mirror of
https://github.com/hanzoai/bootnode.git
synced 2026-10-25 02:31:30 +00:00
zeekay
d1ecf27f98
The api-go backend only had an HS256 verifier (shared JWT_SECRET). After the
FE completes IAM PKCE it presents an IAM-issued RS256 access token, which the
HMAC verifier rejects (SigningMethodHMAC check) — IAM login fails at the API.
Converge on the canonical IAM validation path:
- iam/jwks.go: JWKSVerifier validates RS256/ES256 tokens against the issuer's
JWKS, resolved via OIDC discovery ({issuer}/.well-known/openid-configuration
-> jwks_uri). Keys cached, refreshed on unknown kid (rate-limited). stdlib
only — no new dependency. Issuer is checked (WithIssuer).
- main.go: production selects JWKSVerifier(IAM_URL); dev keeps HS256 for the
built-in email/password flow. One way per environment.
- config: ValidateSecrets() fails fast if production boots with placeholder/
empty JWT_SECRET or API_KEY_SALT — secrets MUST come from KMS, never the
in-code default. IsProduction() gates it.
- iam.go: drop redundant exp/iat int64 fields from Claims — duplicate json
tags shadowed jwt.RegisteredClaims and silently disabled expiry validation
(latent bug in the HS path too; now exp is enforced).
Tests: JWKS valid/expired/wrong-issuer/unknown-kid/HS-rejected + config
secret guard. go build + go vet + go test all green.
skills
@ a066582936
Bootnode
Web3 Backend in a Box - Run locally or deploy to cloud.
Go rewrite (HIP-0106) in progress. The current production service is the Python FastAPI app under
api/. A Go scaffold that mounts intosuperbaseper HIP-0106 lives alongside it —api/,cmd/bootnode/,schema/,zap/. Seedocs/PYTHON_TO_GO_PORT.mdfor the endpoint-by-endpoint port map and the new Go README section below.
Quick Start
docker compose up -d
Done. Your Web3 backend is running:
- API: http://localhost:8000
- Dashboard: http://localhost:3001
- API Docs: http://localhost:8000/docs
Features
| API | Description |
|---|---|
POST /v1/rpc/{chain} |
Multi-chain JSON-RPC proxy |
WS /v1/ws/{chain} |
Real-time blockchain subscriptions |
GET /v1/tokens/{chain}/balances/{address} |
Token balances & metadata |
GET /v1/nfts/{chain}/owned/{address} |
NFT ownership & metadata |
POST /v1/webhooks |
Event-driven notifications |
POST /v1/wallets/create |
ERC-4337 smart wallets |
POST /v1/bundler/{chain} |
UserOp bundling |
POST /v1/gas/sponsor |
Gas sponsorship |
Supported Chains
L1: Ethereum, BNB Chain, Avalanche, Solana, Bitcoin
L2: Arbitrum, Optimism, Base, Polygon, zkSync, Scroll, Linea, Blast
Development
# API (Python 3.12+)
cd api && uv sync && uvicorn bootnode.main:app --reload --port 8000
# Dashboard (Node 22+)
cd web && pnpm install && pnpm dev
Deploy
Self-hosted
docker compose -f docker-compose.prod.yml up -d
# or
kubectl apply -f infra/k8s/
Hanzo Cloud
hanzo deploy
Visit web3.hanzo.ai for managed hosting.
License
Apache-2.0
Go rewrite (HIP-0106)
The Go subsystem mounts into superbase (the unified Hanzo Cloud
binary). It exposes a single Mount(r chi.Router, deps api.Deps) error
entry point and a public ZAP schema (schema/bootnode.zap) covering
every cross-subsystem type.
bootnode/
schema/bootnode.zap # public typed surface (ZAP)
zap/gen/ # zapc-generated Go (hand-stubs today)
api/ # subsystem code (chi handlers + store)
mount.go # HIP-0106 contract
deps.go # IAM/KMS/Base/O11y/Commerce interfaces
handlers/ # one MountXxx per FastAPI route group
middleware/ # auth, telemetry, rate-limit
store/ # per-tenant SQLite via deps.Base
web3/ # chain registry + RPC pool
cmd/bootnode/main.go # standalone dev shim
docs/PYTHON_TO_GO_PORT.md # endpoint-by-endpoint mapping
Build
go build ./...
go vet ./...
go run ./cmd/bootnode # listens on :8100 (BOOTNODE_ADDR to override)
Generate ZAP bindings
cd zap && make gen # no-op if zapc isn't installed
zapc lives at ~/work/hanzo/zap/zapc-rs/. Brand policy: no
.capnp files, no "Cap'n Proto" references on the public surface
(HIP-0106).