build(deps): bump github.com/redis/go-redis/v9 from 9.0.4 to 9.0.5 (#95)

Bumps [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) from 9.0.4 to 9.0.5.
- [Release notes](https://github.com/redis/go-redis/releases)
- [Changelog](https://github.com/redis/go-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/go-redis/compare/v9.0.4...v9.0.5)

---
updated-dependencies:
- dependency-name: github.com/redis/go-redis/v9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Makefile

@@ -11,6 +11,7 @@ build:
 	${BUILD_CONF} go build -ldflags="-X main.build=${BUILD_COMMIT} -s -w" -o ${BIN} cmd/service/*
 
 docs:
+	swag fmt --dir internal/api/
 	swag init --dir internal/api/ -g swagger.go
 
 run:

cmd/service/api.go

@@ -50,6 +50,7 @@ func initApiServer(custodialContainer *custodial.Custodial) *echo.Echo {
 	apiRoute.POST("/account/create", api.HandleAccountCreate(custodialContainer))
 	apiRoute.GET("/account/status/:address", api.HandleNetworkAccountStatus(custodialContainer))
 	apiRoute.POST("/sign/transfer", api.HandleSignTransfer(custodialContainer))
+	apiRoute.POST("/sign/transferAuth", api.HandleSignTranserAuthorization(custodialContainer))
 	apiRoute.GET("/track/:trackingId", api.HandleTrackTx(custodialContainer))
 
 	return server

cmd/service/main.go

@@ -58,8 +58,10 @@ func main() {
 	natsConn, jsCtx := initJetStream()
 
 	custodial, err := custodial.NewCustodial(custodial.Opts{
+		ApprovalTimeout:  ko.MustDuration("system.approve_timeout"),
 		CeloProvider:     celoProvider,
 		LockProvider:     lockProvider,
+		Logg:             lo,
 		Noncestore:       redisNoncestore,
 		Store:            store,
 		RedisClient:      redisPool.Client,

cmd/service/tasker.go

@@ -37,6 +37,7 @@ func initTasker(custodialContainer *custodial.Custodial, redisPool *redis.RedisP
 	taskerServer.RegisterHandlers(tasker.AccountRegisterTask, task.AccountRegisterOnChainProcessor(custodialContainer))
 	taskerServer.RegisterHandlers(tasker.AccountRefillGasTask, task.AccountRefillGasProcessor(custodialContainer))
 	taskerServer.RegisterHandlers(tasker.SignTransferTask, task.SignTransfer(custodialContainer))
+	taskerServer.RegisterHandlers(tasker.SignTransferTaskAuth, task.SignTransferAuthorizationProcessor(custodialContainer))
 	taskerServer.RegisterHandlers(tasker.DispatchTxTask, task.DispatchTx(custodialContainer))
 
 	return taskerServer

config.toml

@@ -3,7 +3,7 @@ address = ":5000"
 # Exposes Go process Prometheus metrics
 # /metrics endpoint
 metrics = true
-docs    = true
+docs    = false
 
 [chain]
 rpc_endpoint     = ""
@@ -13,6 +13,7 @@ registry_address = ""
 [system]
 private_key = ""
 public_key  = ""
+approve_timeout = "30m"
 
 [postgres]
 dsn = ""

docs/docs.go

@@ -25,7 +25,7 @@ const docTemplate = `{
     "host": "{{.Host}}",
     "basePath": "{{.BasePath}}",
     "paths": {
-        "/": {
+        "/account/create": {
             "post": {
                 "description": "Create a new custodial account.",
                 "consumes": [
@@ -34,17 +34,261 @@ const docTemplate = `{
                 "produces": [
                     "application/json"
                 ],
+                "tags": [
+                    "account"
+                ],
                 "summary": "Create a new custodial account.",
                 "responses": {
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "type": "object",
-                            "additionalProperties": true
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
                         }
                     }
                 }
             }
+        },
+        "/account/status/{address}": {
+            "get": {
+                "description": "Return network balance and nonce.",
+                "consumes": [
+                    "*/*"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "network"
+                ],
+                "summary": "Get an address's network balance and nonce.",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Account Public Key",
+                        "name": "address",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        },
+        "/sign/transfer": {
+            "post": {
+                "description": "Sign and dispatch a transfer request.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "network"
+                ],
+                "summary": "Sign and dispatch transfer request.",
+                "parameters": [
+                    {
+                        "description": "Sign Transfer Request",
+                        "name": "signTransferRequest",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "amount": {
+                                    "type": "integer"
+                                },
+                                "from": {
+                                    "type": "string"
+                                },
+                                "to": {
+                                    "type": "string"
+                                },
+                                "voucherAddress": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        },
+        "/sign/transferAuth": {
+            "post": {
+                "description": "Sign and dispatch a transfer authorization (approve) request.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "network"
+                ],
+                "summary": "Sign and dispatch a transfer authorization (approve) request.",
+                "parameters": [
+                    {
+                        "description": "Sign Transfer Authorization (approve) Request",
+                        "name": "signTransferAuthorzationRequest",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "amount": {
+                                    "type": "integer"
+                                },
+                                "authorizedAddress": {
+                                    "type": "string"
+                                },
+                                "authorizer": {
+                                    "type": "string"
+                                },
+                                "voucherAddress": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        },
+        "/track/{trackingId}": {
+            "get": {
+                "description": "Track an OTX (Origin transaction) status.",
+                "consumes": [
+                    "*/*"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "track"
+                ],
+                "summary": "Track an OTX (Origin transaction) status.",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Tracking Id",
+                        "name": "trackingId",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        }
+    },
+    "definitions": {
+        "api.ErrResp": {
+            "type": "object",
+            "properties": {
+                "message": {
+                    "type": "string"
+                },
+                "ok": {
+                    "type": "boolean"
+                }
+            }
+        },
+        "api.H": {
+            "type": "object",
+            "additionalProperties": {}
+        },
+        "api.OkResp": {
+            "type": "object",
+            "properties": {
+                "ok": {
+                    "type": "boolean"
+                },
+                "result": {
+                    "$ref": "#/definitions/api.H"
+                }
+            }
         }
     }
 }`
@@ -59,6 +303,8 @@ var SwaggerInfo = &swag.Spec{
 	Description:      "Interact with CIC Custodial API",
 	InfoInstanceName: "swagger",
 	SwaggerTemplate:  docTemplate,
+	LeftDelim:        "{{",
+	RightDelim:       "}}",
 }
 
 func init() {

docs/swagger.json

@@ -17,7 +17,7 @@
     },
     "basePath": "/api",
     "paths": {
-        "/": {
+        "/account/create": {
             "post": {
                 "description": "Create a new custodial account.",
                 "consumes": [
@@ -26,17 +26,261 @@
                 "produces": [
                     "application/json"
                 ],
+                "tags": [
+                    "account"
+                ],
                 "summary": "Create a new custodial account.",
                 "responses": {
                     "200": {
                         "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        },
+        "/account/status/{address}": {
+            "get": {
+                "description": "Return network balance and nonce.",
+                "consumes": [
+                    "*/*"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "network"
+                ],
+                "summary": "Get an address's network balance and nonce.",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Account Public Key",
+                        "name": "address",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        },
+        "/sign/transfer": {
+            "post": {
+                "description": "Sign and dispatch a transfer request.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "network"
+                ],
+                "summary": "Sign and dispatch transfer request.",
+                "parameters": [
+                    {
+                        "description": "Sign Transfer Request",
+                        "name": "signTransferRequest",
+                        "in": "body",
+                        "required": true,
                         "schema": {
                             "type": "object",
-                            "additionalProperties": true
+                            "properties": {
+                                "amount": {
+                                    "type": "integer"
+                                },
+                                "from": {
+                                    "type": "string"
+                                },
+                                "to": {
+                                    "type": "string"
+                                },
+                                "voucherAddress": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        },
+        "/sign/transferAuth": {
+            "post": {
+                "description": "Sign and dispatch a transfer authorization (approve) request.",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "network"
+                ],
+                "summary": "Sign and dispatch a transfer authorization (approve) request.",
+                "parameters": [
+                    {
+                        "description": "Sign Transfer Authorization (approve) Request",
+                        "name": "signTransferAuthorzationRequest",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "amount": {
+                                    "type": "integer"
+                                },
+                                "authorizedAddress": {
+                                    "type": "string"
+                                },
+                                "authorizer": {
+                                    "type": "string"
+                                },
+                                "voucherAddress": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    }
+                }
+            }
+        },
+        "/track/{trackingId}": {
+            "get": {
+                "description": "Track an OTX (Origin transaction) status.",
+                "consumes": [
+                    "*/*"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "track"
+                ],
+                "summary": "Track an OTX (Origin transaction) status.",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Tracking Id",
+                        "name": "trackingId",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/api.OkResp"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/api.ErrResp"
                         }
                     }
                 }
             }
         }
+    },
+    "definitions": {
+        "api.ErrResp": {
+            "type": "object",
+            "properties": {
+                "message": {
+                    "type": "string"
+                },
+                "ok": {
+                    "type": "boolean"
+                }
+            }
+        },
+        "api.H": {
+            "type": "object",
+            "additionalProperties": {}
+        },
+        "api.OkResp": {
+            "type": "object",
+            "properties": {
+                "ok": {
+                    "type": "boolean"
+                },
+                "result": {
+                    "$ref": "#/definitions/api.H"
+                }
+            }
+        }
     }
 }

