Pro 2758 #145
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,13 +4,29 @@ import { CronTime } from 'cron'; | |
| import { ethers } from "ethers"; | ||
| import ErrorMessage from "../constants/ErrorMessage.js"; | ||
| import ReturnCode from "../constants/ReturnCode.js"; | ||
| import { encode, decode, verifySignature } from "../utils/crypto.js"; | ||
| import SupportedNetworks from "../../config.json" assert { type: "json" }; | ||
| import { APIKey } from "../models/api-key.js"; | ||
| import { ArkaConfigUpdateData } from "../types/arka-config-dto.js"; | ||
| import { ApiKeyDto } from "../types/apikey-dto.js"; | ||
| import { CreateSecretCommand, DeleteSecretCommand, GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; | ||
| import EtherspotAbi from "../abi/EtherspotAbi.js"; | ||
| import { AuthDto } from "../types/auth-dto.js"; | ||
| import { IncomingHttpHeaders } from "http"; | ||
|
|
||
| const adminRoutes: FastifyPluginAsync = async (server) => { | ||
|
|
||
| const prefixSecretId = 'arka_'; | ||
|
|
||
| let client: SecretsManagerClient; | ||
|
|
||
| const unsafeMode: boolean = process.env.UNSAFE_MODE == "true" ? true : false; | ||
|
|
||
| if (!unsafeMode) { | ||
| client = new SecretsManagerClient(); | ||
| } | ||
|
|
||
|
|
||
| server.post('/adminLogin', async function (request, reply) { | ||
| try { | ||
| if(!server.config.UNSAFE_MODE) { | ||
|
|
@@ -76,50 +92,92 @@ const adminRoutes: FastifyPluginAsync = async (server) => { | |
|
|
||
| server.post('/saveKey', async function (request, reply) { | ||
| try { | ||
| const body = JSON.parse(request.body as string) as ApiKeyDto; | ||
| if (!body) return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.EMPTY_BODY }); | ||
| if (!body.apiKey) | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.INVALID_DATA }); | ||
|
|
||
| if (!/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*-_&])[A-Za-z\d@$!%*-_&]{8,}$/.test(body.apiKey)) | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.API_KEY_VALIDATION_FAILED }); | ||
|
|
||
| const mnemonic = ethers.utils.entropyToMnemonic( | ||
| ethers.utils.randomBytes(16) | ||
| ); | ||
| const wallet = ethers.Wallet.fromMnemonic(mnemonic); | ||
| const privateKey = wallet.privateKey; | ||
| const publicAddress = await wallet.getAddress(); | ||
|
|
||
| if(!unsafeMode) { | ||
| const { 'x-signature': signature, 'x-timestamp': timestamp } = request.headers as IncomingHttpHeaders & AuthDto; | ||
| if(!signature || !timestamp) | ||
| return reply.code(ReturnCode.NOT_AUTHORIZED).send({ error: ErrorMessage.INVALID_SIGNATURE_OR_TIMESTAMP }); | ||
| if(!verifySignature(signature, request.body as string, timestamp, server.config.HMAC_SECRET)) | ||
| return reply.code(ReturnCode.NOT_AUTHORIZED).send({ error: ErrorMessage.INVALID_SIGNATURE_OR_TIMESTAMP }); | ||
|
|
||
| const command = new GetSecretValueCommand({SecretId: prefixSecretId + body.apiKey}) | ||
| const secrets = await client.send(command).catch((err) => err); | ||
|
|
||
| if(!(secrets instanceof Error)) { | ||
| request.log.error('Duplicate record found'); | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.DUPLICATE_RECORD }); | ||
| } | ||
|
|
||
| const createCommand = new CreateSecretCommand({ | ||
| Name: prefixSecretId + body.apiKey, | ||
| SecretString: JSON.stringify({ | ||
| PRIVATE_KEY: privateKey, | ||
| PUBLIC_ADDRESS: publicAddress, | ||
| MNEMONIC: mnemonic | ||
| }), | ||
| }); | ||
|
|
||
|
