ipor-fusion 4.2.0.dev20__tar.gz → 4.2.0.dev23__tar.gz

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/AGENTS.md

@@ -202,6 +202,10 @@ checkout's default profile), the pending reader included.
 
 ## Layout (`src/ipor_fusion/`)
 
+- `redaction.py` — `redact_provider_urls`, the one redactor for text carrying
+  exception messages (the CLI group and `main`, every MCP tool through
+  `_RedactingFastMCP.call_tool`, `LogScanError` through `core/logs.py`), and
+  `mask_provider_url`; a new entry point goes through it
 - `chains.py` chain registry; `market_ids.py` `IporFusionMarkets`; `types.py`; `errors.py`
   defines every SDK exception class (`tests/test_error_hierarchy.py` pins it)
 - `fusion_errors.py` — `FUSION_ERROR_SIGNATURES`, every custom error of the

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ipor-fusion
-Version: 4.2.0.dev20
+Version: 4.2.0.dev23
 Summary: The IPOR Fusion SDK for Python
 Project-URL: homepage, https://ipor.io
 Project-URL: repository, https://github.com/IPOR-Labs/ipor-fusion.py

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ipor-fusion"
-version = "4.2.0.dev20"
+version = "4.2.0.dev23"
 description = "The IPOR Fusion SDK for Python"
 authors = [
     { name = "Adam Mydlarz", email = "amydlarz@gmail.com" },

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/src/ipor_fusion/cli/config_cmd.py

@@ -5,9 +5,9 @@ import click
 from ipor_fusion.cli.config_store import (
     FusionConfig,
     load_config,
-    mask_provider_url,
     save_config,
 )
+from ipor_fusion.redaction import mask_provider_url
 from ipor_fusion.types import ChainId
 
 

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/src/ipor_fusion/cli/config_store.py

@@ -3,7 +3,6 @@ from __future__ import annotations
 import json
 import os
 from pathlib import Path
-from urllib.parse import urlsplit
 
 import click
 from eth_typing import ChecksumAddress
@@ -54,18 +53,14 @@ class FusionConfig(BaseModel):
         return data
 
 
-def mask_provider_url(url: str) -> str:
-    """Render a provider URL as scheme and host only.
-
-    RPC provider URLs carry API keys in the path, the query string or the
-    userinfo, so nothing but the scheme and the host (with port) may be
-    displayed. An unparsable value is rendered as ``***``.
-    """
-    parts = urlsplit(url)
-    host = parts.netloc.rpartition("@")[2]
-    if not parts.scheme or not host:
-        return "***"
-    return f"{parts.scheme}://{host}"
+def _describe_invalid_fields(exc: ValidationError) -> str:
+    """Which fields failed and why, never their values: the file holds API keys."""
+    return "\n".join(
+        f"  {'.'.join(str(part) for part in error['loc'])}: {error['msg']}"
+        for error in exc.errors(
+            include_input=False, include_url=False, include_context=False
+        )
+    )
 
 
 def load_config() -> FusionConfig:
@@ -75,7 +70,7 @@ def load_config() -> FusionConfig:
         return FusionConfig.model_validate_json(CONFIG_FILE.read_text(encoding="utf-8"))
     except ValidationError as exc:
         raise click.ClickException(
-            f"Config {CONFIG_FILE} is invalid:\n{exc}\n"
+            f"Config {CONFIG_FILE} is invalid:\n{_describe_invalid_fields(exc)}\n"
             "Fix the file manually or delete it to start fresh."
         ) from exc
     except json.JSONDecodeError as exc:

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/src/ipor_fusion/cli/main.py

@@ -4,6 +4,7 @@ import os
 import sys
 
 import click
+import requests
 
 from ipor_fusion.cli.address_cmd import address
 from ipor_fusion.cli.changelog_cmd import changelog
@@ -12,9 +13,21 @@ from ipor_fusion.cli.fuse_cmd import fuse
 from ipor_fusion.cli.market_cmd import market
 from ipor_fusion.cli.preflight_cmd import preflight
 from ipor_fusion.cli.vault_cmd import vault
+from ipor_fusion.redaction import redact_provider_urls
 