docs/swagger.yaml

@@ -1,4 +1,22 @@
 basePath: /api
+definitions:
+  api.ErrResp:
+    properties:
+      message:
+        type: string
+      ok:
+        type: boolean
+    type: object
+  api.H:
+    additionalProperties: {}
+    type: object
+  api.OkResp:
+    properties:
+      ok:
+        type: boolean
+      result:
+        $ref: '#/definitions/api.H'
+    type: object
 info:
   contact:
     email: devops@grassecon.org
@@ -12,7 +30,7 @@ info:
   title: CIC Custodial API
   version: "1.0"
 paths:
-  /:
+  /account/create:
     post:
       consumes:
       - '*/*'
@@ -23,7 +41,148 @@ paths:
         "200":
           description: OK
           schema:
-            additionalProperties: true
-            type: object
+            $ref: '#/definitions/api.OkResp'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/api.ErrResp'
       summary: Create a new custodial account.
+      tags:
+      - account
+  /account/status/{address}:
+    get:
+      consumes:
+      - '*/*'
+      description: Return network balance and nonce.
+      parameters:
+      - description: Account Public Key
+        in: path
+        name: address
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/api.OkResp'
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+      summary: Get an address's network balance and nonce.
+      tags:
+      - network
+  /sign/transfer:
+    post:
+      consumes:
+      - application/json
+      description: Sign and dispatch a transfer request.
+      parameters:
+      - description: Sign Transfer Request
+        in: body
+        name: signTransferRequest
+        required: true
+        schema:
+          properties:
+            amount:
+              type: integer
+            from:
+              type: string
+            to:
+              type: string
+            voucherAddress:
+              type: string
+          type: object
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/api.OkResp'
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+      summary: Sign and dispatch transfer request.
+      tags:
+      - network
+  /sign/transferAuth:
+    post:
+      consumes:
+      - application/json
+      description: Sign and dispatch a transfer authorization (approve) request.
+      parameters:
+      - description: Sign Transfer Authorization (approve) Request
+        in: body
+        name: signTransferAuthorzationRequest
+        required: true
+        schema:
+          properties:
+            amount:
+              type: integer
+            authorizedAddress:
+              type: string
+            authorizer:
+              type: string
+            voucherAddress:
+              type: string
+          type: object
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/api.OkResp'
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+      summary: Sign and dispatch a transfer authorization (approve) request.
+      tags:
+      - network
+  /track/{trackingId}:
+    get:
+      consumes:
+      - '*/*'
+      description: Track an OTX (Origin transaction) status.
+      parameters:
+      - description: Tracking Id
+        in: path
+        name: trackingId
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/api.OkResp'
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/api.ErrResp'
+      summary: Track an OTX (Origin transaction) status.
+      tags:
+      - track
 swagger: "2.0"

go.mod

@@ -3,28 +3,27 @@ module github.com/grassrootseconomics/cic-custodial
 go 1.20
 
 require (
-	github.com/VictoriaMetrics/metrics v1.23.1
-	github.com/bsm/redislock v0.9.1
+	github.com/VictoriaMetrics/metrics v1.24.0
+	github.com/bsm/redislock v0.9.3
 	github.com/celo-org/celo-blockchain v1.7.2
 	github.com/georgysavva/scany/v2 v2.0.0
-	github.com/go-playground/validator/v10 v10.12.0
+	github.com/go-playground/validator/v10 v10.14.1
 	github.com/google/uuid v1.3.0
-	github.com/grassrootseconomics/celoutils v1.2.1
+	github.com/grassrootseconomics/celoutils v1.4.0
 	github.com/grassrootseconomics/w3-celo-patch v0.2.0
 	github.com/hibiken/asynq v0.24.0
-	github.com/jackc/pgx/v5 v5.3.1
-	github.com/jackc/tern/v2 v2.0.1
+	github.com/jackc/pgx/v5 v5.4.0
+	github.com/jackc/tern/v2 v2.1.1
 	github.com/knadh/goyesql/v2 v2.2.0
 	github.com/knadh/koanf/parsers/toml v0.1.0
 	github.com/knadh/koanf/providers/env v0.1.0
 	github.com/knadh/koanf/providers/file v0.1.0
-	github.com/knadh/koanf/v2 v2.0.0
+	github.com/knadh/koanf/v2 v2.0.1
 	github.com/labstack/echo/v4 v4.10.2
-	github.com/labstack/gommon v0.4.0
-	github.com/nats-io/nats.go v1.25.0
-	github.com/redis/go-redis/v9 v9.0.2
+	github.com/nats-io/nats.go v1.27.1
+	github.com/redis/go-redis/v9 v9.0.5
 	github.com/swaggo/echo-swagger v1.4.0
-	github.com/swaggo/swag v1.8.12
+	github.com/swaggo/swag v1.16.1
 	github.com/zerodha/logf v0.5.5
 )
 
@@ -51,6 +50,7 @@ require (
 	github.com/deckarep/golang-set v1.8.0 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.19.6 // indirect
@@ -76,8 +76,10 @@ require (
 	github.com/jackc/puddle/v2 v2.2.0 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/klauspost/compress v1.16.5 // indirect
 	github.com/knadh/koanf/maps v0.1.1 // indirect
-	github.com/leodido/go-urn v1.2.2 // indirect
+	github.com/labstack/gommon v0.4.0 // indirect
+	github.com/leodido/go-urn v1.2.4 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.17 // indirect
@@ -108,11 +110,11 @@ require (
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/valyala/histogram v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
-	golang.org/x/crypto v0.7.0 // indirect
-	golang.org/x/net v0.8.0 // indirect
+	golang.org/x/crypto v0.10.0 // indirect
+	golang.org/x/net v0.10.0 // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.6.0 // indirect
-	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/text v0.10.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.7.0 // indirect
 	google.golang.org/protobuf v1.28.0 // indirect

