Revert "fix: resolve RPC URLs per-chain via RPC_<chainId> env vars" (#672) (#673)

* Revert "fix: resolve RPC URLs per-chain via RPC_<chainId> env vars (#672)"

This reverts commit 577e509.

* chore: bump Lambda VERSION env vars to force redeploy of reverted code

Set each handler's VERSION one above current main so the reverted
(RPC_PREFIX_URL) Lambda code is picked up on deploy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: send x-internal-service-secret header on all RPC requests (#674)

* feat: send x-internal-service-secret header on all RPC requests

Add the `x-internal-service-secret` header (sourced from the new
RPC_HEADER_SECRET env var) to RPC_HEADERS in lib/util/constants.ts, which
is the single header object used at every StaticJsonRpcProvider
construction site (check-order-status, gs-reaper, EventWatcherMap,
shared providers). The header is omitted when RPC_HEADER_SECRET is unset
(local dev / unit tests).

Wire RPC_HEADER_SECRET through the CDK stacks (bin/app.ts): beta/prod
Lambda env vars from the gouda-service-rpc-urls-2 secret, the integ-test
e2e build, and the local dev stack. Kept out of the jsonRpcUrls CfnOutput
so the secret is not exposed in CloudFormation outputs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: source integ-test RPC_PREFIX_URL from the production RPC secret

Pull RPC_PREFIX_URL from gouda-service-rpc-urls-2:RPC_PREFIX_URL in the
integ-test build so the e2e tests hit the same internal RPC endpoint and
carry a matching RPC_HEADER_SECRET, instead of the separate
all/gouda-service/integ-test/rpc secret.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test: use await import instead of require in rpc-headers test

Avoids the @typescript-eslint/no-var-requires lint error flagged in
review. Dynamic import + jest.resetModules() re-evaluates the module so
the RPC_HEADER_SECRET branch is still exercised per case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: codyborn

.env.example

@@ -1,7 +1,8 @@
-# RPC URL resolution: getRpcUrl(chainId) returns process.env[`RPC_${chainId}`].
-# Define one variable per supported chain (see lib/util/chain.ts SUPPORTED_CHAINS),
-# e.g. RPC_1, RPC_130, RPC_8453, RPC_42161, ...
-RPC_1=
+# RPC URL resolution: getRpcUrl(chainId) returns `${RPC_PREFIX_URL}/${chainId}`.
+RPC_PREFIX_URL=
+# Sent as the `x-internal-service-secret` header on all RPC requests (see RPC_HEADERS
+# in lib/util/constants.ts). Leave unset to omit the header (e.g. public RPC).
+RPC_HEADER_SECRET=
 
 FAILED_EVENT_DESTINATION_ARN=
 

CLAUDE.md

@@ -42,7 +42,8 @@ cdk deploy GoudaServiceStack  # Deploy to AWS
 ## Environment Variables
 
 Required for deployment:
-- `RPC_<chainId>` - Per-chain RPC URL (e.g. `RPC_1`, `RPC_130`, `RPC_8453`). `getRpcUrl(chainId)` in `lib/Config.ts` reads `process.env[\`RPC_${chainId}\`]`. One variable required per chain in `SUPPORTED_CHAINS` (`lib/util/chain.ts`).
+- `RPC_PREFIX_URL` - Base RPC URL; `getRpcUrl(chainId)` in `lib/Config.ts` appends `/<chainId>`.
+- `RPC_HEADER_SECRET` - Value sent as the `x-internal-service-secret` header on all RPC requests (see `RPC_HEADERS` in `lib/util/constants.ts`). Omitted when unset.
 - `FAILED_EVENT_DESTINATION_ARN` - Failed event SNS ARN
 
 For tests:

