tapimo 0.7.2 → 0.9.0

package/src/apps/data/routes/indexer.ts

@@ -259,7 +259,7 @@ async function passthrough(
   // Resolve the upstream for this caller. A resolver `tidx` can route by
   // principal (e.g. anonymous `type: 'public'` callers to a public, no-auth
   // indexer); a static config ignores the principal.
-  const { baseUrl, basicAuth, bearerAuth } = Tidx.resolve(tidx, {
+  const { baseUrl, basicAuth, bearerAuth, zoneHeaders } = Tidx.resolve(tidx, {
     chainId,
     principal: Auth.getPrincipal(c),
     zone: c.get('zones').get(chainId),
@@ -296,6 +296,7 @@ async function passthrough(
   const headers = new Headers()
   for (const [name, value] of c.req.raw.headers)
     if (!strippedHeaders.has(name.toLowerCase())) headers.set(name, value)
+  if (zoneHeaders) for (const [name, value] of new Headers(zoneHeaders)) headers.set(name, value)
   if (basicAuth) headers.set('authorization', `Basic ${btoa(basicAuth)}`)
   else if (bearerAuth) headers.set('authorization', `Bearer ${bearerAuth}`)
 

package/src/apps/data/routes/rpc.ts

@@ -368,6 +368,7 @@ async function passthrough(
     basicAuth,
     bearerAuth,
     publicZoneUrl,
+    zoneHeaders,
     url: resolvedUrl,
   } = Viem.resolveRpc(upstream_rpc, { chainId, principal, zone })
   const usePublicZoneUrl = Boolean(zone && zoneToken)
@@ -385,6 +386,7 @@ async function passthrough(
   const headers = new Headers()
   for (const [name, value] of c.req.raw.headers)
     if (!strippedHeaders.has(name.toLowerCase())) headers.set(name, value)
+  if (zoneHeaders) for (const [name, value] of new Headers(zoneHeaders)) headers.set(name, value)
   // Public Zone endpoints authenticate with the caller's token, never internal RPC credentials.
   if (!usePublicZoneUrl && basicAuth) headers.set('authorization', `Basic ${btoa(basicAuth)}`)
   else if (!usePublicZoneUrl && bearerAuth) headers.set('authorization', `Bearer ${bearerAuth}`)

package/src/apps/data/routes/tokens.test.ts

@@ -274,7 +274,6 @@ describe('GET /tokens?verified=true', () => {
 describe('GET /tokens?addresses=', () => {
   test('separates repeated addresses in the response cache', async () => {
     const routed = TestApp.create({ db })
-    const headers = { authorization: `Bearer ${TestApp.key.token}` }
     const repeated = new URLSearchParams()
     repeated.append('addresses', TestApp.token)
     repeated.append('addresses', TestApp.tokenWithHolders)
@@ -282,9 +281,9 @@ describe('GET /tokens?addresses=', () => {
       addresses: TestApp.tokenWithHolders,
     })
 
-    const primed = await routed.request(`/v1/tokens?${repeated}`, { headers })
-    const miss = await routed.request(`/v1/tokens?${single}`, { headers })
-    const hit = await routed.request(`/v1/tokens?${single}`, { headers })
+    const primed = await routed.request(`/v1/tokens?${repeated}`)
+    const miss = await routed.request(`/v1/tokens?${single}`)
+    const hit = await routed.request(`/v1/tokens?${single}`)
     const primedBody = await TestApp.json(primed, Tokens.schema.getTokens.Response)
     const body = await TestApp.json(hit, Tokens.schema.getTokens.Response)
 
@@ -302,7 +301,6 @@ describe('GET /tokens?addresses=', () => {
 
   test('separates repeated includes in the response cache', async () => {
     const routed = TestApp.create({ db })
-    const headers = { authorization: `Bearer ${TestApp.key.token}` }
     const repeated = new URLSearchParams({ limit: '5' })
     repeated.append('include', 'createdAt')
     repeated.append('include', 'holderCount')
@@ -311,9 +309,9 @@ describe('GET /tokens?addresses=', () => {
       limit: '5',
     })
 