go.sum

@@ -54,8 +54,8 @@ github.com/StackExchange/wmi v0.0.0-20180116203802-5d049714c4a6/go.mod h1:3eOhrU
 github.com/VictoriaMetrics/fastcache v1.6.0/go.mod h1:0qHz5QP0GMX4pfmMA/zt5RgfNuXJrTP0zS7DqpHGGTw=
 github.com/VictoriaMetrics/fastcache v1.12.0 h1:vnVi/y9yKDcD9akmc4NqAoqgQhJrOwUF+j9LTgn4QDE=
 github.com/VictoriaMetrics/fastcache v1.12.0/go.mod h1:tjiYeEfYXCqacuvYw/7UoDIeJaNxq6132xHICNP77w8=
-github.com/VictoriaMetrics/metrics v1.23.1 h1:/j8DzeJBxSpL2qSIdqnRFLvQQhbJyJbbEi22yMm7oL0=
-github.com/VictoriaMetrics/metrics v1.23.1/go.mod h1:rAr/llLpEnAdTehiNlUxKgnjcOuROSzpw0GvjpEbvFc=
+github.com/VictoriaMetrics/metrics v1.24.0 h1:ILavebReOjYctAGY5QU2F9X0MYvkcrG3aEn2RKa1Zkw=
+github.com/VictoriaMetrics/metrics v1.24.0/go.mod h1:eFT25kvsTidQFHb6U0oa0rTrDRdz4xTYjpL8+UPohys=
 github.com/aead/siphash v1.0.1/go.mod h1:Nywa3cDsYNNK3gaciGTWPwHt0wlpNV15vwmswBAUSII=
 github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -77,12 +77,12 @@ github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/bmizerany/pat v0.0.0-20170815010413-6226ea591a40/go.mod h1:8rLXio+WjiTceGBHIoTvn60HIbs7Hm7bcHjyrSqYB9c=
 github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
-github.com/bsm/ginkgo/v2 v2.5.0 h1:aOAnND1T40wEdAtkGSkvSICWeQ8L3UASX7YVCqQx+eQ=
 github.com/bsm/ginkgo/v2 v2.5.0/go.mod h1:AiKlXPm7ItEHNc/2+OkrNG4E0ITzojb9/xWzvQ9XZ9w=
-github.com/bsm/gomega v1.20.0 h1:JhAwLmtRzXFTx2AkALSLa8ijZafntmhSoU63Ok18Uq8=
+github.com/bsm/ginkgo/v2 v2.7.0 h1:ItPMPH90RbmZJt5GtkcNvIRuGEdwlBItdNVoyzaNQao=
 github.com/bsm/gomega v1.20.0/go.mod h1:JifAceMQ4crZIWYUKrlGcmbN3bqHogVTADMD2ATsbwk=
-github.com/bsm/redislock v0.9.1 h1:uTTZU82xg2PjI8X5T9PGcX/5k1FX3Id7bqkwy1As6c0=
-github.com/bsm/redislock v0.9.1/go.mod h1:ToFoB1xQbOJYG7e2ZBiPXotlhImqWgEa4+u/lLQ1nSc=
+github.com/bsm/gomega v1.26.0 h1:LhQm+AFcgV2M0WyKroMASzAzCAJVpAxQXv4SaI9a69Y=
+github.com/bsm/redislock v0.9.3 h1:osmvugkXGiLDEhzUPdM0EUtKpTEgLLuli4Ky2Z4vx38=
+github.com/bsm/redislock v0.9.3/go.mod h1:Epf7AJLiSFwLCiZcfi6pWFO/8eAYrYpQXFxEDPoDeAk=
 github.com/btcsuite/btcd v0.20.1-beta h1:Ik4hyJqN8Jfyv3S4AGBOmyouMsYE3EdYODkMbQjwPGw=
 github.com/btcsuite/btcd v0.20.1-beta/go.mod h1:wVuoA8VJLEcwgqHBwHmzLRazpKxTv13Px/pDuV7OomQ=
 github.com/btcsuite/btclog v0.0.0-20170628155309-84c8d2346e9f/go.mod h1:TdznJufoqS23FtqVCzL0ZqgP5MqXbb4fg/WgDys70nA=
@@ -165,6 +165,8 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
+github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
 github.com/georgysavva/scany/v2 v2.0.0 h1:RGXqxDv4row7/FYoK8MRXAZXqoWF/NM+NP0q50k3DKU=
 github.com/georgysavva/scany/v2 v2.0.0/go.mod h1:sigOdh+0qb/+aOs3TVhehVT10p8qJL7K/Zhyz8vWo38=
 github.com/getkin/kin-openapi v0.53.0/go.mod h1:7Yn5whZr5kJi6t+kShccXS8ae1APpYTW6yheSwk8Yi4=
@@ -199,8 +201,8 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.12.0 h1:E4gtWgxWxp8YSxExrQFv5BpCahla0PVF2oTTEYaWQGI=
-github.com/go-playground/validator/v10 v10.12.0/go.mod h1:hCAPuzYvKdP33pxWa+2+6AIKXEKqjIUyqsNCtbsSJrA=
+github.com/go-playground/validator/v10 v10.14.1 h1:9c50NUPC30zyuKprjL3vNZ0m5oG+jU0zvx4AqHGnv4k=
+github.com/go-playground/validator/v10 v10.14.1/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-sourcemap/sourcemap v2.1.2+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
@@ -275,8 +277,8 @@ github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/ad
 github.com/graph-gophers/graphql-go v1.3.0/go.mod h1:9CQHMSxwO4MprSdzoIEobiHpoLtHm77vfxsvsIN5Vuc=
 github.com/grassrootseconomics/asynq v0.25.0 h1:2zSz5YwNLu/oCTm/xfNixn86i9aw4zth9Dl0dc2kFEs=
 github.com/grassrootseconomics/asynq v0.25.0/go.mod h1:pe2XOdK1eIbTgTmRFHIYl75lvVuTPJxZq2T9Ocz/+2s=
-github.com/grassrootseconomics/celoutils v1.2.1 h1:ndM4h7Df0d57m2kdRXRStrnunqOL61wQ51rnOanX1KI=
-github.com/grassrootseconomics/celoutils v1.2.1/go.mod h1:Uo5YRy6AGLAHDZj9jaOI+AWoQ1H3L0v79728pPMkm9Q=
+github.com/grassrootseconomics/celoutils v1.4.0 h1:AJNKiOpfnQqZ3kRxeUlhWH/zlDDjhtbs/OzAMb5zU4A=
+github.com/grassrootseconomics/celoutils v1.4.0/go.mod h1:Uo5YRy6AGLAHDZj9jaOI+AWoQ1H3L0v79728pPMkm9Q=
 github.com/grassrootseconomics/w3-celo-patch v0.2.0 h1:YqibbPzX0tQKmxU1nUGzThPKk/fiYeYZY6Aif3eyu8U=
 github.com/grassrootseconomics/w3-celo-patch v0.2.0/go.mod h1:WhBXNzNIvHmS6B2hAeShs56oa9Azb4jQSrOMKuMdBWw=
 github.com/hashicorp/go-bexpr v0.1.10/go.mod h1:oxlubA2vC/gFVfX1A6JGp7ls7uCDlfJn732ehYYg+g0=
@@ -320,12 +322,12 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.3.1 h1:Fcr8QJ1ZeLi5zsPZqQeUZhNhxfkkKBOgJuYkJHoBOtU=
-github.com/jackc/pgx/v5 v5.3.1/go.mod h1:t3JDKnCBlYIc0ewLF0Q7B8MXmoIaBOZj/ic7iHozM/8=
+github.com/jackc/pgx/v5 v5.4.0 h1:BSr+GCm4N6QcgIwv0DyTFHK9ugfEFF9DzSbbzxOiXU0=
+github.com/jackc/pgx/v5 v5.4.0/go.mod h1:q6iHT8uDNXWiFNOlRqJzBTaSH3+2xCXkokxHZC5qWFY=
 github.com/jackc/puddle/v2 v2.2.0 h1:RdcDk92EJBuBS55nQMMYFXTxwstHug4jkhT5pq8VxPk=
 github.com/jackc/puddle/v2 v2.2.0/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jackc/tern/v2 v2.0.1 h1:2J05jlmYFsNQe9rGsqoNs0+6eDm3iJns8RQb6DJl1V8=
-github.com/jackc/tern/v2 v2.0.1/go.mod h1:4cpqN/grjWYeRWcKXah5YGoviJKJuoqNLoORKLumoG0=
+github.com/jackc/tern/v2 v2.1.1 h1:qDo41wTtDHrTgkN7lhcoMQ6oiAWqiD8xKgslxyoKHNQ=
+github.com/jackc/tern/v2 v2.1.1/go.mod h1:xnRalAguscgir18eW/wscn/QTEoWwFqrpW+5S+CREWM=
 github.com/jackpal/go-nat-pmp v1.0.2-0.20160603034137-1fa385a6f458/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
 github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
@@ -350,7 +352,8 @@ github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQL
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kkdai/bstream v0.0.0-20161212061736-f391b8402d23/go.mod h1:J+Gs4SYgM6CZQHDETBtE9HaSEkGmuNXF86RwHhHUvq4=
 github.com/klauspost/compress v1.4.0/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.15.15 h1:EF27CXIuDsYJ6mmvtBRlEuB2UVOqHG1tAXgZ7yIO+lw=
+github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
+github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/klauspost/cpuid v0.0.0-20170728055534-ae7887de9fa5/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/crc32 v0.0.0-20161016154125-cb6bfca970f6/go.mod h1:+ZoRqAPRLkC4NPOvfYeR5KNOrY6TD+/sAC3HXPZgDYg=
 github.com/klauspost/pgzip v1.0.2-0.20170402124221-0bf5dcad4ada/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -364,8 +367,8 @@ github.com/knadh/koanf/providers/env v0.1.0 h1:LqKteXqfOWyx5Ab9VfGHmjY9BvRXi+clw
 github.com/knadh/koanf/providers/env v0.1.0/go.mod h1:RE8K9GbACJkeEnkl8L/Qcj8p4ZyPXZIQ191HJi44ZaQ=
 github.com/knadh/koanf/providers/file v0.1.0 h1:fs6U7nrV58d3CFAFh8VTde8TM262ObYf3ODrc//Lp+c=
 github.com/knadh/koanf/providers/file v0.1.0/go.mod h1:rjJ/nHQl64iYCtAW2QQnF0eSmDEX/YZ/eNFj5yR6BvA=
-github.com/knadh/koanf/v2 v2.0.0 h1:XPQ5ilNnwnNaHrfQ1YpTVhUAjcGHnEKA+lRpipQv02Y=
-github.com/knadh/koanf/v2 v2.0.0/go.mod h1:ZeiIlIDXTE7w1lMT6UVcNiRAS2/rCeLn/GdLNvY1Dus=
+github.com/knadh/koanf/v2 v2.0.1 h1:1dYGITt1I23x8cfx8ZnldtezdyaZtfAuRtIFOiRzK7g=
+github.com/knadh/koanf/v2 v2.0.1/go.mod h1:ZeiIlIDXTE7w1lMT6UVcNiRAS2/rCeLn/GdLNvY1Dus=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515 h1:T+h1c/A9Gawja4Y9mFVWj2vyii2bbUNDw3kt9VxK2EY=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
@@ -383,8 +386,8 @@ github.com/labstack/gommon v0.3.0/go.mod h1:MULnywXg0yavhxWKc+lOruYdAhDwPK9wf0OL
 github.com/labstack/gommon v0.4.0 h1:y7cvthEAEbU0yHOf4axH8ZG2NH8knB9iNSoTO8dyIk8=
 github.com/labstack/gommon v0.4.0/go.mod h1:uW6kP17uPlLJsD3ijUYn3/M5bAxtlZhMI6m3MFxTMTM=
 github.com/leanovate/gopter v0.2.9/go.mod h1:U2L/78B+KVFIx2VmW6onHJQzXtFb+p5y3y2Sh+Jxxv8=
-github.com/leodido/go-urn v1.2.2 h1:7z68G0FCGvDk646jz1AelTYNYWrTNm0bEcFAo147wt4=
-github.com/leodido/go-urn v1.2.2/go.mod h1:kUaIbLZWttglzwNuG0pgsh5vuV6u2YcGBYz1hIPjtOQ=
+github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
+github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.10.0 h1:Zx5DJFEYQXio93kgXnQ09fXNiUKsqv4OUEu2UtGcB1E=
 github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
@@ -439,8 +442,8 @@ github.com/naoina/toml v0.1.2-0.20170918210437-9fafd6967416/go.mod h1:NBIhNtsFMo
 github.com/nats-io/jwt/v2 v2.3.0 h1:z2mA1a7tIf5ShggOFlR1oBPgd6hGqcDYsISxZByUzdI=
 github.com/nats-io/nats-server/v2 v2.9.14 h1:n2GscWVgXpA14vQSRP/MM1SGi4wyazR9l19/gWxqgXQ=
 github.com/nats-io/nats-server/v2 v2.9.14/go.mod h1:40ZwFm4npKdFBhOdY7rkh3YyI1oI91FzLvlYyB7HfzM=
-github.com/nats-io/nats.go v1.25.0 h1:t5/wCPGciR7X3Mu8QOi4jiJaXaWM8qtkLu4lzGZvYHE=
-github.com/nats-io/nats.go v1.25.0/go.mod h1:D2WALIhz7V8M0pH8Scx8JZXlg6Oqz5VG+nQkK8nJdvg=
+github.com/nats-io/nats.go v1.27.1 h1:OuYnal9aKVSnOzLQIzf7554OXMCG7KbaTkCSBHRcSoo=
+github.com/nats-io/nats.go v1.27.1/go.mod h1:XpbWUlOElGwTYbMR7imivs7jJj9GtK7ypv321Wp6pjc=
 github.com/nats-io/nkeys v0.4.4 h1:xvBJ8d69TznjcQl9t6//Q5xXuVhyYiSos6RPtvQNTwA=
 github.com/nats-io/nkeys v0.4.4/go.mod h1:XUkxdLPTufzlihbamfzQ7mw/VGx6ObUs+0bN5sNvt64=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
@@ -495,8 +498,8 @@ github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40T
 github.com/prometheus/tsdb v0.10.0 h1:If5rVCMTp6W2SiRAQFlbpJNgVlgMEd+U2GZckwK38ic=
 github.com/prometheus/tsdb v0.10.0/go.mod h1:oi49uRhEe9dPUTlS3JRZOwJuVi6tmh10QSgwXEyGCt4=
 github.com/redis/go-redis/v9 v9.0.1/go.mod h1:/xDTe9EF1LM61hek62Poq2nzQSGj0xSrEtEHbBQevps=
-github.com/redis/go-redis/v9 v9.0.2 h1:BA426Zqe/7r56kCcvxYLWe1mkaz71LKF77GwgFzSxfE=
-github.com/redis/go-redis/v9 v9.0.2/go.mod h1:/xDTe9EF1LM61hek62Poq2nzQSGj0xSrEtEHbBQevps=
+github.com/redis/go-redis/v9 v9.0.5 h1:CuQcn5HIEeK7BgElubPP8CGtE0KakrnbBSTLjathl5o=
+github.com/redis/go-redis/v9 v9.0.5/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk=
 github.com/retailnext/hllpp v1.0.1-0.20180308014038-101a6d2f8b52/go.mod h1:RDpi1RftBQPUCDRw6SmxeaREsAaRKnOclghuzp/WRzc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.3 h1:utMvzDsuh3suAEnhH0RdHmoPbU648o6CvXxTx4SBMOw=
@@ -508,7 +511,6 @@ github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/rwtodd/Go.Sed v0.0.0-20210816025313-55464686f9ef/go.mod h1:8AEUvGVi2uQ5b24BIhcr0GCcpd/RNAFWaN2CJFrWIIQ=
 github.com/segmentio/kafka-go v0.1.0/go.mod h1:X6itGqS9L4jDletMsxZ7Dz+JFWxM6JHfPOCvTvk+EJo=
 github.com/segmentio/kafka-go v0.2.0/go.mod h1:X6itGqS9L4jDletMsxZ7Dz+JFWxM6JHfPOCvTvk+EJo=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
@@ -544,14 +546,14 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/swaggo/echo-swagger v1.4.0 h1:RCxLKySw1SceHLqnmc41pKyiIeE+OiD7NSI7FUOBlLo=
 github.com/swaggo/echo-swagger v1.4.0/go.mod h1:Wh3VlwjZGZf/LH0s81tz916JokuPG7y/ZqaqnckYqoQ=
 github.com/swaggo/files/v2 v2.0.0 h1:hmAt8Dkynw7Ssz46F6pn8ok6YmGZqHSVLZ+HQM7i0kw=
 github.com/swaggo/files/v2 v2.0.0/go.mod h1:24kk2Y9NYEJ5lHuCra6iVwkMjIekMCaFq/0JQj66kyM=
-github.com/swaggo/swag v1.8.12 h1:pctzkNPu0AlQP2royqX3apjKCQonAnf7KGoxeO4y64w=
-github.com/swaggo/swag v1.8.12/go.mod h1:lNfm6Gg+oAq3zRJQNEMBE66LIJKM44mxFqhEEgy2its=
+github.com/swaggo/swag v1.16.1 h1:fTNRhKstPKxcnoKsytm4sahr8FaYzUcT7i1/3nd/fBg=
+github.com/swaggo/swag v1.16.1/go.mod h1:9/LMvHycG3NFHfR6LwvikHv5iFvmPADQ359cKikGxto=
 github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 h1:epCh84lMvA70Z7CTTCmYQn2CKbY8j86K7/FAIr141uY=
 github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7/go.mod h1:q4W45IWZaF22tdD+VEXcAWRA037jwmWEB5VWYORlTpc=
 github.com/test-go/testify v1.1.4 h1:Tf9lntrKUMHiXQ07qBScBTSA0dhYQlu83hswqelv1iE=
@@ -603,8 +605,8 @@ golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
+golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -661,8 +663,8 @@ golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -731,8 +733,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
+golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -746,8 +748,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
+golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

