Skip to content

test: cover all foreign provider auth kinds in verify-foreign-tx e2e - #3759

Merged
haiyuechen-nearone merged 4 commits into
mainfrom
2786-e2e-test-foreign-provider-path-auth-substitution
Jul 13, 2026
Merged

test: cover all foreign provider auth kinds in verify-foreign-tx e2e#3759
haiyuechen-nearone merged 4 commits into
mainfrom
2786-e2e-test-foreign-provider-path-auth-substitution

Conversation

@haiyuechen-nearone

@haiyuechen-nearone haiyuechen-nearone commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Closes #2786

Summary

Extends verify_foreign_transaction__should_sign_all_supported_chains so one chain exercises each credential-carrying AuthConfig kind: Bitcoin path, Base header, BNB query (the rest keep none). Each authenticated mock only answers requests carrying the exact configured credential values, so verification can only succeed if the node injected them — covering the path-auth API key substitution from #2637 (fixed in #2762 with unit tests only) end to end, through real node binaries and config loading.

Why mocks answer bad auth with 401

Requests without the expected credentials fall through to a catch-all returning HTTP 401 with a JSON-RPC error body, mirroring the providers on the testnet on-chain whitelist: Alchemy returns exactly this body (probed live — including for a literal unsubstituted {API_KEY} path, the #2637 scenario; their error reference lists no 404), Geomi returns 401 for an invalid Bearer token, and QuickNode documents 401 "error": "UNAUTHORIZED". A regression therefore produces failure logs matching a real credential misconfiguration.

Testing

verify_foreign_transaction__should_sign_all_supported_chains passes locally in an isolated run (~21s against prebuilt binaries).

@haiyuechen-nearone haiyuechen-nearone self-assigned this Jul 9, 2026
@haiyuechen-nearone
haiyuechen-nearone force-pushed the 2786-e2e-test-foreign-provider-path-auth-substitution branch from 1a01e6e to 706ab7d Compare July 9, 2026 07:17
@haiyuechen-nearone
haiyuechen-nearone marked this pull request as ready for review July 9, 2026 07:48
@claude

claude Bot commented Jul 9, 2026

Copy link
Copy Markdown

Pull request overview

Extends the existing verify_foreign_transaction__should_sign_all_supported_chains E2E test to exercise every credential-carrying AuthConfig variant end-to-end: Bitcoin (Path), Base (Header), BNB (Query), while the remaining chains keep AuthConfig::None. Each authenticated mock only serves the credentialed request path; a catch-all 401 backstop responds if credentials are missing, mirroring what real providers do. This closes #2786 by providing regression coverage for the #2637/#2762 path-auth substitution fix through real node binaries and config loading.

Changes:

  • New MockAuthExpectation enum in foreign_chain_mock.rs mirroring AuthConfig variants, applied to each mock's when.* matcher.
  • New register_unauthorized_catch_all that installs a 401 JSON-RPC fallback for authenticated mocks; skipped for None.
  • setup_{bitcoin,evm,starknet}_mock now take an auth expectation parameter and return the mock id after registering both the credentialed matcher and the catch-all.
  • Test config: Bitcoin URL now carries the literal {api_key} placeholder, Base uses authorization: Bearer …, BNB uses ?apikey=….
  • Three new mock handles on ForeignTxTestEnv plus an assert_authenticated_provider_was_queried backstop invoked after each authenticated verify.

Reviewed changes

Per-file summary
File Description
crates/e2e-tests/src/foreign_chain_mock.rs Adds MockAuthExpectation, a catch-all 401 helper, and threads the auth expectation through the three setup_*_mock functions.
crates/e2e-tests/tests/foreign_chain_tx_validation.rs Configures Bitcoin/Base/BNB with real credentialed AuthConfig variants, wires the corresponding mock expectations, and asserts the credentialed mocks were hit.

Findings

No blocking issues — the wiring between config and mocks is consistent for all three auth kinds (Path substitution → .path("/{key}"), Header → .header(name, "scheme token"), Query → .query_param(name, value)), and success of verify_* already implies the credentialed mock (not the 401 catch-all) served the request, so the extra assert_authenticated_provider_was_queried acts as a defensive backstop against future mock loosening as the doc comment says.