README.md

@@ -47,12 +47,9 @@ To test your changes you must redeploy your service. The dev cycle is thus:
 
 ```
 FAILED_EVENT_DESTINATION_ARN=<>
-# Per-chain RPC URLs: one variable per supported chain (see lib/util/chain.ts).
-RPC_1=<>
-RPC_130=<>
-RPC_8453=<>
-RPC_42161=<>
-# ...etc.
+RPC_PREFIX_URL=<>
+# Optional: sent as the `x-internal-service-secret` header on all RPC requests.
+RPC_HEADER_SECRET=<>
 
 # Only need these if testing against custom contract deployments
 DL_REACTOR_TENDERLY=<>

bin/app.ts

@@ -9,7 +9,6 @@ import { CodeBuildStep, CodePipeline, CodePipelineSource } from 'aws-cdk-lib/pip
 import { Construct } from 'constructs'
 import dotenv from 'dotenv'
 import 'source-map-support/register'
-import { SUPPORTED_CHAINS } from '../lib/util/chain'
 import { STAGE } from '../lib/util/stage'
 import { PROD_TABLE_CAPACITY } from './config'
 import { SERVICE_NAME } from './constants'
@@ -169,19 +168,20 @@ export class APIPipeline extends Stack {
         'arn:aws:secretsmanager:us-east-2:644039819003:secret:prod-priority-labs-cosigner-address-iarU6E',
     })
 
-    // Per-chain RPC URLs. The Lambda's getRpcUrl(chainId) reads `RPC_<chainId>`
-    // from the environment; the secret is a JSON map keyed the same way
-    // (e.g. RPC_1, RPC_130, RPC_8453).
-    const jsonRpcUrls: { [chain: string]: string } = {}
-    for (const chainId of SUPPORTED_CHAINS) {
-      const key = `RPC_${chainId}`
-      jsonRpcUrls[key] = jsonRpcProvidersSecret.secretValueFromJson(key).toString()
+    // Shared prefix the Lambda's getRpcUrl appends the chainId to.
+    const jsonRpcUrls: { [chain: string]: string } = {
+      RPC_PREFIX_URL: jsonRpcProvidersSecret.secretValueFromJson('RPC_PREFIX_URL').toString(),
     }
 
     new CfnOutput(this, 'jsonRpcUrls', {
       value: JSON.stringify(jsonRpcUrls),
     })
 
+    // Authenticates outbound RPC requests via the `x-internal-service-secret`
+    // header (see RPC_HEADERS in lib/util/constants.ts). Kept out of the
+    // CfnOutput above so the secret is not exposed in CloudFormation outputs.
+    const rpcHeaderSecret = jsonRpcProvidersSecret.secretValueFromJson('RPC_HEADER_SECRET').toString()
+
     // Beta us-east-2
     const betaUsEast2Stage = new APIStage(this, 'beta-us-east-2', {
       env: { account: '321377678687', region: 'us-east-2' },
@@ -190,6 +190,7 @@ export class APIPipeline extends Stack {
       stage: STAGE.BETA,
       envVars: {
         ...jsonRpcUrls,
+        RPC_HEADER_SECRET: rpcHeaderSecret,
         QUOTER_TENDERLY: tenderlySecrets.secretValueFromJson('QUOTER_TENDERLY').toString(),
         DL_REACTOR_TENDERLY: tenderlySecrets.secretValueFromJson('DL_REACTOR_TENDERLY').toString(),
         PERMIT2_TENDERLY: tenderlySecrets.secretValueFromJson('PERMIT2_TENDERLY').toString(),
@@ -229,6 +230,7 @@ export class APIPipeline extends Stack {
       stage: STAGE.PROD,
       envVars: {
         ...jsonRpcUrls,
+        RPC_HEADER_SECRET: rpcHeaderSecret,
         FILL_EVENT_DESTINATION_ARN: resourceArnSecret.secretValueFromJson('FILL_EVENT_DESTINATION_ARN_PROD').toString(),
         ACTIVE_ORDER_EVENT_DESTINATION_ARN: resourceArnSecret
           .secretValueFromJson('ACTIVE_ORDER_EVENT_DESTINATION_ARN_PROD')
@@ -305,8 +307,12 @@ export class APIPipeline extends Stack {
             value: `${stage}/gouda-service/integ-test/cosigner`,
             type: BuildEnvironmentVariableType.SECRETS_MANAGER,
           },
-          RPC_1: {
-            value: 'all/gouda-service/integ-test/rpc:RPC_1',
