-
Notifications
You must be signed in to change notification settings - Fork 90
feat: add API key support to prover client #1912
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
c4588b8
baa5485
ac366be
3ddc79c
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,6 +35,10 @@ pub struct ExternalServicesConfig { | |
| pub ws_rpc_url: Option<String>, | ||
| pub indexer_url: Option<String>, | ||
| pub prover_url: Option<String>, | ||
| pub prover_append_url: Option<String>, | ||
| pub prover_update_url: Option<String>, | ||
| pub prover_address_append_url: Option<String>, | ||
| pub prover_api_key: Option<String>, | ||
| pub photon_api_key: Option<String>, | ||
|
Comment on lines
+38
to
42
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security: ExternalServicesConfig derives Debug and now includes secrets — redact or remove.
Apply a custom Debug impl that redacts secrets: // Replace: #[derive(Debug, Clone)]
#[derive(Clone)]
pub struct ExternalServicesConfig {
// ... fields unchanged ...
}
// Add this impl nearby
impl std::fmt::Debug for ExternalServicesConfig {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
f.debug_struct("ExternalServicesConfig")
.field("rpc_url", &self.rpc_url)
.field("ws_rpc_url", &self.ws_rpc_url)
.field("indexer_url", &self.indexer_url)
.field("prover_url", &self.prover_url)
.field("prover_append_url", &self.prover_append_url)
.field("prover_update_url", &self.prover_update_url)
.field("prover_address_append_url", &self.prover_address_append_url)
.field("prover_api_key", &"<REDACTED>")
.field("photon_api_key", &"<REDACTED>")
.field("pushgateway_url", &self.pushgateway_url)
.field("pagerduty_routing_key", &self.pagerduty_routing_key)
.field("rpc_rate_limit", &self.rpc_rate_limit)
.field("photon_rate_limit", &self.photon_rate_limit)
.field("send_tx_rate_limit", &self.send_tx_rate_limit)
.finish()
}
}Alternatively, use a secrecy type (e.g., secrecy::SecretString) for keys, which redacts Debug output by default. 🤖 Prompt for AI Agents |
||
| pub pushgateway_url: Option<String>, | ||
| pub pagerduty_routing_key: Option<String>, | ||
|
|
@@ -210,6 +214,19 @@ impl ForesterConfig { | |
| ws_rpc_url: args.ws_rpc_url.clone(), | ||
| indexer_url: args.indexer_url.clone(), | ||
| prover_url: args.prover_url.clone(), | ||
| prover_append_url: args | ||
| .prover_append_url | ||
| .clone() | ||
| .or_else(|| args.prover_url.clone()), | ||
| prover_update_url: args | ||
| .prover_update_url | ||
| .clone() | ||
| .or_else(|| args.prover_url.clone()), | ||
| prover_address_append_url: args | ||
| .prover_address_append_url | ||
| .clone() | ||
| .or_else(|| args.prover_url.clone()), | ||
| prover_api_key: args.prover_api_key.clone(), | ||
| photon_api_key: args.photon_api_key.clone(), | ||
| pushgateway_url: args.push_gateway_url.clone(), | ||
| pagerduty_routing_key: args.pagerduty_routing_key.clone(), | ||
|
|
@@ -280,6 +297,10 @@ impl ForesterConfig { | |
| ws_rpc_url: None, | ||
| indexer_url: None, | ||
| prover_url: None, | ||
| prover_append_url: None, | ||
| prover_update_url: None, | ||
| prover_address_append_url: None, | ||
| prover_api_key: None, | ||
| photon_api_key: None, | ||
| pushgateway_url: args.push_gateway_url.clone(), | ||
| pagerduty_routing_key: args.pagerduty_routing_key.clone(), | ||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -114,13 +114,20 @@ fn get_prover_url() -> String { | |||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| fn get_api_key() -> Option<String> { | ||||||||||||||||||||||||||||||||||||||||||||
| fn get_photon_api_key() -> Option<String> { | ||||||||||||||||||||||||||||||||||||||||||||
| match TestMode::from_env() { | ||||||||||||||||||||||||||||||||||||||||||||
