feat: Introduce whitelisted logic for prividium mode #4190

Jrigada · 2025-06-17T17:31:25Z

What ❔

Added whitelisted_wallets to the YAML configuration, allowing for flexible wallet authorization.
Updated the Authorizer class to handle the new whitelisted_wallets property, supporting both 'all' and specific wallet addresses.
Enhanced YamlParser to parse and validate the whitelisted_wallets field.
Implemented a new route in usersRoutes to check if a user's address is whitelisted based on the updated logic.

Why ❔

Is this a breaking change?

Yes
No

Operational changes

Checklist

PR title corresponds to the body of PR (we generate changelog entries from PRs).
Tests for the changes have been added / updated.
Documentation comments have been added / updated.
Code has been formatted via zkstack dev fmt and zkstack dev lint.

…date authorizer logic - Added `whitelisted_wallets` to the YAML configuration, allowing for flexible wallet authorization. - Updated the `Authorizer` class to handle the new `whitelisted_wallets` property, supporting both 'all' and specific wallet addresses. - Enhanced `YamlParser` to parse and validate the `whitelisted_wallets` field. - Implemented a new route in `usersRoutes` to check if a user's address is whitelisted based on the updated logic.

…ion logic - Enhanced the `whitelisted_wallets` configuration to allow the literal string "all" for unrestricted access. - Updated the `Authorizer` class to include a method for checking if an address is whitelisted. - Refactored the `YamlParser` to validate the `whitelisted_wallets` field correctly. - Simplified the user route authorization check by utilizing the new method in the `Authorizer`.

private-rpc/src/permissions/authorizer.ts

private-rpc/src/permissions/yaml-parser.ts

private-rpc/src/routes/users-routes.ts

- Adjusted indentation for `groupSchema` and `contractSchema` to enhance code clarity. - Reformatted the `whitelisted_wallets` validation message for consistency in style.

- Eliminated the `RawContract` type definition from the `yaml-parser.ts` file to streamline the code and improve maintainability.

…ng and contract permissions - Added detailed sections on wallet whitelisting, including configuration options for allowing all wallets or specific addresses. - Introduced a new section on contract and method permissions, outlining how to control access to specific methods on contracts for enhanced security.

- Corrected the whitelisted wallet address in `example-permissions.yaml`. - Added validation in `users-routes.ts` to check if the user's address is whitelisted before proceeding with user creation.

private-rpc/src/permissions/authorizer.ts

calvogenerico

Looks great!

I left a comment, but no stopper at all.

…oute - Updated the user route to directly access the address from request parameters, improving code clarity and reducing unnecessary variable declarations.

…ection - Enhanced the readability of the wallet whitelisting section by adjusting line breaks and formatting. - Clarified the descriptions for allowing all wallets and specific wallets, ensuring better understanding of configuration options.

…te-rpc - Included information on the JSON response format for address authorization checks, specifying the outcomes for whitelisted and non-whitelisted addresses.

- Enhanced the formatting of the address authorization response details for better readability. - Adjusted bullet points for clarity in the JSON response outcomes for whitelisted and non-whitelisted addresses.

- Improved the formatting of YAML code blocks for better readability in the address authorization section. - Ensured consistent indentation and line breaks for clarity in configuration examples.

- Included three new wallet addresses to the whitelisted wallets list in `example-permissions.yaml` for enhanced access control.

…tion - Changed the whitelisted wallets configuration to allow all wallets by default, removing specific addresses for a more streamlined access control approach.

- Implemented a check to ensure that the user's address is whitelisted before processing any RPC calls.

…ter-labs/zksync-era into feat-whitelisting-for-prividium-mode

private-rpc/example-permissions.yaml

…s configuration - Updated the private RPC initialization command to include an integration test flag. - Added a new permissions configuration file specifically for integration tests, allowing all addresses for testing purposes. - Modified the permissions loading logic to switch between the standard and integration test permissions files based on the new flag.

- Modified the initialization logic in the private RPC command to use the ecosystem path for loading permissions configuration files, ensuring correct file resolution for both standard and integration test scenarios.

zkstack_cli/crates/zkstack/src/commands/private_rpc/mod.rs

…ssion editor

zkstack_cli/crates/zkstack/src/commands/private_rpc/mod.rs

- Changed the permissions file path in the private RPC initialization from a full ecosystem path to a relative reference, simplifying the configuration and improving clarity.

