add allowed admins access list

.env.example

@@ -29,6 +29,7 @@ export AUTHORIZED_PUBLISHERS=
 export AUTHORIZED_PUBLISHERS_LIST=
 export INDEXER_INTERVAL=
 export ALLOWED_ADMINS=
+export ALLOWED_ADMINS_LIST=
 export DASHBOARD=true
 export RATE_DENY_LIST=
 export MAX_REQ_PER_MINUTE=

docs/env.md

@@ -22,6 +22,7 @@ Environmental variables are also tracked in `ENVIRONMENT_VARIABLES` within `src/
 - `INDEXER_INTERVAL`: Sets the interval in milliseconds for the indexer to crawl. The default is 30 seconds if not set. Example: `10000`
 - `INDEXER_NETWORKS`: Specifies the networks the Indexer will crawl. If not set, the Indexer will index all networks defined in the RPCS environment variable. If set to an empty string, indexing will be disabled. Example: `[1, 137]`
 - `ALLOWED_ADMINS`: Sets the public address of accounts which have access to admin endpoints e.g. shutting down the node. Example: `"[\"0x967da4048cD07aB37855c090aAF366e4ce1b9F48\",\"0x388C818CA8B9251b393131C08a736A67ccB19297\"]"`
+- `ALLOWED_ADMINS_LIST`: Array of access list addresses (per chain) for accounts that have access to admin endpoints. Example: `"{ \"8996\": [\"0x123\",\"0x456\"]"`
 - `DASHBOARD`: If `false` the dashboard will not run. If not set or `true` the dashboard will start with the node. Example: `false`
 - `RATE_DENY_LIST`: Blocked list of IPs and peer IDs. Example: `"{ \"peers\": [\"16Uiu2HAkuYfgjXoGcSSLSpRPD6XtUgV71t5RqmTmcqdbmrWY9MJo\"], \"ips\": [\"127.0.0.1\"] }"`
 - `MAX_REQ_PER_MINUTE`: Number of requests per minute allowed by the same client (IP or Peer id). Example: `30`

scripts/ocean-node-quickstart.sh

@@ -156,6 +156,7 @@ services:
 #      AUTHORIZED_PUBLISHERS_LIST: ''
 #      INDEXER_NETWORKS: '[]'
       ALLOWED_ADMINS: '["$ALLOWED_ADMINS"]'
+#      ALLOWED_ADMINS_LIST: ''
 #      INDEXER_INTERVAL: ''
       DASHBOARD: 'true'
 #      RATE_DENY_LIST: ''

src/@types/OceanNode.ts

@@ -103,6 +103,7 @@ export interface OceanNodeConfig {
   accountPurgatoryUrl: string
   assetPurgatoryUrl: string
   allowedAdmins?: string[]
+  allowedAdminsList?: AccessListContract | null
   codeHash?: string
   rateLimit?: number // per request ip or peer
   maxConnections?: number // global, regardless of client address(es)

src/@types/commands.ts

@@ -148,9 +148,17 @@ export interface AdminReindexChainCommand extends AdminCommand {
 
 export interface ICommandHandler {
   handle(command: Command): Promise<P2PCommandResponse>
+  verifyParamsAndRateLimits(task: Command): Promise<P2PCommandResponse>
+}
+
+export interface IValidateCommandHandler extends ICommandHandler {
   validate(command: Command): ValidateParams
 }
 
+export interface IValidateAdminCommandHandler extends ICommandHandler {
+  validate(command: AdminCommand): Promise<ValidateParams>
+}
+
 export interface ComputeGetEnvironmentsCommand extends Command {
   chainId?: number
 }

src/OceanNode.ts

@@ -9,7 +9,7 @@ import { ReadableString } from './components/P2P/handleProtocolCommands.js'
 import StreamConcat from 'stream-concat'
 import { pipe } from 'it-pipe'
 import { GENERIC_EMOJIS, LOG_LEVELS_STR } from './utils/logging/Logger.js'
-import { Handler } from './components/core/handler/handler.js'
+import { BaseHandler } from './components/core/handler/handler.js'
 import { C2DEngines } from './components/c2d/compute_engines.js'
 
