ignore documentation in pr-validation workflow

* Use unstable explorer client

* Clean up stale testruns & logging
- log gw identity key
- better agent testrun logging
- log responses
- change response code for agents

* Better logging on agent

* Testrun stores gw identity key instead of gw pk

* Agent 0.1.3

* Agent 0.1.4

* Sqlx offline query data + clippy

* Compatible with directory v2

* Point to internal deps + rebase + v0.1.5

* self described field not null

* Fix build.rs typo

.github/workflows/cd-docs.yml

@@ -6,20 +6,27 @@ on:
 jobs:
   build:
     runs-on: arc-ubuntu-20.04
+    defaults:
+      run:
+        working-directory: documentation/docs
     steps:
       - uses: actions/checkout@v4
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
       - name: Install pip3
-        run: sudo apt install -y python3-pip  
+        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
         run: sudo pip3 install pandas tabulate
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.0.0
+        with:
+          version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 20
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
@@ -29,33 +36,13 @@ jobs:
         with:
           command: build
           args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false
-# This is the original flow
-#      - name: Build all projects in documentation/ & move to ~/dist/docs/
-#        run: cd documentation && ./build_all_to_dist.sh
 
-# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
-      - name: Save current branch to ~/current_branch
-        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
-      - name: Git pull, reset & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: git pull && git reset --hard && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: cd documentation && ./build_all_to_dist.sh
-
-      - name: Switch to current branch
-        run: git checkout $echo "$(cat ~/current_branch)"
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
-        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
-
-# End of replacemet
-
-      - name: Post process
-        run: cd documentation && ./post_process.sh
-        continue-on-error: false
+      - name: Install project dependencies
+        run: pnpm i
+      - name: Build project
+        run: pnpm run build
+      - name: Move files to /dist/
+        run: ../scripts/move-to-dist.sh
 
       - name: Create Vercel project file
         uses: mobiledevops/secret-to-file-action@v1

.github/workflows/ci-build-vpn-api-wasm.yml

@@ -4,7 +4,7 @@ on:
   pull_request:
     paths:
       - 'common/**'
-      - 'nym-vpn-api/**'
+      - 'nym-credential-proxy/**'
       - '.github/workflows/ci-build-vpn-api-wasm.yml'
 
 jobs:
@@ -38,4 +38,4 @@ jobs:
 
       - name: "Build"
         run: make
-        working-directory: nym-vpn-api/vpn-api-lib-wasm
+        working-directory: nym-credential-proxy/vpn-api-lib-wasm

.github/workflows/ci-build-vpn-api.yml

@@ -1,45 +0,0 @@
-name: ci-build-vpn-api
-
-on:
-  pull_request:
-    paths:
-      - 'common/**'
-      - 'nym-vpn-api/**'
-      - '.github/workspace/ci-build-vpn-api.yml'
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: arc-ubuntu-22.04
-    env:
-      CARGO_TERM_COLOR: always
-      MANIFEST_PATH: "--manifest-path nym-vpn-api/Cargo.toml"
-    steps:
-      - name: Check out repository code
-        uses: actions/checkout@v4
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-          components: rustfmt, clippy
-
-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: ${{ env.MANIFEST_PATH }} --all -- --check
-
-      - name: Build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets
-
-      - name: Clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings

.github/workflows/ci-build.yml

@@ -57,6 +57,12 @@ jobs:
           command: fmt
           args: --all -- --check
 
+      - name: Clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: --workspace --all-targets -- -D warnings
+
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:
@@ -82,9 +88,3 @@ jobs:
         with:
           command: test
           args: --workspace -- --ignored
-
-      - name: Clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --workspace --all-targets -- -D warnings

.github/workflows/ci-contracts-upload-binaries.yml

@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: arc-ubuntu-20.04
+        platform: [ arc-ubuntu-20.04 ]
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-docs.yml

@@ -3,28 +3,35 @@ name: ci-docs
 on:
   workflow_dispatch:
   push:
-    branches-ignore: master
+    branches-ignore: [master]
     paths:
-      - 'documentation/docs/**'
-      - '.github/workflows/ci-docs.yml'
+      - "documentation/docs/**"
+      - ".github/workflows/ci-docs.yml"
 
 jobs:
   build:
     runs-on: arc-ubuntu-20.04
+    defaults:
+      run:
+        working-directory: documentation/docs
     steps:
       - uses: actions/checkout@v4
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
       - name: Install pip3
-        run: sudo apt install -y python3-pip  
+        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
         run: sudo pip3 install pandas tabulate
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.0.0
+        with:
+          version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 20
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
@@ -34,30 +41,13 @@ jobs:
         with:
           command: build
           args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false
 
-# This is the original flow
-#      - name: Build all projects in documentation/ & move to ~/dist/docs/
-#        run: cd documentation && ./build_all_to_dist.sh
-
-# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
-      - name: Save current branch to ~/current_branch
-        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
-      - name: Git pull, reset & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: git pull && git reset --hard && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: cd documentation && ./build_all_to_dist.sh
-
-      - name: Switch to current branch
-        run: git checkout $echo "$(cat ~/current_branch)"
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
-        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
-
-# End of replacemet
+      - name: Install project dependencies
+        run: pnpm i
+      - name: Build project
+        run: pnpm run build
+      - name: Move files to /dist/
+        run: ../scripts/move-to-dist.sh
 
       - name: Deploy branch to CI www
         continue-on-error: true
@@ -68,5 +58,5 @@ jobs:
           SOURCE: "dist/docs/"
           REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
           REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-${{ env.GITHUB_REF_SLUG }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-nextra-${{ env.GITHUB_REF_SLUG }}
           EXCLUDE: "/node_modules/"

.github/workflows/ci-sdk-docs-typescript.yml

@@ -1,79 +0,0 @@
-name: ci-sdk-docs-typescript
-
-on:
-  pull_request:
-    paths:
-      - "sdk/typescript/**"
-      - "wasm/**"
-      - '.github/workflows/ci-sdk-docs-typescript.yml'
-
-jobs:
-  build:
-    runs-on: custom-linux
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install rsync
-        run: sudo apt-get install rsync
-        continue-on-error: true
-      - uses: rlespinasse/github-slug-action@v3.x
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 18.17
-      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-      - name: Setup yarn
-        run: npm install -g yarn
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.20'
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Install wasm-opt
-        uses: ./.github/actions/install-wasm-opt
-        with:
-          version: '116'
-
-      - name: Build branch WASM packages
-        run: make sdk-wasm-build
-
-      - name: Install
-        run: yarn
-      - name: Build
-        run: yarn docs:prod:build
-      - name: Deploy branch to CI www (docs)
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "dist/ts/"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/sdk-ts-docs-${{ env.GITHUB_REF_SLUG }}
-          EXCLUDE: "/dist/, /node_modules/"
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ts-packages
-          NYM_PROJECT_NAME: "sdk-ts-docs"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}/docs/sdk/typescript"
-          NYM_CI_WWW_LOCATION: "sdk-ts-docs-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/hello-world.yaml

@@ -0,0 +1,11 @@
+name: Hello world
+
+on:
+  workflow_dispatch:
+
+jobs:
+  my-job:
+    runs-on: arc-ubuntu-22.04
+    steps:
+      - name: my-step
+        run: echo "Hello World!"

.github/workflows/pr-validation.yml

@@ -4,7 +4,9 @@ on:
   pull_request:
     branches:
       - develop
-      - 'release/**'
+      - "release/**"
+    paths-ignore:
+      - "documentation/**"
     types:
       - labeled
       - unlabeled

.github/workflows/push-credential-proxy.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Credential Proxy container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-credential-proxy"
+  CONTAINER_NAME: "credential-proxy"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-data-observatory.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Data observatory container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-data-observatory"
+  CONTAINER_NAME: "data-observatory"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-agent.yaml

@@ -0,0 +1,56 @@
+name: Build and upload Node Status agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-agent"
+  CONTAINER_NAME: "node-status-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-api.yaml

@@ -33,23 +33,23 @@ jobs:
 
       - name: Check if tag exists
         run: |
-          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
-            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.result }} already exists"
           fi
 
       - name: Remove existing tag if exists
         run: |
-          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
-            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.value }}
-            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.value }}
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
           fi
 
       - name: Create tag
         run: |
-          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.value }} -m "Version ${{ steps.get_version.outputs.value }}"
-          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.value }}
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
 
       - name: BuildAndPushImageOnHarbor
         run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.value }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
           docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-nym-node.yaml

@@ -0,0 +1,55 @@
+name: Build and upload nym node container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node"
+  CONTAINER_NAME: "nym-node"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