-    const primed = await routed.request(`/v1/tokens?${repeated}`, { headers })
-    const miss = await routed.request(`/v1/tokens?${single}`, { headers })
-    const hit = await routed.request(`/v1/tokens?${single}`, { headers })
+    const primed = await routed.request(`/v1/tokens?${repeated}`)
+    const miss = await routed.request(`/v1/tokens?${single}`)
+    const hit = await routed.request(`/v1/tokens?${single}`)
     const primedBody = await TestApp.json(primed, Tokens.schema.getTokens.Response)
     const body = await TestApp.json(hit, Tokens.schema.getTokens.Response)
 

package/src/apps/funding/Access.ts

@@ -0,0 +1,26 @@
+import type { Context } from 'hono'
+
+import type * as App from '../../App.js'
+import type * as FundingTransfers from '../../db/tables/fundingTransfers.js'
+import * as Auth from '../../internal/Auth.js'
+import * as Response from '../../internal/Response.js'
+
+/** Returns the funding owner encoded by an API-key principal. */
+export function owner(c: Context<App.Environment>): FundingTransfers.Owner | null {
+  const principal = Auth.getPrincipal(c)
+  if (principal?.type !== 'api_key') return null
+  return {
+    environment: principal.environment,
+    orgId: principal.orgId,
+    projectId: principal.projectId,
+  }
+}
+
+/** Returns the error used when a funding resource has no API-key owner. */
+export function unauthorized(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'unauthorized',
+    message: 'Tempo could not determine which organization owns this funding resource.',
+    status: 401,
+  })
+}

package/src/apps/funding/App.test.ts

@@ -0,0 +1,78 @@
+import { App } from 'tapimo'
+
+import * as Store from '../../internal/Store.js'
+import * as Viem from '../../internal/Viem.js'
+import * as TestApp from '../../../test/App.js'
+import { funding } from './App.js'
+
+const sandbox = {
+  environment: 'sandbox',
+  id: 'key_sandbox_funding',
+  orgId: 'org_test',
+  scopes: ['data:read'],
+  token: 'secret_sandbox_funding',
+} satisfies TestApp.kvStore.Key
+
+function as(key: { token: string }) {
+  return { headers: { authorization: `Bearer ${key.token}` } } as const
+}
+
+describe('funding access', () => {
+  test('rejects sandbox keys on a mainnet-default deployment', async () => {
+    const app = App.create({
+      auth: {},
+      db: TestApp.database(),
+      defaultChainId: Viem.chainId.mainnet,
+      kv: { store: TestApp.kvStore({ keys: [sandbox] }) },
+    }).route('/', funding())
+
+    const response = await app.request('/v1/funding/chains', as(sandbox))
+
+    expect(response.status).toBe(403)
+    expect(((await response.json()) as { error: { code: string } }).error.code).toBe(
+      'api_key_forbidden',
+    )
+  })
+
+  test('requires a matching Zone scope and bypasses the edge cache', async () => {
+    const chainId = 421_700_001
+    const reader = {
+      id: 'key_zone_funding',
+      orgId: 'org_test',
+      scopes: ['data:read', `zone:${chainId}:read`],
+      token: 'secret_zone_funding',
+    } satisfies TestApp.kvStore.Key
+    const app = App.create({
+      auth: {},
+      cache: { store: Store.memory() },
+      db: TestApp.database(),
+      defaultChainId: chainId,
+      kv: { store: TestApp.kvStore({ keys: [reader] }) },
+      zones: [TestApp.zone({ chainId, rpcUrl: `https://${chainId}.rpc.test` })],
+    }).route('/', funding())
+
+    const allowed = await app.request('/v1/funding/chains', as(reader))
+    const anonymous = await app.request('/v1/funding/chains')
+
+    expect(allowed.status).toBe(200)
+    expect(allowed.headers.get('cache-control')).toContain('private')
+    expect(anonymous.status).toBe(403)
+  })
+
+  test('keeps public-chain inventory edge-cacheable on a Zone deployment', async () => {
+    const chainId = 421_700_001
+    const app = App.create({
+      auth: false,
+      cache: { store: Store.memory() },
+      db: TestApp.database(),
+      zones: [TestApp.zone({ chainId, rpcUrl: `https://${chainId}.rpc.test` })],
+    }).route('/', funding())
+
+    const first = await app.request('/v1/funding/chains')
+    const second = await app.request('/v1/funding/chains')
+
+    expect(first.status).toBe(200)
+    expect(second.status).toBe(200)
+    expect(second.headers.get('cache-control')).toContain('public')
+  })
+})

