[Horizon] Phase 4 gateway

Cargo.toml

@@ -18,6 +18,7 @@ axum = { version = "0.8.1", default-features = false, features = [
     "tokio",
     "http1",
 ] }
+base64 = "0.22.1"
 custom_debug = "0.6.1"
 faster-hex = "0.10.0"
 futures = "0.3"
@@ -46,8 +47,8 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0.116", features = ["raw_value"] }
 serde_with = "3.8.1"
 snmalloc-rs = "0.3"
-tap_graph = "0.3.3"
-thegraph-core = { version = "0.15", features = [
+tap_graph = { version = "0.3.4", features = ["v2"] }
+thegraph-core = { version = "0.15.1", features = [
     "alloy-contract",
     "alloy-signer-local",
     "attestation",

README.md

@@ -101,7 +101,7 @@ client query. Indexer fees are clamped to a maximum of the gateway's budget.
 
 For an overview of TAP see https://github.com/semiotic-ai/timeline-aggregation-protocol.
 
-The gateway acts as a TAP sender, where each indexer request is sent with a TAP receipt. The gateway
+This is a horizon-ready gateway that generates TAP v2 receipts exclusively. The gateway acts as a TAP sender, where each indexer request is sent with a TAP v2 receipt. The gateway
 operator is expected to run 2 additional services:
 
 - [tap-aggregator](https://github.com/semiotic-ai/timeline-aggregation-protocol/tree/main/tap_aggregator):
@@ -113,7 +113,7 @@ operator is expected to run 2 additional services:
 The gateway operator is also expected to manage at least 2 wallets:
 
 - sender: requires ETH for transaction gas and GRT to allocate into TAP escrow balances for paying indexers
-- authorized signer: used by the gateway and tap-aggregator to sign receipts and RAVs
+- authorized signer: used by the gateway and tap-aggregator to sign v2 receipts and RAVs
 
 ## operational notes
 

src/client_query.rs

@@ -285,7 +285,10 @@ async fn run_indexer_queries(
             let min_fee = *(min_fee.0 * grt_per_usd * one_grt) / selections.len() as f64;
             let indexer_fee = selection.fee.as_f64() * budget as f64;
             let fee = indexer_fee.max(min_fee) as u128;
-            let receipt = match ctx.receipt_signer.create_receipt(largest_allocation, fee) {
+            let receipt = match ctx
+                .receipt_signer
+                .create_receipt(largest_allocation, *indexer, fee)
+            {
                 Ok(receipt) => receipt,
                 Err(err) => {
                     tracing::error!(?indexer, %deployment, error=?err, "failed to create receipt");
@@ -303,7 +306,11 @@ async fn run_indexer_queries(
                     let start_time = Instant::now();
                     // URL checked: ref df8e647b-1e6e-422a-8846-dc9ee7e0dcc2
                     let deployment_url = url.join(&format!("subgraphs/id/{deployment}")).unwrap();
-                    let auth = IndexerAuth::Paid(&receipt, ctx.attestation_domain);
+                    let auth = IndexerAuth::Paid(
+                        &receipt,
+                        ctx.attestation_domain,
+                        ctx.legacy_attestation_domain,
+                    );
                     let result = indexer_client
                         .query_indexer(deployment_url, auth, &indexer_query)
                         .in_current_span()
@@ -682,7 +689,7 @@ pub async fn handle_indexer_query(
     let fee = *(ctx.budgeter.query_fees_target.0 * grt_per_usd * one_grt) as u128;
 
     let allocation = indexing.largest_allocation;
-    let receipt = match ctx.receipt_signer.create_receipt(allocation, fee) {
+    let receipt = match ctx.receipt_signer.create_receipt(allocation, *indexer, fee) {
         Ok(receipt) => receipt,
         Err(err) => {
             return Err(Error::Internal(anyhow!("failed to create receipt: {err}")));
@@ -695,7 +702,11 @@ pub async fn handle_indexer_query(
         .url
         .join(&format!("subgraphs/id/{deployment}"))
         .unwrap();
-    let indexer_auth = IndexerAuth::Paid(&receipt, ctx.attestation_domain);
+    let indexer_auth = IndexerAuth::Paid(
+        &receipt,
+        ctx.attestation_domain,
+        ctx.legacy_attestation_domain,
+    );
 
     let indexer_start_time = Instant::now();
     let result = ctx

src/client_query/context.rs

@@ -18,5 +18,6 @@ pub struct Context {
     pub network: NetworkService,
     pub indexing_perf: IndexingPerformance,
     pub attestation_domain: &'static Eip712Domain,
+    pub legacy_attestation_domain: &'static Eip712Domain,
     pub reporter: mpsc::UnboundedSender<reports::ClientRequest>,
 }

src/config.rs

@@ -46,7 +46,7 @@ pub struct Config {
     /// Minimum indexer-service version that will receive queries
     #[serde_as(as = "DisplayFromStr")]
     pub min_indexer_version: Version,
-    /// Indexers used to query the network subgraph
+    /// Trusted indexers that can serve the network subgraph for free
     pub trusted_indexers: Vec<TrustedIndexer>,
     /// Maximum acceptable lag (in seconds) for network subgraph responses (default: 120)
     #[serde(default = "default_network_subgraph_max_lag_seconds")]
@@ -61,6 +61,8 @@ pub struct Config {
     #[serde(deserialize_with = "deserialize_not_nan_f64")]
     pub query_fees_target: NotNan<f64>,
     pub receipts: Receipts,
+    /// Address for the Subgraph Service
+    pub subgraph_service: Address,
 }
 