internal/api/account.go

@@ -13,12 +13,14 @@ import (
 )
 
 // HandleAccountCreate godoc
-// @Summary Create a new custodial account.
-// @Description Create a new custodial account.
-// @Accept */*
-// @Produce json
-// @Success 200 {object} map[string]interface{}
-// @Router / [post]
+//	@Summary		Create a new custodial account.
+//	@Description	Create a new custodial account.
+//	@Tags			account
+//	@Accept			*/*
+//	@Produce		json
+//	@Success		200	{object}	OkResp
+//	@Failure		500	{object}	ErrResp
+//	@Router			/account/create [post]
 func HandleAccountCreate(cu *custodial.Custodial) func(echo.Context) error {
 	return func(c echo.Context) error {
 		generatedKeyPair, err := keypair.Generate()

internal/api/network.go

@@ -12,6 +12,17 @@ import (
 	"github.com/labstack/echo/v4"
 )
 
+// HandleNetworkAccountStatus godoc
+//	@Summary		Get an address's network balance and nonce.
+//	@Description	Return network balance and nonce.
+//	@Tags			network
+//	@Accept			*/*
+//	@Produce		json
+//	@Param			address	path		string	true	"Account Public Key"
+//	@Success		200		{object}	OkResp
+//	@Failure		400		{object}	ErrResp
+//	@Failure		500		{object}	ErrResp
+//	@Router			/account/status/{address} [get]
 func HandleNetworkAccountStatus(cu *custodial.Custodial) func(echo.Context) error {
 	return func(c echo.Context) error {
 		var (

internal/api/sign_transfer.go

@@ -12,15 +12,18 @@ import (
 	"github.com/labstack/echo/v4"
 )
 