| TestMode::Local => None, | ||||||||||||||||||||||||||||||||||||||||||||
| TestMode::Devnet => Some(get_env_var("PHOTON_API_KEY")), | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| fn get_prover_api_key() -> Option<String> { | ||||||||||||||||||||||||||||||||||||||||||||
| match TestMode::from_env() { | ||||||||||||||||||||||||||||||||||||||||||||
| TestMode::Local => None, | ||||||||||||||||||||||||||||||||||||||||||||
| TestMode::Devnet => Some(get_env_var("PROVER_API_KEY")), | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+124
to
+129
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Verification agent 🧩 Analysis chainPotential env var naming drift: PROVER_API_KEY vs FORESTER_PROVER_API_KEY. This test uses Run this script to inventory usages and confirm a single, consistent env var name: 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Env var references (PROVER_API_KEY | FORESTER_PROVER_API_KEY | PHOTON_API_KEY):"
rg -n -C1 -P 'env::var\("(PROVER_API_KEY|FORESTER_PROVER_API_KEY|PHOTON_API_KEY)"\)'
echo
echo "All occurrences of prover_api_key symbol:"
rg -n -C2 '\bprover_api_key\b'
echo
echo "StartArgs definition and field list (to confirm CLI wiring):"
rg -n -C3 -U 'struct\s+StartArgs\b.*?{' || true
echo
echo "Look for any docs or README references to prover API key to ensure consistency:"
rg -n -C2 -i 'prover api key|PROVER_API_KEY|FORESTER_PROVER_API_KEY|photon api key|PHOTON_API_KEY' || trueLength of output: 27268 Align env var names for prover API key across code, tests, and docs • In fn get_prover_api_key() -> Option<String> {
match TestMode::from_env() {
TestMode::Local => None,
- TestMode::Devnet => Some(get_env_var("PROVER_API_KEY")),
+ TestMode::Devnet => Some(get_env_var("FORESTER_PROVER_API_KEY")),
}
}• Likewise, in the same file update get_photon_api_key to fn get_photon_api_key() -> Option<String> {
match TestMode::from_env() {
TestMode::Local => None,
- TestMode::Devnet => Some(get_env_var("PHOTON_API_KEY")),
+ TestMode::Devnet => Some(get_env_var("FORESTER_PHOTON_API_KEY")),
}
}• Update These fixes will ensure the env-var wiring is uniform and tests won’t silently fail in CI. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| fn get_forester_keypair() -> Keypair { | ||||||||||||||||||||||||||||||||||||||||||||
| match TestMode::from_env() { | ||||||||||||||||||||||||||||||||||||||||||||
| TestMode::Local => Keypair::new(), | ||||||||||||||||||||||||||||||||||||||||||||
|
|
@@ -189,7 +196,11 @@ async fn e2e_test() { | |||||||||||||||||||||||||||||||||||||||||||
| ws_rpc_url: Some(get_ws_rpc_url()), | ||||||||||||||||||||||||||||||||||||||||||||
| indexer_url: Some(get_indexer_url()), | ||||||||||||||||||||||||||||||||||||||||||||
| prover_url: Some(get_prover_url()), | ||||||||||||||||||||||||||||||||||||||||||||
| photon_api_key: get_api_key(), | ||||||||||||||||||||||||||||||||||||||||||||
| prover_append_url: None, | ||||||||||||||||||||||||||||||||||||||||||||
| prover_update_url: None, | ||||||||||||||||||||||||||||||||||||||||||||
| prover_address_append_url: None, | ||||||||||||||||||||||||||||||||||||||||||||
| prover_api_key: get_prover_api_key(), | ||||||||||||||||||||||||||||||||||||||||||||
| photon_api_key: get_photon_api_key(), | ||||||||||||||||||||||||||||||||||||||||||||
| pushgateway_url: None, | ||||||||||||||||||||||||||||||||||||||||||||
| pagerduty_routing_key: None, | ||||||||||||||||||||||||||||||||||||||||||||
| rpc_rate_limit: None, | ||||||||||||||||||||||||||||||||||||||||||||
|
|
@@ -453,7 +464,7 @@ async fn setup_rpc_connection(forester: &Keypair) -> LightClient { | |||||||||||||||||||||||||||||||||||||||||||
| let mut rpc = LightClient::new(if TestMode::from_env() == TestMode::Local { | ||||||||||||||||||||||||||||||||||||||||||||
