Harden Studio Next wallet and API routing

Author: Manablaq

backend/service_api.py

@@ -44,7 +44,12 @@
     "state_basis",
 )
 
-_VERCEL_ROUTE_CAPTURE_KEY = "1"
+_VERCEL_ROUTE_CAPTURE_KEYS = frozenset(
+    (
+        "1",
+        "path",
+    )
+)
 
 
 class SnapshotStore(
@@ -87,11 +92,12 @@ def _invalid_query_response():
 def _public_query_items(
     request: Request,
 ) -> list[tuple[str, str]]:
-    # Vercel's regex route contributes numbered capture-group metadata to the
-    # function query string. Capture key "1" is transport metadata, never a
-    # COMMIT public input. Remove every instance before enforcing the exact
-    # semantic query allowlist below. Unknown non-reserved keys and duplicate
-    # semantic keys still fail closed in _has_exact_query_shape.
+    # Vercel contributes the rewrite wildcard as query metadata to the
+    # function. The legacy regex route used key "1"; the current named
+    # rewrite uses key "path". Neither is a COMMIT public input. Remove every
+    # instance before enforcing the exact semantic query allowlist below.
+    # Unknown non-reserved keys and duplicate semantic keys still fail closed
+    # in _has_exact_query_shape.
     return [
         (
             key,
@@ -101,7 +107,7 @@ def _public_query_items(
             request.query_params.multi_items()
         )
         if key
-        != _VERCEL_ROUTE_CAPTURE_KEY
+        not in _VERCEL_ROUTE_CAPTURE_KEYS
     ]
 
 

components/application/application-shell.tsx

@@ -40,7 +40,7 @@ import {
 } from "@/components/application/claim-mission-flow";
 import {
   preflightCommitWallet,
-  STUDIO_DEV_CHAIN_ID,
+  STUDIO_NEXT_CHAIN_ID,
   type ConnectedCommitWallet,
   type WalletPreflight,
 } from "@/lib/genlayer-browser";
@@ -255,7 +255,7 @@ export function ApplicationShell() {
           </p>
           <div className="commit-app-anchor">
             <span>
-              Chain {STUDIO_DEV_CHAIN_ID}
+              Chain {STUDIO_NEXT_CHAIN_ID}
             </span>
             <span>
               {shorten(

docs/ARCHITECTURE.md

@@ -84,8 +84,10 @@ claiming on behalf of a beneficiary through the public claim method.
 
 The `/verify` backend reads transaction truth through supported hosted-Studio
 transaction/status surfaces and keeps finality distinct from execution success.
-Vercel rewrite metadata is filtered only when it exactly matches the internal
-route capture expected for the request.
+The Vercel rewrite passes its current named wildcard as `path` (legacy routes
+used `1`). The service removes only those documented transport keys before
+enforcing the exact public query allowlist; unknown non-reserved and duplicate
+semantic keys still fail closed.
 
 ## Candidate source identities
 

eslint.config.mjs

@@ -7,6 +7,7 @@ const eslintConfig = defineConfig([
   ...nextTypeScript,
   globalIgnores([
     ".next/**",
+    ".vercel/**",
     ".venv/**",
     "out/**",
     "build/**",

lib/commit-wallet-connection.ts

@@ -2,7 +2,7 @@ import {
   createClient,
 } from "genlayer-js";
 import {
-  STUDIO_DEV_CHAIN_HEX,
+  STUDIO_NEXT_CHAIN_HEX,
   STUDIO_NETWORK_LABEL,
   STUDIO_NEXT_CHAIN,
   STUDIO_NEXT_RPC_URL,
@@ -192,7 +192,7 @@ function assertWalletAddress(
   }
 }
 