 export interface RequestLimiter {
@@ -135,7 +135,7 @@ export class OceanNode {
 
     try {
       const task = JSON.parse(message)
-      const handler: Handler = this.coreHandlers.getHandler(task.command)
+      const handler: BaseHandler = this.coreHandlers.getHandler(task.command)
       if (handler === null) {
         status = {
           httpStatus: 501,

src/components/P2P/handleProtocolCommands.ts

@@ -7,7 +7,7 @@ import { Command } from '../../@types/commands.js'
 import { P2PCommandResponse } from '../../@types/OceanNode'
 import { GENERIC_EMOJIS, LOG_LEVELS_STR } from '../../utils/logging/Logger.js'
 import StreamConcat from 'stream-concat'
-import { Handler } from '../core/handler/handler.js'
+import { BaseHandler } from '../core/handler/handler.js'
 import { getConfiguration } from '../../utils/index.js'
 import { checkConnectionsRateLimit } from '../httpRoutes/requestValidator.js'
 import { CONNECTIONS_RATE_INTERVAL } from '../../utils/constants.js'
@@ -167,7 +167,7 @@ export async function handleProtocolCommands(otherPeerConnection: any) {
   P2P_LOGGER.logMessage('Performing P2P task: ' + JSON.stringify(task), true)
   // we get the handler from the running instance
   // no need to create a new instance of Handler on every request
-  const handler: Handler = this.getCoreHandlers().getHandler(task.command)
+  const handler: BaseHandler = this.getCoreHandlers().getHandler(task.command)
   let response: P2PCommandResponse = null
   if (handler === null) {
     status = { httpStatus: 501, error: `No handler found for command: ${task.command}` }

src/components/core/admin/IndexingThreadHandler.ts

@@ -8,11 +8,11 @@ import {
   validateCommandParameters,
   ValidateParams
 } from '../../httpRoutes/validateCommands.js'
-import { AdminHandler } from './adminHandler.js'
+import { AdminCommandHandler } from './adminHandler.js'
 import { checkSupportedChainId } from '../../../utils/blockchain.js'
 
-export class IndexingThreadHandler extends AdminHandler {
-  validate(command: StartStopIndexingCommand): ValidateParams {
+export class IndexingThreadHandler extends AdminCommandHandler {
+  async validateAdminCommand(command: StartStopIndexingCommand): Promise<ValidateParams> {
     if (
       !validateCommandParameters(command, ['action']) ||
       ![IndexingCommand.START_THREAD, IndexingCommand.STOP_THREAD].includes(
@@ -24,12 +24,12 @@ export class IndexingThreadHandler extends AdminHandler {
         `Missing or invalid "action" and/or "chainId" fields for command: "${command}".`
       )
     }
-    return super.validate(command)
+    return await super.validate(command)
   }
 
   // eslint-disable-next-line require-await
   async handle(task: StartStopIndexingCommand): Promise<P2PCommandResponse> {
-    const validation = this.validate(task)
+    const validation = await this.validateAdminCommand(task)
     if (!validation.valid) {
       return buildInvalidParametersResponse(validation)
     }

src/components/core/admin/adminHandler.ts

@@ -1,22 +1,47 @@
-import { AdminCommand } from '../../../@types/commands.js'
+import { AdminCommand, IValidateAdminCommandHandler } from '../../../@types/commands.js'
 import {
   ValidateParams,
   validateCommandParameters,
-  buildInvalidRequestMessage
+  buildInvalidRequestMessage,
+  buildRateLimitReachedResponse,
+  buildInvalidParametersResponse
 } from '../../httpRoutes/validateCommands.js'
 import { validateAdminSignature } from '../../../utils/auth.js'
-import { Handler } from '../handler/handler.js'
+import { BaseHandler } from '../handler/handler.js'
+import { CommonValidation } from '../../httpRoutes/requestValidator.js'
+import { P2PCommandResponse } from '../../../@types/OceanNode.js'
+import { ReadableString } from '../../P2P/handleProtocolCommands.js'
 
