✨ server: automate firewall allow after kyc approval

.changeset/afraid-mangos-follow.md

@@ -0,0 +1,5 @@
+---
+"@exactly/infra": minor
+---
+
+🧱 setup credit queue worker

.changeset/blue-bottles-wave.md

@@ -0,0 +1,5 @@
+---
+"@exactly/server": patch
+---
+
+✨ automate firewall allow after kyc approval

.changeset/bumpy-regions-read.md

@@ -0,0 +1,5 @@
+---
+"@exactly/infra": minor
+---
+
+🧱 setup poke queue worker

.changeset/free-lamps-pump.md

@@ -0,0 +1,5 @@
+---
+"@exactly/infra": minor
+---
+
+🧱 setup allow queue worker

.changeset/proud-tools-sneeze.md

@@ -0,0 +1,5 @@
+---
+"@exactly/server": patch
+---
+
+✨ process poke in worker

.changeset/tender-foxes-feel.md

@@ -0,0 +1,5 @@
+---
+"@exactly/server": patch
+---
+
+✨ process auto-credit in worker

infra/Pulumi.base.yaml

@@ -1,4 +1,5 @@
 encryptionsalt: v1::v1:AAAAAAAAAAAAAAAb:rYjVO7/uF2+Qv1LhWq5c2S0ZR4rZaQ==
 config:
   gcp:project: eexxxaa
+  exa:pokeMinimum: 1
   exa:subscribeTimeout: 900s

infra/Pulumi.production.yaml

@@ -2,5 +2,6 @@ encryptionsalt: v1::v1:AAAAAAAAAAAAAAAb:rYjVO7/uF2+Qv1LhWq5c2S0ZR4rZaQ==
 config:
   gcp:project: eexxxaa
   exa:domain: web.exactly.app
+  exa:pokeMinimum: 1
   exa:subscribeTimeout: 900s
   exa:whatsappPhoneNumberId: "1287864854409817"

infra/utils/modules.ts

@@ -8,11 +8,14 @@ export default define({
     },
   },
   workers: {
+    allow: { signers: ["allower"] },
     chat: {
       env: { WHATSAPP_PHONE_NUMBER_ID: "whatsappPhoneNumberId" },
       secrets: ["anthropic-api-key", "whatsapp-access-token"],
     },
+    credit: { secrets: ["onesignal-api-key", "postgres-url"] },
     hook: { secrets: ["panda-api-key", "postgres-url"], shared: ["panda-api-url"] },
+    poke: { secrets: ["onesignal-api-key", "segment-write-key"], signers: ["poker"] },
     refund: {
       secrets: ["panda-api-key", "onesignal-api-key", "postgres-url", "sardine-api-key", "segment-write-key"],
       shared: ["panda-api-url", "sardine-api-url"],

server/api/card.ts

@@ -40,10 +40,10 @@ import { BASE_PRODUCT_ID, PLATINUM_PRODUCT_ID, SIGNATURE_PRODUCT_ID } from "@exa
 import { Address, Base64URL, Hex } from "@exactly/common/validation";
 
 import { cards, credentials } from "../database/schema";
-import { autoCredit } from "../utils/panda";
 import publicClient from "../utils/publicClient";
 import ServiceError from "../utils/ServiceError";
 import validatorHook from "../utils/validatorHook";
+import { name as creditName } from "../workers/credit/job";
 
 import type * as schema from "../database/schema";
 import type { Auth } from "../middleware/auth";
@@ -53,6 +53,7 @@ import type createPersona from "../utils/persona";
 import type createSardine from "../utils/sardine";
 import type createSegment from "../utils/segment";
 import type createWalletExtension from "../utils/walletExtension";
+import type createCredit from "../workers/credit/queue";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 
 const CardResponse = object({
@@ -150,6 +151,7 @@ const Scopes = picklist(["provisioning", "siwe", "webauthn"]);
 
 export default function route({
   auth,
+  credit,
   database,
   panda,
   pax,
@@ -159,6 +161,7 @@ export default function route({
   walletExtension,
 }: {
   auth: Auth;
+  credit: ReturnType<typeof createCredit>;
   database: NodePgDatabase<typeof schema>;
   panda: ReturnType<typeof createPanda>;
   pax: ReturnType<typeof createPax>;
@@ -644,15 +647,14 @@ This endpoint only accepts Wallet Extension bearer access. It does not accept \`
                   }
                 });
 
