mirror of
https://github.com/logos-messaging/logos-delivery.git
synced 2026-08-03 18:33:15 +00:00
* feat: attach RLN proofs at the SendService transmission stage
The relay send path published without an RLN proof: proof generation
lived client-side in (legacy)lightpushPublish, so messages dispatched
through SendService -> RelaySendProcessor reached the network unproven
and would be rejected by an RLN-enforcing relay.
Adds Waku.attachRlnProof in the waku/api publish surface and calls it
from SendService immediately after admission, in both send() and the
retry loop. Placement is load-bearing:
- After admit(), so a message rejected by the rate limiter never draws
a nonce.
- At transmission rather than API entry, because a proof binds to the
epoch current when the message goes out, and a task can be retried
for up to MaxTimeInCache after send() returns.
attachRlnProof is a no-op without RLN mounted (message passes through
unproven, as today) and short-circuits on a message that already
carries a proof, so retrying a task neither redraws a nonce nor
changes the bytes. It uses generateRLNProofWithRootRefresh rather than
the plain generator: a task can wait in the task cache while the group
root moves on chain, so the proof is validated against the
acceptable-root window and regenerated once against a refetched merkle
path if it went stale.
Proof-generation failure parks the task as NextRoundRetry rather than
failing it, matching the admission path: the dominant failure is
NonceLimitReached (RLN's own per-epoch budget exhausted), which the
service loop resolves as the epoch rolls over.
Adds tests/messaging/test_rln_proof_attach.nim covering the unmounted
pass-through, attach when mounted, and the idempotency contract that
the retry loop depends on.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: handle RLN publish rejections in the send service retry loop
An RLN-invalid publish rejection now recovers through the send
service's existing retry loop instead of an inline retry in the kernel.
When a relay or lightpush publish is rejected as RLN-invalid, the
processor clears the message's stale proof, schedules a background
merkle-proof refresh, and parks the task as NextRoundRetry. The next
loop round re-admits the task and regenerates the proof against the
refreshed path. Clearing the proof is required: attachRlnProof
short-circuits on a message that already carries one, so without the
clear the task would resend the rejected proof until it ages out. The
relay processor previously failed such tasks outright, with no
recovery.
Kernel changes supporting this:
- Remove runRlnRefreshRetry from legacyLightpushPublish. The legacy
path now schedules the refresh and returns the error tagged with
RlnProofRefreshScheduledMsg, matching the non-legacy path; retrying
is the caller's decision. Drops the now-unused
RlnMerkleProofRefreshTimeout.
- generateRLNProofWithRootRefresh reuses the nonce drawn for the first
attempt when it regenerates after a stale root, rather than drawing a
second. Only the merkle path differs between the two attempts, so a
redraw would spend two message ids from the epoch budget on a single
message and drift the rate limit manager's accounting away from the
nonce manager's.
Adds Waku.isRlnRejection / Waku.onRlnProofRejected as the messaging
layer's handle on the kernel's RLN rejection detection and background
refresh. Updates the legacy lightpush tests to the schedule-refresh
contract.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: cover currentRlnEpochQuota (mounted and unmounted)
currentRlnEpochQuota ships in the enforcement PR, but its mounted-RLN
assertion needs the anvil-backed group-manager scaffolding that lives in
this file, so the coverage rides along here: none when RLN is unmounted,
and the epoch index + userMessageLimit when it is.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* refactor: consolidate the RLN-rejection parking into parkForRlnProofRefresh
The relay and lightpush processors duplicated the RLN-rejection recovery
(schedule background refresh, clear the stale proof, reset admission,
park as NextRoundRetry); both now call parkForRlnProofRefresh in
send_processor, so the proof-clear the retry contract depends on cannot
drift between the two processors. Also resets firstAdmittedTime so the
regenerated proof's fresh nonce is re-admitted rather than sent uncharged.
No behavior change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs: clarify that lightpush reuses an already-attached RLN proof
The old wording ("attaches an RLN proof per attempt") reads as if every
retry redraws a nonce. The flow proves a message only when it carries no
proof, so a task admitted once reuses its proof and nonce across retries.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: retry once on scheduled RLN proof refresh in the lightpush REST handlers
The kernel lightpush publish paths no longer retry an RLN-invalid publish
inline. On a stale merkle root they schedule a background cache refresh and
return early, tagging the error with RlnProofRefreshScheduledMsg — retrying
is the caller's decision, so the send service recovers through its own loop
and the kernel exposes mechanism only.