package/src/apps/funding/App.ts

@@ -0,0 +1,78 @@
+import { Hono } from 'hono'
+
+import type * as App from '../../App.js'
+import type * as FundingDepositAddress from '../../internal/funding/DepositAddress.js'
+import type * as FundingProvider from '../../internal/funding/Provider.js'
+import * as Metadata from '../metadata.js'
+import { chains } from './routes/chains.js'
+import { depositAddresses } from './routes/deposit-addresses.js'
+import { providers } from './routes/providers.js'
+import { quotes } from './routes/quotes.js'
+import { transfers } from './routes/transfers.js'
+
+/**
+ * Mounts the Funding & Bridge API, including quotes, inventory, reusable
+ * deposit addresses, detected deposits, and transfers.
+ *
+ * ```ts
+ * App.create(options).route('/', data()).route('/', funding())
+ * ```
+ */
+export function funding(options: funding.Options = {}) {
+  const app = new Hono<App.Environment>()
+    .route('/', quotes())
+    .route('/', chains())
+    .route('/', providers())
+    .route('/', depositAddresses(options))
+    .route('/', transfers())
+  return Metadata.defaultChain(Metadata.attach(app, openapi))
+}
+
+export declare namespace funding {
+  /** Inbound funding route configuration. */
+  type Options = {
+    /** Enqueues one deposit address for asynchronous reconciliation. */
+    dispatchReconciliation?:
+      | ((message: FundingProvider.Webhook.receive.Dispatchable) => Promise<void>)
+      | undefined
+    /** Registers a created address with a source-chain observer. */
+    registerDepositAddress?: ((address: FundingDepositAddress.Public) => Promise<void>) | undefined
+  }
+}
+
+const openapi = {
+  tags: [
+    {
+      name: 'Chains',
+      description: 'Source chains and stablecoins supported for funding.',
+      'x-pagePath': 'funding/chains',
+    },
+    {
+      name: 'Deposit Addresses',
+      description: 'Reusable funding addresses and deposits detected at those addresses.',
+      'x-pagePath': 'funding/deposit-addresses',
+    },
+    {
+      name: 'Providers',
+      description: 'Providers available for inbound funding.',
+      'x-pagePath': 'funding/providers',
+    },
+    {
+      name: 'Quotes',
+      description: 'Live quotes for funding Tempo from other chains.',
+      'x-pagePath': 'funding/quotes',
+    },
+    {
+      name: 'Funding Transfers',
+      description: 'Inbound funding transfers.',
+      'x-displayName': 'Transfers',
+      'x-pagePath': 'funding/transfers',
+    },
+  ],
+  'x-tagGroups': [
+    {
+      name: 'Funding & Bridge API',
+      tags: ['Chains', 'Deposit Addresses', 'Providers', 'Quotes', 'Funding Transfers'],
+    },
+  ],
+} satisfies App.create.Metadata