CHANGELOG.md

@@ -4,6 +4,80 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.12-aero] (2024-10-17)
+
+- nym-node: don't use bloomfilters for double spending checks ([#4960])
+- bugfix: replace unreachable macro with an error return ([#4958])
+- [DOCs:/operators]: Update FAQ sphinx size ([#4946])
+- [DOCs/operators]: Release notes v2024.11-wedel ([#4939])
+- Fix handle drop ([#4934])
+- Assume offline mode ([#4926])
+- Make ip-packet-request VERSION pub ([#4925])
+- Expose error type ([#4924])
+- Fix argument to cargo-deny action ([#4922])
+- Fix nymvpn.com url in mainnet defaults ([#4920])
+- Check both version and type in message header ([#4918])
+- Bump http-api-client default timeout to 30 sec ([#4917])
+- Max/proxy ffi ([#4906])
+- Data Observatory stub ([#4905])
+- Fix missing duplication of modified tables ([#4904])
+- Update cargo deny ([#4901])
+- docs: add hostname instructions for wss ([#4900])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4898])
+- Fix clippy for beta toolchain ([#4897])
+- Remove clippy github PR annotations ([#4896])
+- Fix apt install in ci-build-upload-binaries.yml ([#4894])
+- Update network monitor entrypoint ([#4893])
+- Update nym-vpn metapackage and replace nymvpn-x with nym-vpn-app ([#4889])
+- Entry wireguard tickets ([#4888])
+- Build and Push CI ([#4887])
+- Feature/updated gateway registration ([#4885])
+- Few fixes to NNM pre deploy ([#4883])
+- Fix sql serde with enum ([#4875])
+- allow clients to send stateless gateway requests without prior registration ([#4873])
+- chore: remove queued migration for adding explicit admin ([#4871])
+- Gateway database modifications for different modes ([#4868])
+- build(deps): bump strum from 0.25.0 to 0.26.3 ([#4848])
+- Use serde from workspace ([#4833])
+- build(deps): bump toml from 0.5.11 to 0.8.14 ([#4805])
+- Max/rust sdk stream abstraction ([#4743])
+
+[#4960]: https://github.com/nymtech/nym/pull/4960
+[#4958]: https://github.com/nymtech/nym/pull/4958
+[#4946]: https://github.com/nymtech/nym/pull/4946
+[#4939]: https://github.com/nymtech/nym/pull/4939
+[#4934]: https://github.com/nymtech/nym/pull/4934
+[#4926]: https://github.com/nymtech/nym/pull/4926
+[#4925]: https://github.com/nymtech/nym/pull/4925
+[#4924]: https://github.com/nymtech/nym/pull/4924
+[#4922]: https://github.com/nymtech/nym/pull/4922
+[#4920]: https://github.com/nymtech/nym/pull/4920
+[#4918]: https://github.com/nymtech/nym/pull/4918
+[#4917]: https://github.com/nymtech/nym/pull/4917
+[#4906]: https://github.com/nymtech/nym/pull/4906
+[#4905]: https://github.com/nymtech/nym/pull/4905
+[#4904]: https://github.com/nymtech/nym/pull/4904
+[#4901]: https://github.com/nymtech/nym/pull/4901
+[#4900]: https://github.com/nymtech/nym/pull/4900
+[#4898]: https://github.com/nymtech/nym/pull/4898
+[#4897]: https://github.com/nymtech/nym/pull/4897
+[#4896]: https://github.com/nymtech/nym/pull/4896
+[#4894]: https://github.com/nymtech/nym/pull/4894
+[#4893]: https://github.com/nymtech/nym/pull/4893
+[#4889]: https://github.com/nymtech/nym/pull/4889
+[#4888]: https://github.com/nymtech/nym/pull/4888
+[#4887]: https://github.com/nymtech/nym/pull/4887
+[#4885]: https://github.com/nymtech/nym/pull/4885
+[#4883]: https://github.com/nymtech/nym/pull/4883
+[#4875]: https://github.com/nymtech/nym/pull/4875
+[#4873]: https://github.com/nymtech/nym/pull/4873
+[#4871]: https://github.com/nymtech/nym/pull/4871
+[#4868]: https://github.com/nymtech/nym/pull/4868
+[#4848]: https://github.com/nymtech/nym/pull/4848
+[#4833]: https://github.com/nymtech/nym/pull/4833
+[#4805]: https://github.com/nymtech/nym/pull/4805
+[#4743]: https://github.com/nymtech/nym/pull/4743
+
 ## [2024.11-wedel] (2024-09-23)
 
 - Backport #4894 to fix ci ([#4899])

Cargo.toml

@@ -19,33 +19,33 @@ members = [
     "clients/native",
     "clients/native/websocket-requests",
     "clients/socks5",
-    "common/authenticator-requests",
     "common/async-file-watcher",
+    "common/authenticator-requests",
     "common/bandwidth-controller",
     "common/bin-common",
     "common/client-core",
     "common/client-core/config-types",
-    "common/client-core/surb-storage",
     "common/client-core/gateways-storage",
+    "common/client-core/surb-storage",
     "common/client-libs/gateway-client",
     "common/client-libs/mixnet-client",
     "common/client-libs/validator-client",
     "common/commands",
     "common/config",
     "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
-    "common/cosmwasm-smart-contracts/ecash-contract",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
+    "common/cosmwasm-smart-contracts/ecash-contract",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",
     "common/cosmwasm-smart-contracts/vesting-contract",
     "common/country-group",
     "common/credential-storage",
-    "common/credentials",
     "common/credential-utils",
-    "common/credentials-interface",
     "common/credential-verification",
+    "common/credentials",
+    "common/credentials-interface",
     "common/crypto",
     "common/dkg",
     "common/ecash-double-spending",
@@ -54,19 +54,21 @@ members = [
     "common/exit-policy",
     "common/gateway-requests",
     "common/gateway-storage",
+    "common/gateway-stats-storage",
     "common/http-api-client",
     "common/http-api-common",
     "common/inclusion-probability",
     "common/ip-packet-requests",
     "common/ledger",
     "common/mixnode-common",
+    "common/models",
     "common/network-defaults",
     "common/node-tester-utils",
     "common/nonexhaustive-delayqueue",
-    "common/nymcoconut",
-    "common/nym_offline_compact_ecash",
     "common/nym-id",
     "common/nym-metrics",
+    "common/nym_offline_compact_ecash",
+    "common/nymcoconut",
     "common/nymsphinx",
     "common/nymsphinx/acknowledgements",
     "common/nymsphinx/addressing",
@@ -85,6 +87,7 @@ members = [
     "common/socks5-client-core",
     "common/socks5/proxy-helpers",
     "common/socks5/requests",
+    "common/statistics",
     "common/store-cipher",
     "common/task",
     "common/topology",
@@ -95,30 +98,35 @@ members = [
     "common/wasm/utils",
     "common/wireguard",
     "common/wireguard-types",
+    # "documentation/autodoc",
     "explorer-api",
     "explorer-api/explorer-api-requests",
     "explorer-api/explorer-client",
     "gateway",
     "integrations/bity",
     "mixnode",
+    "sdk/ffi/cpp",
+    "sdk/ffi/go",
+    "sdk/ffi/shared",
     "sdk/lib/socks5-listener",
     "sdk/rust/nym-sdk",
-    "sdk/ffi/shared",
-    "sdk/ffi/go",
-    "sdk/ffi/cpp",
     "service-providers/authenticator",
     "service-providers/common",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
-    "nym-network-monitor",
     "nym-api",
-    "nym-browser-extension/storage",
     "nym-api/nym-api-requests",
+    "nym-browser-extension/storage",
+    "nym-credential-proxy/nym-credential-proxy",
+    "nym-credential-proxy/nym-credential-proxy-requests",
+    "nym-credential-proxy/vpn-api-lib-wasm",
     "nym-data-observatory",
+    "nym-network-monitor",
     "nym-node",
     "nym-node/nym-node-http-api",
     "nym-node/nym-node-requests",
     "nym-node-status-api",
+    "nym-node-status-agent",
     "nym-outfox",
     "nym-validator-rewarder",
     "tools/echo-server",
@@ -136,22 +144,25 @@ members = [
     "wasm/mix-fetch",
     "wasm/node-tester",
     "wasm/zknym-lib",
-    "tools/internal/testnet-manager",
-    "tools/internal/testnet-manager/dkg-bypass-contract",
     "tools/echo-server",
     "tools/internal/contract-state-importer/importer-cli",
     "tools/internal/contract-state-importer/importer-contract",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
 ]
 