-// HandleSignTransfer route.
-// POST: /api/sign/transfer
-// JSON Body:
-// from -> ETH address
-// to -> ETH address
-// voucherAddress -> ETH address
-// amount -> int (6 d.p. precision)
-// e.g. 1000000 = 1 VOUCHER
-// Returns the task id.
+// HandleSignTransfer godoc
+//
+//	@Summary		Sign and dispatch transfer request.
+//	@Description	Sign and dispatch a transfer request.
+//	@Tags			network
+//	@Accept			json
+//	@Produce		json
+//	@Param			signTransferRequest	body		object{from=string,to=string,voucherAddress=string,amount=uint64}	true	"Sign Transfer Request"
+//	@Success		200					{object}	OkResp
+//	@Failure		400					{object}	ErrResp
+//	@Failure		500					{object}	ErrResp
+//	@Router			/sign/transfer [post]
 func HandleSignTransfer(cu *custodial.Custodial) func(echo.Context) error {
 	return func(c echo.Context) error {
 		var (
@@ -28,7 +31,7 @@ func HandleSignTransfer(cu *custodial.Custodial) func(echo.Context) error {
 				From           string `json:"from" validate:"required,eth_addr_checksum"`
 				To             string `json:"to" validate:"required,eth_addr_checksum"`
 				VoucherAddress string `json:"voucherAddress" validate:"required,eth_addr_checksum"`
-				Amount         uint64 `json:"amount" validate:"required"`
+				Amount         uint64 `json:"amount" validate:"gt=0"`
 			}
 		)
 
@@ -40,7 +43,7 @@ func HandleSignTransfer(cu *custodial.Custodial) func(echo.Context) error {
 			return err
 		}
 
-		accountActive, gasQuota, err := cu.Store.GetAccountStatus(c.Request().Context(), req.From)
+		accountActive, gasLock, err := cu.Store.GetAccountStatus(c.Request().Context(), req.From)
 		if err != nil {
 			return err
 		}
@@ -52,36 +55,15 @@ func HandleSignTransfer(cu *custodial.Custodial) func(echo.Context) error {
 			})
 		}
 
-		trackingId := uuid.NewString()
-
-		if gasQuota < 1 {
-			gasRefillPayload, err := json.Marshal(task.AccountPayload{
-				PublicKey:  req.From,
-				TrackingId: trackingId,
-			})
-			if err != nil {
-				return err
-			}
-
-			_, err = cu.TaskerClient.CreateTask(
-				c.Request().Context(),
-				tasker.AccountRefillGasTask,
-				tasker.DefaultPriority,
-				&tasker.Task{
-					Id:      trackingId,
-					Payload: gasRefillPayload,
-				},
-			)
-			if err != nil {
-				return err
-			}
-
+		if gasLock {
 			return c.JSON(http.StatusForbidden, ErrResp{
 				Ok:      false,
-				Message: "Out of gas, refill pending. Try again later.",
+				Message: "Gas lock. Gas balance unavailable. Try again later.",
 			})
 		}
 
+		trackingId := uuid.NewString()
+
 		taskPayload, err := json.Marshal(task.TransferPayload{
 			TrackingId:     trackingId,
 			From:           req.From,

internal/api/sign_transfer_auth.go

@@ -0,0 +1,107 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/google/uuid"
+	"github.com/grassrootseconomics/cic-custodial/internal/custodial"
+	"github.com/grassrootseconomics/cic-custodial/internal/tasker"
+	"github.com/grassrootseconomics/cic-custodial/internal/tasker/task"
+	"github.com/labstack/echo/v4"
+)
+
+// Max 10k vouchers per approval session
+const approvalSafetyLimit = 10000 * 1000000
+
+// HandleSignTransferAuthorization godoc
+//
+//	@Summary		Sign and dispatch a transfer authorization (approve) request.
+//	@Description	Sign and dispatch a transfer authorization (approve) request.
+//	@Tags			network
+//	@Accept			json
+//	@Produce		json
+//	@Param			signTransferAuthorzationRequest	body		object{amount=uint64,authorizer=string,authorizedAddress=string,voucherAddress=string}	true	"Sign Transfer Authorization (approve) Request"
+//	@Success		200								{object}	OkResp
+//	@Failure		400								{object}	ErrResp
+//	@Failure		500								{object}	ErrResp
+//	@Router			/sign/transferAuth [post]
+func HandleSignTranserAuthorization(cu *custodial.Custodial) func(echo.Context) error {
+	return func(c echo.Context) error {
+		var (
+			req struct {
+				Amount            uint64 `json:"amount" validate:"gte=0"`
+				Authorizer        string `json:"authorizer" validate:"required,eth_addr_checksum"`
+				AuthorizedAddress string `json:"authorizedAddress" validate:"required,eth_addr_checksum"`
+				VoucherAddress    string `json:"voucherAddress" validate:"required,eth_addr_checksum"`
+			}
+		)
+
+		if err := c.Bind(&req); err != nil {
+			return NewBadRequestError(ErrInvalidJSON)
+		}
+
+		if err := c.Validate(req); err != nil {
+			return err
+		}
+
+		accountActive, gasLock, err := cu.Store.GetAccountStatus(c.Request().Context(), req.Authorizer)
+		if err != nil {
+			return err
+		}
+
+		if req.Amount > approvalSafetyLimit {
+			return c.JSON(http.StatusForbidden, ErrResp{
+				Ok:      false,
+				Message: "Approval amount per session exceeds 10k.",
+			})
+		}
+
+		if !accountActive {
+			return c.JSON(http.StatusForbidden, ErrResp{
+				Ok:      false,
+				Message: "Account pending activation. Try again later.",
+			})
+		}
+
+		if gasLock {
+			return c.JSON(http.StatusForbidden, ErrResp{
+				Ok:      false,
+				Message: "Gas lock. Gas balance unavailable. Try again later.",
+			})
+		}
+
+		trackingId := uuid.NewString()
+
+		taskPayload, err := json.Marshal(task.TransferAuthPayload{
+			TrackingId:        trackingId,
+			Amount:            req.Amount,
+			Authorizer:        req.Authorizer,
+			AuthorizedAddress: req.AuthorizedAddress,
+			VoucherAddress:    req.VoucherAddress,
+		})
+		if err != nil {
+			return err
+		}
+
+		_, err = cu.TaskerClient.CreateTask(
+			c.Request().Context(),
+			tasker.SignTransferTaskAuth,
+			tasker.DefaultPriority,
+			&tasker.Task{
+				Id:      trackingId,
+				Payload: taskPayload,
+			},
+		)
+		if err != nil {
+			return err
+		}
+
+		return c.JSON(http.StatusOK, OkResp{
+			Ok: true,
+			Result: H{
+				"trackingId": trackingId,
+			},
+		})
+	}
+}

internal/api/swagger.go

@@ -1,15 +1,15 @@
 package api
 
-// @title CIC Custodial API
-// @version 1.0
-// @description Interact with CIC Custodial API
-// @termsOfService https://grassecon.org/pages/terms-and-conditions.html
+//	@title			CIC Custodial API
+//	@version		1.0
+//	@description	Interact with CIC Custodial API
+//	@termsOfService	https://grassecon.org/pages/terms-and-conditions.html
 
-// @contact.name API Support
-// @contact.url https://grassecon.org/pages/contact-us
-// @contact.email devops@grassecon.org
+//	@contact.name	API Support
+//	@contact.url	https://grassecon.org/pages/contact-us
+//	@contact.email	devops@grassecon.org
 
-// @license.name AGPL-3.0
-// @license.url https://www.gnu.org/licenses/agpl-3.0.en.html
+//	@license.name	AGPL-3.0
+//	@license.url	https://www.gnu.org/licenses/agpl-3.0.en.html
 
-// @BasePath /api
+//	@BasePath	/api

internal/api/track.go

@@ -7,11 +7,17 @@ import (
 	"github.com/labstack/echo/v4"
 )
 
-// HandleTxStatus route.
-// GET: /api/track/:trackingId
-// Route param:
-// trackingId -> tracking UUID
-// Returns array of tx status.
+// HandleTrackTx godoc
+//	@Summary		Track an OTX (Origin transaction) status.
+//	@Description	Track an OTX (Origin transaction) status.
+//	@Tags			track
+//	@Accept			*/*
+//	@Produce		json
+//	@Param			trackingId	path		string	true	"Tracking Id"
+//	@Success		200			{object}	OkResp
+//	@Failure		400			{object}	ErrResp
+//	@Failure		500			{object}	ErrResp
+//	@Router			/track/{trackingId} [get]
 func HandleTrackTx(cu *custodial.Custodial) func(echo.Context) error {
 	return func(c echo.Context) error {
 		var (

internal/custodial/abis.go

@@ -3,6 +3,7 @@ package custodial
 import "github.com/grassrootseconomics/w3-celo-patch"
 
 const (
+	Approve      = "approve"
 	Check        = "check"
 	GiveTo       = "giveTo"
 	MintTo       = "mintTo"
@@ -16,12 +17,12 @@ const (
 // Any relevant function signature that will be used by the custodial system can be defined here.
 func initAbis() map[string]*w3.Func {
 	return map[string]*w3.Func{
-		Check:        w3.MustNewFunc("check(address)", "bool"),
-		GiveTo:       w3.MustNewFunc("giveTo(address)", "uint256"),
-		MintTo:       w3.MustNewFunc("mintTo(address, uint256)", "bool"),
-		NextTime:     w3.MustNewFunc("nextTime(address)", "uint256"),
-		Register:     w3.MustNewFunc("register(address)", ""),
-		Transfer:     w3.MustNewFunc("transfer(address,uint256)", "bool"),
-		TransferFrom: w3.MustNewFunc("transferFrom(address, address, uint256)", "bool"),
+		Approve:  w3.MustNewFunc("approve(address, uint256)", "bool"),
+		Check:    w3.MustNewFunc("check(address)", "bool"),
+		GiveTo:   w3.MustNewFunc("giveTo(address)", "uint256"),
+		MintTo:   w3.MustNewFunc("mintTo(address, uint256)", "bool"),
+		NextTime: w3.MustNewFunc("nextTime(address)", "uint256"),
+		Register: w3.MustNewFunc("register(address)", ""),
+		Transfer: w3.MustNewFunc("transfer(address,uint256)", "bool"),
 	}
 }

internal/custodial/custodial.go

@@ -3,6 +3,7 @@ package custodial
 import (
 	"context"
 	"crypto/ecdsa"
+	"time"
 