package/src/apps/funding/Inventory.ts

@@ -0,0 +1,30 @@
+import type { Context } from 'hono'
+
+import type * as App from '../../App.js'
+import type * as Db from '../../db/Db.js'
+import * as FundingProvider from '../../internal/funding/Provider.js'
+
+const sourceScopes = new WeakMap<Db.Source, number>()
+let nextSourceScope = 0
+
+/** Returns an inventory cache key scoped by request URL, providers, and database source. */
+export function key(c: Context<App.Environment>) {
+  const url = new URL(c.req.url)
+  const providers = c
+    .get('providers')
+    .filter(FundingProvider.is)
+    .map((provider) => provider.id)
+    .sort()
+  url.searchParams.set('__tempo_database', String(sourceScope(c.get('dbCached'))))
+  url.searchParams.set('__tempo_providers', providers.join(','))
+  return url.toString()
+}
+
+function sourceScope(source: Db.Source) {
+  const current = sourceScopes.get(source)
+  if (current !== undefined) return current
+  // A production isolate has one source, while multi-app runtimes receive distinct scopes.
+  const scope = nextSourceScope++
+  sourceScopes.set(source, scope)
+  return scope
+}

package/src/apps/funding/ProviderAttempts.ts

@@ -0,0 +1,26 @@
+import * as FundingProvider from '../../internal/funding/Provider.js'
+import type * as Log from '../../internal/Log.js'
+
+/** Formats one provider attempt for the canonical request log. */
+export function format(attempt: FundingProvider.ProviderAttempt): Log.FundingProviderAttempt {
+  const { id } = attempt.provider
+  if (attempt.outcome !== 'failed')
+    return {
+      durationMs: attempt.durationMs,
+      id,
+      operation: attempt.operation,
+      outcome: attempt.outcome,
+    }
+
+  return {
+    durationMs: attempt.durationMs,
+    failure: FundingProvider.failure({
+      cause: attempt.cause,
+      operation: attempt.operation,
+      provider: attempt.provider,
+    }).failure,
+    id,
+    operation: attempt.operation,
+    outcome: attempt.outcome,
+  }
+}

package/src/apps/funding/index.ts

@@ -0,0 +1 @@
+export { funding } from './App.js'

package/src/apps/funding/routes/chains.test.ts

@@ -0,0 +1,78 @@
+import * as Across from '../../../internal/funding/providers/across.js'
+
+import * as Relay from '../../../internal/funding/providers/relay.js'
+
+import * as Rhino from '../../../internal/funding/providers/rhino.js'
+
+import * as Squid from '../../../internal/funding/providers/squid.js'
+
+import * as Symbiosis from '../../../internal/funding/providers/symbiosis.js'
+
+import * as TestApp from '../../../../test/App.js'
+
+import * as TestFunding from '../../../../test/Funding.js'
+
+import * as Funding from './chains.js'
+
+const db = TestApp.database()
+
+const providers = [
+  Across.across({
+    apiKey: 'across-api-key',
+    integratorId: '0xdead',
+    userAddress: '0x1111111111111111111111111111111111111111',
+  }),
+  Relay.relay({ userAddress: '0x1111111111111111111111111111111111111111' }),
+  Rhino.rhino(),
+  Squid.squid({
+    integratorId: 'squid-integrator-id',
+    userAddress: '0x1111111111111111111111111111111111111111',
+  }),
+  Symbiosis.symbiosis({ userAddress: '0x1111111111111111111111111111111111111111' }),
+] as const
+
+beforeAll(() => TestFunding.publish(db))
+
+function create(options: TestApp.create.Options = {}) {
+  return TestApp.create({ ...options, db })
+}
+
+describe('funding OpenAPI', () => {
+  test('publishes get operation ids for funding inventory', async () => {
+    const app = create({ auth: false })
+    const spec = await (await app.request('/openapi.json')).json()
+
+    expect({
+      chains: spec.paths['/v1/funding/chains'].get.operationId,
+      providers: spec.paths['/v1/funding/providers'].get.operationId,
+    }).toEqual({
+      chains: 'getFundingChains',
+      providers: 'getFundingProviders',
+    })
+  })
+})
+
+describe('GET /funding/chains', () => {
+  test('lists only inputs supported by quote providers', async () => {
+    const response = await create({ providers }).request('/v1/funding/chains', {
+      headers: TestApp.auth.headers,
+    })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Funding.schema.getFundingChains.Response)
+
+    expect(body.data.map((chain) => chain.id)).toEqual([
+      'eip155:1',
+      'eip155:56',
+      'eip155:8453',
+      'eip155:137',
+      'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp',
+      'tron:0x2b6653dc',
+    ])
+    expect(body.data.flatMap((chain) => chain.tokens.map((token) => token.symbol))).toEqual(
+      expect.arrayContaining(['USDC', 'USDT']),
+    )
+    expect(
+      body.data.flatMap((chain) => chain.tokens).every((token) => token.currency === 'USD'),
+    ).toBe(true)
+  })
+})

