feat: add codex wallet

.env.example

@@ -53,7 +53,6 @@ VITE_ENSO_DISABLED=
 # Holdings History API (server-only)
 ENVIO_GRAPHQL_URL=http://localhost:8080/v1/graphql
 ENVIO_PASSWORD=testing
-HOLDINGS_TEST_WALLET_ADDRESS=
 # Holdings storage
 UPSTASH_REDIS_REST_URL_PORTFOLIO=
 UPSTASH_REDIS_REST_TOKEN_PORTFOLIO=

api/admin/invalidate-cache.ts

@@ -0,0 +1,88 @@
+import type { VercelRequest, VercelResponse } from '@vercel/node'
+import { invalidateVaults, type VaultIdentifier } from '../lib/holdings/services/cache'
+import { isHoldingsStorageEnabled } from '../lib/holdings/storage/redis'
+
+function isValidAddress(address: string): boolean {
+  return /^0x[a-fA-F0-9]{40}$/.test(address)
+}
+
+interface InvalidateRequestBody {
+  vaults: Array<{ address: string; chainId: number }>
+}
+
+function validateBody(body: unknown): body is InvalidateRequestBody {
+  if (!body || typeof body !== 'object') return false
+  const b = body as Record<string, unknown>
+  if (!Array.isArray(b.vaults)) return false
+  if (b.vaults.length === 0) return false
+
+  for (const vault of b.vaults) {
+    if (!vault || typeof vault !== 'object') return false
+    const v = vault as Record<string, unknown>
+    if (typeof v.address !== 'string' || !isValidAddress(v.address)) return false
+    if (typeof v.chainId !== 'number' || !Number.isInteger(v.chainId)) return false
+  }
+
+  return true
+}
+
+export default async function handler(req: VercelRequest, res: VercelResponse) {
+  res.setHeader('Access-Control-Allow-Origin', '*')
+  res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS')
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, x-admin-secret')
+
+  if (req.method === 'OPTIONS') {
+    return res.status(204).end()
+  }
+
+  if (req.method !== 'POST') {
+    return res.status(405).json({ error: 'Method not allowed' })
+  }
+
+  // Check admin secret
+  const adminSecret = process.env.ADMIN_SECRET
+  if (!adminSecret) {
+    return res.status(503).json({ error: 'Admin endpoint not configured' })
+  }
+
+  const providedSecret = req.headers['x-admin-secret']
+  if (providedSecret !== adminSecret) {
+    return res.status(401).json({ error: 'Unauthorized' })
+  }
+
+  // Check Redis storage is enabled
+  if (!isHoldingsStorageEnabled()) {
+    return res.status(503).json({ error: 'Caching not enabled (Redis storage not configured)' })
+  }
+
+  // Validate request body
+  const body = req.body
+  if (!validateBody(body)) {
+    return res.status(400).json({
+      error: 'Invalid request body',
+      expected: {
+        vaults: [{ address: '0x...', chainId: 1 }]
+      }
+    })
+  }
+
+  try {
+    const vaults: VaultIdentifier[] = body.vaults.map((v) => ({
+      address: v.address,
+      chainId: v.chainId
+    }))
+
+    const invalidatedCount = await invalidateVaults(vaults)
+    const timestamp = new Date().toISOString()
+
+    return res.status(200).json({
+      success: true,
+      invalidated: invalidatedCount,
+      vaults: vaults.map((v) => `${v.chainId}:${v.address.toLowerCase()}`),
+      timestamp
+    })
+  } catch (error) {
+    console.error('[Admin] Invalidate cache error:', error)
+    return res.status(500).json({ error: 'Failed to invalidate cache' })
+  }
+}

api/lib/holdings/services/cache.test.ts

@@ -63,4 +63,27 @@ describe('Redis cache writes', () => {
     ])
     expect(result.oldestUpdatedAt?.getTime()).toBe(2000)
   })
+
+  it('marks vaults as invalidated in Redis', async () => {
+    const msetMock = vi.fn().mockResolvedValue('OK')
+    const nowSpy = vi.spyOn(Date, 'now').mockReturnValue(1_779_564_000_000)
+    isHoldingsStorageEnabledMock.mockReturnValue(true)
+    getHoldingsRedisClientMock.mockReturnValue({
+      mset: msetMock
+    })
+
+    const { invalidateVaults } = await import('./cache')
+    const invalidated = await invalidateVaults([
+      {
+        address: '0xBe53A109B494E5c9f97b9Cd39Fe969BE68BF6204',
+        chainId: 1
+      }
+    ])
+
+    expect(invalidated).toBe(1)
+    expect(msetMock).toHaveBeenCalledWith({
+      'holdings:vault-invalidated:1:0xbe53a109b494e5c9f97b9cd39fe969be68bf6204': 1_779_564_000_000
+    })
+    nowSpy.mockRestore()
+  })
 })