The synchronous REST endpoints have no such loop: they call publish once and
map the result to an HTTP status. Left unchanged, a transient stale-root
rejection that the kernel previously absorbed via runRlnRefreshRetry would
now surface to the HTTP client as a 503. Restore the transparent retry where
it belongs under this layering — at the caller — instead of back in the
kernel where it would re-nest inside the send service's retry.
Both the legacy and v3 handlers now retry the publish exactly once when the
first result carries RlnProofRefreshScheduledMsg, under the same
FutTimeoutForPushRequestProcessing bound. The handler's message carries no
proof, so the retry regenerates against the refreshed merkle path. Any other
error, and any error on the retry itself, maps to its response as before.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: retry RLN proof attach on a charged-but-unproven task
admitAndProve set firstAdmittedTime before attaching the proof, then
guarded its whole body on firstAdmittedTime.isSome(). A transient proof
attach failure (e.g. NonceLimitReached) left the task charged but with an
empty proof, and the next round's early-return skipped the attach entirely
and shipped the message bare. The docstring's own invariant — "once
admitted, a task keeps its slot and its proof" — was violated: it kept the
slot but not the proof.
Guard only the rate-limit charge on firstAdmittedTime, not the attach.
attachRlnProof is already idempotent (short-circuits when RLN is unmounted
or a proof is present), so it is safe to call every round: a charged-but-
unproven task retries the attach until it sticks, then short-circuits. The
ordering invariant holds (charge strictly before attach, so an over-budget
message never draws a nonce), the charge stays once-per-task, and NO_PEERS
retries remain free.
This also removes a latent relay double-charge: previously a bare message
reached the relay, was rejected as RLN-invalid, and parkForRlnProofRefresh
reset firstAdmittedTime — re-charging a slot on the next round. The message
now never leaves unproven.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
334 lines
11 KiB
Nim
334 lines
11 KiB
Nim
{.used.}
|
|
|
|
import
|
|
results,
|
|
std/[tempfiles, net, osproc, strutils],
|
|
testutils/unittests,
|
|
chronos,
|
|
std/strformat,
|
|
libp2p/crypto/crypto
|
|
|
|
import
|
|
logos_delivery/waku/[
|
|
waku_core,
|
|
node/peer_manager,
|
|
waku_node,
|
|
waku_lightpush_legacy,
|
|
waku_lightpush_legacy/common,
|
|
waku_lightpush_legacy/protocol_metrics,
|
|
rln,
|
|
rln/constants,
|
|
],
|
|
../testlib/[wakucore, wakunode, testasync, futures, testutils],
|
|
../resources/payloads,
|
|
../waku_rln_relay/[rln/waku_rln_relay_utils, utils_onchain]
|
|
|
|
suite "Waku Legacy Lightpush - End To End":
|
|
var
|
|
server {.threadvar.}: WakuNode
|
|
client {.threadvar.}: WakuNode
|
|
|
|
serverRemotePeerInfo {.threadvar.}: RemotePeerInfo
|
|
pubsubTopic {.threadvar.}: PubsubTopic
|
|
contentTopic {.threadvar.}: ContentTopic
|
|
message {.threadvar.}: WakuMessage
|
|
|
|
asyncSetup:
|
|
let
|
|
serverKey = generateSecp256k1Key()
|
|
clientKey = generateSecp256k1Key()
|
|
|
|
server = newTestWakuNode(serverKey)
|
|
client = newTestWakuNode(clientKey)
|
|
|
|
await allFutures(server.start(), client.start())
|
|
await server.start()
|
|
|
|
(await server.mountRelay()).isOkOr:
|
|
assert false, "Failed to mount relay"
|
|
|
|
check (await server.mountLegacyLightpush()).isOk() # without rln-relay
|
|
client.mountLegacyLightpushClient()
|
|
|
|
serverRemotePeerInfo = server.peerInfo.toRemotePeerInfo()
|
|
pubsubTopic = DefaultPubsubTopic
|
|
contentTopic = DefaultContentTopic
|
|
message = fakeWakuMessage()
|
|
|
|
asyncTeardown:
|
|
await server.stop()
|
|
|
|