 default-members = [
     "clients/native",
     "clients/socks5",
+    "common/models",
     "explorer-api",
     "gateway",
     "mixnode",
     "nym-api",
+    "nym-credential-proxy/nym-credential-proxy",
     "nym-data-observatory",
     "nym-node",
+    "nym-node-status-api",
     "nym-validator-rewarder",
     "nym-node-status-api",
     "service-providers/authenticator",
@@ -184,19 +195,17 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 aead = "0.5.2"
-anyhow = "1.0.89"
+anyhow = "1.0.90"
 argon2 = "0.5.0"
 async-trait = "0.1.83"
+axum-client-ip = "0.6.1"
 axum = "0.7.5"
 axum-extra = "0.9.4"
 base64 = "0.22.1"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
-
-# can we unify those?
-bit-vec = "0.7.0"
+bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
-
 blake3 = "1.5.4"
 bloomfilter = "1.0.14"
 bs58 = "0.5.1"
@@ -209,7 +218,7 @@ chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
 chrono = "0.4.31"
 cipher = "0.4.3"
-clap = "4.5.18"
+clap = "4.5.20"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.0"
@@ -263,7 +272,7 @@ ipnetwork = "0.20"
 isocountry = "0.3.2"
 itertools = "0.13.0"
 k256 = "0.13"
-lazy_static = "1.4.0"
+lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
@@ -273,13 +282,13 @@ moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
 okapi = "0.7.0"
-once_cell = "1.7.2"
+once_cell = "1.20.2"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
 parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
-pin-project = "1.0"
+pin-project = "1.1"
 pin-project-lite = "0.2.14"
 pretty_env_logger = "0.4.0"
 publicsuffix = "2.2.3"
@@ -299,10 +308,10 @@ rocket_okapi = "0.8.0"
 safer-ffi = "0.1.13"
 schemars = "0.8.21"
 semver = "1.0.23"
-serde = "1.0.210"
+serde = "1.0.211"
 serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.128"
+serde_json = "1.0.132"
 serde_json_path = "0.6.7"
 serde_repr = "0.1"
 serde_with = "3.9.0"
@@ -310,8 +319,9 @@ serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
 sphinx-packet = "0.1.1"
-sqlx = "0.6.3"
+sqlx = "0.7.4"
 strum = "0.26"
+strum_macros = "0.26"
 subtle-encoding = "0.5"
 syn = "1"
 sysinfo = "0.30.13"
@@ -356,6 +366,7 @@ prometheus = { version = "0.13.0" }
 bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.0", default-features = false }
+subtle = "2.5.0"
 
 # cosmwasm-related
 cosmwasm-schema = "=1.4.3"
@@ -394,14 +405,19 @@ indexed_db_futures = { git = "https://github.com/TiemenSch/rust-indexed-db", bra
 js-sys = "0.3.70"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-wasm-bindgen = "0.2.93"
-wasm-bindgen-futures = "0.4.43"
+wasm-bindgen = "0.2.95"
+wasm-bindgen-futures = "0.4.45"
 wasmtimer = "0.2.0"
-web-sys = "0.3.70"
-
+web-sys = "0.3.72"
 
 # Profile settings for individual crates
 
+# Compile-time verified queries do quite a bit of work at compile time. Incremental
+#  actions like cargo check and cargo build can be significantly faster when
+# using an optimized build
+[profile.dev.package.sqlx-macros]
+opt-level = 3
+
 [profile.release.package.nym-socks5-listener]
 strip = true
 codegen-units = 1

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.41"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.41"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/authenticator-requests/src/error.rs

@@ -19,4 +19,7 @@ pub enum Error {
         #[source]
         source: hmac::digest::MacError,
     },
+
+    #[error("conversion: {0}")]
+    Conversion(String),
 }

common/authenticator-requests/src/lib.rs

@@ -3,13 +3,14 @@
 
 pub mod v1;
 pub mod v2;
+pub mod v3;
 
 mod error;
 
 pub use error::Error;
-pub use v2 as latest;
+pub use v3 as latest;
 
-pub const CURRENT_VERSION: u8 = 2;
+pub const CURRENT_VERSION: u8 = 3;
 
 fn make_bincode_serializer() -> impl bincode::Options {
     use bincode::Options;

common/authenticator-requests/src/v3/conversion.rs

@@ -0,0 +1,188 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v2, v3};
+
+impl From<v2::request::AuthenticatorRequest> for v3::request::AuthenticatorRequest {
+    fn from(authenticator_request: v2::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v2::request::AuthenticatorRequestData> for v3::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v2::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v2::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v3::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v2::request::AuthenticatorRequestData::Final(gw_client) => {
+                v3::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v2::registration::InitMessage> for v3::registration::InitMessage {
+    fn from(init_msg: v2::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<Box<v2::registration::FinalMessage>> for Box<v3::registration::FinalMessage> {
+    fn from(gw_client: Box<v2::registration::FinalMessage>) -> Self {
+        Box::new(v3::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v3::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v3::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v3::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::ClientMac> for v3::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v3::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v3::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponse> for v2::response::AuthenticatorResponse {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response: v3::response::AuthenticatorResponse,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            data: authenticator_response.data.try_into()?,
+            reply_to: authenticator_response.reply_to,
+            protocol: authenticator_response.protocol,
+        })
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponseData> for v2::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response_data: v3::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v3::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Ok(
+                v2::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_registration_response.into(),
+                ),
+            ),
+            v3::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v2::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v3::response::AuthenticatorResponseData::TopUpBandwidth(_) => {
+                Err(Self::Error::Conversion(
+                    "a v2 request couldn't produce a v3 only type of response".to_string(),
+                ))
+            }
+        }
+    }
+}
+
+impl From<v3::response::PendingRegistrationResponse> for v2::response::PendingRegistrationResponse {
+    fn from(value: v3::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RegisteredResponse> for v2::response::RegisteredResponse {
+    fn from(value: v3::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RemainingBandwidthResponse> for v2::response::RemainingBandwidthResponse {
+    fn from(value: v3::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v3::registration::RegistrationData> for v2::registration::RegistrationData {
+    fn from(value: v3::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RemainingBandwidthData> for v2::registration::RemainingBandwidthData {
+    fn from(value: v3::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}

common/authenticator-requests/src/v3/mod.rs

@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 3;

common/authenticator-requests/src/v3/registration.rs

@@ -0,0 +1,227 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}

common/authenticator-requests/src/v3/request.rs

@@ -0,0 +1,136 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}

common/authenticator-requests/src/v3/response.rs

@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RemainingBandwidthData,
+}

common/authenticator-requests/src/v3/topup.rs

@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}

common/bin-common/Cargo.toml

@@ -45,3 +45,4 @@ tracing = [
     "opentelemetry",
 ]
 clap = [ "dep:clap", "dep:clap_complete", "dep:clap_complete_fig" ]
+models = []

common/client-core/gateways-storage/.sqlx/query-06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'",
+  "describe": {
+    "columns": [
+      {
+        "name": "exists",
+        "ordinal": 0,
+        "type_info": "Int"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32"
+}

common/client-core/gateways-storage/.sqlx/query-0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985.json

@@ -0,0 +1,44 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_owner_address",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_listener",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 4,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985"
+}

common/client-core/gateways-storage/.sqlx/query-0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE remote_gateway_details\n                SET\n                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,\n                    derived_aes256_gcm_siv_key = ?\n                WHERE gateway_id_bs58 = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54"
+}

common/client-core/gateways-storage/.sqlx/query-1da6904e72b5abb9abf75affb13af7974d7795b4cbdba234273345fe161df233.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "1da6904e72b5abb9abf75affb13af7974d7795b4cbdba234273345fe161df233"
+}

common/client-core/gateways-storage/.sqlx/query-4f78619aca933484cd67cb89a376b2a5bec1c191993ff58f0c71c03e3ef6d92d.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "4f78619aca933484cd67cb89a376b2a5bec1c191993ff58f0c71c03e3ef6d92d"
+}

common/client-core/gateways-storage/.sqlx/query-54f552a9dbe95236f946ac2b6615e03504afa58e345ae16a128629d8e76f0a11.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "data",
+        "ordinal": 1,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "54f552a9dbe95236f946ac2b6615e03504afa58e345ae16a128629d8e76f0a11"
+}

common/client-core/gateways-storage/.sqlx/query-5661cf1ad8bd5ca062e855e1971a8787133ee41814bd3efdd501f9ee0c050f2b.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT gateway_id_bs58 FROM registered_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5661cf1ad8bd5ca062e855e1971a8787133ee41814bd3efdd501f9ee0c050f2b"
+}

common/client-core/gateways-storage/.sqlx/query-80476cf2906eb0ecf7f66c16bc5682169b87f488b6927fa67fade6bf5abf7582.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "UPDATE active_gateway SET active_gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "80476cf2906eb0ecf7f66c16bc5682169b87f488b6927fa67fade6bf5abf7582"
+}

common/client-core/gateways-storage/.sqlx/query-8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) \n                VALUES (?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e"
+}

common/client-core/gateways-storage/.sqlx/query-a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)\n                VALUES (?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 5
+    },
+    "nullable": []
+  },
+  "hash": "a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0"
+}