-export abstract class AdminHandler extends Handler {
-  validate(command: AdminCommand): ValidateParams {
+export abstract class AdminCommandHandler
+  extends BaseHandler
+  implements IValidateAdminCommandHandler
+{
+  async verifyParamsAndRateLimits(task: AdminCommand): Promise<P2PCommandResponse> {
+    if (!(await this.checkRateLimit())) {
+      return buildRateLimitReachedResponse()
+    }
+    // then validate the command arguments
+    const validation = await this.validate(task)
+    if (!validation.valid) {
+      return buildInvalidParametersResponse(validation)
+    }
+
+    // all good!
+    return {
+      stream: new ReadableString('OK'),
+      status: { httpStatus: 200, error: null }
+    }
+  }
+
+  async validate(command: AdminCommand): Promise<ValidateParams> {
     const commandValidation = validateCommandParameters(command, [
       'expiryTimestamp',
       'signature'
     ])
     if (!commandValidation.valid) {
       return buildInvalidRequestMessage(commandValidation.reason)
     }
-    const signatureValidation = validateAdminSignature(
+    const signatureValidation: CommonValidation = await validateAdminSignature(
       command.expiryTimestamp,
       command.signature
     )
@@ -25,8 +50,6 @@ export abstract class AdminHandler extends Handler {
         `Signature check failed: ${signatureValidation.error}`
       )
     }
-    return {
-      valid: true
-    }
+    return { valid: true }
   }
 }

src/components/core/admin/collectFeesHandler.ts

@@ -1,4 +1,4 @@
-import { AdminHandler } from './adminHandler.js'
+import { AdminCommandHandler } from './adminHandler.js'
 import {
   AdminCollectFeesCommand,
   AdminCollectFeesHandlerResponse
@@ -21,8 +21,8 @@ import ERC20Template from '@oceanprotocol/contracts/artifacts/contracts/template
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
 import { Readable } from 'stream'
 
-export class CollectFeesHandler extends AdminHandler {
-  validate(command: AdminCollectFeesCommand): ValidateParams {
+export class CollectFeesHandler extends AdminCommandHandler {
+  async validate(command: AdminCollectFeesCommand): Promise<ValidateParams> {
     if (
       !validateCommandParameters(command, [
         'chainId',
@@ -40,11 +40,11 @@ export class CollectFeesHandler extends AdminHandler {
       CORE_LOGGER.error(msg)
       return buildInvalidRequestMessage(msg)
     }
-    return super.validate(command)
+    return await super.validate(command)
   }
 
   async handle(task: AdminCollectFeesCommand): Promise<P2PCommandResponse> {
-    const validation = this.validate(task)
+    const validation = await this.validate(task)
     if (!validation.valid) {
       return buildInvalidParametersResponse(validation)
     }

src/components/core/admin/reindexChainHandler.ts

@@ -1,4 +1,4 @@
-import { AdminHandler } from './adminHandler.js'
+import { AdminCommandHandler } from './adminHandler.js'
 import { AdminReindexChainCommand } from '../../../@types/commands.js'
 import {
   validateCommandParameters,
@@ -12,18 +12,18 @@ import { CORE_LOGGER } from '../../../utils/logging/common.js'
 import { checkSupportedChainId } from '../../../utils/blockchain.js'
 import { ReadableString } from '../../P2P/handleProtocolCommands.js'
 