suite "Assessment of Message Relaying Mechanisms":
|
|
asyncTest "Via 11/WAKU2-RELAY from Relay/Full Node":
|
|
# Given a light lightpush client
|
|
let lightpushClient = newTestWakuNode(generateSecp256k1Key())
|
|
lightpushClient.mountLegacyLightpushClient()
|
|
|
|
# When the client publishes a message
|
|
let publishResponse = await lightpushClient.legacyLightpushPublish(
|
|
Opt.some(pubsubTopic), message, serverRemotePeerInfo
|
|
)
|
|
|
|
if not publishResponse.isOk():
|
|
echo "Publish failed: ", publishResponse.error()
|
|
|
|
# Then the message is not relayed but not due to RLN
|
|
assert publishResponse.isErr(), "We expect an error response"
|
|
|
|
assert (publishResponse.error == protocol_metrics.notPublishedAnyPeer),
|
|
"incorrect error response"
|
|
|
|
suite "Waku LightPush Validation Tests":
|
|
asyncTest "Validate message size exceeds limit":
|
|
let msgOverLimit = fakeWakuMessage(
|
|
contentTopic = contentTopic,
|
|
payload = getByteSequence(DefaultMaxWakuMessageSize + 64 * 1024),
|
|
)
|
|
|
|
# When the client publishes an over-limit message
|
|
let publishResponse = await client.legacyLightpushPublish(
|
|
Opt.some(pubsubTopic), msgOverLimit, serverRemotePeerInfo
|
|
)
|
|
|
|
check:
|
|
publishResponse.isErr()
|
|
publishResponse.error ==
|
|
fmt"Message size exceeded maximum of {DefaultMaxWakuMessageSize} bytes"
|
|
|
|
suite "RLN Proofs as a Lightpush Service":
|
|
var
|
|
server {.threadvar.}: WakuNode
|
|
client {.threadvar.}: WakuNode
|
|
anvilProc {.threadvar.}: Process
|
|
manager {.threadvar.}: OnchainGroupManager
|
|
wakuRlnConfig {.threadvar.}: WakuRlnConfig
|
|
|
|
serverRemotePeerInfo {.threadvar.}: RemotePeerInfo
|
|
pubsubTopic {.threadvar.}: PubsubTopic
|
|
contentTopic {.threadvar.}: ContentTopic
|
|
message {.threadvar.}: WakuMessage
|
|
|
|
asyncSetup:
|
|
let
|
|
serverKey = generateSecp256k1Key()
|
|
clientKey = generateSecp256k1Key()
|
|
|
|
server = newTestWakuNode(serverKey)
|
|
client = newTestWakuNode(clientKey)
|
|
|
|
anvilProc = runAnvil(stateFile = Opt.some(DEFAULT_ANVIL_STATE_PATH))
|
|
manager = waitFor setupOnchainGroupManager(deployContracts = false)
|
|
|
|
# mount rln-relay
|
|
# match prod epoch window to reduce test flake
|
|
wakuRlnConfig = getWakuRlnConfig(
|
|
manager = manager,
|
|
userMessageLimit = 20,
|
|
index = MembershipIndex(1),
|
|
epochSizeSec = 600,
|
|
)
|
|
|
|
await allFutures(server.start(), client.start())
|
|
await server.start()
|
|
|
|
(await server.mountRelay()).isOkOr:
|
|
assert false, "Failed to mount relay"
|
|
await server.setRlnValidator(wakuRlnConfig)
|
|
check (await server.mountLegacyLightPush()).isOk()
|
|
client.mountLegacyLightPushClient()
|
|
|
|
let manager1 = cast[OnchainGroupManager](server.rln.groupManager)
|
|
let idCredentials1 = generateCredentials()
|
|
|
|
(waitFor manager1.register(idCredentials1, UserMessageLimit(20))).isOkOr:
|
|
assert false, "error returned when calling register: " & error
|
|
|
|
let rootUpdated1 = waitFor manager1.updateRoots()
|
|
info "Updated root for node1", rootUpdated1
|
|
|
|
if rootUpdated1:
|
|
let proofResult = waitFor manager1.fetchMerkleProofElements()
|
|
if proofResult.isErr():
|
|
error "Failed to fetch Merkle proof", error = proofResult.error
|
|
manager1.merkleProofCache = proofResult.get()
|
|
|
|
serverRemotePeerInfo = server.peerInfo.toRemotePeerInfo()
|
|
pubsubTopic = DefaultPubsubTopic
|
|
contentTopic = DefaultContentTopic
|
|
message = fakeWakuMessage()
|
|
|
|
asyncTeardown:
|
|
await server.stop()
|
|
stopAnvil(anvilProc)
|
|
|
|
suite "Lightpush attaching RLN proofs":
|
|
asyncTest "Message is published when RLN enabled":
|
|
# Given a light lightpush client
|
|
let lightpushClient = newTestWakuNode(generateSecp256k1Key())
|
|
lightpushClient.mountLegacyLightPushClient()