common/client-core/gateways-storage/.sqlx/query-b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data) \n                VALUES (?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4"
+}

common/client-core/gateways-storage/.sqlx/query-bf249752f08c283bf5942b6ff48125c24750b523cfcad1e5e9069dbf7050e2a1.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT active_gateway_id_bs58 FROM active_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "active_gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "bf249752f08c283bf5942b6ff48125c24750b523cfcad1e5e9069dbf7050e2a1"
+}

common/client-core/gateways-storage/.sqlx/query-f3ebe259e26c05ecdd33bd9085dbb91cd5046a8c9d4434cf085a4fa2ebf03e93.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM registered_gateway WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "f3ebe259e26c05ecdd33bd9085dbb91cd5046a8c9d4434cf085a4fa2ebf03e93"
+}

common/client-core/gateways-storage/src/backend/fs_backend/manager.rs

@@ -29,11 +29,10 @@ impl StorageManager {
             })?;
         }
 
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .filename(database_path)
-            .create_if_missing(true);
-
-        opts.disable_statement_logging();
+            .create_if_missing(true)
+            .disable_statement_logging();
 
         let connection_pool = sqlx::SqlitePool::connect_with(opts)
             .await
@@ -82,7 +81,7 @@ impl StorageManager {
         sqlx::query!("SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'", gateway_id)
             .fetch_one(&self.connection_pool)
             .await
-            .map(|result| result.exists == 1)
+            .map(|result| result.exists == Some(1))
     }
 
     pub(crate) async fn maybe_get_registered_gateway(

common/client-core/src/client/topology_control/geo_aware_provider.rs

@@ -110,7 +110,11 @@ impl GeoAwareTopologyProvider {
     }
 
     async fn get_topology(&self) -> Option<NymTopology> {
-        let mixnodes = match self.validator_client.get_basic_mixnodes(None).await {
+        let mixnodes = match self
+            .validator_client
+            .get_all_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
+            .await
+        {
             Err(err) => {
                 error!("failed to get network mixnodes - {err}");
                 return None;
@@ -118,7 +122,11 @@ impl GeoAwareTopologyProvider {
             Ok(mixes) => mixes,
         };
 
-        let gateways = match self.validator_client.get_basic_gateways(None).await {
+        let gateways = match self
+            .validator_client
+            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
+            .await
+        {
             Err(err) => {
                 error!("failed to get network gateways - {err}");
                 return None;
@@ -185,8 +193,7 @@ impl GeoAwareTopologyProvider {
             .filter(|m| filtered_mixnode_ids.contains(&m.node_id))
             .collect::<Vec<_>>();
 
-        let topology = nym_topology_from_basic_info(&mixnodes, &gateways)
-            .filter_system_version(&self.client_version);
+        let topology = nym_topology_from_basic_info(&mixnodes, &gateways);
 
         // TODO: return real error type
         check_layer_integrity(topology.clone()).ok()?;

common/client-core/src/client/topology_control/mod.rs

@@ -6,7 +6,6 @@ pub(crate) use accessor::{TopologyAccessor, TopologyReadPermit};
 use futures::StreamExt;
 use log::*;
 use nym_sphinx::addressing::nodes::NodeIdentity;
-use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::NymTopologyError;
 use std::time::Duration;
 
@@ -18,7 +17,11 @@ use wasmtimer::tokio::sleep;
 
 mod accessor;
 pub mod geo_aware_provider;
-pub(crate) mod nym_api_provider;
+pub mod nym_api_provider;
+
+pub use geo_aware_provider::GeoAwareTopologyProvider;
+pub use nym_api_provider::{Config as NymApiTopologyProviderConfig, NymApiTopologyProvider};
+pub use nym_topology::provider_trait::TopologyProvider;
 
 // TODO: move it to config later
 const MAX_FAILURE_COUNT: usize = 10;

common/client-core/src/client/topology_control/nym_api_provider.rs

@@ -14,9 +14,10 @@ use url::Url;
 pub const DEFAULT_MIN_MIXNODE_PERFORMANCE: u8 = 50;
 pub const DEFAULT_MIN_GATEWAY_PERFORMANCE: u8 = 50;
 
-pub(crate) struct Config {
-    pub(crate) min_mixnode_performance: u8,
-    pub(crate) min_gateway_performance: u8,
+#[derive(Debug)]
+pub struct Config {
+    pub min_mixnode_performance: u8,
+    pub min_gateway_performance: u8,
 }
 
 impl Default for Config {
@@ -29,7 +30,7 @@ impl Default for Config {
     }
 }
 
-pub(crate) struct NymApiTopologyProvider {
+pub struct NymApiTopologyProvider {
     config: Config,
 
     validator_client: nym_validator_client::client::NymApiClient,
@@ -40,7 +41,7 @@ pub(crate) struct NymApiTopologyProvider {
 }
 
 impl NymApiTopologyProvider {
-    pub(crate) fn new(
+    pub fn new(
         config: Config,
         mut nym_api_urls: Vec<Url>,
         client_version: String,
@@ -98,7 +99,7 @@ impl NymApiTopologyProvider {
     async fn get_current_compatible_topology(&mut self) -> Option<NymTopology> {
         let mixnodes = match self
             .validator_client
-            .get_basic_mixnodes(Some(self.client_version.clone()))
+            .get_all_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
             .await
         {
             Err(err) => {
@@ -110,7 +111,7 @@ impl NymApiTopologyProvider {
 
         let gateways = match self
             .validator_client
-            .get_basic_gateways(Some(self.client_version.clone()))
+            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
             .await
         {
             Err(err) => {
@@ -134,7 +135,6 @@ impl NymApiTopologyProvider {
                 g.performance.round_to_integer() >= self.config.min_gateway_performance
             }),
         );
-
         if let Err(err) = self.check_layer_distribution(&topology) {
             warn!("The current filtered active topology has extremely skewed layer distribution. It cannot be used: {err}");
             self.use_next_nym_api();

common/client-core/src/init/helpers.rs

@@ -7,7 +7,7 @@ use futures::{SinkExt, StreamExt};
 use log::{debug, info, trace, warn};
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::GatewayClient;
-use nym_topology::{filter::VersionFilterable, gateway, mix};
+use nym_topology::{gateway, mix};
 use nym_validator_client::client::IdentityKeyRef;
 use nym_validator_client::UserAgent;
 use rand::{seq::SliceRandom, Rng};
@@ -94,7 +94,7 @@ pub async fn current_gateways<R: Rng>(
 
     log::debug!("Fetching list of gateways from: {nym_api}");
 
-    let gateways = client.get_basic_gateways(None).await?;
+    let gateways = client.get_all_basic_entry_assigned_nodes(None).await?;
     log::debug!("Found {} gateways", gateways.len());
     log::trace!("Gateways: {:#?}", gateways);
 
@@ -102,17 +102,12 @@ pub async fn current_gateways<R: Rng>(
         .iter()
         .filter_map(|gateway| gateway.try_into().ok())
         .collect::<Vec<gateway::LegacyNode>>();
-    log::debug!("Ater checking validity: {}", valid_gateways.len());
+    log::debug!("After checking validity: {}", valid_gateways.len());
     log::trace!("Valid gateways: {:#?}", valid_gateways);
 
-    // we were always filtering by version so I'm not removing that 'feature'
-    let filtered_gateways = valid_gateways.filter_by_version(env!("CARGO_PKG_VERSION"));
-    log::debug!("After filtering for version: {}", filtered_gateways.len());
-    log::trace!("Filtered gateways: {:#?}", filtered_gateways);
+    log::info!("nym-api reports {} valid gateways", valid_gateways.len());
 
-    log::info!("nym-api reports {} valid gateways", filtered_gateways.len());
-
-    Ok(filtered_gateways)
+    Ok(valid_gateways)
 }
 
 pub async fn current_mixnodes<R: Rng>(
@@ -126,15 +121,15 @@ pub async fn current_mixnodes<R: Rng>(
 
     log::trace!("Fetching list of mixnodes from: {nym_api}");
 
-    let mixnodes = client.get_basic_mixnodes(None).await?;
+    let mixnodes = client
+        .get_all_basic_active_mixing_assigned_nodes(None)
+        .await?;
     let valid_mixnodes = mixnodes
         .iter()
         .filter_map(|mixnode| mixnode.try_into().ok())
         .collect::<Vec<mix::LegacyNode>>();
 
-    // we were always filtering by version so I'm not removing that 'feature'
-    let filtered_mixnodes = valid_mixnodes.filter_by_version(env!("CARGO_PKG_VERSION"));
-    Ok(filtered_mixnodes)
+    Ok(valid_mixnodes)
 }
 
