tapimo 0.7.1 → 0.8.0

package/src/apps/composition.test.ts

@@ -1,8 +1,9 @@
 import { App, Store } from 'tapimo'
-import { data, management, mpp, relay } from 'tapimo/apps'
+import { data, funding, management, mpp, relay } from 'tapimo/apps'
 import { Hono } from 'hono'
 import { describeRoute } from 'hono-openapi'
 import * as TestApp from '../../test/App.js'
+import * as Relay from '../../test/Relay.js'
 
 // Each test mounts one group and asserts its routes exist while omitted groups
 // are absent (404 and not in the document). The management case also locks its
@@ -13,7 +14,10 @@ async function document(app: { request: (path: string) => Promise<Response> | Re
   const res = await app.request('/openapi.json')
   return (await res.json()) as {
     components: { securitySchemes: Record<string, unknown> }
-    paths: Record<string, unknown>
+    paths: Record<
+      string,
+      Partial<Record<'get' | 'post', { operationId: string; tags?: readonly string[] | undefined }>>
+    >
     tags: readonly { description: string; name: string }[]
     webhooks?: Record<string, unknown> | undefined
     'x-tagGroups'?: readonly { name: string; tags: readonly string[] }[] | undefined
@@ -145,10 +149,12 @@ describe('data()', () => {
     expect(keys.some((path) => path.startsWith('/v1/blocks'))).toBe(true)
     expect(keys.some((path) => path.startsWith('/v1/orgs'))).toBe(false)
     expect(keys.some((path) => path.startsWith('/v1/me'))).toBe(false)
+    expect(keys.some((path) => path.startsWith('/v1/funding'))).toBe(false)
 
     // The omitted management route resolves to a 404 (never mounted), not a 401.
     const orgs = await app.request('/v1/orgs')
     expect(orgs.status).toBe(404)
+    expect((await app.request('/v1/funding/chains')).status).toBe(404)
   })
 