There was a problem hiding this comment. We need to also create a record on the connected db since the sponsorship olivies are handled by that so even in unsafeMode as false create one record on was secrets as above and also include database record creation for the same which also includes addition of policy record by default for the same apiKey There was a problem hiding this comment. @vignesha22 does this mean we have to delete the record also on /deleteKey endpoint ? |
||
| await client.send(createCommand); | ||
|
|
||
| await server.apiKeyRepository.create({ | ||
| apiKey: body.apiKey, | ||
| walletAddress: publicAddress, | ||
| privateKey: encode(privateKey, server.config.HMAC_SECRET), | ||
| supportedNetworks: body.supportedNetworks, | ||
| erc20Paymasters: body.erc20Paymasters, | ||
| multiTokenPaymasters: body.multiTokenPaymasters ?? null, | ||
| multiTokenOracles: body.multiTokenOracles ?? null, | ||
| sponsorName: body.sponsorName ?? null, | ||
| logoUrl: body.logoUrl ?? null, | ||
| transactionLimit: body.transactionLimit ?? 0, | ||
| noOfTransactionsInAMonth: body.noOfTransactionsInAMonth ?? 10, | ||
| indexerEndpoint: body.indexerEndpoint ?? process.env.DEFAULT_INDEXER_ENDPOINT ?? null, | ||
| bundlerApiKey: body.bundlerApiKey ?? null, | ||
| }); | ||
| } else { | ||
| const result = await server.apiKeyRepository.findOneByApiKey(body.apiKey); | ||
| if (result) { | ||
| request.log.error('Duplicate record found'); | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.DUPLICATE_RECORD }); | ||
| } | ||
|
|
||
| await server.apiKeyRepository.create({ | ||
| apiKey: body.apiKey, | ||
| walletAddress: publicAddress, | ||
| privateKey: encode(privateKey, server.config.HMAC_SECRET), | ||
| supportedNetworks: body.supportedNetworks, | ||
| erc20Paymasters: body.erc20Paymasters, | ||
| multiTokenPaymasters: body.multiTokenPaymasters ?? null, | ||
| multiTokenOracles: body.multiTokenOracles ?? null, | ||
| sponsorName: body.sponsorName ?? null, | ||
| logoUrl: body.logoUrl ?? null, | ||
| transactionLimit: body.transactionLimit ?? 0, | ||
| noOfTransactionsInAMonth: body.noOfTransactionsInAMonth ?? 10, | ||
| indexerEndpoint: body.indexerEndpoint ?? process.env.DEFAULT_INDEXER_ENDPOINT ?? null, | ||
| bundlerApiKey: body.bundlerApiKey ?? null, | ||
| }); | ||
| } | ||
|
|
||
| return reply.code(ReturnCode.SUCCESS).send({ error: null, message: 'Successfully saved' }); | ||
| } catch (err: any) { | ||
| request.log.error(err); | ||
| return reply.code(ReturnCode.FAILURE).send({ error: err.message ?? ErrorMessage.FAILED_TO_PROCESS }); | ||
| } | ||
| }); | ||
|
|
||
| server.post('/updateKey', async function (request, reply) { | ||
| try { | ||
|
|
@@ -173,21 +231,100 @@ const adminRoutes: FastifyPluginAsync = async (server) => { | |
|
|
||
| server.post('/deleteKey', async function (request, reply) { | ||
| try { | ||
| const body: any = JSON.parse(request.body as string); | ||
| if (!body) | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.EMPTY_BODY }); | ||
| if (!body.apiKey) | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.INVALID_DATA }); | ||
| if (!/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*-_&])[A-Za-z\d@$!%*-_&]{8,}$/.test(body.apiKey)) | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.API_KEY_VALIDATION_FAILED }); | ||
|
|
||
| let bundlerApiKey = body.apiKey; | ||
| let supportedNetworks; | ||
| if(!unsafeMode) { | ||
| const { 'x-signature': signature, 'x-timestamp': timestamp } = request.headers as IncomingHttpHeaders & AuthDto; | ||
| if(!signature || !timestamp || isNaN(+timestamp)) | ||
| return reply.code(ReturnCode.NOT_AUTHORIZED).send({ error: ErrorMessage.INVALID_SIGNATURE_OR_TIMESTAMP }); | ||