| LightClientConfig::local() | ||||||||||||||||||||||||||||||||||||||||||||
| } else { | ||||||||||||||||||||||||||||||||||||||||||||
| LightClientConfig::new(get_rpc_url(), Some(get_indexer_url()), get_api_key()) | ||||||||||||||||||||||||||||||||||||||||||||
| LightClientConfig::new(get_rpc_url(), Some(get_indexer_url()), get_photon_api_key()) | ||||||||||||||||||||||||||||||||||||||||||||
| }) | ||||||||||||||||||||||||||||||||||||||||||||
| .await | ||||||||||||||||||||||||||||||||||||||||||||
| .unwrap(); | ||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,9 +1,9 @@ | ||||||||||||||
| ## [0.22.0] | ||||||||||||||
|
|
||||||||||||||
| - `CreateMint` action now allows passing a non-payer mint and freeze authority. | ||||||||||||||
| - More efficient computebudgets for actions. | ||||||||||||||
| - Better DX: Parameter lookup in call signatures of CompressedTokenProgram instructions | ||||||||||||||
| - QoL: improved typedocs. | ||||||||||||||
| - `CreateMint` action now allows passing a non-payer mint and freeze authority. | ||||||||||||||
| - More efficient computebudgets for actions. | ||||||||||||||
| - Better DX: Parameter lookup in call signatures of CompressedTokenProgram instructions | ||||||||||||||
| - QoL: improved typedocs. | ||||||||||||||
|
Comment on lines
+3
to
+6
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fix minor wording/typos
Apply this diff: -- More efficient computebudgets for actions.
-— QoL: improved typedocs.
+- More efficient compute budgets for actions.
+- QoL: improved TypeDoc comments.
🧰 Tools🪛 LanguageTool[grammar] ~3-~3: There might be a mistake here. (QB_NEW_EN) [grammar] ~4-~4: There might be a mistake here. (QB_NEW_EN) 🤖 Prompt for AI Agents |
||||||||||||||
|
|
||||||||||||||
| ## [0.21.0] | ||||||||||||||
|
|
||||||||||||||
|
|
@@ -58,25 +58,23 @@ const ix = await CompressedTokenProgram.decompress({ | |||||||||||||
|
|
||||||||||||||
| ### Overview | ||||||||||||||
|
|
||||||||||||||
| - new type: TokenPoolInfo | ||||||||||||||
| - Instruction Changes: | ||||||||||||||
| - new type: TokenPoolInfo | ||||||||||||||
| - Instruction Changes: | ||||||||||||||
| - `compress`, `mintTo`, `approveAndMintTo`, `compressSplTokenAccount` now require valid TokenPoolInfo | ||||||||||||||
| - `decompress` now requires an array of one or more TokenPoolInfos. | ||||||||||||||
| - `decompress`, `transfer` now do not allow state tree overrides. | ||||||||||||||
|
|
||||||||||||||
| - `compress`, `mintTo`, `approveAndMintTo`, `compressSplTokenAccount` now require valid TokenPoolInfo | ||||||||||||||
| - `decompress` now requires an array of one or more TokenPoolInfos. | ||||||||||||||
| - `decompress`, `transfer` now do not allow state tree overrides. | ||||||||||||||
| - Action Changes: | ||||||||||||||
| - Removed optional tokenProgramId: PublicKey | ||||||||||||||
| - removed optional merkleTree: PublicKey | ||||||||||||||
| - removed optional outputStateTree: PublicKey | ||||||||||||||
| - added optional stateTreeInfo: StateTreeInfo | ||||||||||||||
| - added optional tokenPoolInfo: TokenPoolInfo | ||||||||||||||
|
|
||||||||||||||
| - Action Changes: | ||||||||||||||
|
|
||||||||||||||
| - Removed optional tokenProgramId: PublicKey | ||||||||||||||
| - removed optional merkleTree: PublicKey | ||||||||||||||
| - removed optional outputStateTree: PublicKey | ||||||||||||||
| - added optional stateTreeInfo: StateTreeInfo | ||||||||||||||
| - added optional tokenPoolInfo: TokenPoolInfo | ||||||||||||||
|
|
||||||||||||||
| - new instructions: | ||||||||||||||
| - `approve`, `revoke`: delegated transfer support. | ||||||||||||||
| - `addTokenPools`: you can now register additional token pool pdas. Use | ||||||||||||||