 #[cfg(not(target_arch = "wasm32"))]

common/client-core/surb-storage/src/backend/fs_backend/manager.rs

@@ -1,9 +1,12 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::backend::fs_backend::error::StorageError;
-use crate::backend::fs_backend::models::{
-    ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag, StoredSurbSender,
+use crate::backend::fs_backend::{
+    error::StorageError,
+    models::{
+        ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag,
+        StoredSurbSender,
+    },
 };
 use log::{error, info};
 use sqlx::ConnectOptions;
@@ -27,11 +30,10 @@ impl StorageManager {
             })?;
         }
 
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .filename(database_path)
-            .create_if_missing(fresh);
-
-        opts.disable_statement_logging();
+            .create_if_missing(fresh)
+            .disable_statement_logging();
 
         let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
             Ok(pool) => pool,

common/client-libs/validator-client/src/client.rs

@@ -19,7 +19,7 @@ use nym_api_requests::ecash::{
 };
 use nym_api_requests::models::{
     GatewayCoreStatusResponse, MixnodeCoreStatusResponse, MixnodeStatusResponse,
-    RewardEstimationResponse, StakeSaturationResponse,
+    NymNodeDescription, RewardEstimationResponse, StakeSaturationResponse,
 };
 use nym_api_requests::models::{LegacyDescribedGateway, MixNodeBondAnnotated};
 use nym_api_requests::nym_nodes::SkimmedNode;
@@ -30,10 +30,10 @@ use time::Date;
 use url::Url;
 
 pub use crate::nym_api::NymApiClientExt;
+use nym_mixnet_contract_common::NymNodeDetails;
 pub use nym_mixnet_contract_common::{
     mixnode::MixNodeDetails, GatewayBond, IdentityKey, IdentityKeyRef, NodeId,
 };
-
 // re-export the type to not break existing imports
 pub use crate::coconut::EcashApiClient;
 
@@ -106,7 +106,9 @@ impl Config {
 
 pub struct Client<C, S = NoSigner> {
     // ideally they would have been read-only, but unfortunately rust doesn't have such features
+    // #[deprecated(note = "please use `nym_api_client` instead")]
     pub nym_api: nym_api::Client,
+    // pub nym_api_client: NymApiClient,
     pub nyxd: NyxdClient<C, S>,
 }
 
@@ -243,6 +245,50 @@ impl<C, S> Client<C, S> {
         Ok(self.nym_api.get_gateways().await?)
     }
 
+    // TODO: combine with NymApiClient...
+    pub async fn get_all_cached_described_nodes(
+        &self,
+    ) -> Result<Vec<NymNodeDescription>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut descriptions = Vec::new();
+
+        loop {
+            let mut res = self.nym_api.get_nodes_described(Some(page), None).await?;
+
+            descriptions.append(&mut res.data);
+            if descriptions.len() < res.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(descriptions)
+    }
+
+    // TODO: combine with NymApiClient...
+    pub async fn get_all_cached_bonded_nym_nodes(
+        &self,
+    ) -> Result<Vec<NymNodeDetails>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut bonds = Vec::new();
+
+        loop {
+            let mut res = self.nym_api.get_nym_nodes(Some(page), None).await?;
+
+            bonds.append(&mut res.data);
+            if bonds.len() < res.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(bonds)
+    }
+
     pub async fn blind_sign(
         &self,
         request_body: &BlindSignRequestBody,
@@ -290,6 +336,7 @@ impl NymApiClient {
         self.nym_api.change_base_url(new_endpoint);
     }
 
+    #[deprecated(note = "use get_all_basic_active_mixing_assigned_nodes instead")]
     pub async fn get_basic_mixnodes(
         &self,
         semver_compatibility: Option<String>,
@@ -301,6 +348,7 @@ impl NymApiClient {
             .nodes)
     }
 
+    #[deprecated(note = "use get_all_basic_entry_assigned_nodes instead")]
     pub async fn get_basic_gateways(
         &self,
         semver_compatibility: Option<String>,
@@ -312,6 +360,96 @@ impl NymApiClient {
             .nodes)
     }
 
+    /// retrieve basic information for nodes are capable of operating as an entry gateway
+    /// this includes legacy gateways and nym-nodes
+    pub async fn get_all_basic_entry_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut nodes = Vec::new();
+
+        loop {
+            let mut res = self
+                .nym_api
+                .get_basic_entry_assigned_nodes(
+                    semver_compatibility.clone(),
+                    false,
+                    Some(page),
+                    None,
+                )
+                .await?;
+
+            nodes.append(&mut res.nodes.data);
+            if nodes.len() < res.nodes.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(nodes)
+    }
+
+    /// retrieve basic information for nodes that got assigned 'mixing' node in this epoch
+    /// this includes legacy mixnodes and nym-nodes
+    pub async fn get_all_basic_active_mixing_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut nodes = Vec::new();
+
+        loop {
+            let mut res = self
+                .nym_api
+                .get_basic_active_mixing_assigned_nodes(
+                    semver_compatibility.clone(),
+                    false,
+                    Some(page),
+                    None,
+                )
+                .await?;
+
+            nodes.append(&mut res.nodes.data);
+            if nodes.len() < res.nodes.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(nodes)
+    }
+
+    /// retrieve basic information for all bonded nodes on the network
+    pub async fn get_all_basic_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut nodes = Vec::new();
+
+        loop {
+            let mut res = self
+                .nym_api
+                .get_basic_nodes(semver_compatibility.clone(), false, Some(page), None)
+                .await?;
+
+            nodes.append(&mut res.nodes.data);
+            if nodes.len() < res.nodes.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(nodes)
+    }
+
     pub async fn get_cached_active_mixnodes(
         &self,
     ) -> Result<Vec<MixNodeDetails>, ValidatorClientError> {
@@ -338,6 +476,48 @@ impl NymApiClient {
         Ok(self.nym_api.get_gateways_described().await?)
     }
 
+    pub async fn get_all_described_nodes(
+        &self,
+    ) -> Result<Vec<NymNodeDescription>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut descriptions = Vec::new();
+
+        loop {
+            let mut res = self.nym_api.get_nodes_described(Some(page), None).await?;
+
+            descriptions.append(&mut res.data);
+            if descriptions.len() < res.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(descriptions)
+    }
+
+    pub async fn get_all_bonded_nym_nodes(
+        &self,
+    ) -> Result<Vec<NymNodeDetails>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut bonds = Vec::new();
+
+        loop {
+            let mut res = self.nym_api.get_nym_nodes(Some(page), None).await?;
+
+            bonds.append(&mut res.data);
+            if bonds.len() < res.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(bonds)
+    }
+
     pub async fn get_gateway_core_status_count(
         &self,
         identity: IdentityKeyRef<'_>,