🤖 I have created a release *beep* *boop* --- ## [28.7.0](core-v28.6.0...core-v28.7.0) (2025-06-30) ### Features * add `pubdata_limit` as batch parameter ([#4228](#4228)) ([238941c](238941c)) * Add proof manager contracts submodule ([#4189](#4189)) ([0c75985](0c75985)) * **api:** remove token API ([#4180](#4180)) ([893a5bc](893a5bc)) * **api:** stabilize zks_gasPerPubdata ([#4225](#4225)) ([120fc13](120fc13)) * **api:** Support Unix domain sockets for healthcheck server ([#4226](#4226)) ([b06bacb](b06bacb)) * **en:** Use config system for env-based EN configuration ([#4104](#4104)) ([b706025](b706025)) * **fee_model:** scale the batch fee unconditionally ([#4111](#4111)) ([5e3fc0d](5e3fc0d)) * Introduce whitelisted logic for prividium mode ([#4190](#4190)) ([e86306f](e86306f)) * Prover Cluster follow-up [#2](#2) ([#4001](#4001)) ([d8ed7f7](d8ed7f7)) * **state-keeper:** add `process_block` method ([#4087](#4087)) ([c580857](c580857)) * **state-keeper:** allow sub-second block interval ([#3925](#3925)) ([4265ea8](4265ea8)) ### Bug Fixes * **consensus:** Handle custom reverts on VM calls ([#4174](#4174)) ([c511cd0](c511cd0)) * **consensus:** Update consensus dependencies ([#4186](#4186)) ([110a527](110a527)) * **en:** Fix parsing consensus secrets ([#4216](#4216)) ([20c7913](20c7913)) * **eth-watcher:** handle get_logs timeout in eth watch ([#4224](#4224)) ([26e5fc4](26e5fc4)) * Fix crate features some more ([#4177](#4177)) ([2964b93](2964b93)) * Fix node_framework feature for high-level crates ([#4171](#4171)) ([d42e98d](d42e98d)) * **prover:** Use unified prometheus initialization ([#4173](#4173)) ([db4f036](db4f036)) * **prover:** Use unified Prometheus initialization in gateway and job monitor ([#4191](#4191)) ([f93704e](f93704e)) ### Performance Improvements * Instrumentation for Jemalloc (pt. 2) ([#4204](#4204)) ([5e0bd65](5e0bd65)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: zksync-era-bot <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [28.7.0](matter-labs/zksync-era@core-v28.6.0...core-v28.7.0) (2025-06-30) ### Features * add `pubdata_limit` as batch parameter ([#4228](matter-labs/zksync-era#4228)) ([238941c](matter-labs/zksync-era@238941c)) * Add proof manager contracts submodule ([#4189](matter-labs/zksync-era#4189)) ([7b69c19](matter-labs/zksync-era@7b69c19)) * **api:** remove token API ([#4180](matter-labs/zksync-era#4180)) ([893a5bc](matter-labs/zksync-era@893a5bc)) * **api:** stabilize