api/lib/holdings/services/cache.ts

@@ -269,6 +269,34 @@ export async function checkCacheStaleness(
   }
 }
 
+export async function invalidateVaults(vaults: VaultIdentifier[]): Promise<number> {
+  if (!isHoldingsStorageEnabled() || vaults.length === 0) {
+    if (vaults.length > 0) {
+      debugLog('cache', 'skipping vault invalidation because Redis storage is disabled', { vaults: vaults.length })
+    }
+    return 0
+  }
+
+  const redis = getHoldingsRedisClient()
+  if (!redis) {
+    debugLog('cache', 'skipping vault invalidation because Redis client is unavailable', { vaults: vaults.length })
+    return 0
+  }
+
+  try {
+    const invalidatedAt = Date.now()
+    const valuesByKey = Object.fromEntries(vaults.map((vault) => [getVaultInvalidationKey(vault), invalidatedAt]))
+
+    await redis.mset(valuesByKey)
+    console.log(`[Cache] Invalidated ${vaults.length} vault cache markers`)
+    return vaults.length
+  } catch (error) {
+    handleHoldingsRedisError('vault invalidation failed', error)
+    debugError('cache', 'vault invalidation failed', error, { vaults: vaults.length })
+    return 0
+  }
+}
+
 export async function getCachedTotalsWithTimestamp(
   userAddress: string,
   version: string,

api/tenderly.helpers.test.ts

@@ -27,6 +27,48 @@ describe('parseTenderlyServerChains', () => {
       }
     ])
   })
+
+  it('rejects Tenderly execution chain ids that shadow other canonical chain ids', () => {
+    expect(() =>
+      parseTenderlyServerChains({
+        VITE_TENDERLY_MODE: 'true',
+        VITE_TENDERLY_CHAIN_ID_FOR_1: '10',
+        VITE_TENDERLY_RPC_URI_FOR_1: 'https://public.rpc'
+      })
+    ).toThrow(
+      /Tenderly canonical chain 1 \(Ethereum\) uses execution chain ID 10, which shadows supported canonical chain 10 .*Tenderly execution chain IDs must not shadow supported canonical chain IDs/
+    )
+  })
+
+  it('accepts identity Tenderly execution chain ids for the same canonical chain', () => {
+    expect(
+      parseTenderlyServerChains({
+        VITE_TENDERLY_MODE: 'true',
+        VITE_TENDERLY_CHAIN_ID_FOR_1: '1',
+        VITE_TENDERLY_RPC_URI_FOR_1: 'https://public.rpc'
+      })
+    ).toEqual([
+      {
+        canonicalChainId: 1,
+        canonicalChainName: 'Ethereum',
+        executionChainId: 1,
+        rpcUri: 'https://public.rpc',
+        adminRpcUri: undefined
+      }
+    ])
+  })
+
+  it('rejects duplicate Tenderly execution chain ids', () => {
+    expect(() =>
+      parseTenderlyServerChains({
+        VITE_TENDERLY_MODE: 'true',
+        VITE_TENDERLY_CHAIN_ID_FOR_1: '73571',
+        VITE_TENDERLY_RPC_URI_FOR_1: 'https://public.ethereum.rpc',
+        VITE_TENDERLY_CHAIN_ID_FOR_10: '73571',
+        VITE_TENDERLY_RPC_URI_FOR_10: 'https://public.optimism.rpc'
+      })
+    ).toThrow(/Duplicate Tenderly execution chain ID 73571 configured for canonical chains 1 and 10/)
+  })
 })
 
 describe('buildTenderlyPanelStatus', () => {

api/tenderly.helpers.ts

@@ -8,6 +8,9 @@ import type {
 import { canonicalChains } from '../src/config/chainDefinitions'
 
 type TTenderlyServerEnv = Record<string, string | undefined>
+const supportedCanonicalChainById = new Map<number, (typeof canonicalChains)[number]>(
+  canonicalChains.map((chain) => [chain.id, chain])
+)
 
 export type TTenderlyServerChainConfig = {
   canonicalChainId: number
@@ -51,6 +54,20 @@ export function parseTenderlyServerChains(env: TTenderlyServerEnv): TTenderlySer
       throw new Error(`Invalid Tenderly execution chain ID for canonical chain ${chain.id}: ${rawExecutionChainId}`)
     }
 
+    const collidingCanonicalChain = supportedCanonicalChainById.get(executionChainId)
+    if (collidingCanonicalChain && collidingCanonicalChain.id !== chain.id) {
+      throw new Error(
+        `Tenderly canonical chain ${chain.id} (${chain.name}) uses execution chain ID ${executionChainId}, which shadows supported canonical chain ${collidingCanonicalChain.id} (${collidingCanonicalChain.name}). Tenderly execution chain IDs must not shadow supported canonical chain IDs.`
+      )
+    }
+
+    const existingChain = accumulator.find((configuredChain) => configuredChain.executionChainId === executionChainId)
+    if (existingChain) {
+      throw new Error(
+        `Duplicate Tenderly execution chain ID ${executionChainId} configured for canonical chains ${existingChain.canonicalChainId} and ${chain.id}`
+      )
+    }
+
     accumulator.push({
       canonicalChainId: chain.id,
       canonicalChainName: chain.name,

api/tenderlyAccess.test.ts

@@ -1,10 +1,19 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import {
   buildTenderlyAdminAccessDeniedResponse,
+  buildTenderlyAdminCorsPreflightResponse,
   isLoopbackAddress,
-  isTenderlyAdminRequestAllowed
+  isTenderlyAdminOriginAllowed,
+  isTenderlyAdminRequestAllowed,
+  withTenderlyAdminCors
 } from './tenderlyAccess'
 
