feat: near wallet login by danielwpz · Pull Request #237 · nearai/cloud-api

danielwpz · 2025-12-09T04:26:37Z

Note

Adds NEAR wallet authentication endpoint with NEP-413 verification, DB-backed nonce replay protection, config/env wiring, and E2E tests.

API:
- Add POST /v1/auth/near route and wire via build_auth_routes; pass AuthComponents and include near_auth_service in AuthComponents.
- New request/response DTOs for NEAR auth; header validation (User-Agent); error mapping.
Services (Auth):
- Implement NearAuthService (NEP-413): validates recipient/message, nonce timestamp (5‑min window), verifies signature via near-api, consumes nonce to prevent replay, then creates session.
- Expose NearNonceRepository port; integrate with existing AuthServiceTrait.
Database:
- Migration V0033__add_near_nonces.sql creating near_used_nonces table + index.
- New PostgresNearNonceRepository with consume_nonce and cleanup.
Config:
- Add NearConfig { rpc_url, expected_recipient } to AuthConfig; load from env (NEAR_EXPECTED_RECIPIENT, optional NEAR_RPC_URL).
- Update examples and tests to include defaults.
Tests:
- Add e2e_near_auth covering invalid signatures, User‑Agent checks, nonce window, invalid message/recipient, malformed JSON, zero‑timestamp nonce.
- Helpers for constructing NEP‑413 payloads/nonces.
Dependencies:
- Add near-api, base64; lockfile updates and minor crate version pinning (e.g., hmac, sha2, secp256k1).

^{Written by Cursor Bugbot for commit 516db68. This will update automatically on new commits. Configure here.}

cursor

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

crates/services/src/auth/near.rs

think-in-universe · 2025-12-10T10:09:51Z

@claude review

Copilot

Pull request overview

This PR adds NEAR wallet authentication using the NEP-413 signature standard, implementing a complete authentication flow with nonce replay protection, timestamp validation, and database-backed session management.

Key Changes:

Implements NEP-413 signature verification with RPC-based public key ownership validation
Adds database-backed nonce replay protection with automatic cleanup of expired nonces
Integrates NEAR authentication into the existing OAuth-based auth system with session and token management

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
`crates/services/src/auth/near.rs`	Core NEAR authentication service with NEP-413 verification, nonce validation, and timestamp checks
`crates/services/src/auth/ports.rs`	Adds `NearNonceRepository` trait for replay protection
`crates/services/src/auth/mod.rs`	Exports NEAR auth service module
`crates/database/src/repositories/near_nonce.rs`	PostgreSQL implementation of nonce repository with INSERT/CONFLICT pattern
`crates/database/src/repositories/mod.rs`	Exports NEAR nonce repository
`crates/database/src/migrations/sql/V0030__add_near_nonces.sql`	Creates `near_used_nonces` table with hex validation constraint and cleanup index
`crates/database/src/lib.rs`	Exports PostgreSQL nonce repository for public API
`crates/config/src/types.rs`	Adds `NearConfig` with RPC URL and expected recipient configuration
`crates/api/src/routes/auth.rs`	POST `/v1/auth/near` endpoint with request validation and structured error responses
`crates/api/src/lib.rs`	Wires `NearAuthService` into `AuthComponents` and route configuration
`crates/api/tests/e2e_near_auth.rs`	E2E tests for input validation, nonce expiration, and message/recipient validation
`crates/api/tests/common/mod.rs`	Test helpers for creating NEP-413 payloads with configurable timestamps
`crates/services/Cargo.toml`	Adds `near-api` dependency from GitHub
`crates/api/Cargo.toml`	Adds `near-api`, `base64`, and `rand` dependencies
`Cargo.lock`	Locks NEAR-related dependencies and transitive dependencies

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

crates/api/tests/e2e_near_auth.rs

crates/api/tests/common/mod.rs

crates/api/src/routes/auth.rs

crates/services/src/auth/near.rs

crates/config/src/types.rs

crates/services/src/auth/near.rs

crates/api/Cargo.toml

crates/services/src/auth/near.rs

crates/services/Cargo.toml

crates/api/tests/common/mod.rs

crates/api/src/routes/auth.rs

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-12T03:49:04Z

crates/config/src/types.rs

+        Self {
+            rpc_url: env::var("NEAR_RPC_URL")
+                .unwrap_or_else(|_| "https://free.rpc.fastnear.com".to_string()),
+            expected_recipient: NEAR_DEFAULT_RECIPIENT.to_string(),


The expected_recipient field is hardcoded to NEAR_DEFAULT_RECIPIENT and cannot be configured via environment variable. This prevents customization for different deployment environments (e.g., staging vs production, different domains). Consider adding an environment variable option like NEAR_EXPECTED_RECIPIENT that falls back to the default if not set, similar to how rpc_url is handled.