 	"github.com/bsm/redislock"
 	"github.com/celo-org/celo-blockchain/common"
@@ -13,14 +14,16 @@ import (
 	"github.com/grassrootseconomics/cic-custodial/internal/tasker"
 	"github.com/grassrootseconomics/cic-custodial/pkg/util"
 	"github.com/grassrootseconomics/w3-celo-patch"
-	"github.com/labstack/gommon/log"
 	"github.com/redis/go-redis/v9"
+	"github.com/zerodha/logf"
 )
 
 type (
 	Opts struct {
+		ApprovalTimeout  time.Duration
 		CeloProvider     *celoutils.Provider
 		LockProvider     *redislock.Client
+		Logg             logf.Logger
 		Noncestore       nonce.Noncestore
 		Store            store.Store
 		RedisClient      *redis.Client
@@ -31,9 +34,11 @@ type (
 	}
 
 	Custodial struct {
+		ApprovalTimeout  time.Duration
 		Abis             map[string]*w3.Func
 		CeloProvider     *celoutils.Provider
 		LockProvider     *redislock.Client
+		Logg             logf.Logger
 		Noncestore       nonce.Noncestore
 		Store            store.Store
 		RedisClient      *redis.Client
@@ -50,24 +55,28 @@ func NewCustodial(o Opts) (*Custodial, error) {
 
 	registryMap, err := o.CeloProvider.RegistryMap(ctx, celoutils.HexToAddress(o.RegistryAddress))
 	if err != nil {
-		log.Errorf("err: %v", err)
+		o.Logg.Error("custodial: critical error loading contracts from registry: %v", err)
 		return nil, err
 	}
 
-	_, err = o.Noncestore.Peek(ctx, o.SystemPublicKey)
+	systemNonce, err := o.Noncestore.Peek(ctx, o.SystemPublicKey)
 	if err != nil {
 		return nil, err
 	}
 
+	o.Logg.Info("custodial: loaded_nonce", "system_nonce", systemNonce)
+
 	privateKey, err := eth_crypto.HexToECDSA(o.SystemPrivateKey)
 	if err != nil {
 		return nil, err
 	}
 
 	return &Custodial{
+		ApprovalTimeout:  o.ApprovalTimeout,
 		Abis:             initAbis(),
 		CeloProvider:     o.CeloProvider,
 		LockProvider:     o.LockProvider,
+		Logg:             o.Logg,
 		Noncestore:       o.Noncestore,
 		Store:            o.Store,
 		RedisClient:      o.RedisClient,

internal/nonce/redis.go

@@ -37,13 +37,17 @@ func NewRedisNoncestore(o Opts) Noncestore {
 
 func (n *RedisNoncestore) Peek(ctx context.Context, publicKey string) (uint64, error) {
 	nonce, err := n.redis.Client.Get(ctx, publicKey).Uint64()
-	if err == redis.Nil {
-		nonce, err = n.bootstrap(ctx, publicKey)
-		if err != nil {
+	if err != nil {
+		if err == redis.Nil {
+			nonce, err = n.bootstrap(ctx, publicKey)
+			if err != nil {
+				return 0, err
+			}
+
+			return nonce, nil
+		} else {
 			return 0, err
 		}
-	} else if err != nil {
-		return 0, err
 	}
 
 	return nonce, nil
@@ -55,13 +59,15 @@ func (n *RedisNoncestore) Acquire(ctx context.Context, publicKey string) (uint64
 	)
 
 	nonce, err := n.redis.Client.Get(ctx, publicKey).Uint64()
-	if err == redis.Nil {
-		nonce, err = n.bootstrap(ctx, publicKey)
-		if err != nil {
+	if err != nil {
+		if err == redis.Nil {
+			nonce, err = n.bootstrap(ctx, publicKey)
+			if err != nil {
+				return 0, err
+			}
+		} else {
 			return 0, err
 		}
-	} else if err != nil {
-		return 0, err
 	}
 
 	err = n.redis.Client.Incr(ctx, publicKey).Err()

internal/store/account.go

@@ -22,10 +22,10 @@ func (s *PgStore) ActivateAccount(
 func (s *PgStore) GetAccountStatus(
 	ctx context.Context,
 	publicAddress string,
-) (bool, int, error) {
+) (bool, bool, error) {
 	var (
 		accountActive bool
-		gasQuota      int
+		gasLock       bool
 	)
 
 	if err := s.db.QueryRow(
@@ -34,21 +34,21 @@ func (s *PgStore) GetAccountStatus(
 		publicAddress,
 	).Scan(
 		&accountActive,
-		&gasQuota,
+		&gasLock,
 	); err != nil {
-		return false, 0, err
+		return false, false, err
 	}
 
-	return accountActive, gasQuota, nil
+	return accountActive, gasLock, nil
 }
 
-func (s *PgStore) DecrGasQuota(
+func (s *PgStore) GasLock(
 	ctx context.Context,
 	publicAddress string,
 ) error {
 	if _, err := s.db.Exec(
 		ctx,
-		s.queries.DecrGasQuota,
+		s.queries.GasLock,
 		publicAddress,
 	); err != nil {
 		return err
@@ -57,13 +57,13 @@ func (s *PgStore) DecrGasQuota(
 	return nil
 }
 
-func (s *PgStore) ResetGasQuota(
+func (s *PgStore) GasUnlock(
 	ctx context.Context,
 	publicAddress string,
 ) error {
 	if _, err := s.db.Exec(
 		ctx,
-		s.queries.ResetGasQuota,
+		s.queries.GasUnlock,
 		publicAddress,
 	); err != nil {
 		return err

internal/store/otx.go

@@ -22,7 +22,7 @@ type (
 		GasPrice      *big.Int
 		Nonce         uint64
 	}
-	txStatus struct {
+	TxStatus struct {
 		CreatedAt     time.Time `db:"created_at" json:"createdAt"`
 		Status        string    `db:"status" json:"status"`
 		TransferValue uint64    `db:"transfer_value" json:"transferValue"`
@@ -85,9 +85,9 @@ func (s *PgStore) GetNextNonce(
 func (s *PgStore) GetTxStatus(
 	ctx context.Context,
 	trackingId string,
-) (txStatus, error) {
+) (TxStatus, error) {
 	var (
-		tx txStatus
+		tx TxStatus
 	)
 
 	rows, err := s.db.Query(

internal/store/store.go

@@ -22,15 +22,15 @@ type (
 		// Otx related actions.
 		CreateOtx(context.Context, Otx) (uint, error)
 		GetNextNonce(context.Context, string) (uint64, error)
-		GetTxStatus(context.Context, string) (txStatus, error)
+		GetTxStatus(context.Context, string) (TxStatus, error)
 		CreateDispatchStatus(context.Context, uint, enum.OtxStatus) error
 		UpdateDispatchStatus(context.Context, bool, string, uint64) error
 		// Account related actions.
 		ActivateAccount(context.Context, string) error
-		GetAccountStatus(context.Context, string) (bool, int, error)
+		GetAccountStatus(context.Context, string) (bool, bool, error)
 		// Gas quota related actions.
-		DecrGasQuota(context.Context, string) error
-		ResetGasQuota(context.Context, string) error
+		GasLock(context.Context, string) error
+		GasUnlock(context.Context, string) error
 	}
 
 	Opts struct {
@@ -57,8 +57,8 @@ type (
 		// Account related queries.
 		ActivateAccount  string `query:"activate-account"`
 		GetAccountStatus string `query:"get-account-status-by-address"`
-		DecrGasQuota     string `query:"decr-gas-quota"`
-		ResetGasQuota    string `query:"reset-gas-quota"`
+		GasLock          string `query:"acc-gas-lock"`
+		GasUnlock        string `query:"acc-gas-unlock"`
 	}
 )
 

internal/sub/handler.go

@@ -45,11 +45,11 @@ func (s *Sub) processEventHandler(ctx context.Context, msg *nats.Msg) error {
 				return err
 			}
 
