LIT-Protocol
diff --git a/‎lit-api-server/Cargo.lock‎
Lines changed: 10 additions & 0 deletions b/‎lit-api-server/Cargo.lock‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎lit-api-server/Cargo.toml‎
Lines changed: 3 additions & 1 deletion b/‎lit-api-server/Cargo.toml‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎lit-api-server/src/auth_resolver.rs‎
Lines changed: 108 additions & 0 deletions b/‎lit-api-server/src/auth_resolver.rs‎
Lines changed: 108 additions & 0 deletions
diff --git a/‎lit-api-server/src/core/v1/endpoints/billing.rs‎
Lines changed: 1 addition & 1 deletion b/‎lit-api-server/src/core/v1/endpoints/billing.rs‎
Lines changed: 1 addition & 1 deletion
@@ -20,6 +20,7 @@ apalis = { version = "0.6.0", features = ["tracing"] }
 apalis-sql = { version = "0.6.0", features = ["sqlite", "tokio-comp"] }
 
 anyhow = "1.0"
+async-trait = "0.1"
 base64_light = "0.1"
 dstack-sdk = "0.1.2"
 derive_builder = "0.12.0"
@@ -43,7 +44,7 @@ sha3 = "0.10"
 ipfs-hasher = "0.13.0"
 elliptic-curve = "0.13.8"
 k256 = { version = "0.13.4", features = ["ecdsa"] }
-lit-billing-core = { path = "../lit-billing-core" }
+lit-billing-core = { path = "../lit-billing-core", features = ["openapi"] }
 lit-core = { path = "../lit-core/lit-core" }
 lit-core-derive = { path = "../lit-core/lit-core-derive" }
 lit-observability = { path = "../lit-core/lit-observability", features = ["channels"] }
@@ -76,6 +77,7 @@ rand = { version = "0.8" }
 sqlx = { version = "0.8", features = ["sqlite", "runtime-tokio"] }
 strum = "0.28.0"
 strum_macros = "0.28.0"
+subtle = "2.6"
 url = "2"
 
 rocket_okapi = { version = "=0.9.0", features = ["swagger"] }
 
@@ -0,0 +1,108 @@
+//! Local [`AuthResolver`] implementation — runs auth verification in-process.
+//!
+//! `lit-api-server` already owns the on-chain `allApiKeyHashesToMaster`
+//! resolver and the in-process EIP-712 verifier. This adapter wires those
+//! into the shared `lit-billing-core::billing_auth` trait so the same Rocket
+//! guard can authenticate handlers on this service without an HTTP hop.
+//!
+//! Post-glitch-refactor: `lit-payments` constructs an identical in-process
+//! resolver using the shared crate's primitives — see
+//! `lit-payments/src/auth_resolver.rs`. There is no HTTP fallback any more;
+//! the `/internal/verify_wallet_auth` + `/internal/resolve_api_key`
+//! endpoints have been deleted.
+
+use alloy::primitives::keccak256;
+use async_trait::async_trait;
+use lit_billing_core::billing_auth::{
+    AuthError, AuthResolver, ResolvedIdentity, WalletAuthPayload,
+};
+
+use crate::core::eip712::{PRIMARY_TYPE_BILLING_AUTH, verify_eip712_signature};
+
+pub struct LocalAuthResolver;
+
+impl LocalAuthResolver {
+    pub fn new() -> Self {
+        Self
+    }
+}
+
+impl Default for LocalAuthResolver {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl AuthResolver for LocalAuthResolver {
+    async fn verify_wallet_auth(
+        &self,
+        payload: &WalletAuthPayload,
+    ) -> Result<ResolvedIdentity, AuthError> {
+        let wallet = verify_eip712_signature(
+            &payload.typed_data,
+            &payload.signature,
+            PRIMARY_TYPE_BILLING_AUTH,
+        )
+        .map_err(|e| {
+            // ApiStatus has 4xx and 5xx variants; we collapse to BadCredentials
+            // since every error path here is some flavour of "this payload did
+            // not authenticate." Chain/RPC failures inside verify_eip712 would
+            // be surfaced through the chain-id check, which is also a 4xx.
+            AuthError::BadCredentials(format!("eip712 verification failed: {e:?}"))
+        })?;
+
+        let wallet_address_hex = format!("0x{:x}", wallet);
+        let hash = keccak256(wallet.as_slice());
+        let api_key_hash_hex = format!("0x{}", hex::encode(hash));
+        Ok(ResolvedIdentity {
+            wallet_address_hex,
+            api_key_hash_hex,
+        })
+    }
+
+    async fn resolve_api_key(&self, api_key: &str) -> Result<ResolvedIdentity, AuthError> {
+        // `get_billing_wallet_address` already accepts either a raw API key or
+        // a precomputed 0x-prefixed hash. The Rocket guard rejects the latter
+        // for the API-key header (CPL-285 hardening), so callers here always
+        // pass a raw key, but the function is shared with WalletSigned
+        // downstream so we keep the broad acceptance.
+        //
+        // Codex P2 (Phase 2) fix: distinguish "key has no wallet on chain"
+        // (BadCredentials → 401) from "RPC / contract call failed"
+        // (Transient → 503). Pre-fix this method collapsed every error to
+        // Transient, so bad API keys produced 503s and made lit-payments
+        // retry-loop for permanent credential failures.
+        let wallet_address_hex = match crate::accounts::get_billing_wallet_address(api_key).await {
+            Ok(v) => v,
+            Err(e) => {
+                // `accounts::get_billing_wallet_address` bails with "account
+                // has no wallet address" when the on-chain mapping returns
+                // Address::ZERO for this key hash — i.e. the key isn't
+                // registered. Any other anyhow error is transport / RPC /
+                // contract decoding noise → transient.
+                let msg = format!("{e}");
+                if msg.contains("no wallet address") || msg.contains("Address::ZERO") {
+                    return Err(AuthError::BadCredentials(format!(
+                        "api key not found on chain: {msg}"
+                    )));
+                }
+                return Err(AuthError::Transient(format!(
+                    "on-chain resolve failed: {msg}"
+                )));
+            }
+        };
+
+        // Derive the api_key_hash_hex from the wallet address — same value
+        // ChainSecured callers carry around so downstream caching keys match.
+        let bytes = hex::decode(wallet_address_hex.trim_start_matches("0x"))
+            .map_err(|e| AuthError::BadCredentials(format!("invalid wallet hex: {e}")))?;
+        let hash = keccak256(&bytes);
+        let api_key_hash_hex = format!("0x{}", hex::encode(hash));
+
+        Ok(ResolvedIdentity {
+            wallet_address_hex,
+            api_key_hash_hex,
+        })
+    }
+}
@@ -1,13 +1,13 @@
 use std::sync::Arc;
 
-use crate::core::v1::guards::billing_auth::BillingAuth;
 use crate::core::v1::helpers::api_status::{ApiResult, ApiStatus, ErrMessage};
 use crate::core::v1::helpers::open_api_response::OpenApiResponse;
 use crate::core::v1::models::request::{ConfirmPaymentRequest, CreatePaymentIntentRequest};
 use crate::core::v1::models::response::{
     AccountOpResponse, BillingBalanceResponse, CreatePaymentIntentResponse, StripeConfigResponse,
 };
 use crate::stripe::{self, StripeState};
+use lit_billing_core::billing_auth::BillingAuth;
 use rocket::State;
 use rocket::serde::json::Json;
 use rocket::{get, post};