common/client-libs/validator-client/src/nym_api/mod.rs

@@ -11,8 +11,10 @@ use nym_api_requests::ecash::models::{
 };
 use nym_api_requests::ecash::VerificationKeyResponse;
 use nym_api_requests::models::{
-    AnnotationResponse, LegacyDescribedMixNode, NodePerformanceResponse,
+    AnnotationResponse, LegacyDescribedMixNode, NodePerformanceResponse, NymNodeDescription,
 };
+use nym_api_requests::nym_nodes::PaginatedCachedNodesResponse;
+use nym_api_requests::pagination::PaginatedResponse;
 pub use nym_api_requests::{
     ecash::{
         models::{
@@ -37,7 +39,7 @@ use nym_contracts_common::IdentityKey;
 pub use nym_http_api_client::Client;
 use nym_http_api_client::{ApiClient, NO_PARAMS};
 use nym_mixnet_contract_common::mixnode::MixNodeDetails;
-use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, NodeId};
+use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, NodeId, NymNodeDetails};
 use time::format_description::BorrowedFormatItem;
 use time::Date;
 use tracing::instrument;
@@ -126,6 +128,44 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    async fn get_nodes_described(
+        &self,
+        page: Option<u32>,
+        per_page: Option<u32>,
+    ) -> Result<PaginatedResponse<NymNodeDescription>, NymAPIError> {
+        let mut params = Vec::new();
+
+        if let Some(page) = page {
+            params.push(("page", page.to_string()))
+        }
+
+        if let Some(per_page) = per_page {
+            params.push(("per_page", per_page.to_string()))
+        }
+
+        self.get_json(&[routes::API_VERSION, "nym-nodes", "described"], &params)
+            .await
+    }
+
+    async fn get_nym_nodes(
+        &self,
+        page: Option<u32>,
+        per_page: Option<u32>,
+    ) -> Result<PaginatedResponse<NymNodeDetails>, NymAPIError> {
+        let mut params = Vec::new();
+
+        if let Some(page) = page {
+            params.push(("page", page.to_string()))
+        }
+
+        if let Some(per_page) = per_page {
+            params.push(("per_page", per_page.to_string()))
+        }
+
+        self.get_json(&[routes::API_VERSION, "nym-nodes", "bonded"], &params)
+            .await
+    }
+
     #[tracing::instrument(level = "debug", skip_all)]
     async fn get_basic_mixnodes(
         &self,
@@ -174,6 +214,122 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    /// retrieve basic information for nodes are capable of operating as an entry gateway
+    /// this includes legacy gateways and nym-nodes
+    #[instrument(level = "debug", skip(self))]
+    async fn get_basic_entry_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+        no_legacy: bool,
+        page: Option<u32>,
+        per_page: Option<u32>,
+    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
+        let mut params = Vec::new();
+
+        if let Some(arg) = &semver_compatibility {
+            params.push(("semver_compatibility", arg.clone()))
+        }
+
+        if no_legacy {
+            params.push(("no_legacy", "true".to_string()))
+        }
+
+        if let Some(page) = page {
+            params.push(("page", page.to_string()))
+        }
+
+        if let Some(per_page) = per_page {
+            params.push(("per_page", per_page.to_string()))
+        }
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                "unstable",
+                "nym-nodes",
+                "skimmed",
+                "entry-gateways",
+                "all",
+            ],
+            &params,
+        )
+        .await
+    }
+
+    /// retrieve basic information for nodes that got assigned 'mixing' node in this epoch
+    /// this includes legacy mixnodes and nym-nodes
+    #[instrument(level = "debug", skip(self))]
+    async fn get_basic_active_mixing_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+        no_legacy: bool,
+        page: Option<u32>,
+        per_page: Option<u32>,
+    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
+        let mut params = Vec::new();
+
+        if let Some(arg) = &semver_compatibility {
+            params.push(("semver_compatibility", arg.clone()))
+        }
+
+        if no_legacy {
+            params.push(("no_legacy", "true".to_string()))
+        }
+
+        if let Some(page) = page {
+            params.push(("page", page.to_string()))
+        }
+
+        if let Some(per_page) = per_page {
+            params.push(("per_page", per_page.to_string()))
+        }
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                "unstable",
+                "nym-nodes",
+                "skimmed",
+                "mixnodes",
+                "active",
+            ],
+            &params,
+        )
+        .await
+    }
+
+    async fn get_basic_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+        no_legacy: bool,
+        page: Option<u32>,
+        per_page: Option<u32>,
+    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
+        let mut params = Vec::new();
+
+        if let Some(arg) = &semver_compatibility {
+            params.push(("semver_compatibility", arg.clone()))
+        }
+
+        if no_legacy {
+            params.push(("no_legacy", "true".to_string()))
+        }
+
+        if let Some(page) = page {
+            params.push(("page", page.to_string()))
+        }
+
+        if let Some(per_page) = per_page {
+            params.push(("per_page", per_page.to_string()))
+        }
+
+        self.get_json(
+            &[routes::API_VERSION, "unstable", "nym-nodes", "skimmed"],
+            &params,
+        )
+        .await
+    }
+
     #[instrument(level = "debug", skip(self))]
     async fn get_active_mixnodes(&self) -> Result<Vec<MixNodeDetails>, NymAPIError> {
         self.get_json(

common/commands/src/ecash/import_ticket_book.rs

@@ -1,8 +1,6 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::utils::CommonConfigsWrapper;
-use anyhow::bail;
 use clap::ArgGroup;
 use clap::Parser;
 use nym_credential_storage::initialise_persistent_storage;
@@ -31,7 +29,7 @@ impl FromStr for CredentialDataWrapper {
 pub struct Args {
     /// Config file of the client that is supposed to use the credential.
     #[clap(long)]
-    pub(crate) client_config: PathBuf,
+    pub(crate) credentials_store: PathBuf,
 
     /// Explicitly provide the encoded credential data (as base58)
     #[clap(long, group = "cred_data")]
@@ -70,21 +68,7 @@ impl Args {
 }
 
 pub async fn execute(args: Args) -> anyhow::Result<()> {
-    let loaded = CommonConfigsWrapper::try_load(&args.client_config)?;
-
-    if let Ok(id) = loaded.try_get_id() {
-        println!("loaded config file for client '{id}'");
-    }
-
-    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
-        bail!("the loaded config does not have a credentials store information")
-    };
-
-    println!(
-        "using credentials store at '{}'",
-        credentials_store.display()
-    );
-    let credentials_store = initialise_persistent_storage(credentials_store).await;
+    let credentials_store = initialise_persistent_storage(args.credentials_store.clone()).await;
 
     let version = args.version;
     let standalone = args.standalone;

common/cosmwasm-smart-contracts/mixnet-contract/src/helpers.rs

@@ -10,12 +10,13 @@ use crate::{
 use contracts_common::IdentityKeyRef;
 use cosmwasm_std::{Coin, Decimal, StdError, StdResult, Uint128};
 
+#[track_caller]
 pub fn compare_decimals(a: Decimal, b: Decimal, epsilon: Option<Decimal>) {
     let epsilon = epsilon.unwrap_or_else(|| Decimal::from_ratio(1u128, 100_000_000u128));
     if a > b {
-        assert!(a - b < epsilon, "{a} != {b}")
+        assert!(a - b < epsilon, "{a} != {b}, delta: {}", a - b)
     } else {
-        assert!(b - a < epsilon, "{a} != {b}")
+        assert!(b - a < epsilon, "{a} != {b}, delta: {}", b - a)
     }
 }
 

common/cosmwasm-smart-contracts/mixnet-contract/src/mixnode.rs

@@ -17,6 +17,7 @@ use crate::{
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::{Addr, Coin, Decimal, StdResult, Uint128};
 use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
 use serde_repr::{Deserialize_repr, Serialize_repr};
 
 /// Full details associated with given mixnode.
@@ -647,14 +648,39 @@ impl From<LegacyMixLayer> for u8 {
         export_to = "ts-packages/types/src/types/rust/PendingMixnodeChanges.ts"
     )
 )]
-#[cw_serde]
-#[derive(Default, Copy)]
+// note: we had to remove `#[cw_serde]` as it enforces `#[serde(deny_unknown_fields)]` which we do not want
+// with the addition of  .cost_params_change field
+#[derive(
+    ::cosmwasm_schema::serde::Serialize,
+    ::cosmwasm_schema::serde::Deserialize,
+    ::std::clone::Clone,
+    ::std::fmt::Debug,
+    ::std::cmp::PartialEq,
+    ::cosmwasm_schema::schemars::JsonSchema,
+    Default,
+    Copy,
+)]
+#[schemars(crate = "::cosmwasm_schema::schemars")]
 pub struct PendingMixNodeChanges {
     pub pledge_change: Option<EpochEventId>,
+
     #[serde(default)]
     pub cost_params_change: Option<IntervalEventId>,
 }
 
+#[derive(Default, Copy, Clone, Debug, Serialize, Deserialize, JsonSchema)]
+pub struct LegacyPendingMixNodeChanges {
+    pub pledge_change: Option<EpochEventId>,
+}
+
+impl From<PendingMixNodeChanges> for LegacyPendingMixNodeChanges {
+    fn from(value: PendingMixNodeChanges) -> Self {
+        LegacyPendingMixNodeChanges {
+            pledge_change: value.pledge_change,
+        }
+    }
+}
+
 impl PendingMixNodeChanges {
     pub fn new_empty() -> PendingMixNodeChanges {
         PendingMixNodeChanges {

common/cosmwasm-smart-contracts/mixnet-contract/src/msg.rs

@@ -830,4 +830,5 @@ pub enum QueryMsg {
 #[cw_serde]
 pub struct MigrateMsg {
     pub vesting_contract_address: Option<String>,
+    pub unsafe_skip_state_updates: Option<bool>,
 }

common/credential-storage/.sqlx/query-00d857b624e7edab1198114b17cbad1e16988a3f9989d135840500e1143ce5e5.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                SELECT epoch_id as \"epoch_id: u32\", serialised_signatures, serialization_revision as \"serialization_revision: u8\"\n                FROM expiration_date_signatures\n                WHERE expiration_date = ?\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "epoch_id: u32",
+        "ordinal": 0,
+        "type_info": "Int64"
+      },
+      {
+        "name": "serialised_signatures",
+        "ordinal": 1,
+        "type_info": "Blob"
+      },
+      {
+        "name": "serialization_revision: u8",
+        "ordinal": 2,
+        "type_info": "Int64"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "00d857b624e7edab1198114b17cbad1e16988a3f9989d135840500e1143ce5e5"
+}

common/credential-storage/.sqlx/query-0112296b190328a3856d1adf51aafa2525da6c0b871633aad80ad555db9cf47c.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                SELECT epoch_id as \"epoch_id: u32\", serialised_key, serialization_revision as \"serialization_revision: u8\"\n                FROM master_verification_key WHERE epoch_id = ?\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "epoch_id: u32",
+        "ordinal": 0,
+        "type_info": "Int64"
+      },
+      {
+        "name": "serialised_key",
+        "ordinal": 1,
+        "type_info": "Blob"
+      },
+      {
+        "name": "serialization_revision: u8",
+        "ordinal": 2,
+        "type_info": "Int64"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "0112296b190328a3856d1adf51aafa2525da6c0b871633aad80ad555db9cf47c"
+}

