Fiet 370 - #23

In `@src/client.dev.ts` around lines 72 - 76, The call to client.executeAction
with Action.FetchFees is missing the required symbol field causing an
INVALID_ARGUMENT error; update the request object passed to client.executeAction
(the call site using Action.FetchFees) to include a symbol property (e.g.,
symbol: "<MARKET_SYMBOL>" or the appropriate variable) alongside cex and action
so the server receives the required symbol parameter.

#!/bin/bash
# Check the Action enum definition to see if FetchAccountId still exists
echo "=== Action enum definition ==="
rg -n "enum Action" -A 20 src/proto/

echo -e "\n=== All references to FetchAccountId ==="
rg -n "FetchAccountId" 

echo -e "\n=== All references to FetchFees ==="
rg -n "FetchFees"

echo -e "\n=== Check if fiet-prover is mentioned in the codebase ==="
rg -n "fiet-prover"

#!/bin/bash
# Check the server.ts switch statement for Action handling
echo "=== Server.ts Action.FetchFees case ==="
rg -n "case Action.FetchFees" -B 2 -A 25 src/server.ts

echo -e "\n=== Check all case statements in the switch ==="
rg -n "case Action\." src/server.ts

echo -e "\n=== Check default case in switch ==="
rg -n "default:" -A 5 src/server.ts

Learnt from: victorshevtsov
Repo: usherlabs/cex-broker PR: 23
File: src/client.dev.ts:72-76
Timestamp: 2026-01-29T17:09:48.143Z
Learning: In the cex-broker codebase, Action.FetchAccountId must remain implemented in src/server.ts to support external consumers like fiet-prover that depend on fetching account IDs from CEX endpoints; removing or replacing this handler breaks backward compatibility.

In `@src/server.ts` around lines 230 - 234, The response currently returns
broker.fees directly which can be undefined; update the callback payload so that
the result JSON always includes an explicit generalFee value set to the broker's
fee when present or the string "unknown" when absent, and emit a warning when
fees are missing (use the existing logger used in this module, e.g.,
processLogger.warn or console.warn) before returning; keep the rest of the
returned fields (proof: verityProof, market) unchanged and ensure result is
JSON.stringified as before.

#!/bin/bash
# Find all comments by victorshevtsov in this PR to understand "the same question"
gh pr view 23 --json comments,reviews --jq '.comments[] | select(.author.login == "victorshevtsov") | {body, createdAt, url}' 

# Also get review comments
gh api repos/usherlabs/cex-broker/pulls/23/comments --jq '.[] | select(.user.login == "victorshevtsov") | {body, path, line, created_at}'

log

export type PolicyConfig = {
	withdraw: {
		rule: WithdrawRule;
	};
	deposit: Record<string, null>;
	order: {
		rule: OrderRule;
	};
};

export type brokers = Required<BrokerMap>;

export function authenticateRequest<T, E>(
	call: ServerUnaryCall<T, E>,
	whitelistIps: string[],
): boolean {
	const clientIp = call.getPeer().split(":")[0];
	if (whitelistIps.includes("*")) {
		return true;
	} else if (!clientIp || !whitelistIps.includes(clientIp)) {
		log.warn(`Blocked access from unauthorized IP: ${clientIp || "unknown"}`);
		return false;
	}
	return true;
}

export function selectBroker(
	brokers:
		| {
				primary: Exchange;
				secondaryBrokers: Exchange[];
		  }
		| undefined,
	metadata: Metadata,
): Exchange | null {
	if (!brokers) {
		return null;
	} else {
		const use_secondary_key = metadata.get("use-secondary-key");
		if (!use_secondary_key || use_secondary_key.length === 0) {
			return brokers.primary;
		} else if (use_secondary_key.length > 0) {
			const keyIndex = Number.isInteger(
				+(use_secondary_key[use_secondary_key.length - 1] ?? "0"),
			);
			return brokers.secondaryBrokers[+keyIndex] ?? null;
		} else {
			return null;
		}
	}
}

export function createBroker(
	cex: string,
	credsOrMetadata: { apiKey: string; apiSecret: string } | Metadata,
): Exchange | null {
	let apiKey: string | undefined;
	let apiSecret: string | undefined;