zks_gasPerPubdata ([#4225](matter-labs/zksync-era#4225)) ([120fc13](matter-labs/zksync-era@120fc13)) * **api:** Support Unix domain sockets for healthcheck server ([#4226](matter-labs/zksync-era#4226)) ([b06bacb](matter-labs/zksync-era@b06bacb)) * **en:** Use config system for env-based EN configuration ([#4104](matter-labs/zksync-era#4104)) ([a52b5eb](matter-labs/zksync-era@a52b5eb)) * **fee_model:** scale the batch fee unconditionally ([#4111](matter-labs/zksync-era#4111)) ([5e3fc0d](matter-labs/zksync-era@5e3fc0d)) * Introduce whitelisted logic for prividium mode ([#4190](matter-labs/zksync-era#4190)) ([e86306f](matter-labs/zksync-era@e86306f)) * Prover Cluster follow-up [#2](matter-labs/zksync-era#2) ([#4001](matter-labs/zksync-era#4001)) ([75ed817](matter-labs/zksync-era@75ed817)) * **state-keeper:** add `process_block` method ([#4087](matter-labs/zksync-era#4087)) ([c580857](matter-labs/zksync-era@c580857)) * **state-keeper:** allow sub-second block interval ([#3925](matter-labs/zksync-era#3925)) ([4265ea8](matter-labs/zksync-era@4265ea8)) ### Bug Fixes * **consensus:** Handle custom reverts on VM calls ([#4174](matter-labs/zksync-era#4174)) ([c511cd0](matter-labs/zksync-era@c511cd0)) * **consensus:** Update consensus dependencies ([#4186](matter-labs/zksync-era#4186)) ([5c6a4e2](matter-labs/zksync-era@5c6a4e2)) * **en:** Fix parsing consensus secrets ([#4216](matter-labs/zksync-era#4216)) ([20c7913](matter-labs/zksync-era@20c7913)) * **eth-watcher:** handle get_logs timeout in eth watch ([#4224](matter-labs/zksync-era#4224)) ([26e5fc4](matter-labs/zksync-era@26e5fc4)) * Fix crate features some more ([#4177](matter-labs/zksync-era#4177)) ([2964b93](matter-labs/zksync-era@2964b93)) * Fix node_framework feature for high-level crates ([#4171](matter-labs/zksync-era#4171)) ([d42e98d](matter-labs/zksync-era@d42e98d)) * **prover:** Use unified prometheus initialization ([#4173](matter-labs/zksync-era#4173)) ([db4f036](matter-labs/zksync-era@db4f036)) * **prover:** Use unified Prometheus initialization in gateway and job monitor ([#4191](matter-labs/zksync-era#4191)) ([f93704e](matter-labs/zksync-era@f93704e)) ### Performance Improvements * Instrumentation for Jemalloc (pt. 2) ([#4204](matter-labs/zksync-era#4204)) ([eb70e4d](matter-labs/zksync-era@eb70e4d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: zksync-era-bot <[email protected]>

