feat(lit-api-server): enforce per-key spending rules on the hot path (lambda-parity PR 2)

Gateway side of the Lambda-parity work. Reads the on-chain hasSpendingRules gate
in the same multicall as the execute-permission check; keys without rules pay
zero extra work.

- accounts: can_execute_action_with_spending_rules -> (can_execute,
  has_spending_rules), cached in BlockchainCache (new execute_and_spending
  entry, same generation invalidation). Reads the new view via a scoped sol!
  interface (read_only_client_and_address helper) so it tracks the workspace
  alloy version instead of the regenerated giant binding.
- core::spending_rules: flag-gated enforcer. On a flagged key it fetches rules
  (cached, TTL) from lit-payments /internal, then enforces a rolling spend cap
  (402), a per-node token-bucket rate limit (429), and a per-node concurrency
  cap (429). Spend is recorded off the response path (in-memory + fire-and-
  forget POST). Inert unless LIT_PAYMENTS_INTERNAL_URL + INTERNAL_SERVICE_TOKEN
  are set AND the key's on-chain flag is on.
- Wired into core_features::lit_action + the /lit_action route + main state.
- 429 (too_many_requests) ApiStatus helper.

Origin allowlist (P2.1) deferred. SWR background refresh for the rules cache is
a marked follow-up (currently TTL with inline cold-miss fetch). cargo check
clean; 4 unit tests for the token bucket, window reset, and hash format.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glitch003

lit-api-server/src/accounts/blockchain_cache.rs

@@ -35,6 +35,8 @@ pub struct BlockchainCache {
     use_wallet: Cache<String, bool>,
     /// `can_execute_action_and_use_wallet` results.
     execute_and_wallet: Cache<String, (bool, bool)>,
+    /// `can_execute_action_with_spending_rules` results: (canExecute, hasSpendingRules).
+    execute_and_spending: Cache<String, (bool, bool)>,
     /// `get_wallet_derivation` results.
     wallet_derivation: Cache<String, U256>,
     /// Per-account generation counter keyed by the string representation of
@@ -62,6 +64,11 @@ impl BlockchainCache {
             .time_to_idle(ttl)
             .time_to_live(ttl)
             .build();
+        let execute_and_spending = Cache::builder()
+            .max_capacity(MAX_CAPACITY)
+            .time_to_idle(ttl)
+            .time_to_live(ttl)
+            .build();
         let wallet_derivation = Cache::builder()
             .max_capacity(MAX_CAPACITY)
             .time_to_idle(ttl)
@@ -71,6 +78,7 @@ impl BlockchainCache {
             execute_action,
             use_wallet,
             execute_and_wallet,
+            execute_and_spending,
             wallet_derivation,
             generations: RwLock::new(HashMap::new()),
         }
@@ -112,6 +120,13 @@ impl BlockchainCache {
         format!("{h}:g{g}:ew:{cid_hash}:{wallet:#x}")
     }
 
+    /// Build a cache key for `can_execute_action_with_spending_rules`.
+    pub fn execute_and_spending_key(&self, api_key_hash: U256, cid_hash: U256) -> String {
+        let h = api_key_hash.to_string();
+        let g = self.generation(&h);
+        format!("{h}:g{g}:es:{cid_hash}")
+    }
+
     /// Build a cache key for `get_wallet_derivation`.
     pub fn wallet_derivation_key(&self, api_key_hash: U256, wallet: Address) -> String {
         let h = api_key_hash.to_string();
@@ -134,6 +149,11 @@ impl BlockchainCache {
         &self.execute_and_wallet
     }
 
+    /// Reference to the `can_execute_action_with_spending_rules` cache.
+    pub fn execute_and_spending_cache(&self) -> &Cache<String, (bool, bool)> {
+        &self.execute_and_spending
+    }
+
     /// Reference to the `get_wallet_derivation` cache.
     pub fn wallet_derivation_cache(&self) -> &Cache<String, U256> {
         &self.wallet_derivation

lit-api-server/src/accounts/mod.rs

@@ -676,6 +676,67 @@ pub async fn can_execute_action(api_key: &str, cid_hash: U256) -> Result<bool> {
     Ok(can_execute)
 }
 
+/// Scoped binding for the spending-rules view added in lambda-parity PR 3.
+/// Defined here (not via the giant generated binding) so it tracks the workspace
+/// alloy version directly; fold into the generated binding once it is
+/// regenerated on the canonical toolchain. See `plans/chipotle-lambda-parity.md`.
+mod spending_view {
+    alloy::sol! {
+        #[sol(rpc)]
+        contract SpendingView {
+            function canExecuteActionWithSpendingRules(
+                uint256 apiKeyHash,
+                uint256 cidHash
+            ) external view returns (bool canExecute, bool hasSpendingRules);
+        }
+    }
+}
+
+async fn fetch_execute_and_spending(
+    account_api_key_hash: U256,
+    cid_hash_eth: U256,
+) -> Result<(bool, bool)> {
+    let (client, address) = crate::accounts::signable_contract::read_only_client_and_address()?;
+    let contract = spending_view::SpendingView::new(address, client);
+    let result = contract
+        .canExecuteActionWithSpendingRules(account_api_key_hash, cid_hash_eth)
+        .call()
+        .await?;
+    Ok((result.canExecute, result.hasSpendingRules))
+}
+
+/// Combined hot-path check: `(can_execute, has_spending_rules)` in a single RPC.
+///
+/// `has_spending_rules` is the zero-latency gate for per-key Lambda-parity
+/// controls — false for every key that never set it, so the common path does no
+/// extra work. See `plans/chipotle-lambda-parity.md`.
+#[instrument(
+    name = "accounts::can_execute_action_with_spending_rules",
+    level = "debug",
+    skip_all,
+    err
+)]
+pub async fn can_execute_action_with_spending_rules(
+    api_key: &str,
+    cid_hash: U256,
+) -> Result<(bool, bool)> {
+    let account_api_key_hash = api_key_hash(api_key);
+    let cid_hash_eth = cid_hash;
+
+    if let Some(cache) = blockchain_cache::get() {
+        let key = cache.execute_and_spending_key(account_api_key_hash, cid_hash);
+        return cache
+            .execute_and_spending_cache()
+            .try_get_with(key, async move {
+                fetch_execute_and_spending(account_api_key_hash, cid_hash_eth).await
+            })
+            .await
+            .map_err(|e: Arc<anyhow::Error>| anyhow::anyhow!("{:#}", e));
+    }
+
+    fetch_execute_and_spending(account_api_key_hash, cid_hash_eth).await
+}
+
 #[instrument(
     name = "accounts::can_use_wallet_in_action",
     level = "debug",