-export class ReindexChainHandler extends AdminHandler {
-  validate(command: AdminReindexChainCommand): ValidateParams {
+export class ReindexChainHandler extends AdminCommandHandler {
+  async validateAdminCommand(command: AdminReindexChainCommand): Promise<ValidateParams> {
     if (!validateCommandParameters(command, ['chainId'])) {
       return buildInvalidRequestMessage(
         `Missing chainId field for command: "${command}".`
       )
     }
-    return super.validate(command)
+    return await super.validate(command)
   }
 
   async handle(task: AdminReindexChainCommand): Promise<P2PCommandResponse> {
-    const validation = this.validate(task)
+    const validation = await this.validateAdminCommand(task)
     if (!validation.valid) {
       return buildInvalidParametersResponse(validation)
     }

src/components/core/admin/reindexTxHandler.ts

@@ -1,4 +1,4 @@
-import { AdminHandler } from './adminHandler.js'
+import { AdminCommandHandler } from './adminHandler.js'
 import {
   validateCommandParameters,
   buildInvalidRequestMessage,
@@ -12,8 +12,8 @@ import { CORE_LOGGER } from '../../../utils/logging/common.js'
 import { ReadableString } from '../../P2P/handleProtocolCommands.js'
 import { checkSupportedChainId } from '../../../utils/blockchain.js'
 
-export class ReindexTxHandler extends AdminHandler {
-  validate(command: AdminReindexTxCommand): ValidateParams {
+export class ReindexTxHandler extends AdminCommandHandler {
+  async validate(command: AdminReindexTxCommand): Promise<ValidateParams> {
     if (!validateCommandParameters(command, ['chainId', 'txId'])) {
       return buildInvalidRequestMessage(
         `Missing chainId or txId fields for command: "${command}".`
@@ -22,11 +22,11 @@ export class ReindexTxHandler extends AdminHandler {
     if (!/^0x([A-Fa-f0-9]{64})$/.test(command.txId)) {
       return buildInvalidRequestMessage(`Invalid format for transaction ID.`)
     }
-    return super.validate(command)
+    return await super.validate(command)
   }
 
   async handle(task: AdminReindexTxCommand): Promise<P2PCommandResponse> {
-    const validation = this.validate(task)
+    const validation = await this.validate(task)
     if (!validation.valid) {
       return buildInvalidParametersResponse(validation)
     }

src/components/core/admin/stopNodeHandler.ts

@@ -1,4 +1,4 @@
-import { AdminHandler } from './adminHandler.js'
+import { AdminCommandHandler } from './adminHandler.js'
 import { AdminStopNodeCommand } from '../../../@types/commands.js'
 import { P2PCommandResponse } from '../../../@types/OceanNode.js'
 import {
@@ -8,13 +8,13 @@ import {
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
 import { ReadableString } from '../../P2P/handleProtocolCommands.js'
 
-export class StopNodeHandler extends AdminHandler {
-  validate(command: AdminStopNodeCommand): ValidateParams {
-    return super.validate(command)
+export class StopNodeHandler extends AdminCommandHandler {
+  async validate(command: AdminStopNodeCommand): Promise<ValidateParams> {
+    return await super.validate(command)
   }
 
-  handle(task: AdminStopNodeCommand): Promise<P2PCommandResponse> {
-    const validation = this.validate(task)
+  async handle(task: AdminStopNodeCommand): Promise<P2PCommandResponse> {
+    const validation = await this.validate(task)
     if (!validation.valid) {
       return new Promise<P2PCommandResponse>((resolve, reject) => {
         resolve(buildInvalidParametersResponse(validation))

src/components/core/compute/environments.ts

@@ -2,15 +2,15 @@ import { Readable } from 'stream'
 import { P2PCommandResponse } from '../../../@types/index.js'
 import { ComputeEnvByChain } from '../../../@types/C2D.js'
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
-import { Handler } from '../handler/handler.js'
+import { CommandHandler } from '../handler/handler.js'
 import { ComputeGetEnvironmentsCommand } from '../../../@types/commands.js'
 import { getConfiguration } from '../../../utils/config.js'
 import {
   ValidateParams,
   buildInvalidRequestMessage,
   validateCommandParameters
 } from '../../httpRoutes/validateCommands.js'
-export class ComputeGetEnvironmentsHandler extends Handler {
+export class ComputeGetEnvironmentsHandler extends CommandHandler {
   validate(command: ComputeGetEnvironmentsCommand): ValidateParams {
     const validateCommand = validateCommandParameters(command, [])
     if (!validateCommand.valid) {