-              let mode = 0;
-              try {
-                if (await autoCredit(account)) mode = 1;
-              } catch (error) {
-                captureException(error);
-              }
-              await database
-                .insert(cards)
-                .values([{ id: card.id, credentialId, lastFour: card.last4, mode, productId }]);
+              await database.insert(cards).values([{ id: card.id, credentialId, lastFour: card.last4, productId }]);
+              await credit.enqueue(account).catch((error: unknown) =>
+                captureException(error, {
+                  level: "error",
+                  tags: { queue: creditName, job: creditName },
+                  extra: { account },
+                }),
+              );
               segment.track({
                 event: "CardIssued",
                 userId: account,

server/api/index.ts

@@ -27,13 +27,15 @@ import type createManteca from "../utils/ramps/manteca";
 import type createSardine from "../utils/sardine";
 import type createSegment from "../utils/segment";
 import type createWalletExtension from "../utils/walletExtension";
+import type createCredit from "../workers/credit/queue";
 import type createSubscribe from "../workers/subscribe/queue";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { Redis } from "ioredis";
 
 export default function api({
   authSecret,
   bridge,
+  credit,
   database,
   intercom,
   manteca,
@@ -48,6 +50,7 @@ export default function api({
 }: {
   authSecret: string;
   bridge: ReturnType<typeof createBridge>;
+  credit: ReturnType<typeof createCredit>;
   database: NodePgDatabase<typeof schema>;
   intercom: ReturnType<typeof createIntercom>;
   manteca: ReturnType<typeof createManteca>;
@@ -77,7 +80,7 @@ export default function api({
       authentication({ authSecret, createCredential: credential, database, intercom, redis, walletExtension }),
     )
     .route("/activity", activity({ auth, database }))
-    .route("/card", card({ auth, database, panda, pax, persona, sardine, segment, walletExtension }))
+    .route("/card", card({ auth, credit, database, panda, pax, persona, sardine, segment, walletExtension }))
     .route("/kyc", kyc({ auth, database, panda, persona }))
     .route("/passkey", passkey({ auth, database })) // eslint-disable-line @typescript-eslint/no-deprecated -- // TODO remove
     .route("/pax", paxRoute({ auth, database, pax }))

server/hooks/activity.ts

@@ -1,52 +1,34 @@
 import { vValidator } from "@hono/valibot-validator";
-import { SPAN_STATUS_ERROR, SPAN_STATUS_OK } from "@sentry/core";
 import {
   captureException,
-  continueTrace,
   getActiveSpan,
-  getTraceData,
   SEMANTIC_ATTRIBUTE_SENTRY_OP,
   setContext,
   setTag,
   setUser,
-  startSpan,
-  withScope,
 } from "@sentry/node";
 import createDebug from "debug";
-import { eq, inArray } from "drizzle-orm";
+import { inArray } from "drizzle-orm";
 import { Hono } from "hono";
 import { validator } from "hono/validator";
 import * as v from "valibot";
-import { bytesToBigInt, hexToBigInt, withRetry, type LocalAccount } from "viem";
+import { bytesToHex, hexToBigInt } from "viem";
 import { anvil } from "viem/chains";
 
-import exaChain, {
-  auditorAbi,
-  exaAccountFactoryAbi,
-  exaPluginAbi,
-  exaPreviewerAbi,
-  exaPreviewerAddress,
-  marketAbi,
-  upgradeableModularAccountAbi,
-  wethAddress,
-} from "@exactly/common/generated/chain";
+import exaChain, { exaPreviewerAbi, exaPreviewerAddress, wethAddress } from "@exactly/common/generated/chain";
 import { Address, Hash, Hex } from "@exactly/common/validation";
 