+          RPC_PREFIX_URL: {
+            value: 'gouda-service-rpc-urls-2:RPC_PREFIX_URL',
+            type: BuildEnvironmentVariableType.SECRETS_MANAGER,
+          },
+          RPC_HEADER_SECRET: {
+            value: 'gouda-service-rpc-urls-2:RPC_HEADER_SECRET',
             type: BuildEnvironmentVariableType.SECRETS_MANAGER,
           },
           TEST_WALLET_PK: {
@@ -327,7 +333,8 @@ export class APIPipeline extends Stack {
         'echo "TAPI_API_KEY=${TAPI_API_KEY}" >> .env',
         'echo "GPA_SERVICE_URL=${GPA_SERVICE_URL}" >> .env',
         'echo "COSIGNER_ADDRESS=${COSIGNER_ADDRESS}" >> .env',
-        'echo "RPC_1=${RPC_1}" >> .env',
+        'echo "RPC_PREFIX_URL=${RPC_PREFIX_URL}" >> .env',
+        'echo "RPC_HEADER_SECRET=${RPC_HEADER_SECRET}" >> .env',
         'echo "TEST_WALLET_PK=${TEST_WALLET_PK}" >> .env',
         'echo "TEST_FILLER_PK=${TEST_FILLER_PK}" >> .env',
         'yarn install --network-concurrency 1 --skip-integrity-check',
@@ -355,10 +362,8 @@ const app = new cdk.App()
 // Local dev stack
 const envVars: { [key: string]: string } = {}
 
-for (const chainId of SUPPORTED_CHAINS) {
-  const key = `RPC_${chainId}`
-  envVars[key] = process.env[key] || ''
-}
+envVars['RPC_PREFIX_URL'] = process.env['RPC_PREFIX_URL'] || ''
+envVars['RPC_HEADER_SECRET'] = process.env['RPC_HEADER_SECRET'] || ''
 
 envVars['RPC_TENDERLY'] = process.env[`RPC_TENDERLY`] || ''
 envVars['DL_REACTOR_TENDERLY'] = process.env[`DL_REACTOR_TENDERLY`] || ''

bin/stacks/lambda-stack.ts

@@ -129,7 +129,7 @@ export class LambdaStack extends cdk.NestedStack {
       ...props.envVars,
       stage: props.stage as STAGE,
       KMS_KEY_ID: kmsKey.keyId,
-      VERSION: '8',
+      VERSION: '9',
       NODE_OPTIONS: '--enable-source-maps',
     }
 
@@ -165,7 +165,7 @@ export class LambdaStack extends cdk.NestedStack {
         ...props.envVars,
         stage: props.stage as STAGE,
         KMS_KEY_ID: kmsKey.keyId,
-        VERSION: '7',
+        VERSION: '8',
         NODE_OPTIONS: '--enable-source-maps',
       },
       vpc,
@@ -206,7 +206,7 @@ export class LambdaStack extends cdk.NestedStack {
       ...props.envVars,
       stage: props.stage as STAGE,
       KMS_KEY_ID: kmsKey.keyId,
-      VERSION: '8',
+      VERSION: '9',
       NODE_OPTIONS: '--enable-source-maps',
       REGION: this.region,
     }
@@ -279,7 +279,7 @@ export class LambdaStack extends cdk.NestedStack {
         ...props.envVars,
         stage: props.stage as STAGE,
         KMS_KEY_ID: kmsKey.keyId,
-        VERSION: '7',
+        VERSION: '8',
         NODE_OPTIONS: '--enable-source-maps',
       },
       tracing: aws_lambda.Tracing.ACTIVE,
@@ -300,7 +300,7 @@ export class LambdaStack extends cdk.NestedStack {
         stage: props.stage as STAGE,
         ...props.envVars,
         KMS_KEY_ID: kmsKey.keyId,
-        VERSION: '7',
+        VERSION: '8',
         NODE_OPTIONS: '--enable-source-maps',
       },
       logRetention: logRetentionDays(props.stage),
@@ -320,7 +320,7 @@ export class LambdaStack extends cdk.NestedStack {
         stage: props.stage as STAGE,
         KMS_KEY_ID: kmsKey.keyId,
         ...props.envVars,
-        VERSION: '7',
+        VERSION: '8',
         NODE_OPTIONS: '--enable-source-maps',
       },
       logRetention: logRetentionDays(props.stage),

bin/stacks/reaper-stack.ts

@@ -4,9 +4,8 @@ import { Cluster, ContainerImage } from "aws-cdk-lib/aws-ecs";
 import { Construct } from "constructs";
 import { SERVICE_NAME } from "../constants";
 