|
|
|
|
# Attach the RLN proof. In production the client mounts RLN and generates the
|
|
# proof in legacyLightpushPublish; here we generate it using the server's RLN
|
|
# instance since both ends share group state via the in-memory manager.
|
|
let msgWithProof =
|
|
(await checkAndGenerateRLNProof(Opt.some(server.rln), message)).get()
|
|
|
|
# When the client publishes a message
|
|
let publishResponse = await lightpushClient.legacyLightpushPublish(
|
|
Opt.some(pubsubTopic), msgWithProof, serverRemotePeerInfo
|
|
)
|
|
|
|
if not publishResponse.isOk():
|
|
echo "Publish failed: ", publishResponse.error()
|
|
|
|
# Then the message is not relayed but not due to RLN
|
|
assert publishResponse.isErr(), "We expect an error response"
|
|
check publishResponse.error == protocol_metrics.notPublishedAnyPeer
|
|
|
|
# The tests below drive `server.legacyLightpushPublish(...)` against the
|
|
# server node. Because `server.wakuLegacyLightPush` is mounted (and no
|
|
# legacy client is), the call takes the self-request path — it runs the
|
|
# full client-side flow (proof gen, RLN-rejection detection via the
|
|
# RlnValidatorErrorMsg substring), but the request lands in the local
|
|
# pushHandler. Swapping in a stub pushHandler lets each test control what
|
|
# the publish attempt sees.
|
|
#
|
|
# On an RLN rejection the publish schedules a background merkle-proof
|
|
# refresh and returns the error tagged with RlnProofRefreshScheduledMsg;
|
|
# the caller (the send service loop) regenerates the proof and republishes
|
|
# on its next round.
|
|
|
|
asyncTest "RLN rejection schedules a refresh and surfaces the tagged error":
|
|
var callCount = 0
|
|
let stub: PushMessageHandler = proc(
|
|
pubsubTopic: PubsubTopic, message: WakuMessage
|
|
): Future[WakuLightPushResult[void]] {.async.} =
|
|
inc callCount
|
|
return err(RlnValidatorErrorMsg & ": simulated stale merkle path")
|
|
server.wakuLegacyLightPush.pushHandler = stub
|
|
|
|
let response = await server.legacyLightpushPublish(
|
|
Opt.some(pubsubTopic), message, server.peerInfo.toRemotePeerInfo()
|
|
)
|
|
|
|
check:
|
|
callCount == 1
|
|
response.isErr()
|
|
response.error.contains(RlnProofRefreshScheduledMsg)
|
|
response.error.contains(RlnValidatorErrorMsg)
|
|
|
|
asyncTest "no retry when error does not contain RlnValidatorErrorMsg":
|
|
var callCount = 0
|
|
let stub: PushMessageHandler = proc(
|
|
pubsubTopic: PubsubTopic, message: WakuMessage
|
|
): Future[WakuLightPushResult[void]] {.async.} =
|
|
inc callCount
|
|
return err("unrelated failure")
|
|
server.wakuLegacyLightPush.pushHandler = stub
|
|
|
|
let response = await server.legacyLightpushPublish(
|
|
Opt.some(pubsubTopic), message, server.peerInfo.toRemotePeerInfo()
|
|
)
|
|
|
|
check:
|
|
callCount == 1
|
|
response.isErr()
|
|
response.error == "unrelated failure"
|
|
|
|
asyncTest "no refresh scheduled when node.rln is nil":