## What ❔ - Added `whitelisted_wallets` to the YAML configuration, allowing for flexible wallet authorization. - Updated the `Authorizer` class to handle the new `whitelisted_wallets` property, supporting both 'all' and specific wallet addresses. - Enhanced `YamlParser` to parse and validate the `whitelisted_wallets` field. - Implemented a new route in `usersRoutes` to check if a user's address is whitelisted based on the updated logic. ## Why ❔    ## Is this a breaking change? - [ ] Yes - [ ] No ## Operational changes   ## Checklist   - [ ] PR title corresponds to the body of PR (we generate changelog entries from PRs). - [ ] Tests for the changes have been added / updated. - [ ] Documentation comments have been added / updated. - [ ] Code has been formatted via `zkstack dev fmt` and `zkstack dev lint`.

🤖 I have created a release *beep* *boop* --- ## [28.7.0](matter-labs/zksync-era@core-v28.6.0...core-v28.7.0) (2025-06-30) ### Features * add `pubdata_limit` as batch parameter ([matter-labs#4228](matter-labs#4228)) ([238941c](matter-labs@238941c)) * Add proof manager contracts submodule ([matter-labs#4189](matter-labs#4189)) ([0c75985](matter-labs@0c75985)) * **api:** remove token API ([matter-labs#4180](matter-labs#4180)) ([893a5bc](matter-labs@893a5bc)) * **api:** stabilize zks_gasPerPubdata ([matter-labs#4225](matter-labs#4225)) ([120fc13](matter-labs@120fc13)) * **api:** Support Unix domain sockets for healthcheck server ([matter-labs#4226](matter-labs#4226)) ([b06bacb](matter-labs@b06bacb)) * **en:** Use config system for env-based EN configuration ([matter-labs#4104](matter-labs#4104)) ([b706025](matter-labs@b706025)) * **fee_model:** scale the batch fee unconditionally ([matter-labs#4111](matter-labs#4111)) ([5e3fc0d](matter-labs@5e3fc0d)) * Introduce whitelisted logic for prividium mode ([matter-labs#4190](matter-labs#4190)) ([e86306f](matter-labs@e86306f)) * Prover Cluster follow-up [matter-labs#2](matter-labs#2) ([matter-labs#4001](matter-labs#4001)) ([d8ed7f7](matter-labs@d8ed7f7)) * **state-keeper:** add `process_block` method ([matter-labs#4087](matter-labs#4087)) ([c580857](matter-labs@c580857)) * **state-keeper:** allow sub-second block interval ([matter-labs#3925](matter-labs#3925)) ([4265ea8](matter-labs@4265ea8)) ### Bug Fixes * **consensus:** Handle custom reverts on VM calls ([matter-labs#4174](matter-labs#4174)) ([c511cd0](matter-labs@c511cd0)) * **consensus:** Update consensus dependencies ([matter-labs#4186](matter-labs#4186)) ([110a527](matter-labs@110a527)) * **en:** Fix parsing consensus secrets ([matter-labs#4216](matter-labs#4216)) ([20c7913](matter-labs@20c7913)) * **eth-watcher:** handle get_logs timeout in eth watch ([matter-labs#4224](matter-labs#4224)) ([26e5fc4](matter-labs@26e5fc4)) * Fix crate features some more ([matter-labs#4177](matter-labs#4177)) ([2964b93](matter-labs@2964b93)) * Fix node_framework feature for high-level crates ([matter-labs#4171](matter-labs#4171)) ([d42e98d](matter-labs@d42e98d)) * **prover:** Use unified prometheus initialization ([matter-labs#4173](matter-labs#4173)) ([db4f036](matter-labs@db4f036)) * **prover:** Use unified Prometheus initialization in gateway and job monitor ([matter-labs#4191](matter-labs#4191)) ([f93704e](matter-labs@f93704e)) ### Performance Improvements * Instrumentation for Jemalloc (pt. 2) ([matter-labs#4204](matter-labs#4204)) ([5e0bd65](matter-labs@5e0bd65)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: zksync-era-bot <[email protected]>

Jrigada added 3 commits June 17, 2025 14:30

refactor(yaml-parser): Enhance rule handling with block scoping

0831598

aon previously approved these changes Jun 18, 2025

View reviewed changes

refactor(yaml-parser): Standardize indentation and improve readability

e599388

- Adjusted indentation for `groupSchema` and `contractSchema` to enhance code clarity. - Reformatted the `whitelisted_wallets` validation message for consistency in style.

Jrigada dismissed aon’s stale review via e599388 June 19, 2025 19:58

refactor(yaml-parser): Remove unused RawContract type definition

76f441c

- Eliminated the `RawContract` type definition from the `yaml-parser.ts` file to streamline the code and improve maintainability.

Jrigada marked this pull request as ready for review June 23, 2025 11:53

Jrigada requested a review from aon June 23, 2025 11:53

Merge branch 'main' into feat-whitelisting-for-prividium-mode

f7e8266

aon previously approved these changes Jun 23, 2025

View reviewed changes

Jrigada added 2 commits June 23, 2025 10:43

merge new changes from upstream

45d25fd

Jrigada dismissed aon’s stale review via 45d25fd June 23, 2025 13:44

fix: Update whitelisted wallet address and enhance user route validation

292d6a5

- Corrected the whitelisted wallet address in `example-permissions.yaml`. - Added validation in `users-routes.ts` to check if the user's address is whitelisted before proceeding with user creation.

calvogenerico reviewed Jun 23, 2025

View reviewed changes

private-rpc/src/permissions/authorizer.ts Show resolved Hide resolved

calvogenerico previously approved these changes Jun 23, 2025

View reviewed changes

refactor(users-routes): Simplify address whitelisting check in user r…

801bfb3

…oute - Updated the user route to directly access the address from request parameters, improving code clarity and reducing unnecessary variable declarations.