 /// Default network subgraph max lag threshold (120 seconds)
@@ -128,6 +130,7 @@ pub enum BlocklistEntry {
 pub struct AttestationConfig {
     pub chain_id: String,
     pub dispute_manager: Address,
+    pub legacy_dispute_manager: Address,
 }
 
 /// The exchange rate provider.
@@ -183,6 +186,8 @@ impl From<KafkaConfig> for rdkafka::config::ClientConfig {
 pub struct Receipts {
     /// TAP verifier contract chain
     pub chain_id: U256,
+    /// TAP payer address
+    pub payer: Address,
     /// TAP signer key
     pub signer: B256,
     /// TAP verifier contract address

src/indexer_client.rs

@@ -35,7 +35,7 @@ pub struct IndexerClient {
 }
 
 pub enum IndexerAuth<'a> {
-    Paid(&'a Receipt, &'a Eip712Domain),
+    Paid(&'a Receipt, &'a Eip712Domain, &'a Eip712Domain),
     Free(&'a str),
 }
 
@@ -47,7 +47,7 @@ impl IndexerClient {
         query: &str,
     ) -> Result<IndexerResponse, IndexerError> {
         let (auth_key, auth_value) = match auth {
-            IndexerAuth::Paid(receipt, _) => ("Tap-Receipt", receipt.serialize()),
+            IndexerAuth::Paid(receipt, _, _) => ("tap-receipt", receipt.serialize()),
             IndexerAuth::Free(token) => (AUTHORIZATION.as_str(), format!("Bearer {token}")),
         };
 
@@ -113,18 +113,26 @@ impl IndexerClient {
             return Err(BadResponse(format!("unattestable response: {error}")));
         }
 
-        if let IndexerAuth::Paid(receipt, attestation_domain) = auth {
+        if let IndexerAuth::Paid(receipt, attestation_domain, legacy_attestation_domain) = auth {
             match &payload.attestation {
                 Some(attestation) => {
                     let allocation = receipt.allocation();
-                    if let Err(err) = attestation::verify(
+                    if let Err(legacy_err) = attestation::verify(
+                        legacy_attestation_domain,
+                        attestation,
+                        &allocation,
+                        query,
+                        &original_response,
+                    ) && let Err(err) = attestation::verify(
                         attestation_domain,
                         attestation,
                         &allocation,
                         query,
                         &original_response,
                     ) {
-                        return Err(BadResponse(format!("bad attestation: {err}")));
+                        return Err(BadResponse(format!(
+                            "bad attestation: {legacy_err} - {err}"
+                        )));
                     }
                 }
                 None => {

src/main.rs

@@ -104,6 +104,15 @@ async fn main() {
             conf.attestations.dispute_manager,
         )));
 
+    let legacy_attestation_domain: &'static Eip712Domain =
+        Box::leak(Box::new(attestation::eip712_domain(
+            conf.attestations
+                .chain_id
+                .parse::<ChainId>()
+                .expect("failed to parse attestation domain chain_id"),
+            conf.attestations.legacy_dispute_manager,
+        )));
+
     let indexer_client = IndexerClient {
         client: http_client.clone(),
     };
@@ -134,9 +143,11 @@ async fn main() {
     network.wait_until_ready().await;
 
     let receipt_signer: &'static ReceiptSigner = Box::leak(Box::new(ReceiptSigner::new(
+        conf.receipts.payer,
         receipt_signer,
         conf.receipts.chain_id,
         conf.receipts.verifier,
+        conf.subgraph_service,
     )));
 
     let auth_service = init_auth_service(
@@ -171,6 +182,7 @@ async fn main() {
         indexing_perf,
         network,
         attestation_domain,
+        legacy_attestation_domain,
         reporter,
     };
 

src/network/subgraph_client.rs

@@ -94,7 +94,7 @@ pub mod types {
 #[serde_as]
 #[derive(Clone, CustomDebug, Deserialize)]
 pub struct TrustedIndexer {
-    /// network subgraph endpoint
+    /// Complete network subgraph endpoint URL (e.g., http://indexer:7601/subgraphs/id/Qmc2Cb...)
     #[debug(with = std::fmt::Display::fmt)]
     #[serde_as(as = "serde_with::DisplayFromStr")]
     pub url: Url,