fix: authorize front-end RPC calls with the Prividium session token - #656
Conversation
The token page reads Max Total Supply with a browser eth_call to totalSupply(). On Prividium that call is anonymous and carries no `from`, so the permissions API rejects it before any rule is evaluated and the field renders empty for every token. Proxy the read through the explorer API instead, which holds the user's Prividium token in its httpOnly session and can call the RPC as that user with their address as `from`. Public networks keep calling the contract directly. Admins then control visibility by adding totalSupply() to the token's contract or template function permissions.
API E2E Test Results185 tests 185 ✅ 12s ⏱️ Results for commit 26732f3. ♻️ This comment has been updated with latest results. |
API Prividium E2E Test Results9 tests 9 ✅ 4s ⏱️ Results for commit 26732f3. ♻️ This comment has been updated with latest results. |
|
Visit the preview URL for this PR: |
Unit Test Results 4 files 281 suites 8m 51s ⏱️ Results for commit 26732f3. ♻️ This comment has been updated with latest results. |
Replaces the explorer API proxy endpoint from the previous commit, per review. Prividium authorizes every RPC call against the caller, but the front-end built its JsonRpcProvider with a bare URL, so calls went out anonymous and were rejected before any permission rule was evaluated. The token page's Max Total Supply is the visible symptom, but this affects any front-end RPC read on a Prividium chain. Attach the session token to the shared provider so every front-end RPC call is made as the logged in user, and send the user's address as `from` on the totalSupply read, which the RPC also requires. Public networks are unaffected.
bxpana
changed the title
|
Visit the preview URL for this PR: |
|
Visit the preview URL for this PR: |
|
Visit the preview URL for this PR: |
Replaces the localStorage session token from the previous commit, per review. Prividium authorizes every RPC call against the caller, but the front-end built its JsonRpcProvider with a bare URL, so calls went out anonymous and were rejected before any permission rule was evaluated. The token page's Max Total Supply is the visible symptom, but this affects any front-end RPC read on a Prividium chain. The browser is not meant to hold the permissions API token, the explorer API session already does, so add a POST /rpc endpoint that forwards JSON-RPC requests with the session's token and point the shared provider at it. The RPC infers the caller from the token, so the `from` workaround on the totalSupply read is no longer needed. Public networks still talk to the RPC directly.
|
Visit the preview URL for this PR: |
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio. |
|
Visit the preview URL for this PR: |
|
🎉 This PR is included in version 3.29.9 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
3 participants
What ❔
Attaches the Prividium session token to the front-end's shared
JsonRpcProvider, so every RPC call the app makes is authorized as the logged in user.useContext.getL2Providerbuilds the provider from aFetchRequestcarryingAuthorization: Bearer <session token>whencurrentNetwork.prividiumis set. Public networks keep passing the bare URL, unchanged.useTokenOverviewsends the user's address asfrom, which the Prividium RPC also requires.Why ❔
Max Total Supply is empty for every token on Prividium chains, reported by Memento (PRIV-185).
The provider was constructed with a bare
rpcUrl, so calls reached the permissions API anonymous.checkContractAccesshas no anonymous branch, andeth_callis separately rejected when it carries nofrom, so the call failed twice over before any permission rule was evaluated. No admin-side permission change could have fixed it.Doing this on the shared provider rather than per call fixes it generically, since the explorer makes other front-end RPC reads that hit the same wall.
With this in place an admin controls visibility from the admin panel by adding
totalSupply()to the token's contract or template function permissions and picking who can call it (All Users, or a specific role).Note on the first commit
The first commit proxied the read through a dedicated explorer API endpoint. Per review that was too narrow, so it is fully reverted in the second commit and the branch diff against
maintouches only the four app files. Theprividium_tokenSupplyDisclosureroute was also considered and skipped:DISCLOSURE_METHODS_ENABLEDis off in every environment, and it runs a trace plus storage proofs per call to produce a value we would use unverified.Checklist