common/credential-storage/.sqlx/query-16d10f0ac0ed9ce4239937f46df3797a6a9ee7db2aab9f1b5e55f7c13c53bcc1.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT OR IGNORE INTO expiration_date_signatures(expiration_date, epoch_id, serialised_signatures, serialization_revision)\n                VALUES (?, ?, ?, ?);\n                UPDATE expiration_date_signatures\n                    SET\n                        serialised_signatures = ?,\n                        serialization_revision = ?\n                     WHERE expiration_date = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 7
+    },
+    "nullable": []
+  },
+  "hash": "16d10f0ac0ed9ce4239937f46df3797a6a9ee7db2aab9f1b5e55f7c13c53bcc1"
+}

common/credential-storage/.sqlx/query-284b3ceae42f9320c30323dde47765854899103fd3c0fa670eb6809492270e02.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO ecash_ticketbook\n                (serialization_revision, ticketbook_data, expiration_date, ticketbook_type, epoch_id, total_tickets, used_tickets)\n                VALUES (?, ?, ?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 7
+    },
+    "nullable": []
+  },
+  "hash": "284b3ceae42f9320c30323dde47765854899103fd3c0fa670eb6809492270e02"
+}

common/credential-storage/.sqlx/query-37f82c9ec26b53d01601a2d6df82038a77ec37cca9f9aef18008dcd03030c2c4.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM ecash_ticketbook WHERE expiration_date <= ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "37f82c9ec26b53d01601a2d6df82038a77ec37cca9f9aef18008dcd03030c2c4"
+}

common/credential-storage/.sqlx/query-5c5d4bfabf18bc6fa56e76a9b98e38b7f6ceb8e9191a7b9201922efcf6b07966.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM pending_issuance WHERE deposit_id = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "5c5d4bfabf18bc6fa56e76a9b98e38b7f6ceb8e9191a7b9201922efcf6b07966"
+}

common/credential-storage/.sqlx/query-81a12a8a419c88b1c28a5533fde4d63462e9ea0049e2edafea1dc3f8476b33e4.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO pending_issuance\n                (deposit_id, serialization_revision, pending_ticketbook_data, expiration_date)\n                VALUES (?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 4
+    },
+    "nullable": []
+  },
+  "hash": "81a12a8a419c88b1c28a5533fde4d63462e9ea0049e2edafea1dc3f8476b33e4"
+}

common/credential-storage/.sqlx/query-84cad8b1078a4000830835e6349de3eb76fed954b7336530401db72cd008aff3.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "UPDATE ecash_ticketbook SET used_tickets = used_tickets + ? WHERE id = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "84cad8b1078a4000830835e6349de3eb76fed954b7336530401db72cd008aff3"
+}

common/credential-storage/.sqlx/query-a5b18e66d77ff802e274623605e15dcfcffb502ba8398caefd56c481f44eb84e.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT OR IGNORE INTO master_verification_key(epoch_id, serialised_key, serialization_revision) VALUES (?, ?, ?);\n                UPDATE master_verification_key\n                    SET\n                        serialised_key = ?,\n                        serialization_revision = ?\n                     WHERE epoch_id = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 6
+    },
+    "nullable": []
+  },
+  "hash": "a5b18e66d77ff802e274623605e15dcfcffb502ba8398caefd56c481f44eb84e"
+}

common/credential-storage/.sqlx/query-ba96344db31b0f2155e2af53eaaeafc9b5f64061b6c9a829e2912945b6cffc82.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                SELECT epoch_id as \"epoch_id: u32\", serialised_signatures, serialization_revision as \"serialization_revision: u8\"\n                FROM coin_indices_signatures WHERE epoch_id = ?\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "epoch_id: u32",
+        "ordinal": 0,
+        "type_info": "Int64"
+      },
+      {
+        "name": "serialised_signatures",
+        "ordinal": 1,
+        "type_info": "Blob"
+      },
+      {
+        "name": "serialization_revision: u8",
+        "ordinal": 2,
+        "type_info": "Int64"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "ba96344db31b0f2155e2af53eaaeafc9b5f64061b6c9a829e2912945b6cffc82"
+}

common/credential-storage/.sqlx/query-bc823c54143e2dc590b91347cd089dde284b38a3a4960afed758206d03ca1cf4.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE ecash_ticketbook\n                SET used_tickets = used_tickets - ?\n                WHERE id = ?\n                AND used_tickets = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "bc823c54143e2dc590b91347cd089dde284b38a3a4960afed758206d03ca1cf4"
+}

common/credential-storage/.sqlx/query-bd1973696121b6128bd75ae80fab253c071e04eb853d4b0f3b21782ea57c2f68.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT OR IGNORE INTO coin_indices_signatures(epoch_id, serialised_signatures, serialization_revision) VALUES (?, ?, ?);\n                UPDATE coin_indices_signatures\n                    SET\n                        serialised_signatures = ?,\n                        serialization_revision = ?\n                     WHERE epoch_id = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 6
+    },
+    "nullable": []
+  },
+  "hash": "bd1973696121b6128bd75ae80fab253c071e04eb853d4b0f3b21782ea57c2f68"
+}

common/credential-storage/src/persistent_storage/mod.rs

@@ -3,27 +3,35 @@
 
 mod legacy_helpers;
 
-use crate::backends::sqlite::{
-    get_next_unspent_ticketbook, increase_used_ticketbook_tickets, SqliteEcashTicketbookManager,
+use crate::{
+    backends::sqlite::{
+        get_next_unspent_ticketbook, increase_used_ticketbook_tickets, SqliteEcashTicketbookManager,
+    },
+    error::StorageError,
+    models::{BasicTicketbookInformation, RetrievedPendingTicketbook, RetrievedTicketbook},
+    persistent_storage::legacy_helpers::{
+        deserialise_v1_coin_index_signatures, deserialise_v1_expiration_date_signatures,
+        deserialise_v1_master_verification_key,
+    },
+    storage::Storage,
 };
-use crate::error::StorageError;
-use crate::models::{BasicTicketbookInformation, RetrievedPendingTicketbook, RetrievedTicketbook};
-use crate::persistent_storage::legacy_helpers::{
-    deserialise_v1_coin_index_signatures, deserialise_v1_expiration_date_signatures,
-    deserialise_v1_master_verification_key,
-};
-use crate::storage::Storage;
 use async_trait::async_trait;
 use log::{debug, error};
-use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
-use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
-use nym_compact_ecash::VerificationKeyAuth;
-use nym_credentials::ecash::bandwidth::serialiser::keys::EpochVerificationKey;
-use nym_credentials::ecash::bandwidth::serialiser::signatures::{
-    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures,
+use nym_compact_ecash::{
+    scheme::{
+        coin_indices_signatures::AnnotatedCoinIndexSignature,
+        expiration_date_signatures::AnnotatedExpirationDateSignature,
+    },
+    VerificationKeyAuth,
+};
+use nym_credentials::{
+    ecash::bandwidth::serialiser::{
+        keys::EpochVerificationKey,
+        signatures::{AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures},
+        VersionedSerialise,
+    },
+    IssuanceTicketBook, IssuedTicketBook,
 };
-use nym_credentials::ecash::bandwidth::serialiser::VersionedSerialise;
-use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
 use nym_ecash_time::{ecash_today, Date, EcashTime};
 use sqlx::ConnectOptions;
 use std::path::Path;
@@ -47,11 +55,10 @@ impl PersistentStorage {
             database_path.as_ref().as_os_str()
         );
 
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .filename(database_path)
-            .create_if_missing(true);
-
-        opts.disable_statement_logging();
+            .create_if_missing(true)
+            .disable_statement_logging();
 
         let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
             Ok(db) => db,
@@ -179,7 +186,7 @@ impl Storage for PersistentStorage {
 
         // we don't want ticketbooks with expiration in the past
         let Some(raw) =
-            get_next_unspent_ticketbook(&mut tx, ticketbook_type, deadline, tickets).await?
+            get_next_unspent_ticketbook(&mut *tx, ticketbook_type, deadline, tickets).await?
         else {
             // make sure to finish our tx
             tx.commit().await?;
@@ -194,7 +201,7 @@ impl Storage for PersistentStorage {
                     ))
                 })?;
 
-        increase_used_ticketbook_tickets(&mut tx, raw.id, tickets).await?;
+        increase_used_ticketbook_tickets(&mut *tx, raw.id, tickets).await?;
         tx.commit().await?;
 
