feat: upgrade rafiki (#2157)

* feat: upgrade rafiki

* fix: change schema urls

* fix: resolve fixture issue

* fix: update open payments url

* fix: remove/add tenant id on requests as needed

Author: dragosp1011

docker/dev/.env.example

@@ -28,3 +28,6 @@ CARD_DATA_HREF=
 PRIVATE_KEY=
 KEY_ID=
 PAYMENT_POINTER=
+
+OPERATOR_TENANT_ID=
+ADMIN_API_SECRET=

docker/dev/docker-compose.yml

@@ -74,6 +74,9 @@ services:
       STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY}
       STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
       USE_STRIPE: ${USE_STRIPE}
+      OPERATOR_TENANT_ID: ${OPERATOR_TENANT_ID:-f829c064-762a-4430-ac5d-7af5df198551}
+      ADMIN_API_SECRET: ${ADMIN_API_SECRET:-secret-key}
+      ADMIN_SIGNATURE_VERSION: 1
     restart: always
     networks:
       - testnet
@@ -114,7 +117,7 @@ services:
   # Rafiki
   rafiki-auth:
     container_name: rafiki-auth
-    image: ghcr.io/interledger/rafiki-auth:v1.2.0-beta
+    image: ghcr.io/interledger/rafiki-auth:v2.0.0-beta
     restart: always
     networks:
       - testnet
@@ -134,13 +137,16 @@ services:
       INTERACTION_COOKIE_SAME_SITE: ${AUTH_INTERACTION_COOKIE_SAME_SITE:-lax}
       WAIT_SECONDS: 1
       REDIS_URL: redis://redis:6379/0
+      OPERATOR_TENANT_ID: ${OPERATOR_TENANT_ID:-f829c064-762a-4430-ac5d-7af5df198551}
+      ADMIN_API_SECRET: ${ADMIN_API_SECRET:-secret-key}
+      ADMIN_SIGNATURE_VERSION: 1
     depends_on:
       - postgres
     <<: *logging
 
   rafiki-backend:
     container_name: rafiki-backend
-    image: ghcr.io/interledger/rafiki-backend:v1.2.0-beta
+    image: ghcr.io/interledger/rafiki-backend:v2.0.0-beta
     restart: always
     privileged: true
     volumes:
@@ -169,7 +175,7 @@ services:
       ILP_CONNECTOR_URL: http://127.0.0.1:3002
       STREAM_SECRET: BjPXtnd00G2mRQwP/8ZpwyZASOch5sUXT5o0iR5b5wU=
       ADMIN_KEY: admin
-      OPEN_PAYMENTS_URL: http://rafiki-backend
+      OPEN_PAYMENTS_URL: https://rafiki-backend
       REDIS_URL: redis://redis:6379/0
       WALLET_ADDRESS_URL: https://rafiki-backend/.well-known/pay
       # Testnet urls - not implemented
@@ -183,14 +189,18 @@ services:
       SLIPPAGE: 0.01
       KEY_ID: rafiki
       WALLET_ADDRESS_REDIRECT_HTML_PAGE: ${WALLET_ADDRESS_REDIRECT_HTML_PAGE}
+      OPERATOR_TENANT_ID: ${OPERATOR_TENANT_ID:-f829c064-762a-4430-ac5d-7af5df198551}
+      ADMIN_API_SECRET: ${ADMIN_API_SECRET:-secret-key}
+      ADMIN_SIGNATURE_VERSION: 1
+      AUTH_SERVICE_API_URL: http://rafiki-auth:3011
     depends_on:
       - postgres
       - redis
     <<: *logging
 
   rafiki-frontend:
     container_name: rafiki-frontend
-    image: ghcr.io/interledger/rafiki-frontend:v1.2.0-beta
+    image: ghcr.io/interledger/rafiki-frontend:v2.0.0-beta
     depends_on:
       - rafiki-backend
     restart: always
@@ -208,6 +218,7 @@ services:
       KRATOS_BROWSER_PUBLIC_URL: 'http://localhost:4433'
       KRATOS_ADMIN_URL: 'http://kratos:4434/admin'
       AUTH_ENABLED: false
+      SIGNATURE_VERSION: 1
     <<: *logging
 
   kratos:

packages/boutique/backend/src/open-payments/service.ts

@@ -167,10 +167,13 @@ export class OpenPayments implements IOpenPayments {
         interactRef
       })
 