-			if err := s.cu.Store.ResetGasQuota(ctx, chainEvent.To); err != nil {
+			if err := s.cu.Store.GasUnlock(ctx, chainEvent.To); err != nil {
 				return err
 			}
 		case "CHAIN.gas":
-			if err := s.cu.Store.ResetGasQuota(ctx, chainEvent.To); err != nil {
+			if err := s.cu.Store.GasUnlock(ctx, chainEvent.To); err != nil {
 				return err
 			}
 		}

internal/tasker/task/account_refill_gas.go

@@ -17,10 +17,6 @@ import (
 	"github.com/hibiken/asynq"
 )
 
-const (
-	gasGiveToLimit = 250000
-)
-
 func AccountRefillGasProcessor(cu *custodial.Custodial) func(context.Context, *asynq.Task) error {
 	return func(ctx context.Context, t *asynq.Task) error {
 		var (
@@ -35,16 +31,6 @@ func AccountRefillGasProcessor(cu *custodial.Custodial) func(context.Context, *a
 			return err
 		}
 
-		_, gasQuota, err := cu.Store.GetAccountStatus(ctx, payload.PublicKey)
-		if err != nil {
-			return err
-		}
-
-		// The user has enough gas for atleast 5 more transactions.
-		if gasQuota > 5 {
-			return nil
-		}
-
 		if err := cu.CeloProvider.Client.CallCtx(
 			ctx,
 			eth.CallFunc(
@@ -56,8 +42,8 @@ func AccountRefillGasProcessor(cu *custodial.Custodial) func(context.Context, *a
 			return err
 		}
 
-		// The user already requested funds, there is a cooldown applied.
-		// We can schedule an attempt after the cooldown period has passed.
+		// The user recently requested funds, there is a cooldown applied.
+		// We can schedule an attempt after the cooldown period has passed + 10 seconds.
 		if nextTime.Int64() > time.Now().Unix() {
 			_, err = cu.TaskerClient.CreateTask(
 				ctx,
@@ -66,7 +52,7 @@ func AccountRefillGasProcessor(cu *custodial.Custodial) func(context.Context, *a
 				&tasker.Task{
 					Payload: t.Payload(),
 				},
-				asynq.ProcessAt(time.Unix(nextTime.Int64(), 0)),
+				asynq.ProcessAt(time.Unix(nextTime.Int64()+10, 0)),
 			)
 			if err != nil {
 				return err
@@ -130,6 +116,7 @@ func AccountRefillGasProcessor(cu *custodial.Custodial) func(context.Context, *a
 				InputData:       input,
 				GasFeeCap:       celoutils.SafeGasFeeCap,
 				GasTipCap:       celoutils.SafeGasTipCap,
+				GasLimit:        uint64(celoutils.SafeGasLimit),
 				Nonce:           nonce,
 			},
 		)

internal/tasker/task/account_register.go

@@ -69,7 +69,7 @@ func AccountRegisterOnChainProcessor(cu *custodial.Custodial) func(context.Conte
 				InputData:       input,
 				GasFeeCap:       celoutils.SafeGasFeeCap,
 				GasTipCap:       celoutils.SafeGasTipCap,
-				GasLimit:        gasLimit,
+				GasLimit:        uint64(celoutils.SafeGasLimit),
 				Nonce:           nonce,
 			},
 		)

internal/tasker/task/sign_transfer.go

@@ -12,6 +12,7 @@ import (
 	"github.com/grassrootseconomics/cic-custodial/internal/store"
 	"github.com/grassrootseconomics/cic-custodial/internal/tasker"
 	"github.com/grassrootseconomics/cic-custodial/pkg/enum"
+	"github.com/grassrootseconomics/w3-celo-patch/module/eth"
 	"github.com/hibiken/asynq"
 )
 
@@ -26,8 +27,9 @@ type TransferPayload struct {
 func SignTransfer(cu *custodial.Custodial) func(context.Context, *asynq.Task) error {
 	return func(ctx context.Context, t *asynq.Task) error {
 		var (
-			err     error
-			payload TransferPayload
+			err            error
+			networkBalance big.Int
+			payload        TransferPayload
 		)
 
 		if err := json.Unmarshal(t.Payload(), &payload); err != nil {
@@ -58,13 +60,16 @@ func SignTransfer(cu *custodial.Custodial) func(context.Context, *asynq.Task) er
 		}
 		defer func() {
 			if err != nil {
-				if nErr := cu.Noncestore.Return(ctx, cu.SystemPublicKey); nErr != nil {
+				if nErr := cu.Noncestore.Return(ctx, payload.From); nErr != nil {
 					err = nErr
 				}
 			}
 		}()
 
-		input, err := cu.Abis[custodial.Transfer].EncodeArgs(celoutils.HexToAddress(payload.To), new(big.Int).SetUint64(payload.Amount))
+		input, err := cu.Abis[custodial.Transfer].EncodeArgs(
+			celoutils.HexToAddress(payload.To),
+			new(big.Int).SetUint64(payload.Amount),
+		)
 		if err != nil {
 			return err
 		}
@@ -76,7 +81,7 @@ func SignTransfer(cu *custodial.Custodial) func(context.Context, *asynq.Task) er
 				InputData:       input,
 				GasFeeCap:       celoutils.SafeGasFeeCap,
 				GasTipCap:       celoutils.SafeGasTipCap,
-				GasLimit:        gasLimit,
+				GasLimit:        uint64(celoutils.SafeGasLimit),
 				Nonce:           nonce,
 			},
 		)
@@ -105,7 +110,10 @@ func SignTransfer(cu *custodial.Custodial) func(context.Context, *asynq.Task) er
 			return err
 		}
 
-		if err := cu.Store.DecrGasQuota(ctx, payload.From); err != nil {
+		if err := cu.CeloProvider.Client.CallCtx(
+			ctx,
+			eth.Balance(celoutils.HexToAddress(payload.From), nil).Returns(&networkBalance),
+		); err != nil {
 			return err
 		}
 
@@ -137,16 +145,22 @@ func SignTransfer(cu *custodial.Custodial) func(context.Context, *asynq.Task) er
 			return err
 		}
 
-		_, err = cu.TaskerClient.CreateTask(
-			ctx,
-			tasker.AccountRefillGasTask,
-			tasker.DefaultPriority,
-			&tasker.Task{
-				Payload: gasRefillPayload,
-			},
-		)
-		if err != nil {
-			return err
+		if !balanceCheck(networkBalance) {
+			if err := cu.Store.GasLock(ctx, payload.From); err != nil {
+				return err
+			}
+
+			_, err = cu.TaskerClient.CreateTask(
+				ctx,
+				tasker.AccountRefillGasTask,
+				tasker.DefaultPriority,
+				&tasker.Task{
+					Payload: gasRefillPayload,
+				},
+			)
+			if err != nil {
+				return err
+			}
 		}
 