-export async function ensureStudioDevWalletNetwork(
+export async function ensureStudioNextWalletNetwork(
   provider: BrowserProvider,
 ): Promise<void> {
   const current = await provider.request({
@@ -202,7 +202,7 @@ export async function ensureStudioDevWalletNetwork(
   if (
     typeof current === "string"
     && current.toLowerCase()
-      === STUDIO_DEV_CHAIN_HEX
+      === STUDIO_NEXT_CHAIN_HEX
   ) {
     return;
   }
@@ -213,7 +213,7 @@ export async function ensureStudioDevWalletNetwork(
       params: [
         {
           chainId:
-            STUDIO_DEV_CHAIN_HEX,
+            STUDIO_NEXT_CHAIN_HEX,
         },
       ],
     });
@@ -227,7 +227,7 @@ export async function ensureStudioDevWalletNetwork(
       params: [
         {
           chainId:
-            STUDIO_DEV_CHAIN_HEX,
+            STUDIO_NEXT_CHAIN_HEX,
           chainName:
             STUDIO_NETWORK_LABEL,
           rpcUrls: [
@@ -245,7 +245,7 @@ export async function ensureStudioDevWalletNetwork(
       params: [
         {
           chainId:
-            STUDIO_DEV_CHAIN_HEX,
+            STUDIO_NEXT_CHAIN_HEX,
         },
       ],
     });
@@ -259,7 +259,7 @@ export async function ensureStudioDevWalletNetwork(
   if (
     typeof selected !== "string"
     || selected.toLowerCase()
-      !== STUDIO_DEV_CHAIN_HEX
+      !== STUDIO_NEXT_CHAIN_HEX
   ) {
     throw new Error(
       `MetaMask did not switch to ${STUDIO_NETWORK_LABEL} (61997).`,
@@ -343,7 +343,7 @@ export async function connectCommitWallet(): Promise<ConnectedCommitWallet> {
     address,
   );
 
-  await ensureStudioDevWalletNetwork(
+  await ensureStudioNextWalletNetwork(
     provider,
   );
 

lib/genlayer-browser.ts

@@ -17,8 +17,8 @@ import {
 export const COMMIT_POLICY_DIGEST =
   "983307fac383ac4a92be6c0c361ea8f3c9d9efa20ad5e6e8bc8dee932f2a6103";
 
-export const STUDIO_DEV_CHAIN_ID = 61997;
-export const STUDIO_DEV_CHAIN_HEX = "0xf22d";
+export const STUDIO_NEXT_CHAIN_ID = 61997;
+export const STUDIO_NEXT_CHAIN_HEX = "0xf22d";
 export const STUDIO_NEXT_RPC_URL = "https://studio-next.genlayer.com/api";
 export const STUDIO_NETWORK_LABEL = "GenLayer Studio Next";
 export const GEN_DECIMALS = 18;
@@ -239,26 +239,6 @@ function assertAddress(
   }
 }
 
-function browserProvider(): BrowserProvider {
-  if (typeof window === "undefined") {
-    throw new Error("Wallet connection is available only in the browser.");
-  }
-
-  const candidate = (
-    window as typeof window & {
-      ethereum?: BrowserProvider;
-    }
-  ).ethereum;
-
-  if (candidate === undefined) {
-    throw new Error(
-      "No MetaMask-compatible browser wallet was detected. Install or enable a wallet that supports the GenLayer Snap.",
-    );
-  }
-
-  return candidate;
-}
-
 function receiptText(
   value: unknown,
   key: string,
@@ -417,58 +397,6 @@ export function validateMissionDraft(
   return errors;
 }
 
-export async function connectCommitWallet(): Promise<ConnectedCommitWallet> {
-  const provider = browserProvider();
-
-  const accounts = await provider.request({
-    method: "eth_requestAccounts",
-  });
-
-  if (
-    !Array.isArray(accounts)
-    || typeof accounts[0] !== "string"
-  ) {
-    throw new Error(
-      "The wallet did not return an account.",
-    );
-  }
-
-  const address = accounts[0];
-  assertAddress(
-    address,
-    "Wallet account",
-  );
-
-  const client = createClient({
-    chain: STUDIO_NEXT_CHAIN,
-    account: address,
-    provider: provider as never,
-  });
-
-  await client.connect(
-    "studioDevnet",
-  );
-
-  const chainId = await provider.request({
-    method: "eth_chainId",
-  });
-
-  if (
-    typeof chainId !== "string"
-    || chainId.toLowerCase() !== STUDIO_DEV_CHAIN_HEX
-  ) {
-    throw new Error(
-      `Wallet must be connected to ${STUDIO_NETWORK_LABEL} (${STUDIO_DEV_CHAIN_ID}).`,
-    );
-  }
-
-  return {
-    address,
-    provider,
-    client,
-  };
-}
-
 function valueRecord(
   value: unknown,
   label: string,
@@ -591,10 +519,10 @@ export async function preflightCommitWallet(
 