+      const customerWalletAddress = await this.getWalletAddress(
+        order.payments.walletAddress
+      )
       await this.opClient.outgoingPayment
         .create(
           {
-            url: new URL(order.payments.walletAddress).origin,
+            url: customerWalletAddress.resourceServer,
             accessToken: continuation.accessToken
           },
           {
@@ -220,6 +223,9 @@ export class OpenPayments implements IOpenPayments {
       url = url.replace('rafiki-auth', 'localhost')
     }
 
+    // remove tenant id as it is not used for hash
+    url = url.replace(/\/[0-9a-fA-F-]+\/?$/, '')
+
     const data = `${clientNonce}\n${interactNonce}\n${interactRef}\n${url}/`
     const hash = createHash('sha-256').update(data).digest('base64')
 

packages/wallet/backend/codegen.yml

@@ -9,13 +9,13 @@ config:
 generates:
   src/rafiki/backend/generated/graphql.ts:
     documents: 'src/rafiki/backend/**/!(*.d).{ts,tsx}'
-    schema: http://localhost:3011/graphql
+    schema: https://raw.githubusercontent.com/interledger/rafiki/refs/tags/v2.0.0-beta/packages/backend/src/graphql/schema.graphql
     plugins:
       - 'typescript'
       - 'typescript-operations'
   src/rafiki/auth/generated/graphql.ts:
     documents: 'src/rafiki/auth/**/!(*.d).{ts,tsx}'
-    schema: http://localhost:3008/graphql
+    schema: https://raw.githubusercontent.com/interledger/rafiki/refs/tags/v2.0.0-beta/packages/auth/src/graphql/schema.graphql
     plugins:
       - 'typescript'
       - 'typescript-operations'

packages/wallet/backend/src/config/env.ts

@@ -39,6 +39,9 @@ const envSchema = z.object({
   AUTH_DOMAIN: z.string().url().default('http://rafiki-auth:3009'),
   AUTH_IDENTITY_SERVER_SECRET: z.string().default('replace-me'),
   RAFIKI_WEBHOOK_SIGNATURE_SECRET: z.string().default('replace-me'),
+  ADMIN_SIGNATURE_VERSION: z.string().default('1'),
+  ADMIN_API_SECRET: z.string().default('replace-me'),
+  OPERATOR_TENANT_ID: z.string().default('tenant'),
   OPEN_PAYMENTS_HOST: z.string().url().default('https://backend:80'),
   RAFIKI_MONEY_FRONTEND_HOST: z.string().default('localhost'),
   SENDGRID_API_KEY: z.string().default('SG.API_KEY'),

packages/wallet/backend/src/config/rafiki.ts

@@ -1,10 +1,74 @@
 import { Env } from '@/config/env'
-import { GraphQLClient } from 'graphql-request'
+import {
+  GraphQLClient,
+  type RequestMiddleware,
+  type Variables
+} from 'graphql-request'
+import { canonicalize } from 'json-canonicalize'
+import { createHmac } from 'crypto'
+
+// Type for the request body in GraphQL requests
+interface GraphQLRequestBody {
+  query: string
+  variables?: Variables
+  operationName?: string
+}
+
+function createSignedClient(endpoint: string, env: Env) {
+  const middleware: RequestMiddleware = async (request) => {
+    try {
+      const timestamp = Date.now()
+      const version = env.ADMIN_SIGNATURE_VERSION
+
+      // Extract query from the request body
+      let query = ''
+      if (request.body && typeof request.body === 'string') {
+        try {
+          const body: GraphQLRequestBody = JSON.parse(request.body)
+          query = body.query || ''
+        } catch (e) {
+          // Body is not valid JSON - this shouldn't happen with GraphQL requests
+          // but we'll handle it gracefully
+          query = ''
+        }
+      }
+
+      const formattedRequest = {
+        variables: request.variables ?? {},
+        operationName: request.operationName,
+        query
+      }
+
+      const payload = `${timestamp}.${canonicalize(formattedRequest)}`
+
+      const hmac = createHmac('sha256', env.ADMIN_API_SECRET)
+      hmac.update(payload)
+      const digest = hmac.digest('hex')
+
+      const signature = `t=${timestamp}, v${version}=${digest}`
+
+      return {
+        ...request,
+        headers: {
+          ...(request.headers as Record<string, string>),
+          signature,
+          'tenant-id': env.OPERATOR_TENANT_ID
+        }
+      }
+    } catch (e) {
+      return request
+    }
+  }
+
+  return new GraphQLClient(endpoint, {
+    requestMiddleware: middleware
+  })
+}
 