 		return nil

internal/tasker/task/sign_transfer_auth.go

@@ -0,0 +1,196 @@
+package task
+
+import (
+	"context"
+	"encoding/json"
+	"math/big"
+
+	"github.com/bsm/redislock"
+	"github.com/celo-org/celo-blockchain/common/hexutil"
+	"github.com/grassrootseconomics/celoutils"
+	"github.com/grassrootseconomics/cic-custodial/internal/custodial"
+	"github.com/grassrootseconomics/cic-custodial/internal/store"
+	"github.com/grassrootseconomics/cic-custodial/internal/tasker"
+	"github.com/grassrootseconomics/cic-custodial/pkg/enum"
+	"github.com/grassrootseconomics/w3-celo-patch/module/eth"
+	"github.com/hibiken/asynq"
+)
+
+type TransferAuthPayload struct {
+	Amount            uint64 `json:"amount"`
+	Authorizer        string `json:"authorizer"`
+	AuthorizedAddress string `json:"authorizedAddress"`
+	TrackingId        string `json:"trackingId"`
+	VoucherAddress    string `json:"voucherAddress"`
+}
+
+func SignTransferAuthorizationProcessor(cu *custodial.Custodial) func(context.Context, *asynq.Task) error {
+	return func(ctx context.Context, t *asynq.Task) error {
+		var (
+			err            error
+			networkBalance big.Int
+			payload        TransferAuthPayload
+		)
+
+		if err := json.Unmarshal(t.Payload(), &payload); err != nil {
+			return err
+		}
+
+		lock, err := cu.LockProvider.Obtain(
+			ctx,
+			lockPrefix+payload.Authorizer,
+			lockTimeout,
+			&redislock.Options{
+				RetryStrategy: lockRetry(),
+			},
+		)
+		if err != nil {
+			return err
+		}
+		defer lock.Release(ctx)
+
+		key, err := cu.Store.LoadPrivateKey(ctx, payload.Authorizer)
+		if err != nil {
+			return err
+		}
+
+		nonce, err := cu.Noncestore.Acquire(ctx, payload.Authorizer)
+		if err != nil {
+			return err
+		}
+		defer func() {
+			if err != nil {
+				if nErr := cu.Noncestore.Return(ctx, payload.Authorizer); nErr != nil {
+					err = nErr
+				}
+			}
+		}()
+
+		input, err := cu.Abis[custodial.Approve].EncodeArgs(
+			celoutils.HexToAddress(payload.AuthorizedAddress),
+			new(big.Int).SetUint64(payload.Amount),
+		)
+		if err != nil {
+			return err
+		}
+
+		builtTx, err := cu.CeloProvider.SignContractExecutionTx(
+			key,
+			celoutils.ContractExecutionTxOpts{
+				ContractAddress: celoutils.HexToAddress(payload.VoucherAddress),
+				InputData:       input,
+				GasFeeCap:       celoutils.SafeGasFeeCap,
+				GasTipCap:       celoutils.SafeGasTipCap,
+				GasLimit:        uint64(celoutils.SafeGasLimit),
+				Nonce:           nonce,
+			},
+		)
+		if err != nil {
+			return err
+		}
+
+		rawTx, err := builtTx.MarshalBinary()
+		if err != nil {
+			return err
+		}
+
+		id, err := cu.Store.CreateOtx(ctx, store.Otx{
+			TrackingId:    payload.TrackingId,
+			Type:          enum.TRANSFER_AUTH,
+			RawTx:         hexutil.Encode(rawTx),
+			TxHash:        builtTx.Hash().Hex(),
+			From:          cu.SystemPublicKey,
+			Data:          hexutil.Encode(builtTx.Data()),
+			GasPrice:      builtTx.GasPrice(),
+			GasLimit:      builtTx.Gas(),
+			TransferValue: 0,
+			Nonce:         builtTx.Nonce(),
+		})
+		if err != nil {
+			return err
+		}
+
+		if err := cu.CeloProvider.Client.CallCtx(
+			ctx,
+			eth.Balance(celoutils.HexToAddress(payload.Authorizer), nil).Returns(&networkBalance),
+		); err != nil {
+			return err
+		}
+
+		disptachJobPayload, err := json.Marshal(TxPayload{
+			OtxId: id,
+			Tx:    builtTx,
+		})
+		if err != nil {
+			return err
+		}
+
+		_, err = cu.TaskerClient.CreateTask(
+			ctx,
+			tasker.DispatchTxTask,
+			tasker.HighPriority,
+			&tasker.Task{
+				Payload: disptachJobPayload,
+			},
+		)
+		if err != nil {
+			return err
+		}
+
+		// Auto-revoke every session (15 min)
+		// Check if already a revoke request
+		if payload.Amount > 0 {
+			taskPayload, err := json.Marshal(TransferAuthPayload{
+				TrackingId:        payload.TrackingId,
+				Amount:            0,
+				Authorizer:        payload.Authorizer,
+				AuthorizedAddress: payload.AuthorizedAddress,
+				VoucherAddress:    payload.VoucherAddress,
+			})
+			if err != nil {
+				return err
+			}
+
+			_, err = cu.TaskerClient.CreateTask(
+				ctx,
+				tasker.SignTransferTaskAuth,
+				tasker.DefaultPriority,
+				&tasker.Task{
+					Payload: taskPayload,
+				},
+				asynq.ProcessIn(cu.ApprovalTimeout),
+			)
+			if err != nil {
+				return err
+			}
+		}
+
+		gasRefillPayload, err := json.Marshal(AccountPayload{
+			PublicKey:  payload.Authorizer,
+			TrackingId: payload.TrackingId,
+		})
+		if err != nil {
+			return err
+		}
+
+		if !balanceCheck(networkBalance) {
+			if err := cu.Store.GasLock(ctx, payload.Authorizer); err != nil {
+				return err
+			}
+
+			_, err = cu.TaskerClient.CreateTask(
+				ctx,
+				tasker.AccountRefillGasTask,
+				tasker.DefaultPriority,
+				&tasker.Task{
+					Payload: gasRefillPayload,
+				},
+			)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}
+}

internal/tasker/task/utils.go

@@ -1,19 +1,27 @@
 package task
 
 import (
+	"math/big"
 	"time"
 
 	"github.com/bsm/redislock"
 )
 
 const (
-	gasLimit = 250000
-
 	lockPrefix     = "lock:"
 	lockRetryDelay = 25 * time.Millisecond
 	lockTimeout    = 1 * time.Second
 )
 
+var (
+	// 20 gwei = max gas price we are willing to pay
+	// 250k = max gas limit
+	// minGasBalanceRequired is optimistic that the immidiate next transfer request will be successful
+	// but the subsequent one could fail (though low probability), therefore we can trigger a gas lock.
+	// Therefore our system wide threshold is 0.01 CELO or 10000000000000000 gas units
+	minGasBalanceRequired = big.NewInt(20000000000 * 250000 * 2)
+)
+
 // lockRetry will at most try to obtain the lock 20 times within ~0.5s.
 // it is expected to prevent immidiate requeue of the task at the expense of more redis calls.
 func lockRetry() redislock.RetryStrategy {
@@ -22,3 +30,8 @@ func lockRetry() redislock.RetryStrategy {
 		20,
 	)
 }
+
+// balanceCheck compares the network balance with the system set min as threshold to execute a transfer.
+func balanceCheck(networkBalance big.Int) bool {
+	return minGasBalanceRequired.Cmp(&networkBalance) < 0
+}

internal/tasker/types.go

@@ -18,6 +18,7 @@ const (
 	AccountRegisterTask  TaskName = "sys:register_account"
 	AccountRefillGasTask TaskName = "sys:refill_gas"
 	SignTransferTask     TaskName = "usr:sign_transfer"
+	SignTransferTaskAuth TaskName = "usr:sign_transfer_auth"
 	DispatchTxTask       TaskName = "rpc:dispatch"
 )
 

migrations/005_remove_gas_quota.sql

@@ -0,0 +1,34 @@
+-- Replace gas_quota with gas_lock which checks network balance threshold 
+DROP TRIGGER IF EXISTS update_gas_quota_timestamp ON gas_quota;
+DROP TABLE IF EXISTS gas_quota_meta;
+DROP TABLE IF EXISTS gas_quota;
+DROP TRIGGER IF EXISTS insert_gas_quota ON keystore;
+DROP FUNCTION IF EXISTS insert_gas_quota;
+
+-- Gas lock table
+-- A gas_locked account indicates gas balance is below threshold awaiting next available top up
+CREATE TABLE IF NOT EXISTS gas_lock (
+    id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    key_id INT REFERENCES keystore(id) NOT NULL,
+    lock BOOLEAN DEFAULT true,
+    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+create function insert_gas_lock()
+    returns trigger
+as $$
+begin
+    insert into gas_lock (key_id) values (new.id);
+    return new;
+end;
+$$ language plpgsql;
+
+create trigger insert_gas_lock
+    after insert on keystore
+for each row
+execute procedure insert_gas_lock();
+
+create trigger update_gas_lock_timestamp
+    before update on gas_lock
+for each row
+execute procedure update_timestamp();

migrations/006_transfer_auth.sql

@@ -0,0 +1 @@
+INSERT INTO otx_tx_type (value) VALUES ('TRANSFER_AUTHORIZATION');

pkg/enum/enum.go

@@ -21,5 +21,6 @@ const (
 
 	ACCOUNT_REGISTER OtxType = "ACCOUNT_REGISTER"
 	REFILL_GAS       OtxType = "REFILL_GAS"
+	TRANSFER_AUTH    OtxType = "TRANSFER_AUTHORIZATION"
 	TRANSFER_VOUCHER OtxType = "TRANSFER_VOUCHER"
 )

queries.sql

@@ -73,27 +73,24 @@ UPDATE otx_dispatch SET "status" = $2, "block" = $3 WHERE otx_dispatch.id = (
 UPDATE keystore SET active = true WHERE public_key=$1
 
 --name: get-account-status-by-address
--- Gets current gas quota for an individual account by address
+-- Gets current gas lock and activation status for an individual account by address
 -- $1: public_key
-SELECT keystore.active, gas_quota.quota FROM keystore
-INNER JOIN gas_quota ON keystore.id = gas_quota.key_id
+SELECT keystore.active, gas_lock.lock FROM keystore
+INNER JOIN gas_lock ON keystore.id = gas_lock.key_id
 WHERE keystore.public_key=$1
 
---name: decr-gas-quota
--- Consumes a gas quota
+--name: acc-gas-lock
+-- Locks an account for gas reasons
 -- $1: public_key
-UPDATE gas_quota SET quota = quota - 1 WHERE key_id = (
+UPDATE gas_lock SET lock = true WHERE key_id = (
     SELECT id FROM keystore
     WHERE public_key=$1    
 )
 
---name: reset-gas-quota
--- Resets the gas quota
--- 25 is the agreed upon quota
+--name: acc-gas-unlock
+-- Unlocks an account for gas reasons
 -- $1: public_key
-UPDATE gas_quota SET quota = gas_quota_meta.default_quota
-FROM gas_quota_meta
-WHERE key_id = (
+UPDATE gas_lock SET lock = false WHERE key_id = (
     SELECT id FROM keystore
     WHERE public_key=$1    
-)
+)