Suggested change

expected_recipient: NEAR_DEFAULT_RECIPIENT.to_string(),

expected_recipient: env::var("NEAR_EXPECTED_RECIPIENT")

.unwrap_or_else(|_| NEAR_DEFAULT_RECIPIENT.to_string()),

crates/api/tests/common/mod.rs

PierreLeGuen · 2025-12-12T03:37:50Z

crates/services/src/auth/near.rs

+const EXPECTED_MESSAGE: &str = "Sign in to NEAR AI Cloud";
+
+/// Custom error type for NEAR authentication
+#[derive(Debug)]


We should use thiserror. Example:

cloud-api/crates/services/src/auth/ports.rs

Lines 102 to 138 in 3e7f179

// Error types

#[derive(Debug, thiserror::Error)]

pub enum AuthError {

#[error("OAuth error: {0}")]

OAuthError(String),

#[error("Invalid state parameter")]

InvalidState,

#[error("Authentication failed: {0}")]

AuthFailed(String),

#[error("Configuration error: {0}")]

ConfigError(String),

#[error("Network error: {0}")]

NetworkError(String),

#[error("Session not found")]

SessionNotFound,

#[error("User not found")]

UserNotFound,

#[error("Internal error: {0}")]

InternalError(String),

#[error("Unauthorized")]

Unauthorized,

#[error("Invalid user agent")]

InvalidUserAgent,

#[error("User agent is too long (max {0} chars)")]

UserAgentTooLong(usize),

}

PierreLeGuen · 2025-12-12T03:46:22Z

crates/services/src/auth/near.rs

+        Self::validate_message(&payload.message).map_err(|e| anyhow::anyhow!(e))?;
+
+        // 3. Cleanup expired nonces
+        self.cleanup_nonces().await;


I think that should be a periodic process. Not on every requests?

actually it's a balance between optimization and code simplicity, since we have the index INDEX idx_near_used_nonces_used_at ON near_used_nonces(used_at), deletion won't cause a full table scan.
So the cleanup should be very effective each call. (Imagine we have 10k new NEAR auth each day, the deletion call will only touch about 20 rows each time)

PierreLeGuen · 2025-12-12T03:48:23Z

crates/services/src/auth/near.rs

+                1,
+                7 * 24,


Should be consts

PierreLeGuen · 2025-12-12T03:49:09Z

crates/api/src/routes/auth.rs

+                status,
+                Json(serde_json::json!({
+                    "error": error_type,
+                    "error_description": error_msg


Returns internal error?

We shouldn't leak internal error details.

crates/api/src/routes/auth.rs

The comments has been resolved.

danielwpz added 2 commits December 9, 2025 11:50

implement near oauth login

949adda

add tests

57dae2c

danielwpz had a problem deploying to Cloud API test env December 9, 2025 04:26 — with GitHub Actions Failure

cursor bot reviewed Dec 9, 2025

View reviewed changes

crates/services/src/auth/near.rs Outdated Show resolved Hide resolved

crates/services/src/auth/near.rs Outdated Show resolved Hide resolved

crates/services/src/auth/near.rs Outdated Show resolved Hide resolved

Fix zero-timestamp nonce bypass in NEAR authentication

3535a04

danielwpz had a problem deploying to Cloud API test env December 9, 2025 04:44 — with GitHub Actions Failure

Simplify NEAR auth to match GitHub/Google OAuth response format

c26e10a

danielwpz had a problem deploying to Cloud API test env December 9, 2025 05:31 — with GitHub Actions Failure

cursor bot reviewed Dec 9, 2025

View reviewed changes

crates/services/src/auth/near.rs Show resolved Hide resolved

fix comment

1cd4075

danielwpz had a problem deploying to Cloud API test env December 10, 2025 01:32 — with GitHub Actions Failure

think-in-universe requested a review from Copilot December 10, 2025 10:09

Copilot started reviewing on behalf of think-in-universe December 10, 2025 10:09 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