-// Expect per-chain RPC env vars (`RPC_<chainId>`, e.g. RPC_1, RPC_130) to be
-// set in environmentVariables; the reaper calls getRpcUrl(chainId) which reads
-// the corresponding `RPC_<chainId>` variable.
+// Expect RPC_PREFIX_URL to be set in environmentVariables; the reaper calls
+// getRpcUrl(chainId) which appends the chainId to it.
 export interface ReaperStackProps extends StackProps {
   environmentVariables: { [key: string]: string };
 }

lib/Config.ts

@@ -6,16 +6,15 @@ type Config = {
 }
 
 /**
- * Resolve the RPC URL for a given chainId from the per-chain env var
- * `RPC_<chainId>` (e.g. RPC_1, RPC_130, RPC_8453). Throws if it is unset.
+ * Resolve the RPC URL for a given chainId by appending it to RPC_PREFIX_URL.
+ * Throws if the prefix is not set.
  */
 export const getRpcUrl = (chainId: number): string => {
-  const envVar = `RPC_${chainId}`
-  const url = process.env[envVar]
-  if (!url) {
-    throw new Error(`No RPC for chain ${chainId}: set ${envVar}`)
+  const prefix = process.env.RPC_PREFIX_URL
+  if (!prefix) {
+    throw new Error(`No RPC for chain ${chainId}: set RPC_PREFIX_URL`)
   }
-  return url
+  return `${prefix.replace(/\/$/, '')}/${chainId}`
 }
 
 /**

lib/util/chain.ts

@@ -3,13 +3,25 @@ import { ChainId } from '@uniswap/sdk-core'
 export { ChainId }
 
 // Each chain in SUPPORTED_CHAINS needs an RPC URL resolvable by
-// getRpcUrl(chainId) (Config.ts), which reads the `RPC_<chainId>` env var
-// (e.g. RPC_1, RPC_130, RPC_8453).
+// getRpcUrl(chainId) (Config.ts), which appends the chainId to
+// RPC_PREFIX_URL.
 export const SUPPORTED_CHAINS = [
   ChainId.MAINNET,
-  ChainId.BASE,
+  ChainId.OPTIMISM,
+  ChainId.BNB,
   ChainId.UNICHAIN,
-  ChainId.ARBITRUM_ONE,
   ChainId.POLYGON,
+  ChainId.MONAD,
+  ChainId.XLAYER,
+  ChainId.WORLDCHAIN,
   ChainId.SEPOLIA,
+  ChainId.UNICHAIN_SEPOLIA,
+  ChainId.SONEIUM,
+  ChainId.TEMPO,
+  ChainId.BASE,
+  ChainId.ARBITRUM_ONE,
+  ChainId.CELO,
+  ChainId.AVALANCHE,
+  ChainId.BLAST,
+  ChainId.ZORA,
 ]

lib/util/constants.ts

@@ -95,9 +95,13 @@ export const USE_CLASSIC_PARAMETERS = {
   // batchNumber and algorithmVersion are added dynamically
 }
 
-export const RPC_HEADERS = {
+export const RPC_HEADERS: { [key: string]: string } = {
   'x-uni-service-id': 'x_order_service',
-} as const
+  // Authenticate RPC requests against internal providers. The value is provided
+  // via the RPC_HEADER_SECRET env var (sourced from Secrets Manager); omitted
+  // when unset (e.g. local dev / unit tests).
+  ...(process.env.RPC_HEADER_SECRET ? { 'x-internal-service-secret': process.env.RPC_HEADER_SECRET } : {}),
+}
 
 export enum TradeType {
   EXACT_INPUT = 'EXACT_INPUT',

test/e2e/order.test.ts

@@ -79,8 +79,8 @@ describe('/dutch-auction/order', () => {
     if (!process.env.GPA_SERVICE_URL) {
       throw new Error('GPA_SERVICE_URL not set')
     }
-    if (!process.env.RPC_1) {
-      throw new Error('RPC_1 not set')
+    if (!process.env.RPC_PREFIX_URL) {
+      throw new Error('RPC_PREFIX_URL not set')
     }
     if (!process.env.TEST_WALLET_PK) {
       throw new Error('TEST_WALLET_PK not set')
@@ -98,7 +98,7 @@ describe('/dutch-auction/order', () => {
     QUOTE_API_KEY = process.env.TAPI_API_KEY
 
     provider = new ethers.providers.StaticJsonRpcProvider({
-      url: process.env.RPC_1,
+      url: `${process.env.RPC_PREFIX_URL.replace(/\/$/, '')}/1`,
       headers: RPC_HEADERS
     })
     alice = new ethers.Wallet(process.env.TEST_WALLET_PK).connect(provider)