|
|
# Detach RLN so the RLN-rejection branch short-circuits on rln.isNone()
|
|
# even when the error string carries RlnValidatorErrorMsg. Restore before
|
|
# teardown so server.stop() sees the same object graph it was
|
|
# constructed with.
|
|
let savedRln = server.rln
|
|
server.rln = nil
|
|
|
|
var callCount = 0
|
|
let stub: PushMessageHandler = proc(
|
|
pubsubTopic: PubsubTopic, message: WakuMessage
|
|
): Future[WakuLightPushResult[void]] {.async.} =
|
|
inc callCount
|
|
return err(RlnValidatorErrorMsg & ": simulated")
|
|
server.wakuLegacyLightPush.pushHandler = stub
|
|
|
|
let response = await server.legacyLightpushPublish(
|
|
Opt.some(pubsubTopic), message, server.peerInfo.toRemotePeerInfo()
|
|
)
|
|
|
|
server.rln = savedRln
|
|
|
|
check:
|
|
callCount == 1
|
|
response.isErr()
|
|
|
|
suite "Waku Legacy Lightpush message delivery":
|
|
asyncTest "Legacy lightpush message flow succeed":
|
|
## Setup
|
|
let
|
|
lightNodeKey = generateSecp256k1Key()
|
|
lightNode = newTestWakuNode(lightNodeKey)
|
|
bridgeNodeKey = generateSecp256k1Key()
|
|
bridgeNode = newTestWakuNode(bridgeNodeKey)
|
|
destNodeKey = generateSecp256k1Key()
|
|
destNode = newTestWakuNode(destNodeKey)
|
|
|
|
await allFutures(destNode.start(), bridgeNode.start(), lightNode.start())
|
|
|
|
(await destNode.mountRelay()).isOkOr:
|
|
assert false, "Failed to mount relay"
|
|
(await bridgeNode.mountRelay()).isOkOr:
|
|
assert false, "Failed to mount relay"
|
|
check (await bridgeNode.mountLegacyLightPush()).isOk()
|
|
lightNode.mountLegacyLightPushClient()
|
|
|
|
discard await lightNode.peerManager.dialPeer(
|
|
bridgeNode.peerInfo.toRemotePeerInfo(), WakuLegacyLightPushCodec
|
|
)
|
|
await sleepAsync(100.milliseconds)
|
|
await destNode.connectToNodes(@[bridgeNode.peerInfo.toRemotePeerInfo()])
|
|
|
|
## Given
|
|
const CustomPubsubTopic = "/waku/2/rs/0/1"
|
|
let message = fakeWakuMessage()
|
|
var completionFutRelay = newFuture[bool]()
|
|
proc relayHandler(
|
|
topic: PubsubTopic, msg: WakuMessage
|
|
): Future[void] {.async, gcsafe.} =
|
|
check:
|
|
topic == CustomPubsubTopic
|
|
msg == message
|
|
completionFutRelay.complete(true)
|
|
|
|
destNode.subscribe((kind: PubsubSub, topic: CustomPubsubTopic), relayHandler).isOkOr:
|
|
assert false, "Failed to subscribe to topic:" & $error
|
|
|
|
# Wait for subscription to take effect
|
|
await sleepAsync(100.millis)
|
|
|
|
## When
|
|
let res =
|
|
await lightNode.legacyLightpushPublish(Opt.some(CustomPubsubTopic), message)
|
|
assert res.isOk(), $res.error
|
|
|
|
## Then
|
|
check await completionFutRelay.withTimeout(5.seconds)
|
|
|
|
## Cleanup
|
|
await allFutures(lightNode.stop(), bridgeNode.stop(), destNode.stop())
|
|
|
|
suite "Waku Legacy Lightpush mounting behavior":
|
|
asyncTest "fails to mount when relay is not mounted":
|
|
## Given a node without Relay mounted
|
|
let
|
|
key = generateSecp256k1Key()
|
|
node = newTestWakuNode(key)
|
|
|
|
# Do not mount Relay on purpose
|
|
check node.wakuRelay.isNil()
|
|
|
|
## Then mounting Legacy Lightpush must fail
|
|
let res = await node.mountLegacyLightPush()
|
|
check:
|
|
res.isErr()
|
|
res.error == MountWithoutRelayError
|