	// Duck-typing check for gRPC Metadata (has get/remove functions)
	if (
		credsOrMetadata &&
		typeof (credsOrMetadata as unknown as { get: unknown }).get ===
			"function" &&
		typeof (credsOrMetadata as unknown as { remove: unknown }).remove ===
			"function"
	) {
		const metadata = credsOrMetadata as Metadata;
		apiKey = metadata.get("api-key")?.[0]?.toString();
		apiSecret = metadata.get("api-secret")?.[0]?.toString();
		metadata.remove("api-key");
		metadata.remove("api-secret");
	} else {
		const creds = credsOrMetadata as { apiKey: string; apiSecret: string };
		apiKey = creds.apiKey;
		apiSecret = creds.apiSecret;
	}

	const ExchangeClass = (ccxt.pro as Record<string, typeof Exchange>)[cex];
	if (!ExchangeClass || !apiKey || !apiSecret) {
		return null;
	}

	const exchange = new ExchangeClass({ apiKey, secret: apiSecret });
	applyCommonExchangeConfig(exchange);
	return exchange;
}

export function buildHttpClientOverrideFromMetadata(
	metadata: Metadata,
	verityProverUrl: string,
	onProofCallback: (proof: string, notaryPubKey?: string) => void,
): HttpClientOverride {
	const redact = metadata.get("verity-t-redacted")?.[0]?.toString() || "";
	const rawTimeout = metadata.get("verity-proof-timeout")?.[0]?.toString();
	const proofTimeout = rawTimeout ? parseInt(rawTimeout, 10) : 5 * 60 * 1000; // default 5 minutes
	const factory = createVerityHttpClientOverride(
		verityProverUrl,
		onProofCallback,
	);
	return factory(redact, proofTimeout);
}

export const verityHttpClientOverridePredicate: HttpOverridePredicate = ({
	method,
	methodCalled,
}) => {
	return (
		["get", "post"].includes(method.toLowerCase()) &&
		CCXT_METHODS_WITH_VERITY.includes(methodCalled)
	);
};

export function validateWithdraw(
	policy: PolicyConfig,
	network: string,
	recipientAddress: string,
	amount: number,
	ticker: string,
): { valid: boolean; error?: string } {
	const withdrawRule = policy.withdraw.rule;

	// Check if network is allowed
	if (!withdrawRule.networks.includes(network)) {
		return {
			valid: false,
			error: `Network ${network} is not allowed. Allowed networks: ${withdrawRule.networks.join(", ")}`,
		};
	}

	// Check if address is whitelisted
	if (!withdrawRule.whitelist.includes(recipientAddress.toLowerCase())) {
		return {
			valid: false,
			error: `Address ${recipientAddress} is not whitelisted for withdrawals`,
		};
	}

	// Check amount limits
	const amountRule = withdrawRule.amounts.find((a) => a.ticker === ticker);

	if (!amountRule) {
		return {
			valid: false,
			error: `Ticker ${ticker} is not allowed. Supported tickers: ${withdrawRule.amounts.map((a) => a.ticker).join(", ")}`,
		};
	}

	if (amount < amountRule.min) {
		return {
			valid: false,
			error: `Amount ${amount} is below minimum ${amountRule.min}`,
		};
	}

	if (amount > amountRule.max) {
		return {
			valid: false,
			error: `Amount ${amount} exceeds maximum ${amountRule.max}`,
		};
	}

	return { valid: true };
}

export function validateOrder(
	policy: PolicyConfig,
	fromToken: string,
	toToken: string,
	amount: number,
	broker: string,
): { valid: boolean; error?: string } {
	const orderRule = policy.order.rule;

	// Check if market is allowed
	const marketKeys = [
		`${broker.toUpperCase()}:${toToken}/${fromToken}`,
		`${broker.toUpperCase()}:${fromToken}/${toToken}`,
	];
	if (
		!(
			orderRule.markets.includes(marketKeys[0] ?? "") ||
			orderRule.markets.includes(marketKeys[1] ?? "")
		)
	) {
		return {
			valid: false,
			error: `Market ${marketKeys} is not allowed. Allowed markets: ${orderRule.markets.join(", ")}`,
		};
	}

	// Check conversion limits
	const limit = orderRule.limits.find(
		(l) => l.from === fromToken && l.to === toToken,
	);

	if (!limit) {
		return {
			valid: false,
			error: `Conversion from ${fromToken} to ${toToken} is not allowed`,
		};
	}

	if (amount < limit.min) {
		return {
			valid: false,
			error: `Amount ${amount} is below minimum ${limit.min} for ${fromToken} to ${toToken} conversion`,
		};
	}

	if (amount > limit.max) {
		return {
			valid: false,
			error: `Amount ${amount} exceeds maximum ${limit.max} for ${fromToken} to ${toToken} conversion`,
		};
	}

	return { valid: true };
}

Learnt from: victorshevtsov
Repo: usherlabs/cex-broker PR: 23
File: src/client.dev.ts:72-76
Timestamp: 2026-01-29T17:09:48.143Z
Learning: In the cex-broker codebase, Action.FetchAccountId must remain implemented in src/server.ts to support external consumers like fiet-prover that depend on fetching account IDs from CEX endpoints; removing or replacing this handler breaks backward compatibility.