 export function createBackendGraphQLClient(env: Env) {
-  return new GraphQLClient(env.GRAPHQL_ENDPOINT)
+  return createSignedClient(env.GRAPHQL_ENDPOINT, env)
 }
 
 export function createAuthGraphQLClient(env: Env) {
-  return new GraphQLClient(env.AUTH_GRAPHQL_ENDPOINT)
+  return createSignedClient(env.AUTH_GRAPHQL_ENDPOINT, env)
 }

packages/wallet/backend/src/incomingPayment/service.ts

@@ -111,7 +111,7 @@ export class IncomingPaymentService implements IIncomingPaymentService {
 
     return {
       description: receiver.metadata.description,
-      value: parseFloat(transformAmount(value, asset.scale)),
+      value: parseFloat(transformAmount(value.toString(), asset.scale)),
       assetCode: asset.code
     }
   }

packages/wallet/backend/src/rafiki/auth/generated/graphql.ts

@@ -12,8 +12,10 @@ export type Scalars = {
   Boolean: { input: boolean; output: boolean; }
   Int: { input: number; output: number; }
   Float: { input: number; output: number; }
-  BigInt: { input: bigint; output: bigint; }
+  /** The `UInt8` scalar type represents unsigned 8-bit whole numeric values, ranging from 0 to 255. */
   UInt8: { input: number; output: number; }
+  /** The `UInt64` scalar type represents unsigned 64-bit whole numeric values. It is capable of handling values that are larger than the JavaScript `Number` type limit (greater than 2^53). */
+  UInt64: { input: any; output: any; }
 };
 
 export type Access = Model & {
@@ -65,6 +67,8 @@ export type Grant = Model & {
   id: Scalars['ID']['output'];
   /** Current state of the grant. */
   state: GrantState;
+  /** Unique identifier of the tenant associated with the grant. */
+  tenantId: Scalars['ID']['output'];
 };
 
 export type GrantEdge = {
@@ -161,7 +165,7 @@ export type PaymentAmount = {
   /** Difference in orders of magnitude between the standard unit of an asset and a corresponding fractional unit. */
   assetScale: Scalars['UInt8']['output'];
   /** The value of the payment amount. */
-  value: Scalars['BigInt']['output'];
+  value: Scalars['UInt64']['output'];
 };
 
 export type Query = {
@@ -185,6 +189,7 @@ export type QueryGrantsArgs = {
   first?: InputMaybe<Scalars['Int']['input']>;
   last?: InputMaybe<Scalars['Int']['input']>;
   sortOrder?: InputMaybe<SortOrder>;
+  tenantId?: InputMaybe<Scalars['ID']['input']>;
 };
 
 export type RevokeGrantInput = {
@@ -214,14 +219,14 @@ export type GetGrantsQueryVariables = Exact<{
 }>;
 