lit-api-server/src/accounts/signable_contract.rs

@@ -93,6 +93,28 @@ pub async fn get_admin_api_signer() -> Result<SigningClient> {
     signer_provider(wallet)
 }
 
+/// Read-only provider + the AccountConfig address, for ad-hoc scoped `sol!`
+/// interfaces that target functions not yet present in the regenerated giant
+/// binding (e.g. the spending-rules view from lambda-parity PR 3). Tracks the
+/// workspace alloy version directly; fold callers into the generated binding
+/// once it is regenerated on the canonical toolchain.
+pub(crate) fn read_only_client_and_address() -> Result<(SigningClient, Address)> {
+    let client = GLOBAL_READ_ONLY_CLIENT
+        .get()
+        .ok_or_else(|| {
+            anyhow::anyhow!(
+                "Read-only client not initialised — call init_chain_clients() at startup"
+            )
+        })?
+        .clone();
+    let node_config = GLOBAL_NODE_CONFIG
+        .get()
+        .ok_or_else(|| anyhow::anyhow!("Node configuration not found"))?;
+    let account_config_address =
+        Address::from_slice(&hex_to_bytes(&node_config.contract_address)?);
+    Ok((client, account_config_address))
+}
+
 pub(crate) async fn get_read_only_account_config_contract() -> Result<AccountConfigInstance> {
     let client = GLOBAL_READ_ONLY_CLIENT
         .get()

lit-api-server/src/core/core_features.rs

@@ -1,5 +1,6 @@
-use crate::accounts::can_execute_action;
+use crate::accounts::can_execute_action_with_spending_rules;
 use crate::accounts::chain_config::{ChainConfig, ConfigKeys};
+use crate::core::spending_rules::SpendingRulesState;
 use crate::actions::client::ClientBuilder;
 use crate::actions::client::models::DenoExecutionEnv;
 use crate::actions::client::{
@@ -32,6 +33,7 @@ pub async fn lit_action(
     http_client: &reqwest::Client,
     chain_config: Arc<ChainConfig>,
     stripe_state: Option<Arc<StripeState>>,
+    spending: &SpendingRulesState,
     lit_action_request: Json<LitActionRequest>,
 ) -> Result<LitActionResponse, ApiStatus> {
     let request_id = request_span.request_id.clone();
@@ -49,7 +51,10 @@ pub async fn lit_action(
     )
     .await?;
     let cid_hash = ipfs_cid_to_u256(&derived_ipfs_id)?;
-    let can_execute = can_execute_action(api_key, cid_hash)
+    // Single multicall returns the execute permission AND the zero-latency
+    // spending-rules gate. has_spending_rules is false for almost every key, so
+    // the spending-rules path below is skipped entirely for them.
+    let (can_execute, has_spending_rules) = can_execute_action_with_spending_rules(api_key, cid_hash)
         .instrument(tracing::debug_span!("lit_action::can_execute_action"))
         .await?;
     if !can_execute {
@@ -59,6 +64,11 @@ pub async fn lit_action(
         return Err(ApiStatus::forbidden(msg));
     }
 
+    // Enforce per-key spending rules (rolling cap / rate / concurrency) before
+    // execution. Inert unless the key is flagged AND enforcement is configured.
+    // The returned admission holds any concurrency permit until end of scope.
+    let admission = spending.admit(api_key, has_spending_rules).await?;
+
     // Cache after authorization so unauthorized requests cannot pollute the cache.
     ipfs_cache
         .insert(derived_ipfs_id.clone(), Arc::new(code_to_run.clone()))
@@ -96,6 +106,7 @@ pub async fn lit_action(
         action_ipfs_id: Some(derived_ipfs_id),
     };
 
+    let exec_start = std::time::Instant::now();
     let result = match client
         .execute_js(execution_options)
         .instrument(tracing::debug_span!("lit_action::execute_js"))
@@ -105,6 +116,11 @@ pub async fn lit_action(
         Err(e) => return Err(anyhow::anyhow!("Actions failed with : {:?}", e).into()),
     };
 
+    // Record execution against the key's rolling spend counter (no-op unless the
+    // key has a spend cap). Off the response path — the local update is in-memory
+    // and the lit-payments write is fire-and-forget.
+    admission.record_seconds(exec_start.elapsed().as_secs_f64().ceil() as u64);
+
     let response = match serde_json::from_str::<serde_json::Value>(&result.response) {
         Ok(response) => response,
         Err(e) => {

lit-api-server/src/core/mod.rs

@@ -3,6 +3,7 @@ use crate::utils::{parse_with_hash::pkp_id_to_h160, u256_to_derviation_path};
 pub mod account_management;
 pub mod core_features;
 pub mod eip712;
+pub mod spending_rules;
 pub mod v1;
 
 pub async fn pkp_id_to_derviation_path(api_key: &str, pkp_id: &str) -> Result<String, String> {