-import { cards, credentials } from "../database/schema";
+import { credentials } from "../database/schema";
 import t, { f } from "../i18n";
 import { activityNetworks, activityUrl, NETWORKS } from "../utils/alchemy";
-import decodePublicKey from "../utils/decodePublicKey";
-import { autoCredit } from "../utils/panda";
 import publicClient from "../utils/publicClient";
-import revertFingerprint from "../utils/revertFingerprint";
 import validatorHook from "../utils/validatorHook";
 import verifySignature from "../utils/verifySignature";
-import createWallet from "../utils/wallet";
 
 import type * as schema from "../database/schema";
 import type createAlchemy from "../utils/alchemy";
 import type createOnesignal from "../utils/onesignal";
-import type createSegment from "../utils/segment";
+import type createPoke from "../workers/poke/queue";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { Redis } from "ioredis";
 
@@ -59,17 +41,15 @@ Object.assign(debug, { inspectOpts: { depth: undefined } });
 export default function hook({
   alchemy,
   database,
-  executor,
   onesignal,
+  poke,
   redis,
-  segment,
 }: {
   alchemy: ReturnType<typeof createAlchemy>;
   database: NodePgDatabase<typeof schema>;
-  executor: LocalAccount;
   onesignal: ReturnType<typeof createOnesignal>;
+  poke: ReturnType<typeof createPoke>;
   redis: Redis;
-  segment: ReturnType<typeof createSegment>;
 }) {
   const networks = activityNetworks();
   let entries = new Map<string, { network: string; signingKey: string }>();
@@ -204,150 +184,19 @@ export default function hook({
           pokes.set(account, { publicKey, factory, source, assets: new Set([asset]) });
         }
       }
-      const { "sentry-trace": sentryTrace, baggage } = getTraceData();
-      const wallet = createWallet(executor, chain);
-      Promise.allSettled(
-        [...pokes].map(([account, { publicKey, factory, source, assets }]) =>
-          continueTrace({ sentryTrace, baggage }, () =>
-            withScope((scope) =>
-              startSpan(
-                { name: "account activity", op: "exa.activity", attributes: { account }, forceTransaction: true },
-                async (span) => {
-                  scope.setUser({ id: account });
-                  const isDeployed = !!(await wallet.getCode({ address: account }));
-                  scope.setTag("exa.new", !isDeployed);
-                  if (!isDeployed) {
-                    try {
-                      await wallet.exaSend(
-                        { name: "create account", op: "exa.account", attributes: { account } },
-                        {
-                          address: factory,
-                          functionName: "createAccount",
-                          args: [0n, [decodePublicKey(publicKey, bytesToBigInt)]],
-                          abi: exaAccountFactoryAbi,
-                        },
-                        chain.id === exaChain.id ? undefined : { fees: "auto" },
-                      );
-                      segment.track({ event: "AccountFunded", userId: account, properties: { source } });
-                    } catch (error: unknown) {
-                      span.setStatus({ code: SPAN_STATUS_ERROR, message: "account_failed" });
-                      throw error;
-                    }
-                  }
-                  if (chain.id !== exaChain.id) {
-                    span.setStatus({ code: SPAN_STATUS_OK });
-                    return;
-                  }
-                  if (assets.has(ETH)) assets.delete(WETH);
-                  const results = await Promise.allSettled(
-                    [...assets]
-                      .filter((asset) => marketsByAsset.has(asset) || asset === ETH)
-                      .map(async (asset) =>
-                        withRetry(
-                          () =>
-                            wallet
-                              .exaSend(
-                                { name: "poke account", op: "exa.poke", attributes: { account, asset } },
-                                {
-                                  address: account,
-                                  abi: [...exaPluginAbi, ...upgradeableModularAccountAbi, ...auditorAbi, ...marketAbi],
-                                  ...(asset === ETH
-                                    ? { functionName: "pokeETH" }
-                                    : {
-                                        functionName: "poke",
-                                        args: [marketsByAsset.get(asset)!], // eslint-disable-line @typescript-eslint/no-non-null-assertion
-                                      }),
-                                },
