safe-global / safe-client-gateway / 36136421482

89%

push

github

feat(policies): serve active spending-limit policies for a space (#3393)

* feat(policies): serve the active policies of a space

One route, reporting the spending limits the indexer holds:

  GET /v1/spaces/{spaceId}/policies/active

Policies are read per Space, never per Safe. A per-Safe route would put the
Policies page back to fanning out one request per Safe - the problem moving this
to the backend was meant to solve, returning as HTTP instead of RPC - and a
caller wanting one Safe passes `?safes=`, which costs the same single read. One
indexer read covers every Safe on every chain, asserted end to end by a Space
holding two Safes on two chains: one upstream POST, two items, each labelled with
its own Safe so nothing merges across chains.

The Space names the set, so nothing is passed in: the caller's membership is
checked against this Space, and the Space's Safes are the query. That is also
what authorises it. `?safes=` narrows the read and can only ever be a subset; a
Safe outside the Space is a 422 rather than a silent narrowing, which would look
like a Space whose Safes hold no policies. A GET with a query filter rather than
a POST body, because one pair is ~53 URL-encoded characters and a Space holds few
Safes.

The route service holds orchestration only. It reads the indexer once, scopes the
rows to each Safe, and hands each assembler a context it cannot widen - which is
what stops an assembler reporting another Safe's limits, asserted by a test that
puts a second Safe's allowance in the response.

The spending-limit assembler applies three rules that are wrong by default:

- the module's pending reset is applied on read. It zeroes `spent` lazily inside
  getAllowance and emits nothing, so a rolled window still reads as spent on the
  stored row; `available` carries the rule, while `spent` and `remaining` stay as
  the indexer reported them.
- an all-zero row is not a limit. resetAllowance and deleteAllowance have no
  registered-delegate c... (continued)

4434 of 5214 branches covered (85.04%)

Branch coverage included in aggregate %.

82 of 82 new or added lines in 6 files covered. (100.0%)

11327 of 12437 relevant lines covered (91.08%)

540.61 hits per line