think-in-universe requested changes Dec 10, 2025

View reviewed changes

crates/api/Cargo.toml Outdated Show resolved Hide resolved

crates/services/src/auth/near.rs Outdated Show resolved Hide resolved

crates/services/Cargo.toml Outdated Show resolved Hide resolved

danielwpz added 5 commits December 10, 2025 19:47

Replace NEAR auth string matching with type-safe error enum

12739d8

Fix documentation and remove duplicate NEAR config constant

f8764a5

Simplify NEAR auth nonce handling and improve error messages

08206bc

Apply clippy and formatter fixes

e2499af

Update near-api to v0.8.0 and simplify auth message

1d244f3

danielwpz had a problem deploying to Cloud API test env December 10, 2025 12:35 — with GitHub Actions Failure

cursor bot reviewed Dec 10, 2025

View reviewed changes

crates/api/tests/common/mod.rs Outdated Show resolved Hide resolved

crates/api/src/routes/auth.rs Show resolved Hide resolved

fix comments

0a98637

danielwpz had a problem deploying to Cloud API test env December 12, 2025 01:44 — with GitHub Actions Failure

Merge branch 'main' into near_login

73a7aaf

think-in-universe had a problem deploying to Cloud API test env December 12, 2025 03:26 — with GitHub Actions Failure

refactor: increase migration index

0afe370

think-in-universe temporarily deployed to Cloud API test env December 12, 2025 03:35 — with GitHub Actions Inactive

Merge branch 'main' into near_login

8fff841

PierreLeGuen temporarily deployed to Cloud API test env December 12, 2025 03:41 — with GitHub Actions Inactive

think-in-universe requested a review from Copilot December 12, 2025 03:43

Copilot started reviewing on behalf of think-in-universe December 12, 2025 03:43 View session

Copilot AI reviewed Dec 12, 2025

View reviewed changes

PierreLeGuen previously requested changes Dec 12, 2025

View reviewed changes

danielwpz added 2 commits December 12, 2025 15:57

fix comments

fef11fd

Merge branch 'near_login' of github.com:nearai/cloud-api into near_login

ddc236d

danielwpz had a problem deploying to Cloud API test env December 12, 2025 07:59 — with GitHub Actions Failure

cursor bot reviewed Dec 12, 2025

View reviewed changes

crates/api/src/routes/auth.rs Outdated Show resolved Hide resolved

fix

6c75598

danielwpz had a problem deploying to Cloud API test env December 12, 2025 08:20 — with GitHub Actions Failure

Merge branch 'main' into near_login

104ddee

think-in-universe had a problem deploying to Cloud API test env December 12, 2025 08:52 — with GitHub Actions Failure

fix: resolve issues

8eda8a3

think-in-universe had a problem deploying to Cloud API test env December 12, 2025 09:03 — with GitHub Actions Failure

think-in-universe had a problem deploying to Cloud API test env December 12, 2025 09:22 — with GitHub Actions Failure

fix test

516db68

danielwpz temporarily deployed to Cloud API test env December 12, 2025 09:42 — with GitHub Actions Inactive

think-in-universe approved these changes Dec 12, 2025

View reviewed changes

think-in-universe merged commit 0e643b2 into main Dec 12, 2025
2 checks passed

think-in-universe deleted the near_login branch December 12, 2025 09:58

PierreLeGuen linked an issue Dec 16, 2025 that may be closed by this pull request

Feature: NEAR Wallet login #229

Closed

	expected_recipient: NEAR_DEFAULT_RECIPIENT.to_string(),
	expected_recipient: env::var("NEAR_EXPECTED_RECIPIENT")
	.unwrap_or_else(\|_\| NEAR_DEFAULT_RECIPIENT.to_string()),

	// Error types
	#[derive(Debug, thiserror::Error)]
	pub enum AuthError {
	#[error("OAuth error: {0}")]
	OAuthError(String),

	#[error("Invalid state parameter")]
	InvalidState,

	#[error("Authentication failed: {0}")]
	AuthFailed(String),

	#[error("Configuration error: {0}")]
	ConfigError(String),

	#[error("Network error: {0}")]
	NetworkError(String),

	#[error("Session not found")]
	SessionNotFound,

	#[error("User not found")]
	UserNotFound,

	#[error("Internal error: {0}")]
	InternalError(String),

	#[error("Unauthorized")]
	Unauthorized,

	#[error("Invalid user agent")]
	InvalidUserAgent,

	#[error("User agent is too long (max {0} chars)")]
	UserAgentTooLong(usize),
	}

Conversation

danielwpz commented Dec 9, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

This PR is being reviewed by Cursor Bugbot

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

think-in-universe commented Dec 10, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

danielwpz commented Dec 9, 2025 •

edited by cursor bot

Loading