-                                { ignore: ["NoBalance()"] },
-                              )
-                              .then((receipt) => {
-                                if (receipt) return receipt;
-                                throw new Error("NoBalance()");
-                              }),
-                          {
-                            delay: 2000,
-                            retryCount: 5,
-                            shouldRetry: ({ error }) => {
-                              if (error instanceof Error && error.message === "NoBalance()") return true;
-                              withScope((captureScope) => {
-                                captureScope.setUser({ id: account });
-                                captureException(error, { level: "error", fingerprint: revertFingerprint(error) });
-                              });
-                              return true;
-                            },
-                          },
-                        ),
-                      ),
-                  );
-                  for (const result of results) {
-                    if (result.status === "fulfilled") continue;
-                    if (result.reason instanceof Error && result.reason.message === "NoBalance()") {
-                      withScope((captureScope) => {
-                        captureScope.setUser({ id: account });
-                        captureScope.addEventProcessor((event) => {
-                          if (event.exception?.values?.[0]) event.exception.values[0].type = "NoBalance";
-                          return event;
-                        });
-                        captureException(result.reason, {
-                          level: "warning",
-                          fingerprint: ["{{ default }}", "NoBalance"],
-                        });
-                      });
-                      continue;
-                    }
-                    span.setStatus({ code: SPAN_STATUS_ERROR, message: "poke_failed" });
-                    throw result.reason;
-                  }
-                  autoCredit(account)
-                    .then(async (auto) => {
-                      span.setAttribute("exa.autoCredit", auto);
-                      if (!auto) return;
-                      const credential = await database.query.credentials.findFirst({
-                        where: eq(credentials.account, account),
-                        columns: {},
-                        with: {
-                          cards: {
-                            columns: { id: true, mode: true },
-                            where: inArray(cards.status, ["ACTIVE", "FROZEN"]),
-                          },
-                        },
-                      });
-                      const card = credential?.cards[0];
-                      if (!card) return;
-                      span.setAttribute("exa.card", card.id);
-                      if (card.mode !== 0) return;
-                      await database.update(cards).set({ mode: 1 }).where(eq(cards.id, card.id));
-                      span.setAttribute("exa.mode", 1);
-                      onesignal
-                        .sendPushNotification({
-                          userId: account,
-                          headings: t("Card mode changed"),
-                          contents: t("Credit mode activated"),
-                        })
-                        .catch((error: unknown) => captureException(error));
-                    })
-                    .catch((error: unknown) => captureException(error));
-                  span.setStatus({ code: SPAN_STATUS_OK });
-                },
-              ),
-            ),
-          ).catch((error: unknown) => {
-            withScope((scope) => {
-              scope.setUser({ id: account });
-              captureException(error, { level: "error", fingerprint: revertFingerprint(error) });
-            });
-            throw error;
+      await Promise.all(
+        [...pokes].map(([account, { assets, factory, publicKey, source }]) =>
+          poke.enqueue({
+            account,
+            assets: [...assets],
+            chainId: chain.id,
+            factory,
+            origin: "activity",
+            publicKey: bytesToHex(publicKey),
+            source,
           }),
         ),
-      )
-        .then((results) => {
-          getActiveSpan()?.setStatus(
-            results.every((result) => result.status === "fulfilled")
-              ? { code: SPAN_STATUS_OK }
-              : { code: SPAN_STATUS_ERROR, message: "activity_failed" },
-          );
-        })
-        .catch((error: unknown) => captureException(error));
+      );
       return c.json({});
     },
   );