| this if you need very high concurrency. | ||||||||||||||
| - new instructions: | ||||||||||||||
| - `approve`, `revoke`: delegated transfer support. | ||||||||||||||
| - `addTokenPools`: you can now register additional token pool pdas. Use | ||||||||||||||
| this if you need very high concurrency. | ||||||||||||||
|
|
||||||||||||||
| ### Why the Changes are helpful | ||||||||||||||
|
|
||||||||||||||
|
|
@@ -96,32 +94,32 @@ accounts. | |||||||||||||
|
|
||||||||||||||
| ### Changed | ||||||||||||||
|
|
||||||||||||||
| - improved documentation and error messages. | ||||||||||||||
| - improved documentation and error messages. | ||||||||||||||
|
|
||||||||||||||
| ## [0.20.4] - 2025-02-19 | ||||||||||||||
|
|
||||||||||||||
| ### Breaking Changes | ||||||||||||||
|
|
||||||||||||||
| - `selectMinCompressedTokenAccountsForTransfer` and | ||||||||||||||
| `selectSmartCompressedTokenAccountsForTransfer` now throw an error | ||||||||||||||
| if not enough accounts are found. In most cases this is not a breaking | ||||||||||||||
| change, because a proof request would fail anyway. This just makes the error | ||||||||||||||
| message more informative. | ||||||||||||||
| - `selectMinCompressedTokenAccountsForTransfer` and | ||||||||||||||
| `selectSmartCompressedTokenAccountsForTransfer` now throw an error | ||||||||||||||
| if not enough accounts are found. In most cases this is not a breaking | ||||||||||||||
| change, because a proof request would fail anyway. This just makes the error | ||||||||||||||
| message more informative. | ||||||||||||||
|
|
||||||||||||||
| ### Added | ||||||||||||||
|
|
||||||||||||||
| - `selectSmartCompressedTokenAccountsForTransfer` and | ||||||||||||||
| `selectSmartCompressedTokenAccountsForTransferOrPartial` | ||||||||||||||
| - `selectSmartCompressedTokenAccountsForTransfer` and | ||||||||||||||
| `selectSmartCompressedTokenAccountsForTransferOrPartial` | ||||||||||||||
|
|
||||||||||||||
| ### Changed | ||||||||||||||
|
|
||||||||||||||
| - `selectMinCompressedTokenAccountsForTransfer` and | ||||||||||||||
| `selectMinCompressedTokenAccountsForTransferorPartial` now accept an optional | ||||||||||||||
| `maxInputs` parameter, defaulting to 4. | ||||||||||||||
| - `selectMinCompressedTokenAccountsForTransfer` and | ||||||||||||||
| `selectMinCompressedTokenAccountsForTransferorPartial` now accept an optional | ||||||||||||||
| `maxInputs` parameter, defaulting to 4. | ||||||||||||||
|
|
||||||||||||||
|
Comment on lines
+116
to
119
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Typo: method name casing Looks like a stray typo in the method name (“TransferorPartial”). Should be Apply this diff: - `selectMinCompressedTokenAccountsForTransferorPartial` now accept an optional
+ `selectMinCompressedTokenAccountsForTransferOrPartial` now accept an optional📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||
| ### Security | ||||||||||||||
|
|
||||||||||||||
| - N/A | ||||||||||||||
| - N/A | ||||||||||||||
|
|
||||||||||||||
| For previous release notes, check: | ||||||||||||||
| https://www.zkcompression.com/release-notes/1.0.0-mainnet-beta | ||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Avoid leaking prover_api_key in logs/debug output.
StartArgs derives Debug, which can unintentionally log the API key. Redact the value and hide env values in help/error output.
Apply this diff to avoid exposing the key in Clap output and improve UX:
Additionally, consider replacing the auto-derived Debug for StartArgs with a manual Debug that redacts secrets (outside the shown hunk). Example:
Or use a secret wrapper type to enforce redaction at the type level.
🤖 Prompt for AI Agents