 
-@click.group()
+class _RedactingGroup(click.Group):
+    """Click prints a `ClickException` itself, before `main` could see it."""
+
+    def invoke(self, ctx: click.Context) -> object:
+        try:
+            return super().invoke(ctx)
+        except click.ClickException as exc:
+            exc.message = redact_provider_urls(exc.message)
+            raise
+
+
+@click.group(cls=_RedactingGroup)
 @click.version_option(package_name="ipor_fusion")
 @click.option("--verbose", "-v", is_flag=True, help="Print RPC call details.")
 @click.option("--quiet", "-q", is_flag=True, help="Suppress non-essential output.")
@@ -49,16 +62,17 @@ def main() -> None:
         sys.exit(130)
     except click.UsageError:
         raise
-    except ConnectionError as exc:
-        click.secho(f"Connection failed: {exc}. Check your provider URL.", fg="red")
+    except (ConnectionError, requests.ConnectionError) as exc:
+        msg = redact_provider_urls(str(exc))
+        click.secho(f"Connection failed: {msg}. Check your provider URL.", fg="red")
         sys.exit(1)
     except ValueError as exc:
-        msg = str(exc)
+        msg = redact_provider_urls(str(exc))
         if "address" in msg.lower():
             click.secho(f"Invalid address: {msg}", fg="red")
         else:
             click.secho(f"Error: {msg}", fg="red")
         sys.exit(1)
     except Exception as exc:
-        click.secho(f"Error: {exc}", fg="red")
+        click.secho(f"Error: {redact_provider_urls(str(exc))}", fg="red")
         sys.exit(1)

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/src/ipor_fusion/core/logs.py

@@ -28,6 +28,7 @@ from web3.exceptions import Web3Exception
 from web3.types import BlockIdentifier, FilterParams, LogReceipt
 
 from ipor_fusion.errors import LogScanError
+from ipor_fusion.redaction import redact_provider_urls
 from ipor_fusion.types import ChainId
 
 # The log shapes the SDK's event readers accept: a receipt log from web3.py
@@ -70,7 +71,6 @@ _TRANSIENT_TEXT = re.compile(
     r"rate.?limit|too many requests|compute units|temporar|try again later", re.I
 )
 _TRANSIENT_STATUS = frozenset({429, 502, 503})
-_URL = re.compile(r"\w+://\S+")
 
 
 class LogSource(Protocol):
@@ -370,13 +370,13 @@ def _status_code(exc: BaseException) -> int | None:
 
 
 def _describe(exc: BaseException) -> str:
-    """Error text with the response body, provider URLs (they embed API keys)
-    removed, truncated."""
+    """Error text with the response body, provider URLs reduced to their host,
+    truncated."""
     text = f"{type(exc).__name__}: {exc}"
     body = getattr(getattr(exc, "response", None), "text", None)
     if isinstance(body, str) and body:
         text = f"{text} {body}"
-    return _URL.sub("<provider>", text)[:400]
+    return redact_provider_urls(text)[:400]
 
 
 def _is_transient(exc: BaseException) -> bool:

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/src/ipor_fusion/mcp/server.py

@@ -4,12 +4,14 @@ Calls the ipor_fusion SDK directly — no CLI subprocess.
 Configuration is loaded from the shared CLI config (~/.config/ipor-fusion/).
 """
 
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from functools import partial
-from typing import Annotated, Literal
+from typing import Annotated, Any, Literal
 
 from eth_typing import ChecksumAddress
 from mcp.server.fastmcp import FastMCP
+from mcp.server.fastmcp.exceptions import ToolError
+from mcp.types import ContentBlock
 from pydantic import AfterValidator, BeforeValidator, Field
 from web3 import Web3
 