   if (
     typeof chainId !== "string"
-    || chainId.toLowerCase() !== STUDIO_DEV_CHAIN_HEX
+    || chainId.toLowerCase() !== STUDIO_NEXT_CHAIN_HEX
   ) {
     throw new Error(
-      `Wallet is not on ${STUDIO_NETWORK_LABEL} (${STUDIO_DEV_CHAIN_ID}).`,
+      `Wallet is not on ${STUDIO_NETWORK_LABEL} (${STUDIO_NEXT_CHAIN_ID}).`,
     );
   }
 
@@ -640,7 +568,7 @@ export async function preflightCommitWallet(
 
   return {
     account: wallet.address,
-    chainId: STUDIO_DEV_CHAIN_ID,
+    chainId: STUDIO_NEXT_CHAIN_ID,
     balanceWei,
     balanceGen: formatGenAmount(
       balanceWei,

tests/frontend/commit-wallet-connection.test.ts

@@ -4,7 +4,7 @@ import {
   it,
 } from "vitest";
 import {
-  ensureStudioDevWalletNetwork,
+  ensureStudioNextWalletNetwork,
   tryEnableOptionalGenLayerSnap,
   walletConnectionErrorMessage,
 } from "@/lib/commit-wallet-connection";
@@ -39,7 +39,7 @@ describe(
           },
         };
 
-        await ensureStudioDevWalletNetwork(
+        await ensureStudioNextWalletNetwork(
           provider,
         );
 
@@ -91,7 +91,7 @@ describe(
           },
         };
 
-        await ensureStudioDevWalletNetwork(
+        await ensureStudioNextWalletNetwork(
           provider,
         );
 
@@ -153,7 +153,7 @@ describe(
           },
         };
 
-        await ensureStudioDevWalletNetwork(
+        await ensureStudioNextWalletNetwork(
           provider,
         );
 

tests/frontend/genlayer-browser.test.ts

@@ -8,7 +8,7 @@ import {
   formatGenAmount,
   parseGenAmount,
   preflightCommitWallet,
-  STUDIO_DEV_CHAIN_ID,
+  STUDIO_NEXT_CHAIN_ID,
   validateFundingEligibility,
   validateEvidenceAttestationEligibility,
   validateEvidenceRegistrationEligibility,
@@ -26,7 +26,7 @@ import {
 
 describe("COMMIT GenLayer browser integration", () => {
   it("binds the deployed policy and Studio Next chain", () => {
-    expect(STUDIO_DEV_CHAIN_ID).toBe(61997);
+    expect(STUDIO_NEXT_CHAIN_ID).toBe(61997);
     expect(COMMIT_POLICY_DIGEST).toBe(
       "983307fac383ac4a92be6c0c361ea8f3c9d9efa20ad5e6e8bc8dee932f2a6103",
     );

tests/test_backend_service_api_integrity.py

@@ -219,6 +219,63 @@ def test_matching_vercel_transaction_capture_is_not_public_query_input(
             1,
         )
 
+    def test_matching_vercel_named_rewrite_capture_is_not_public_query_input(
+        self,
+    ):
+        api = _api()
+
+        store = FIXTURE.FakeStore(
+            FIXTURE._index_snapshot()
+        )
+
+        app = api.create_app(
+            store=store
+        )
+
+        query = urlencode(
+            [
+                (
+                    "chain_id",
+                    str(
+                        FIXTURE.CHAIN_ID
+                    ),
+                ),
+                (
+                    "contract_address",
+                    FIXTURE.CONTRACT_ADDRESS,
+                ),
+                (
+                    "state_basis",
+                    "FINALIZED",
+                ),
+                (
+                    "path",
+                    "index",
+                ),
+            ]
+        )
+
+        status, body = FIXTURE._request(
+            app,
+            path="/api/v1/index",
+            query=query,
+        )
+
+        self.assertEqual(
+            status,
+            200,
+        )
+        self.assertIs(
+            body[
+                "found"
+            ],
+            True,
+        )
+        self.assertEqual(
+            store.loads,
+            1,
+        )
+
     def test_reserved_vercel_capture_value_is_ignored_before_public_shape_validation(
         self,
     ):