   test('inherits shared chain context', async () => {
@@ -167,6 +173,7 @@ describe('data()', () => {
       defaultChainId: 333,
       rpc,
       supportedChainIds: [444],
+      zones: true,
     })
       .route('/', data())
       .route('/', context)
@@ -183,10 +190,184 @@ describe('data()', () => {
           444,
           4217,
           42431,
+          421700001,
+          421700006,
         ],
       }
     `)
   })
+
+  test('keeps RPC and TIDX chain capabilities separate', async () => {
+    const both = 421_700_005
+    const rpcOnly = 31_318
+    const tidxOnly = 421_700_006
+    const server = await Relay.createServer((request, response) => {
+      response.writeHead(200, { 'content-type': 'application/json' })
+      response.end(
+        JSON.stringify(
+          request.method === 'POST'
+            ? { id: 1, jsonrpc: '2.0', result: '0x7a56' }
+            : { columns: [], ok: true, row_count: 0, rows: [] },
+        ),
+      )
+    })
+
+    try {
+      const context = new Hono<App.Environment>().get('/context', (c) =>
+        c.json({ supportedChainIds: [...c.get('supportedChainIds')].sort((a, b) => a - b) }),
+      )
+      const app = App.create({
+        auth: false,
+        db: TestApp.database(),
+        rpc: {
+          publicZoneUrl: JSON.stringify({
+            421_700_007: 'https://zone-only.public-rpc.test',
+          }),
+          url: JSON.stringify({ [both]: server.url, [rpcOnly]: server.url }),
+        },
+      })
+        .route(
+          '/',
+          data({
+            tidx: {
+              baseUrl: JSON.stringify({ [both]: server.url, [tidxOnly]: server.url }),
+            },
+          }),
+        )
+        .route('/', context)
+
+      expect(await (await app.request('/context')).json()).toMatchInlineSnapshot(`
+        {
+          "supportedChainIds": [
+            4217,
+            31318,
+            42431,
+            421700005,
+            421700006,
+          ],
+        }
+      `)
+
+      for (const chainId of [rpcOnly, tidxOnly]) {
+        const response = await app.request(`/v1/blocks/latest?chainId=${chainId}`)
+        const body = (await response.json()) as { error: { code: string } }
+        expect(response.status).toBe(400)
+        expect(body.error.code).toBe('chain_id_unsupported')
+      }
+
+      const response_both = await app.request(`/v1/blocks/not-a-block?chainId=${both}`)
+      const body_both = (await response_both.json()) as { error: { code: string } }
+      expect(response_both.status).toBe(400)
+      expect(body_both.error.code).toBe('block_invalid')
+
+      const response_rpc = await app.request(`/rpc/${rpcOnly}`, {
+        body: JSON.stringify({ id: 1, jsonrpc: '2.0', method: 'eth_chainId' }),
+        headers: { 'content-type': 'application/json' },
+        method: 'POST',
+      })
+      expect(response_rpc.status).toBe(200)
+
+      const response_tidx = await app.request(
+        `/v1/indexer/query?chainId=${tidxOnly}&sql=select%201`,
+      )
+      expect(response_tidx.status).toBe(200)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+})
+
+describe('funding()', () => {
+  test('mounts the Funding & Bridge API independently', async () => {
+    const group = funding()
+    expectTypeOf(App.funding).toEqualTypeOf<typeof funding>()
+    expectTypeOf(group).toEqualTypeOf<App.FundingApp>()
+    const app = App.create({ auth: false, db: TestApp.database() }).route('/', group)
+    const spec = await document(app)
+
+    expect(
+      Object.keys(spec.paths)
+        .filter((path) => path.startsWith('/v1/funding'))
+        .sort(),
+    ).toEqual(
+      [
+        '/v1/funding/chains',
+        '/v1/funding/deposit-addresses',
+        '/v1/funding/deposit-addresses/{id}',
+        '/v1/funding/deposit-addresses/{id}/deposits',
+        '/v1/funding/deposit-addresses/{id}/reconcile',
+        '/v1/funding/deposits',
+        '/v1/funding/deposits/{id}',
+        '/v1/funding/providers',
+        '/v1/funding/quotes',
+        '/v1/funding/transfers',
+        '/v1/funding/transfers/vault',
+        '/v1/funding/transfers/zone',
+        '/v1/funding/transfers/{id}',
+      ].sort(),
+    )
+    expect(Object.keys(spec.paths).some((path) => path.startsWith('/v1/tokens'))).toBe(false)
+    expect(spec.paths['/webhooks/funding/{providerId}']).toBeUndefined()
+    expect(spec['x-tagGroups']).toEqual([
+      {
+        name: 'Funding & Bridge API',
+        tags: ['Chains', 'Deposit Addresses', 'Providers', 'Quotes', 'Transfers'],
+      },
+    ])
+    expect(
+      Object.values(spec.paths).flatMap((path) =>
+        [path.get, path.post].flatMap((operation) =>
+          operation?.tags?.includes('Deposit Addresses') ? [operation.operationId] : [],
+        ),
+      ),
+    ).toEqual([
+      'createFundingDepositAddress',
+      'reconcileFundingDepositAddress',
+      'getFundingDepositAddress',
+      'getFundingDeposit',
+      'listFundingDepositAddressDeposits',
+      'listFundingDeposits',
+    ])
+    expect((await app.request('/v1/tokens')).status).toBe(404)
+  })
+
+  test('maps operations to five tags and reuses Transfers across groups', async () => {
+    const app = App.create({ auth: false, db: TestApp.database() })
+      .route('/', data())
+      .route('/', funding())
+    const spec = await document(app)
+    const operationTag = (path: string, method: 'get' | 'post') =>
+      (spec.paths[path] as Record<string, { tags?: readonly string[] | undefined } | undefined>)[
+        method
+      ]?.tags
+
+    expect({
+      chains: operationTag('/v1/funding/chains', 'get'),
+      depositAddress: operationTag('/v1/funding/deposit-addresses', 'post'),
+      deposits: operationTag('/v1/funding/deposit-addresses/{id}/deposits', 'get'),
+      providers: operationTag('/v1/funding/providers', 'get'),
+      quotes: operationTag('/v1/funding/quotes', 'get'),
+      transfers: operationTag('/v1/funding/transfers', 'get'),
+      vault: operationTag('/v1/funding/transfers/vault', 'post'),
+      zone: operationTag('/v1/funding/transfers/zone', 'post'),
+    }).toEqual({
+      chains: ['Chains'],
+      depositAddress: ['Deposit Addresses'],
+      deposits: ['Deposit Addresses'],
+      providers: ['Providers'],
+      quotes: ['Quotes'],
+      transfers: ['Transfers'],
+      vault: ['Transfers'],
+      zone: ['Transfers'],
+    })
+
+    const groups = Object.fromEntries(
+      (spec['x-tagGroups'] ?? []).map((group) => [group.name, group.tags]),
+    )
+    expect(groups['Data API']).toContain('Transfers')
+    expect(groups['Funding & Bridge API']).toContain('Transfers')
+    expect(spec.tags.filter((tag) => tag.name === 'Transfers')).toHaveLength(1)
+  })
 })
 
 describe('relay()', () => {
@@ -211,7 +392,7 @@ describe('relay()', () => {
 
 describe('mpp()', () => {
   test('mounts documented MPP routes independently', async () => {
-    const app = App.create({ db: TestApp.database() }).route('/', mpp())
+    const app = App.create({ db: TestApp.database() }).route('/', mpp({ state: Store.memory() }))
 
     expect((await paths(app)).some((path) => path.startsWith('/v1/mpp'))).toBe(true)
     expect((await app.request('/rpc/relay')).status).toBe(404)

package/src/apps/data/App.test.ts

@@ -55,7 +55,7 @@ const mpp = {
     getClient: () => Tempo.client,
     recipient: Tempo.accounts[2].address,
   },
-} satisfies NonNullable<TestApp.create.Options['mpp']>
+} satisfies NonNullable<Exclude<NonNullable<TestApp.create.Options['auth']>, false>['mpp']>
 