@@ -23,7 +25,6 @@ from ipor_fusion.cli.config_store import (
     FusionConfig,
     VaultEntry,
     load_config,
-    mask_provider_url,
     resolve_chain_id,
     save_config,
 )
@@ -69,6 +70,7 @@ from ipor_fusion.preflight import (
 )
 from ipor_fusion.readers.morpho import MorphoReader, morpho_blue_address
 from ipor_fusion.readers.oracle_mapping import build_oracle_mapping
+from ipor_fusion.redaction import mask_provider_url, redact_provider_urls
 from ipor_fusion.registry import (
     build_address_list_json,
     build_address_lookup_json,
@@ -92,7 +94,20 @@ from ipor_fusion.vault_info import build_vault_info_json, build_vault_validation
 
 # chain_id default: detect the chain from the saved vault or the single provider.
 
-mcp = FastMCP(
+
+class _RedactingFastMCP(FastMCP):
+    """Every tool failure reaches the client through `call_tool`."""
+
+    async def call_tool(
+        self, name: str, arguments: dict[str, Any]
+    ) -> Sequence[ContentBlock] | dict[str, Any]:
+        try:
+            return await super().call_tool(name, arguments)
+        except Exception as exc:
+            raise ToolError(redact_provider_urls(str(exc))) from exc
+
+
+mcp = _RedactingFastMCP(
     "ipor-fusion",
     instructions=(
         "Inspection and configuration tools for IPOR Fusion Plasma Vaults. "

ipor_fusion-4.2.0.dev23/src/ipor_fusion/redaction.py

@@ -0,0 +1,39 @@
+"""Removes provider URLs from text meant for a person or a log.
+
+RPC provider URLs carry API keys in the path, the query string or the userinfo,
+and requests and web3 quote them in their exception messages.
+"""
+
+from __future__ import annotations
+
+import re
+from urllib.parse import urlsplit
+
+# A URL runs to the next whitespace, since quotes and brackets are legal inside
+# one and a key may follow them; only punctuation closing it stays in the text.
+# The lookbehind tries each run of scheme characters once, so long hex in an error
+# stays linear; a run that is no valid scheme ("0xhttp") comes out masked whole.
+_URL = re.compile(r"(?<![a-zA-Z0-9+.\-])[a-zA-Z0-9+.\-]+://\S*[^\s.,;:)'\">]")
+# urllib3 names only the path and query: "Max retries exceeded with url: /v2/key"
+_REQUEST_TARGET = re.compile(r"\burl: /\S*")
+_HOST = re.compile(r"(?:[a-zA-Z0-9.\-]+|\[[0-9a-fA-F:.]+\])(?::\d+)?")
+
+
+def mask_provider_url(url: str) -> str:
+    """Render a provider URL as scheme and host only. An unparsable value is
+    rendered as ``***``: what looks like its host may be part of a key."""
+    try:
+        parts = urlsplit(url)
+    except ValueError:
+        return "***"
+    host = parts.netloc.rpartition("@")[2]
+    if not parts.scheme or not _HOST.fullmatch(host):
+        return "***"
+    return f"{parts.scheme}://{host}"
+
+
+def redact_provider_urls(text: str) -> str:
+    """``text`` with every URL reduced to scheme and host, and every request
+    target urllib3 quotes on its own replaced."""
+    text = _URL.sub(lambda match: mask_provider_url(match.group()), text)
+    return _REQUEST_TARGET.sub("url: <redacted>", text)

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/tests/test_cli_config_store.py

@@ -8,9 +8,9 @@ from ipor_fusion.cli.config_store import (
     FusionConfig,
     VaultEntry,
     load_config,
-    mask_provider_url,
     save_config,
 )
+from ipor_fusion.redaction import mask_provider_url
 
 
 @pytest.fixture(autouse=True)

{ipor_fusion-4.2.0.dev20 → ipor_fusion-4.2.0.dev23}/tests/test_logs.py

@@ -1,5 +1,6 @@
 """Adaptive eth_getLogs paging (`core.logs`) against a fake provider."""
 