+const ORIGINAL_ENV = { ...process.env }
+
+afterEach(() => {
+  process.env = { ...ORIGINAL_ENV }
+})
+
 describe('isLoopbackAddress', () => {
   it('accepts loopback addresses', () => {
     expect(isLoopbackAddress('localhost')).toBe(true)
@@ -37,3 +46,100 @@ describe('isTenderlyAdminRequestAllowed', () => {
     })
   })
 })
+
+describe('Tenderly admin browser-origin access', () => {
+  it('allows only configured local browser origins', () => {
+    expect(isTenderlyAdminOriginAllowed(null)).toBe(true)
+    expect(isTenderlyAdminOriginAllowed('http://localhost:3000')).toBe(true)
+    expect(isTenderlyAdminOriginAllowed('http://127.0.0.1:3000')).toBe(true)
+    expect(isTenderlyAdminOriginAllowed('http://localhost:5173')).toBe(false)
+
+    process.env.TENDERLY_ADMIN_ALLOWED_ORIGINS = 'http://localhost:5173'
+    expect(isTenderlyAdminOriginAllowed('http://localhost:5173')).toBe(true)
+  })
+
+  it('reflects allowlisted origins on admin preflight responses', () => {
+    const response = buildTenderlyAdminCorsPreflightResponse(
+      new Request('http://localhost:3001/api/tenderly/snapshot', {
+        method: 'OPTIONS',
+        headers: { Origin: 'http://localhost:3000' }
+      })
+    )
+
+    expect(response.status).toBe(204)
+    expect(response.headers.get('Access-Control-Allow-Origin')).toBe('http://localhost:3000')
+    expect(response.headers.get('Access-Control-Allow-Methods')).toBe('POST, OPTIONS')
+    expect(response.headers.get('Access-Control-Allow-Headers')).toBe('Content-Type, x-admin-secret')
+  })
+
+  it('rejects unallowlisted browser preflights without permissive CORS', () => {
+    const response = buildTenderlyAdminCorsPreflightResponse(
+      new Request('http://localhost:3001/api/tenderly/snapshot', {
+        method: 'OPTIONS',
+        headers: { Origin: 'http://evil.localhost:3000' }
+      })
+    )
+
+    expect(response.status).toBe(403)
+    expect(response.headers.get('Access-Control-Allow-Origin')).toBeNull()
+  })
+
+  it('requires a configured admin secret for loopback mutation requests', async () => {
+    process.env.TENDERLY_ADMIN_SECRET = 'test-secret'
+
+    const missingSecret = buildTenderlyAdminAccessDeniedResponse(
+      '127.0.0.1',
+      new Request('http://localhost:3001/api/tenderly/snapshot', { method: 'POST' })
+    )
+    expect(missingSecret?.status).toBe(401)
+
+    const validSecret = buildTenderlyAdminAccessDeniedResponse(
+      '127.0.0.1',
+      new Request('http://localhost:3001/api/tenderly/snapshot', {
+        method: 'POST',
+        headers: { 'x-admin-secret': 'test-secret' }
+      })
+    )
+    expect(validSecret).toBeUndefined()
+  })
+
+  it('rejects unallowlisted browser mutation requests before handlers run', () => {
+    process.env.TENDERLY_ADMIN_SECRET = 'test-secret'
+
+    const response = buildTenderlyAdminAccessDeniedResponse(
+      '127.0.0.1',
+      new Request('http://localhost:3001/api/tenderly/snapshot', {
+        method: 'POST',
+        headers: {
+          Origin: 'http://evil.localhost:3000',
+          'x-admin-secret': 'test-secret'
+        }
+      })
+    )
+
+    expect(response?.status).toBe(403)
+    expect(response?.headers.get('Access-Control-Allow-Origin')).toBeNull()
+  })
+
+  it('does not add wildcard CORS to Tenderly admin mutation responses', () => {
+    const response = withTenderlyAdminCors(
+      Response.json(
+        { ok: true },
+        {
+          headers: {
+            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Credentials': 'true'
+          }
+        }
+      ),
+      new Request('http://localhost:3001/api/tenderly/snapshot', {
+        method: 'POST',
+        headers: { Origin: 'http://evil.localhost:3000' }
+      })
+    )
+
+    expect(response.headers.get('Access-Control-Allow-Origin')).toBeNull()
+    expect(response.headers.get('Access-Control-Allow-Credentials')).toBeNull()
+    expect(response.headers.get('Access-Control-Allow-Methods')).toBe('POST, OPTIONS')
+  })
+})