feat: add codex wallet

.env.example

@@ -53,7 +53,6 @@ VITE_ENSO_DISABLED=
 # Holdings History API (server-only)
 ENVIO_GRAPHQL_URL=http://localhost:8080/v1/graphql
 ENVIO_PASSWORD=testing
-HOLDINGS_TEST_WALLET_ADDRESS=
 # Holdings storage
 UPSTASH_REDIS_REST_URL_PORTFOLIO=
 UPSTASH_REDIS_REST_TOKEN_PORTFOLIO=

api/admin/invalidate-cache.test.ts

@@ -0,0 +1,96 @@
+import type { VercelRequest, VercelResponse } from '@vercel/node'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import handler from './invalidate-cache'
+
+const { invalidateVaultsMock, isHoldingsStorageEnabledMock } = vi.hoisted(() => ({
+  invalidateVaultsMock: vi.fn(),
+  isHoldingsStorageEnabledMock: vi.fn()
+}))
+
+vi.mock('../lib/holdings/services/cache', () => ({
+  invalidateVaults: invalidateVaultsMock
+}))
+
+vi.mock('../lib/holdings/storage/redis', () => ({
+  isHoldingsStorageEnabled: isHoldingsStorageEnabledMock
+}))
+
+const ORIGINAL_ENV = { ...process.env }
+
+function createResponse() {
+  const headers = new Map<string, string>()
+  const res = {
+    statusCode: 200,
+    body: undefined as unknown,
+    ended: false,
+    setHeader: vi.fn((key: string, value: string) => {
+      headers.set(key, value)
+      return res
+    }),
+    status: vi.fn((statusCode: number) => {
+      res.statusCode = statusCode
+      return res
+    }),
+    json: vi.fn((body: unknown) => {
+      res.body = body
+      return res
+    }),
+    end: vi.fn(() => {
+      res.ended = true
+      return res
+    }),
+    getHeader: (key: string) => headers.get(key)
+  }
+
+  return res as typeof res & VercelResponse
+}
+
+describe('admin cache invalidation CORS', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    process.env = { ...ORIGINAL_ENV, ADMIN_SECRET: 'test-secret' }
+    isHoldingsStorageEnabledMock.mockReturnValue(true)
+    invalidateVaultsMock.mockResolvedValue(1)
+  })
+
+  afterEach(() => {
+    process.env = { ...ORIGINAL_ENV }
+  })
+
+  it('reflects allowlisted origins without wildcard CORS', async () => {
+    process.env.ADMIN_ALLOWED_ORIGINS = 'https://preview.example'
+    const res = createResponse()
+
+    await handler(
+      {
+        method: 'OPTIONS',
+        headers: { origin: 'https://preview.example' }
+      } as VercelRequest,
+      res
+    )
+
+    expect(res.status).toHaveBeenCalledWith(204)
+    expect(res.getHeader('Access-Control-Allow-Origin')).toBe('https://preview.example')
+    expect(res.getHeader('Vary')).toBe('Origin')
+  })
+
+  it('rejects unallowlisted browser origins without CORS headers', async () => {
+    const res = createResponse()
+
+    await handler(
+      {
+        method: 'POST',
+        headers: { origin: 'https://evil.example', 'x-admin-secret': 'test-secret' },
+        body: {
+          vaults: [{ address: '0xBe53A109B494E5c9f97b9Cd39Fe969BE68BF6204', chainId: 1 }]
+        }
+      } as VercelRequest,
+      res
+    )
+
+    expect(res.status).toHaveBeenCalledWith(403)
+    expect(res.body).toEqual({ error: 'Origin not allowed' })
+    expect(res.getHeader('Access-Control-Allow-Origin')).toBeUndefined()
+    expect(invalidateVaultsMock).not.toHaveBeenCalled()
+  })
+})