+import socket
 import threading
 from collections.abc import Callable
 from typing import Any
@@ -366,17 +367,40 @@ class TestNoPartialResults:
         with pytest.raises(KeyError):
             get_logs_adaptive(_web3(eth), ADDRESS, TOPICS, chunk_hint=100)
 
-    def test_error_names_no_provider_url(self):
-        provider_url = "https://rpc.example/v2/SECRETKEY"
-        eth = _FakeEth(
-            reject=lambda _l, _h: Web3RPCError(f"bad for url: {provider_url}")
-        )
+    @pytest.mark.parametrize(
+        "quoted",
+        ["https://rpc.example/v2/SECRETKEY", "/v2/SECRETKEY?apikey=SECRETKEY"],
+    )
+    def test_error_names_no_provider_url(self, quoted):
+        eth = _FakeEth(reject=lambda _l, _h: Web3RPCError(f"bad for url: {quoted}"))
 
         with pytest.raises(LogScanError) as info:
             get_logs_adaptive(_web3(eth), ADDRESS, TOPICS, 999, 1_000)
 
         assert "SECRETKEY" not in str(info.value)
 
+    def test_refused_connection_names_no_request_target(self, monkeypatch):
+        monkeypatch.setattr(logs_mod, "_TRANSIENT_RETRIES", 0)
+        with socket.socket() as probe:
+            probe.bind(("127.0.0.1", 0))
+            port = probe.getsockname()[1]
+
+        def reject(_low: int, _high: int) -> Exception | None:
+            try:
+                requests.post(
+                    f"http://127.0.0.1:{port}/v2/SECRETKEY?apikey=SECRETKEY", timeout=1
+                )
+            except requests.ConnectionError as exc:
+                return exc
+            return None
+
+        with pytest.raises(LogScanError) as info:
+            get_logs_adaptive(
+                _web3(_FakeEth(reject=reject)), ADDRESS, TOPICS, 999, 1_000
+            )
+
+        assert "SECRETKEY" not in str(info.value)
+
     def test_is_an_ipor_fusion_error(self):
         assert issubclass(LogScanError, IporFusionError)
 