 
-export type GetGrantsQuery = { __typename?: 'Query', grants: { __typename?: 'GrantsConnection', edges: Array<{ __typename?: 'GrantEdge', cursor: string, node: { __typename?: 'Grant', id: string, client: string, state: GrantState, finalizationReason?: GrantFinalization | null, createdAt: string, access: Array<{ __typename?: 'Access', id: string, identifier?: string | null, createdAt: string, actions: Array<string | null>, type: string, limits?: { __typename?: 'LimitData', receiver?: string | null, interval?: string | null, debitAmount?: { __typename?: 'PaymentAmount', value: bigint, assetCode: string, assetScale: number } | null, receiveAmount?: { __typename?: 'PaymentAmount', value: bigint, assetCode: string, assetScale: number } | null } | null }> } }>, pageInfo: { __typename?: 'PageInfo', endCursor?: string | null, hasNextPage: boolean, hasPreviousPage: boolean, startCursor?: string | null } } };
+export type GetGrantsQuery = { __typename?: 'Query', grants: { __typename?: 'GrantsConnection', edges: Array<{ __typename?: 'GrantEdge', cursor: string, node: { __typename?: 'Grant', id: string, client: string, state: GrantState, finalizationReason?: GrantFinalization | null, createdAt: string, access: Array<{ __typename?: 'Access', id: string, identifier?: string | null, createdAt: string, actions: Array<string | null>, type: string, limits?: { __typename?: 'LimitData', receiver?: string | null, interval?: string | null, debitAmount?: { __typename?: 'PaymentAmount', value: any, assetCode: string, assetScale: number } | null, receiveAmount?: { __typename?: 'PaymentAmount', value: any, assetCode: string, assetScale: number } | null } | null }> } }>, pageInfo: { __typename?: 'PageInfo', endCursor?: string | null, hasNextPage: boolean, hasPreviousPage: boolean, startCursor?: string | null } } };
 
 export type GetGrantQueryVariables = Exact<{
   grantId: Scalars['ID']['input'];
 }>;
 
 
-export type GetGrantQuery = { __typename?: 'Query', grant: { __typename?: 'Grant', id: string, client: string, state: GrantState, finalizationReason?: GrantFinalization | null, createdAt: string, access: Array<{ __typename?: 'Access', id: string, identifier?: string | null, createdAt: string, actions: Array<string | null>, type: string, limits?: { __typename?: 'LimitData', receiver?: string | null, interval?: string | null, debitAmount?: { __typename?: 'PaymentAmount', value: bigint, assetCode: string, assetScale: number } | null, receiveAmount?: { __typename?: 'PaymentAmount', value: bigint, assetCode: string, assetScale: number } | null } | null }> } };
+export type GetGrantQuery = { __typename?: 'Query', grant: { __typename?: 'Grant', id: string, client: string, state: GrantState, finalizationReason?: GrantFinalization | null, createdAt: string, access: Array<{ __typename?: 'Access', id: string, identifier?: string | null, createdAt: string, actions: Array<string | null>, type: string, limits?: { __typename?: 'LimitData', receiver?: string | null, interval?: string | null, debitAmount?: { __typename?: 'PaymentAmount', value: any, assetCode: string, assetScale: number } | null, receiveAmount?: { __typename?: 'PaymentAmount', value: any, assetCode: string, assetScale: number } | null } | null }> } };
 
 export type RevokeGrantMutationVariables = Exact<{
   grantId: Scalars['String']['input'];

packages/wallet/backend/src/rafiki/auth/service.ts

@@ -38,7 +38,7 @@ export class RafikiAuthService implements IRafikiAuthService {
       GetGrantsQueryVariables
     >(getGrantsQuery, { filter: { identifier: { in: identifiers } } })
 
-    return response.grants.edges.map((el: { node: Grant }) => el.node)
+    return response.grants.edges.map((el) => el.node as Grant)
   }
 
   async listGrantsWithPagination(args: GetGrantsQueryVariables) {
@@ -67,7 +67,7 @@ export class RafikiAuthService implements IRafikiAuthService {
       GetGrantQueryVariables
     >(getGrantByIdQuery, { grantId })
 
-    return response.grant
+    return response.grant as Grant
   }
 
   async getGrantByInteraction(interactionId: string, nonce: string) {