api/admin/invalidate-cache.ts

@@ -0,0 +1,133 @@
+import type { VercelRequest, VercelResponse } from '@vercel/node'
+import { invalidateVaults, type VaultIdentifier } from '../lib/holdings/services/cache'
+import { isHoldingsStorageEnabled } from '../lib/holdings/storage/redis'
+
+const ADMIN_ALLOWED_ORIGIN_DEFAULTS = ['http://localhost:3000', 'http://127.0.0.1:3000']
+const ADMIN_CORS_HEADERS = {
+  'Access-Control-Allow-Methods': 'POST, OPTIONS',
+  'Access-Control-Allow-Headers': 'Content-Type, x-admin-secret'
+}
+
+function isValidAddress(address: string): boolean {
+  return /^0x[a-fA-F0-9]{40}$/.test(address)
+}
+
+interface InvalidateRequestBody {
+  vaults: Array<{ address: string; chainId: number }>
+}
+
+function validateBody(body: unknown): body is InvalidateRequestBody {
+  if (!body || typeof body !== 'object') return false
+  const b = body as Record<string, unknown>
+  if (!Array.isArray(b.vaults)) return false
+  if (b.vaults.length === 0) return false
+
+  for (const vault of b.vaults) {
+    if (!vault || typeof vault !== 'object') return false
+    const v = vault as Record<string, unknown>
+    if (typeof v.address !== 'string' || !isValidAddress(v.address)) return false
+    if (typeof v.chainId !== 'number' || !Number.isInteger(v.chainId)) return false
+  }
+
+  return true
+}
+
+function readCsvValues(value: string | undefined): string[] {
+  return (
+    value
+      ?.split(',')
+      .map((origin) => origin.trim())
+      .filter(Boolean) ?? []
+  )
+}
+
+function getAdminAllowedOrigins(): Set<string> {
+  return new Set([...ADMIN_ALLOWED_ORIGIN_DEFAULTS, ...readCsvValues(process.env.ADMIN_ALLOWED_ORIGINS)])
+}
+
+function getRequestOrigin(req: VercelRequest): string | null {
+  const origin = req.headers.origin
+  if (Array.isArray(origin)) {
+    return origin[0] ?? null
+  }
+  return origin ?? null
+}
+
+function applyAdminCorsHeaders(req: VercelRequest, res: VercelResponse): boolean {
+  const origin = getRequestOrigin(req)
+  if (origin && !getAdminAllowedOrigins().has(origin)) {
+    return false
+  }
+
+  for (const [key, value] of Object.entries(ADMIN_CORS_HEADERS)) {
+    res.setHeader(key, value)
+  }
+
+  if (origin) {
+    res.setHeader('Access-Control-Allow-Origin', origin)
+    res.setHeader('Vary', 'Origin')
+  }
+
+  return true
+}
+
+export default async function handler(req: VercelRequest, res: VercelResponse) {
+  if (!applyAdminCorsHeaders(req, res)) {
+    return res.status(403).json({ error: 'Origin not allowed' })
+  }
+
+  if (req.method === 'OPTIONS') {
+    return res.status(204).end()
+  }
+
+  if (req.method !== 'POST') {
+    return res.status(405).json({ error: 'Method not allowed' })
+  }
+
+  // Check admin secret
+  const adminSecret = process.env.ADMIN_SECRET
+  if (!adminSecret) {
+    return res.status(503).json({ error: 'Admin endpoint not configured' })
+  }
+
+  const providedSecret = req.headers['x-admin-secret']
+  if (providedSecret !== adminSecret) {
+    return res.status(401).json({ error: 'Unauthorized' })
+  }
+
+  // Check Redis storage is enabled
+  if (!isHoldingsStorageEnabled()) {
+    return res.status(503).json({ error: 'Caching not enabled (Redis storage not configured)' })
+  }
+
+  // Validate request body
+  const body = req.body
+  if (!validateBody(body)) {
+    return res.status(400).json({
+      error: 'Invalid request body',
+      expected: {
+        vaults: [{ address: '0x...', chainId: 1 }]
+      }
+    })
+  }
+
+  try {
+    const vaults: VaultIdentifier[] = body.vaults.map((v) => ({
+      address: v.address,
+      chainId: v.chainId
+    }))
+
+    const invalidatedCount = await invalidateVaults(vaults)
+    const timestamp = new Date().toISOString()
+
+    return res.status(200).json({
+      success: true,
+      invalidated: invalidatedCount,
+      vaults: vaults.map((v) => `${v.chainId}:${v.address.toLowerCase()}`),
+      timestamp
+    })
+  } catch (error) {
+    console.error('[Admin] Invalidate cache error:', error)
+    return res.status(500).json({ error: 'Failed to invalidate cache' })
+  }
+}

api/lib/holdings/services/cache.test.ts

@@ -63,4 +63,27 @@ describe('Redis cache writes', () => {
     ])
     expect(result.oldestUpdatedAt?.getTime()).toBe(2000)
   })
+
+  it('marks vaults as invalidated in Redis', async () => {
+    const msetMock = vi.fn().mockResolvedValue('OK')
+    const nowSpy = vi.spyOn(Date, 'now').mockReturnValue(1_779_564_000_000)
+    isHoldingsStorageEnabledMock.mockReturnValue(true)
+    getHoldingsRedisClientMock.mockReturnValue({
+      mset: msetMock
+    })
+
+    const { invalidateVaults } = await import('./cache')
+    const invalidated = await invalidateVaults([
+      {
+        address: '0xBe53A109B494E5c9f97b9Cd39Fe969BE68BF6204',
+        chainId: 1
+      }
+    ])
+
+    expect(invalidated).toBe(1)
+    expect(msetMock).toHaveBeenCalledWith({
+      'holdings:vault-invalidated:1:0xbe53a109b494e5c9f97b9cd39fe969be68bf6204': 1_779_564_000_000
+    })
+    nowSpy.mockRestore()
+  })
 })