ipor_fusion-4.2.0.dev23/tests/test_provider_url_redaction.py

@@ -0,0 +1,297 @@
+"""No error text carries a provider URL's path, query or userinfo: they hold API
+keys. Every path runs the real HTTP stack against a local socket, so the text
+under test is what requests and web3 actually produce."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import socket
+import sys
+import threading
+from collections.abc import Iterator
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import pytest
+from mcp.server.fastmcp.exceptions import ToolError
+
+from ipor_fusion.cli import config_store
+from ipor_fusion.cli.config_store import FusionConfig, save_config
+from ipor_fusion.cli.main import main
+from ipor_fusion.mcp import server
+from ipor_fusion.redaction import mask_provider_url, redact_provider_urls
+
+VAULT = "0x4c4f752fa54dafaa7770b2c6d6f0d6d7e5cf8b2f"
+ACCESS_MANAGER_WORD = "0x" + "00" * 12 + "11" * 20
+CHAIN_ID = 8453
+SECRETS = ("SECRETKEY123", "SECRETQ456")
+PROVIDER_PATH = f"/v2/{SECRETS[0]}?apikey={SECRETS[1]}"
+USAGE_ERROR_EXIT = 2
+
+
+class _Rpc(BaseHTTPRequestHandler):
+    """Refuses every method in ``forbidden`` with a 403, answers the rest."""
+
+    forbidden: frozenset[str] = frozenset()
+
+    def do_POST(self) -> None:
+        body = json.loads(self.rfile.read(int(self.headers["Content-Length"])))
+        if body["method"] in self.forbidden:
+            self.send_error(403)
+            return
+        answers = {
+            "eth_chainId": hex(CHAIN_ID),
+            "eth_blockNumber": "0x4",
+            "eth_call": ACCESS_MANAGER_WORD,
+            "eth_getCode": "0x60",
+        }
+        payload = json.dumps(
+            {"jsonrpc": "2.0", "id": body["id"], "result": answers[body["method"]]}
+        ).encode()
+        self.send_response(200)
+        self.send_header("Content-Length", str(len(payload)))
+        self.end_headers()
+        self.wfile.write(payload)
+
+    # The parameter name is the base class's.
+    def log_message(self, format: str, *args: object) -> None:  # noqa: A002
+        del format, args
+
+
+def _serve(refused: frozenset[str]) -> Iterator[str]:
+    class Handler(_Rpc):
+        forbidden = refused
+
+    httpd = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield f"http://127.0.0.1:{httpd.server_address[1]}{PROVIDER_PATH}"
+    finally:
+        httpd.shutdown()
+        httpd.server_close()
+        thread.join()
+
+
+@pytest.fixture
+def refusing_provider() -> Iterator[str]:
+    yield from _serve(frozenset({"eth_chainId", "eth_call", "eth_getLogs"}))
+
+
+@pytest.fixture
+def closed_provider() -> str:
+    with socket.socket() as probe:
+        probe.bind(("127.0.0.1", 0))
+        port = probe.getsockname()[1]
+    return f"http://127.0.0.1:{port}{PROVIDER_PATH}"
+
+
+@pytest.fixture
+def scan_refusing_provider() -> Iterator[str]:
+    yield from _serve(frozenset({"eth_getLogs"}))
+
+
+@pytest.fixture
+def config_paths(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    monkeypatch.setattr(config_store, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(config_store, "CONFIG_FILE", tmp_path / "config.json")
+    return tmp_path / "config.json"
+
+
+def _use_provider(url: str) -> None:
+    save_config(FusionConfig(providers={str(CHAIN_ID): url}))
+
+
+def _run_cli(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    *args: str,
+) -> tuple[int | str | None, str]:
+    monkeypatch.setattr(sys, "argv", ["fusion", *args])
+    with pytest.raises(SystemExit) as exit_info:
+        main()
+    captured = capsys.readouterr()
+    return exit_info.value.code, captured.out + captured.err
+
+
+def _assert_no_secret(text: str) -> None:
+    assert "/v2/" not in text
+    assert "apikey" not in text
+    for secret in SECRETS:
+        assert secret not in text
+
+
+@pytest.mark.parametrize("provider", ["refusing_provider", "closed_provider"])
+class TestProviderFailure:
+    def test_cli(
+        self,
+        provider: str,
+        request: pytest.FixtureRequest,
+        config_paths: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        capsys: pytest.CaptureFixture[str],
+    ):
+        del config_paths
+        _use_provider(request.getfixturevalue(provider))
+
+        code, output = _run_cli(
+            monkeypatch, capsys, "vault", "info", VAULT, "--chain-id", str(CHAIN_ID)
+        )
+
+        assert code == 1
+        assert "127.0.0.1" in output
+        _assert_no_secret(output)
+
+    def test_mcp_tool(
+        self,
+        provider: str,
+        request: pytest.FixtureRequest,
+        config_paths: Path,
+    ):
+        del config_paths
+        _use_provider(request.getfixturevalue(provider))