| if(!verifySignature(signature, request.body as string, timestamp, server.config.HMAC_SECRET)) | ||
| return reply.code(ReturnCode.NOT_AUTHORIZED).send({ error: ErrorMessage.INVALID_SIGNATURE_OR_TIMESTAMP }); | ||
| const getSecretCommand = new GetSecretValueCommand({SecretId: prefixSecretId + body.apiKey}); | ||
| const secretValue = await client.send(getSecretCommand) | ||
| if(secretValue instanceof Error) | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.RECORD_NOT_FOUND }); | ||
|
|
||
| const secrets = JSON.parse(secretValue.SecretString ?? '{}'); | ||
|
|
||
| if (!secrets['PRIVATE_KEY']) { | ||
| server.log.info("Invalid Api Key provided") | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.INVALID_API_KEY }) | ||
| } | ||
| if (secrets['BUNDLER_API_KEY']) { | ||
| bundlerApiKey = secrets['BUNDLER_API_KEY']; | ||
| } | ||
|
|
||
| if(secrets['SUPPORTED_NETWORKS']) { | ||
| const buffer = Buffer.from(secrets['SUPPORTED_NETWORKS'], 'base64'); | ||
| supportedNetworks = JSON.parse(buffer.toString()) | ||
| } | ||
| supportedNetworks = supportedNetworks ?? SupportedNetworks; | ||
|
|
||
| const privateKey = secrets['PRIVATE_KEY']; | ||
|
|
||
| // native balance check. | ||
| const nativeBalancePromiseArr = []; | ||
| const nativePaymasterDepositPromiseArr = []; | ||
| for(const network of supportedNetworks) { | ||
| const provider = new ethers.providers.JsonRpcProvider(network.bundler + '?api-key=' + bundlerApiKey); | ||
| const wallet = new ethers.Wallet(privateKey, provider) | ||
| nativeBalancePromiseArr.push(wallet.getBalance()); | ||
|
|
||
| const contract = new ethers.Contract( | ||
| network.contracts.etherspotPaymasterAddress, | ||
| EtherspotAbi, | ||
| wallet | ||
| ); | ||
| nativePaymasterDepositPromiseArr.push(contract.getSponsorBalance(wallet.address)); | ||
| } | ||
|
|
||
| let error = false; | ||
|
|
||
| await Promise.allSettled([...nativeBalancePromiseArr, ...nativePaymasterDepositPromiseArr]).then((data) => { | ||
| const threshold = ethers.utils.parseEther('0.0001'); | ||
| for(const item of data) { | ||
| if( | ||
| item.status === 'fulfilled' && | ||
| item.value?.gt(threshold) | ||
| ) { | ||
| error = true; | ||
| return; | ||
| } | ||
| if(item.status === 'rejected') { | ||
| request.log.error( | ||
| `Error occurred while fetching balance/sponsor balance for apiKey: ${body.apiKey}, reason: ${JSON.stringify(item.reason)}` | ||
| ); | ||
| } | ||
| } | ||
| }); | ||
|
|
||
| if(error) { | ||
| return reply.code(400).send({error: ErrorMessage.BALANCE_EXCEEDS_THRESHOLD }); | ||
| } | ||
|
|
||
| const deleteCommand = new DeleteSecretCommand({ | ||
| SecretId: prefixSecretId + body.apiKey, | ||
| RecoveryWindowInDays: server.config.DELETE_KEY_RECOVER_WINDOW, | ||
| }); | ||
|
|
||
| await client.send(deleteCommand); | ||
|
|
||
| await server.apiKeyRepository.delete(body.apiKey); | ||
| } else { | ||
| const apiKeyInstance = await server.apiKeyRepository.findOneByApiKey(body.apiKey); | ||
| if (!apiKeyInstance) | ||
| return reply.code(ReturnCode.FAILURE).send({ error: ErrorMessage.RECORD_NOT_FOUND }); | ||
|
|
||
| await server.apiKeyRepository.delete(body.apiKey); | ||
| } | ||
|
|
||
| return reply.code(ReturnCode.SUCCESS).send({ error: null, message: 'Successfully deleted' }); | ||
| } catch (err: any) { | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| export interface AuthDto { | ||
| 'x-signature': string; | ||
| 'x-timestamp': string; | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ch4r10t33r using 7 days because only 7-30 days values are allowed for scheduled deletion.