Non-blocking (nits, follow-ups, suggestions):

  • crates/e2e-tests/tests/foreign_chain_tx_validation.rs:120 and :200 — the string "authorization" is duplicated between the AuthConfig::Header { name: … } config and the MockAuthExpectation::Header { name: … } matcher. If one is changed without the other, the test would silently start hitting the 401 catch-all. Consider hoisting to a constant next to the other HEADER_AUTH_* constants (e.g. HEADER_AUTH_NAME: &str = "authorization").
  • crates/e2e-tests/src/foreign_chain_mock.rs:12 — the doc comment writes [AuthConfig](mpc_node_config::AuthConfig), which is a valid rustdoc link; the corresponding mention in crates/e2e-tests/tests/foreign_chain_tx_validation.rs:549 uses plain backticks (`AuthConfig`). Per engineering-standards.md "Use rustdoc intra-doc links instead of plain backticks," making both intra-doc links would catch drift if the type is ever renamed.
  • crates/e2e-tests/src/foreign_chain_mock.rs:39-42 — since MockAuthExpectation::None triggers an early return, consider whether the fn signature would read better if the caller only invoked it for non-None variants (would remove the matches! guard). Purely stylistic; current form keeps the call sites uniform, which has value.

✅ Approved

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR strengthens the verify_foreign_transaction__should_sign_all_supported_chains E2E test to exercise all credential-carrying AuthConfig variants end-to-end (path/header/query), ensuring the node actually injects configured credentials during foreign provider calls (including the path placeholder substitution regression from #2637 / #2762).

Changes:

  • Extend the foreign tx validation E2E test to configure Bitcoin/Base/BNB providers with AuthConfig::{Path,Header,Query} and require matching credentials in mocks.
  • Add mock-side authentication expectations plus a 401 unauthorized catch-all to ensure unauthenticated requests fail in a realistic way.
  • Add assertions that the authenticated mocks were actually hit (preventing accidental mock loosening).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
crates/e2e-tests/tests/foreign_chain_tx_validation.rs Configures one chain per auth kind and asserts authenticated mocks were queried.
crates/e2e-tests/src/foreign_chain_mock.rs Adds MockAuthExpectation and an unauthorized catch-all to enforce credential presence in requests.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +24 to +33
impl MockAuthExpectation {
fn apply(&self, when: When) -> When {
match self {
Self::None => when.path("/"),
Self::ApiKeyInPath { key } => when.path(format!("/{key}")),
Self::Header { name, value } => when.path("/").header(name, value),
Self::QueryParam { name, value } => when.path("/").query_param(name, value),
}
}
}
bitcoin: bitcoin_server.url("/"),
// The configured URL carries the literal placeholder; the node must
// substitute the API key into it before any request can match the mock.
bitcoin: bitcoin_server.url(format!("/{PATH_AUTH_PLACEHOLDER}")),
anodar
anodar previously approved these changes Jul 9, 2026

@anodar anodar left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

Bitcoin, Base and BNB mock providers now require path, header and query
credentials respectively; requests without them get the 401 real
providers return instead of a valid RPC response. Verification can only
succeed if the node injects each configured credential, covering the
path-auth API key substitution end to end.

Closes #2786
@haiyuechen-nearone
haiyuechen-nearone force-pushed the 2786-e2e-test-foreign-provider-path-auth-substitution branch from 10ea069 to a0a32cf Compare July 10, 2026 06:22
anodar
anodar previously approved these changes Jul 10, 2026
SimonRastikian
SimonRastikian previously approved these changes Jul 13, 2026

@SimonRastikian SimonRastikian left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking

Comment thread crates/e2e-tests/src/foreign_chain_mock.rs Outdated
Comment thread crates/e2e-tests/src/foreign_chain_mock.rs Outdated
Comment thread crates/e2e-tests/tests/foreign_chain_tx_validation.rs Outdated
@haiyuechen-nearone
haiyuechen-nearone added this pull request to the merge queue Jul 13, 2026
Merged via the queue into main with commit e577de2 Jul 13, 2026
15 checks passed
@haiyuechen-nearone
haiyuechen-nearone deleted the 2786-e2e-test-foreign-provider-path-auth-substitution branch July 13, 2026 13:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

E2E test for foreign provider config path auth substitution

4 participants