src/components/core/compute/getResults.ts

@@ -1,6 +1,6 @@
 import { P2PCommandResponse } from '../../../@types/index.js'
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
-import { Handler } from '../handler/handler.js'
+import { CommandHandler } from '../handler/handler.js'
 import { ComputeGetResultCommand } from '../../../@types/commands.js'
 import { checkNonce, NonceResponse } from '../utils/nonceHandler.js'
 import {
@@ -10,7 +10,7 @@ import {
 } from '../../httpRoutes/validateCommands.js'
 import { isAddress } from 'ethers'
 
-export class ComputeGetResultHandler extends Handler {
+export class ComputeGetResultHandler extends CommandHandler {
   validate(command: ComputeGetResultCommand): ValidateParams {
     const validation = validateCommandParameters(command, [
       'consumerAddress',

src/components/core/compute/getStatus.ts

@@ -2,7 +2,7 @@ import { Readable } from 'stream'
 import { P2PCommandResponse } from '../../../@types/index.js'
 import { ComputeJob } from '../../../@types/C2D.js'
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
-import { Handler } from '../handler/handler.js'
+import { CommandHandler } from '../handler/handler.js'
 import { ComputeGetStatusCommand } from '../../../@types/commands.js'
 import {
   ValidateParams,
@@ -11,7 +11,7 @@ import {
 } from '../../httpRoutes/validateCommands.js'
 import { isAddress } from 'ethers'
 
-export class ComputeGetStatusHandler extends Handler {
+export class ComputeGetStatusHandler extends CommandHandler {
   validate(command: ComputeGetStatusCommand): ValidateParams {
     const validation = validateCommandParameters(command, [])
     if (validation.valid) {

src/components/core/compute/initialize.ts

@@ -1,7 +1,7 @@
 import { Readable } from 'stream'
 import { P2PCommandResponse } from '../../../@types/index.js'
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
-import { Handler } from '../handler/handler.js'
+import { CommandHandler } from '../handler/handler.js'
 import { ComputeInitializeCommand } from '../../../@types/commands.js'
 import { ProviderComputeInitializeResults } from '../../../@types/Fees.js'
 import {
@@ -26,7 +26,7 @@ import { getConfiguration } from '../../../utils/index.js'
 import { sanitizeServiceFiles } from '../../../utils/util.js'
 import { FindDdoHandler } from '../handler/ddoHandler.js'
 import { isOrderingAllowedForAsset } from '../handler/downloadHandler.js'
-export class ComputeInitializeHandler extends Handler {
+export class ComputeInitializeHandler extends CommandHandler {
   validate(command: ComputeInitializeCommand): ValidateParams {
     const validation = validateCommandParameters(command, [
       'datasets',

src/components/core/compute/startCompute.ts

@@ -2,7 +2,7 @@ import { Readable } from 'stream'
 import { P2PCommandResponse } from '../../../@types/index.js'
 import { ComputeAsset } from '../../../@types/C2D.js'
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
-import { Handler } from '../handler/handler.js'
+import { CommandHandler } from '../handler/handler.js'
 import { ComputeStartCommand } from '../../../@types/commands.js'
 import { getAlgoChecksums, validateAlgoForDataset } from './utils.js'
 import {
@@ -28,7 +28,7 @@ import { sanitizeServiceFiles } from '../../../utils/util.js'
 import { FindDdoHandler } from '../handler/ddoHandler.js'
 import { ProviderFeeValidation } from '../../../@types/Fees.js'
 import { isOrderingAllowedForAsset } from '../handler/downloadHandler.js'
-export class ComputeStartHandler extends Handler {
+export class ComputeStartHandler extends CommandHandler {
   validate(command: ComputeStartCommand): ValidateParams {
     const commandValidation = validateCommandParameters(command, [
       'consumerAddress',