package/src/apps/funding/routes/chains.ts

@@ -0,0 +1,101 @@
+import { Hono } from 'hono'
+import * as z from 'zod/mini'
+
+import type * as App from '../../../App.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as Cache from '../../../internal/Cache.js'
+import * as FundingCatalog from '../../../internal/funding/Catalog.js'
+import * as FundingProvider from '../../../internal/funding/Provider.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+import * as Inventory from '../Inventory.js'
+
+/** Zod schemas owned by funding chain resources. */
+export namespace schema {
+  /** Source chain reference. */
+  export const Chain = FundingProvider.schema.ChainRef
+
+  /** Source token reference. */
+  export const Token = FundingProvider.schema.TokenRef
+
+  /** Chain inventory entry returned by the funding chains endpoint. */
+  export const ChainInventory = Schema.describe(
+    z.extend(Chain, {
+      tokens: z.array(Token).check(z.describe('Stablecoins known on this source chain.')),
+    }),
+    'One source chain and its known stablecoin inventory.',
+  )
+
+  /** Schemas for the getFundingChains operation. */
+  export namespace getFundingChains {
+    /** Non-paginated source-chain inventory. */
+    export const Response = Schema.describe(
+      z.object({
+        data: z
+          .array(ChainInventory)
+          .check(z.describe('Source chains and stablecoins supported by funding quotes.')),
+      }),
+      'A non-paginated list of source chains and stablecoin inventory.',
+    )
+  }
+}
+
+const baseChainExample = {
+  addressFormat: 'hex',
+  id: 'eip155:8453',
+  kind: 'evm',
+  name: 'Base',
+} as const
+
+const baseUsdcExample = {
+  address: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913',
+  currency: 'USD',
+  decimals: 6,
+  name: 'USD Coin',
+  standard: 'ERC-20',
+  symbol: 'USDC',
+  tokenKey: 'eip155:8453/erc20:0x833589fcd6edb6e08f4c7c32d4f71b54bda02913',
+  verified: true,
+} as const
+
+const fundingChainsResponseExample = {
+  data: [{ ...baseChainExample, tokens: [baseUsdcExample] }],
+} satisfies z.output<typeof schema.getFundingChains.Response>
+
+/** Mounts funding chain inventory routes. */
+export function chains() {
+  return new Hono<App.Environment>().get(
+    '/v1/funding/chains',
+    Auth.policy({ apiKey: { scopes: ['data:read'] }, mpp: true, public: true }),
+    OpenApi.describeRoute({
+      description: 'Lists supported source chains and tokens.',
+      operationId: 'getFundingChains',
+      responses: OpenApi.responses({
+        success: {
+          description: 'Supported source chains and stablecoins.',
+          example: fundingChainsResponseExample,
+          schema: schema.getFundingChains.Response,
+        },
+      }),
+      summary: 'Get chains',
+      tags: ['Chains'],
+    }),
+    Cache.response<App.Environment>({
+      cacheControl: Cache.policies.stable,
+      key: Inventory.key,
+      name: 'tempo-api:funding-chains:v5',
+    }),
+    async (c) => {
+      if (Auth.narrowAccess) return Auth.paidAccessError(c)
+      const catalog = await FundingCatalog.snapshot(c)
+      const providers = c.get('providers').filter(FundingProvider.is)
+      return c.json(
+        Response.validated(schema.getFundingChains.Response, {
+          data: FundingProvider.getChains({ catalog, providers }),
+        }),
+        200,
+      )
+    },
+  )
+}