 describe('MPP session management', () => {
   test('keeps generated POST routes private', async () => {
@@ -72,7 +72,7 @@ describe('MPP session management', () => {
 
   test('matches GET scopes for static, parameterized, and hidden resources', async () => {
     const rateLimitStore = Store.memory()
-    const app = TestApp.create({ mpp, rateLimit: { store: rateLimitStore } })
+    const app = TestApp.create({ auth: { mpp }, rateLimit: { store: rateLimitStore } })
     await exhaustPublicQuota(rateLimitStore)
 
     for (const resource of [
@@ -106,7 +106,11 @@ describe('MPP session management', () => {
 
   test('preserves the mounted base path in session scope', async () => {
     const rateLimitStore = Store.memory()
-    const app = TestApp.create({ mpp, path: '/api', rateLimit: { store: rateLimitStore } })
+    const app = TestApp.create({
+      auth: { mpp },
+      path: '/api',
+      rateLimit: { store: rateLimitStore },
+    })
     await exhaustPublicQuota(rateLimitStore)
 
     const resource = new URL(
@@ -129,12 +133,12 @@ describe('MPP session management', () => {
   test('honors endpoint MPP overrides', async () => {
     const app = TestApp.create({
       auth: {
+        mpp,
         overrides: {
           'GET /v1/scopes': { mpp: true },
           'GET /v1/tokens/:token': { mpp: false },
         },
       },
-      mpp,
     })
     const enabled = await app.request('/v1/scopes', { method: 'POST' })
     const disabled = await app.request(`/v1/tokens/${TestApp.token}`, { method: 'POST' })
@@ -151,13 +155,13 @@ describe('zone chain gate', () => {
   /** A consumer-supplied zone chain id (the API never derives these). */
   const zone = 421_700_001
   /** A second zone, isolating per-zone grants. */
-  const zoneB = 421_700_002
+  const zoneB = 4_217_000_002
 
   function zoneOptions(chainId: number) {
-    return {
+    return TestApp.zone({
       chainId,
-      forwardRpcUrl: `https://${chainId}.rpc.test`,
-    }
+      rpcUrl: `https://${chainId}.rpc.test`,
+    })
   }
 
   /** Zone reader: holds the per-zone scope for `zone` (only). */
@@ -168,6 +172,14 @@ describe('zone chain gate', () => {
     token: 'secret_zone',
   } satisfies TestApp.kvStore.Key
 
+  /** Zone writer: broadcasts signed transactions and reads data for `zone`. */
+  const zoneWriter = {
+    id: 'key_zone_writer',
+    orgId: 'org_test',
+    scopes: ['data:read', `zone:${zone}:write`],
+    token: 'secret_zone_writer',
+  } satisfies TestApp.kvStore.Key
+
   /** Full-access key: the wildcard covers every zone. */
   const admin = {
     id: 'key_admin',
@@ -187,7 +199,7 @@ describe('zone chain gate', () => {
   /** A deployment serving two zones. */
   function zoneApp() {
     return TestApp.create({
-      auth: { keys: [admin, outsider, zoneReader] },
+      auth: { keys: [admin, outsider, zoneReader, zoneWriter] },
       zones: [zoneOptions(zone), zoneOptions(zoneB)],
     })
   }
@@ -249,6 +261,11 @@ describe('zone chain gate', () => {
     expect(response.status).toBe(200)
   })
 
+  test('a Zone write scope reads Zone data', async () => {
+    const response = await zoneApp().request(`/v1/tokenlist?chainId=${zone}`, as(zoneWriter))
+    expect(response.status).toBe(200)
+  })
+
   test('zone authorization applies to every data route', async () => {
     const app = TestApp.create({ auth: false, zones: [zoneOptions(zone)] })
     for (const path of [
@@ -369,19 +386,7 @@ describe('zone chain gate', () => {
     expect((await privateApp.request(path)).status).toBe(403)
   })
 
-  test('public chains remain edge-cacheable on a Zone deployment', async () => {
-    const store = Store.memory()
-    const app = TestApp.create({ auth: false, cache: { store }, zones: [zoneOptions(zone)] })
-    const path = '/v1/funding/chains'
-
-    const first = await app.request(path)
-    const second = await app.request(path)
-    expect(first.status).toBe(200)
-    expect(second.status).toBe(200)
-    expect(second.headers.get('cache-control')).toContain('public')
-  })
-
-  test('preserves route-specific edge-cache opt-outs on a Zone deployment', async () => {
+  test('serves anonymous token lists from the edge cache on public chains', async () => {
     const store = Store.memory()
     const app = TestApp.create({ auth: false, cache: { store }, zones: [zoneOptions(zone)] })
     const path = `/v1/tokenlist?chainId=${Viem.chainId.testnet}`
@@ -390,7 +395,7 @@ describe('zone chain gate', () => {
     const second = await app.request(path)
     expect(first.status).toBe(200)
     expect(second.status).toBe(200)
-    expect(second.headers.get('cache-control')).toContain('private')
+    expect(second.headers.get('cache-control')).toContain('public')
   })
 })