Jrigada dismissed calvogenerico’s stale review via 801bfb3 June 23, 2025 14:49

Jrigada added 6 commits June 23, 2025 11:59

docs(README): Add response details for address authorization in priva…

2948dce

…te-rpc - Included information on the JSON response format for address authorization checks, specifying the outcomes for whitelisted and non-whitelisted addresses.

docs(README): Improve formatting in address authorization section

f6c9a84

- Enhanced the formatting of the address authorization response details for better readability. - Adjusted bullet points for clarity in the JSON response outcomes for whitelisted and non-whitelisted addresses.

docs(README): Refine formatting in wallet whitelisting section

4549b54

- Improved the formatting of YAML code blocks for better readability in the address authorization section. - Ensured consistent indentation and line breaks for clarity in configuration examples.

feat(example-permissions): Add additional whitelisted wallet addresses

7116c53

- Included three new wallet addresses to the whitelisted wallets list in `example-permissions.yaml` for enhanced access control.

refactor(example-permissions): Simplify whitelisted wallets configura…

60a6719

…tion - Changed the whitelisted wallets configuration to allow all wallets by default, removing specific addresses for a more streamlined access control approach.

Jrigada requested review from aon, calvogenerico and tomg10 June 23, 2025 19:39

tomg10 previously approved these changes Jun 24, 2025

View reviewed changes

Merge branch 'main' into feat-whitelisting-for-prividium-mode

8146225

Jrigada added 2 commits June 25, 2025 11:56

feat(rpc-routes): Add address whitelisting check for RPC calls

2043f25

- Implemented a check to ensure that the user's address is whitelisted before processing any RPC calls.

Merge branch 'feat-whitelisting-for-prividium-mode' of github.com:mat…

f21aaa5

…ter-labs/zksync-era into feat-whitelisting-for-prividium-mode

Jrigada dismissed tomg10’s stale review via f21aaa5 June 25, 2025 14:57

Jrigada requested a review from tomg10 June 25, 2025 18:17

jcsec-security reviewed Jun 26, 2025

View reviewed changes

private-rpc/example-permissions.yaml Outdated Show resolved Hide resolved

Jrigada force-pushed the feat-whitelisting-for-prividium-mode branch from 850d49c to 93de112 Compare June 26, 2025 18:41

Jrigada and others added 2 commits June 26, 2025 16:07

fix(private-rpc): Update permissions file paths to use ecosystem path

a19edc4

- Modified the initialization logic in the private RPC command to use the ecosystem path for loading permissions configuration files, ensuring correct file resolution for both standard and integration test scenarios.

Merge branch 'main' into feat-whitelisting-for-prividium-mode

24be374

Jrigada requested a review from jcsec-security June 27, 2025 12:41

tomg10 reviewed Jun 27, 2025

View reviewed changes

zkstack_cli/crates/zkstack/src/commands/private_rpc/mod.rs Outdated Show resolved Hide resolved

Jrigada added 2 commits June 27, 2025 11:45

Remove permission test file and flag, added whitelisting in the permi…

7e85041

…ssion editor

fix: format

cfa5a60

Jrigada requested a review from tomg10 June 27, 2025 16:27

tomg10 reviewed Jun 27, 2025

View reviewed changes

zkstack_cli/crates/zkstack/src/commands/private_rpc/mod.rs Outdated Show resolved Hide resolved

fix(private-rpc): Update permissions file path to a relative reference

9781b38

- Changed the permissions file path in the private RPC initialization from a full ecosystem path to a relative reference, simplifying the configuration and improving clarity.

Jrigada requested a review from tomg10 June 27, 2025 16:45

tomg10 approved these changes Jun 27, 2025

View reviewed changes

tomg10 added this pull request to the merge queue Jun 30, 2025

Merged via the queue into main with commit e86306f Jun 30, 2025
36 checks passed

tomg10 deleted the feat-whitelisting-for-prividium-mode branch June 30, 2025 13:50

zksync-era-bot mentioned this pull request Jun 30, 2025

chore(main): release core 28.7.0 #4176

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Introduce whitelisted logic for prividium mode #4190

feat: Introduce whitelisted logic for prividium mode #4190

Uh oh!

Jrigada commented Jun 17, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

calvogenerico left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

feat: Introduce whitelisted logic for prividium mode #4190

feat: Introduce whitelisted logic for prividium mode #4190

Uh oh!

Conversation

Jrigada commented Jun 17, 2025

What ❔

Why ❔

Is this a breaking change?

Operational changes

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

calvogenerico left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants