+        zone: vault.zone,
+      }).toStrictEqual({
+        description: null,
+        slug: null,
+        verified: false,
+        zone: null,
+      })
+    },
+    90_000,
+  )
+})