api/lib/holdings/services/cache.ts

@@ -269,6 +269,34 @@ export async function checkCacheStaleness(
   }
 }
 
+export async function invalidateVaults(vaults: VaultIdentifier[]): Promise<number> {
+  if (!isHoldingsStorageEnabled() || vaults.length === 0) {
+    if (vaults.length > 0) {
+      debugLog('cache', 'skipping vault invalidation because Redis storage is disabled', { vaults: vaults.length })
+    }
+    return 0
+  }
+
+  const redis = getHoldingsRedisClient()
+  if (!redis) {
+    debugLog('cache', 'skipping vault invalidation because Redis client is unavailable', { vaults: vaults.length })
+    return 0
+  }
+
+  try {
+    const invalidatedAt = Date.now()
+    const valuesByKey = Object.fromEntries(vaults.map((vault) => [getVaultInvalidationKey(vault), invalidatedAt]))
+
+    await redis.mset(valuesByKey)
+    console.log(`[Cache] Invalidated ${vaults.length} vault cache markers`)
+    return vaults.length
+  } catch (error) {
+    handleHoldingsRedisError('vault invalidation failed', error)
+    debugError('cache', 'vault invalidation failed', error, { vaults: vaults.length })
+    return 0
+  }
+}
+
 export async function getCachedTotalsWithTimestamp(
   userAddress: string,
   version: string,

api/server.ts

@@ -53,7 +53,11 @@ import {
   requireTenderlyServerChain,
   resolveTenderlyFundRpcRequest
 } from './tenderly.helpers'
-import { buildTenderlyAdminAccessDeniedResponse } from './tenderlyAccess'
+import {
+  buildTenderlyAdminAccessDeniedResponse,
+  buildTenderlyAdminCorsPreflightResponse,
+  withTenderlyAdminCors
+} from './tenderlyAccess'
 
 const ENSO_API_BASE = 'https://api.enso.finance'
 const DEFAULT_API_PORT = 3001
@@ -156,6 +160,15 @@ function handleCorsPreFlight(): Response {
   })
 }
 
+function isTenderlyAdminPath(pathname: string): boolean {
+  return (
+    pathname === '/api/tenderly/snapshot' ||
+    pathname === '/api/tenderly/revert' ||
+    pathname === '/api/tenderly/increase-time' ||
+    pathname === '/api/tenderly/fund'
+  )
+}
+
 async function handleHoldingsProgress(req: Request): Promise<Response> {
   const url = new URL(req.url)
   const progress = await getHoldingsProgress(url.searchParams.get('id'))
@@ -1295,6 +1308,10 @@ async function main() {
       console.log(`[Server] ${req.method} ${url.pathname}`)
 
       try {
+        if (req.method === 'OPTIONS' && isTenderlyAdminPath(url.pathname)) {
+          return buildTenderlyAdminCorsPreflightResponse(req)
+        }
+
         if (req.method === 'OPTIONS') {
           return handleCorsPreFlight()
         }
@@ -1371,35 +1388,35 @@ async function main() {
         }
 
         if (url.pathname === '/api/tenderly/snapshot') {
-          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address)
+          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address, req)
           if (accessDeniedResponse) {
-            return withCors(accessDeniedResponse)
+            return withTenderlyAdminCors(accessDeniedResponse, req)
           }
-          return withCors(await handleTenderlySnapshot(req))
+          return withTenderlyAdminCors(await handleTenderlySnapshot(req), req)
         }
 
         if (url.pathname === '/api/tenderly/revert') {
-          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address)
+          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address, req)
           if (accessDeniedResponse) {
-            return withCors(accessDeniedResponse)
+            return withTenderlyAdminCors(accessDeniedResponse, req)
           }
-          return withCors(await handleTenderlyRevert(req))
+          return withTenderlyAdminCors(await handleTenderlyRevert(req), req)
         }
 
         if (url.pathname === '/api/tenderly/increase-time') {
-          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address)
+          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address, req)
           if (accessDeniedResponse) {
-            return withCors(accessDeniedResponse)
+            return withTenderlyAdminCors(accessDeniedResponse, req)
           }
-          return withCors(await handleTenderlyIncreaseTime(req))
+          return withTenderlyAdminCors(await handleTenderlyIncreaseTime(req), req)
         }
 
         if (url.pathname === '/api/tenderly/fund') {
-          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address)
+          const accessDeniedResponse = buildTenderlyAdminAccessDeniedResponse(server.requestIP(req)?.address, req)
           if (accessDeniedResponse) {
-            return withCors(accessDeniedResponse)
+            return withTenderlyAdminCors(accessDeniedResponse, req)
           }
-          return withCors(await handleTenderlyFund(req))
+          return withTenderlyAdminCors(await handleTenderlyFund(req), req)
         }
 
         return withCors(new Response('Not found', { status: 404 }))