+
+        with pytest.raises(ToolError) as info:
+            asyncio.run(
+                server.mcp.call_tool(
+                    "vault_info",
+                    {"vault_address": VAULT, "chain_id": CHAIN_ID},
+                )
+            )
+
+        assert "127.0.0.1" in str(info.value)
+        _assert_no_secret(str(info.value))
+
+
+class TestLogScanFailure:
+    def test_cli_role_accounts(
+        self,
+        scan_refusing_provider: str,
+        config_paths: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        capsys: pytest.CaptureFixture[str],
+    ):
+        del config_paths
+        _use_provider(scan_refusing_provider)
+
+        code, output = _run_cli(
+            monkeypatch,
+            capsys,
+            "vault",
+            "role-accounts",
+            VAULT,
+            "--chain-id",
+            str(CHAIN_ID),
+        )
+
+        assert code == 1
+        assert "LogScanError" in output
+        _assert_no_secret(output)
+
+    def test_mcp_role_accounts(
+        self,
+        scan_refusing_provider: str,
+        config_paths: Path,
+    ):
+        del config_paths
+        _use_provider(scan_refusing_provider)
+
+        with pytest.raises(ToolError) as info:
+            asyncio.run(
+                server.mcp.call_tool(
+                    "vault_role_accounts",
+                    {"vault_address": VAULT, "chain_id": CHAIN_ID},
+                )
+            )
+
+        assert "eth_getLogs scan" in str(info.value)
+        _assert_no_secret(str(info.value))
+
+
+class TestCliErrorChannels:
+    def test_usage_error_with_a_url(
+        self,
+        config_paths: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        capsys: pytest.CaptureFixture[str],
+    ):
+        del config_paths
+        url = f"http://127.0.0.1:1{PROVIDER_PATH}"
+
+        code, output = _run_cli(monkeypatch, capsys, "vault", "info", url)
+
+        assert code == USAGE_ERROR_EXIT
+        _assert_no_secret(output)
+
+    def test_invalid_config_echoes_no_value(
+        self,
+        config_paths: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        capsys: pytest.CaptureFixture[str],
+    ):
+        config_paths.write_text(
+            json.dumps(
+                {
+                    "providers": {"1": ["SECRETKEY123"]},
+                    "etherscan_api_key": ["SECRETQ456"],
+                }
+            ),
+            encoding="utf-8",
+        )
+
+        code, output = _run_cli(monkeypatch, capsys, "config", "show")
+
+        assert code == 1
+        assert "providers.1" in output
+        assert "etherscan_api_key" in output
+        for secret in SECRETS:
+            assert secret not in output
+
+
+class TestRedactProviderUrls:
+    @pytest.mark.parametrize(
+        ("text", "expected"),
+        [
+            (
+                "403 Client Error: Forbidden for url: https://rpc.example/v2/KEY?a=KEY2",
+                "403 Client Error: Forbidden for url: https://rpc.example",
+            ),
+            (
+                "Pool(host='rpc.example', port=443): Max retries exceeded with url: "
+                "/v2/KEY?a=KEY2 (Caused by Boom())",
+                "Pool(host='rpc.example', port=443): Max retries exceeded with url: "
+                "<redacted> (Caused by Boom())",
+            ),
+            ("dial wss://user:KEY@rpc.example:8546/ws", "dial wss://rpc.example:8546"),
+            ("to 'http://[::1]:8545/KEY'", "to 'http://[::1]:8545'"),
+            ("see (https://rpc.example/KEY).", "see (https://rpc.example)."),
+            ("two http://a.example/K1 and http://b.example/K2", None),
+            ("address: 0xhttp://rpc.example/KEY", "address: ***"),
+            (
+                "for url: https://rpc.example/v2/a'KEY?k=KEY2",
+                "for url: https://rpc.example",
+            ),
+            (
+                "with url: /v2/a'KEY?k=KEY2 (Caused by Boom())",
+                "with url: <redacted> (Caused by Boom())",
+            ),
+            ("at https://rpc.example'KEY/path", "at ***"),
+            ("no url here: just a message", "no url here: just a message"),
+        ],
+    )
+    def test_text(self, text: str, expected: str | None):
+        if expected is None:
+            expected = "two http://a.example and http://b.example"
+        assert redact_provider_urls(text) == expected
+
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "https://user:pass/word@rpc.example/path",
+            "http://[not-ipv6/KEY",
+            "https://bad host/KEY",
+        ],
+    )
+    def test_unparsable_authority_is_masked_whole(self, url: str):
+        assert mask_provider_url(url) == "***"