         // set the number of spent tickets on the crypto object

common/credential-verification/src/ecash/double_spending.rs

@@ -1,100 +0,0 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
-use crate::ecash::error::EcashTicketError;
-use crate::ecash::state::SharedState;
-use nym_ecash_double_spending::DoubleSpendingFilter;
-use nym_gateway_storage::Storage;
-use nym_task::TaskClient;
-use nym_validator_client::client::NymApiClientExt;
-use nym_validator_client::EcashApiClient;
-use rand::prelude::SliceRandom;
-use rand::thread_rng;
-use std::sync::Arc;
-use tokio::sync::{RwLock, RwLockReadGuard};
-use tokio::time::{interval, Duration};
-use tracing::{info, trace, warn};
-
-#[derive(Clone)]
-pub(crate) struct DoubleSpendingDetector<S> {
-    spent_serial_numbers: Arc<RwLock<DoubleSpendingFilter>>,
-    shared_state: SharedState<S>,
-}
-
-impl<S> DoubleSpendingDetector<S>
-where
-    S: Storage + Clone + Send + Sync + 'static,
-{
-    pub(crate) fn new(shared_state: SharedState<S>) -> Self {
-        DoubleSpendingDetector {
-            spent_serial_numbers: Arc::new(RwLock::new(DoubleSpendingFilter::new_empty_ecash())),
-            shared_state,
-        }
-    }
-
-    pub(crate) async fn check(&self, serial_number: &Vec<u8>) -> bool {
-        self.spent_serial_numbers.read().await.check(serial_number)
-    }
-
-    async fn latest_api_endpoints(
-        &self,
-    ) -> Result<RwLockReadGuard<Vec<EcashApiClient>>, EcashTicketError> {
-        let epoch_id = self.shared_state.current_epoch_id().await?;
-        self.shared_state.api_clients(epoch_id).await
-    }
-
-    async fn refresh_bloomfilter(&self) {
-        let mut filter_builder = self.spent_serial_numbers.read().await.rebuild();
-
-        let api_clients = match self.latest_api_endpoints().await {
-            Ok(clients) => clients,
-            Err(err) => {
-                warn!("failed to obtain current api clients: {err}");
-                return;
-            }
-        };
-
-        let mut clients = api_clients
-            .iter()
-            .map(|c| c.api_client.clone())
-            .collect::<Vec<_>>();
-        clients.shuffle(&mut thread_rng());
-
-        for client in clients {
-            match client.nym_api.double_spending_filter_v1().await {
-                Ok(response) => {
-                    // due to relative big size of the filter, query only one api since all of them should contain
-                    // roughly the same data anyway.
-                    filter_builder.add_bytes(&response.bitmap);
-                    *self.spent_serial_numbers.write().await = filter_builder.build();
-                    return;
-                }
-                Err(err) => {
-                    warn!("Validator @ {} could not be reached. There might be a problem with the ecash endpoint: {err}", client.api_url());
-                }
-            }
-        }
-
-        warn!("none of the validators could be reached. the bloomfilter will remain unchanged.");
-    }
-
-    async fn run(&self, mut shutdown: TaskClient) {
-        info!("Starting Ecash DoubleSpendingDetector");
-        let mut interval = interval(Duration::from_secs(600));
-
-        while !shutdown.is_shutdown() {
-            tokio::select! {
-                biased;
-                _ = shutdown.recv() => {
-                    trace!("ecash_verifier::DoubleSpendingDetector : received shutdown");
-                },
-                _ = interval.tick() => self.refresh_bloomfilter().await,
-
-            }
-        }
-    }
-
-    pub(crate) fn start(self, shutdown: nym_task::TaskClient) {
-        tokio::spawn(async move { self.run(shutdown).await });
-    }
-}

common/credential-verification/src/ecash/mod.rs

@@ -4,7 +4,6 @@
 use crate::Error;
 use credential_sender::CredentialHandler;
 use credential_sender::CredentialHandlerConfig;
-use double_spending::DoubleSpendingDetector;
 use error::EcashTicketError;
 use futures::channel::mpsc::{self, UnboundedSender};
 use nym_credentials::CredentialSpendingData;
@@ -18,7 +17,6 @@ use tokio::sync::{Mutex, RwLockReadGuard};
 use tracing::error;
 
 pub mod credential_sender;
-pub(crate) mod double_spending;
 pub mod error;
 mod helpers;
 mod state;
@@ -31,7 +29,6 @@ pub struct EcashManager<S> {
     pk_bytes: [u8; 32], // bytes representation of a pub key representing the verifier
     pay_infos: Mutex<Vec<NymPayInfo>>,
     cred_sender: UnboundedSender<ClientTicket>,
-    double_spend_detector: DoubleSpendingDetector<S>,
 }
 
 impl<S> EcashManager<S>
@@ -47,9 +44,6 @@ where
     ) -> Result<Self, Error> {
         let shared_state = SharedState::new(nyxd_client, storage).await?;
 
-        let double_spend_detector = DoubleSpendingDetector::new(shared_state.clone());
-        double_spend_detector.clone().start(shutdown.clone());
-
         let (cred_sender, cred_receiver) = mpsc::unbounded();
 
         let cs =
@@ -62,7 +56,6 @@ where
             pk_bytes,
             pay_infos: Default::default(),
             cred_sender,
-            double_spend_detector,
         })
     }
 
@@ -163,10 +156,6 @@ where
         Ok(())
     }
 
-    pub async fn check_double_spend(&self, serial_number: &Vec<u8>) -> bool {
-        self.double_spend_detector.check(serial_number).await
-    }
-
     pub fn async_verify(&self, ticket: ClientTicket) {
         // TODO: I guess do something for shutdowns
         let _ = self

common/credential-verification/src/lib.rs

@@ -53,18 +53,6 @@ impl<S: Storage + Clone + 'static> CredentialVerifier<S> {
         Ok(())
     }
 
-    async fn check_bloomfilter(&self, serial_number: &Vec<u8>) -> Result<()> {
-        trace!("checking the bloomfilter...");
-
-        let spent = self.ecash_verifier.check_double_spend(serial_number).await;
-
-        if spent {
-            trace!("the credential has already been spent before at some gateway before (bloomfilter failure)");
-            return Err(Error::BandwidthCredentialAlreadySpent);
-        }
-        Ok(())
-    }
-
     async fn check_local_db_for_double_spending(&self, serial_number: &[u8]) -> Result<()> {
         trace!("checking local db for double spending...");
 
@@ -128,7 +116,6 @@ impl<S: Storage + Clone + 'static> CredentialVerifier<S> {
         }
 
         self.check_credential_spending_date(spend_date.ecash_date())?;
-        self.check_bloomfilter(&serial_number).await?;
         self.check_local_db_for_double_spending(&serial_number)
             .await?;
 

common/crypto/src/asymmetric/encryption/mod.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
-use std::fmt::{self, Display, Formatter};
+use std::fmt::{self, Debug, Display, Formatter};
 use std::str::FromStr;
 use thiserror::Error;
 use zeroize::{Zeroize, ZeroizeOnDrop};
@@ -112,12 +112,18 @@ impl PemStorableKeyPair for KeyPair {
     }
 }
 
-#[derive(PartialEq, Eq, Hash, Copy, Clone, Debug)]
+#[derive(PartialEq, Eq, Hash, Copy, Clone)]
 pub struct PublicKey(x25519_dalek::PublicKey);
 
 impl Display for PublicKey {
     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", self.to_base58_string())
+        Display::fmt(&self.to_base58_string(), f)
+    }
+}
+
+impl Debug for PublicKey {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        Debug::fmt(&self.to_base58_string(), f)
     }
 }
 

common/crypto/src/asymmetric/encryption/serde_helpers.rs

@@ -31,8 +31,16 @@ pub mod option_bs58_x25519_pubkey {
     pub fn deserialize<'de, D: Deserializer<'de>>(
         deserializer: D,
     ) -> Result<Option<PublicKey>, D::Error> {
-        let s = Option::<String>::deserialize(deserializer)?;
-        s.map(|s| PublicKey::from_base58_string(&s).map_err(serde::de::Error::custom))
-            .transpose()
+        match Option::<String>::deserialize(deserializer)? {
+            None => Ok(None),
+            Some(s) => {
+                if s.is_empty() {
+                    Ok(None)
+                } else {
+                    Some(PublicKey::from_base58_string(&s).map_err(serde::de::Error::custom))
+                        .transpose()
+                }
+            }
+        }
     }
 }

common/crypto/src/asymmetric/identity/mod.rs

@@ -5,7 +5,7 @@ pub use ed25519_dalek::SignatureError;
 use ed25519_dalek::{Signer, SigningKey};
 pub use ed25519_dalek::{Verifier, PUBLIC_KEY_LENGTH, SECRET_KEY_LENGTH, SIGNATURE_LENGTH};
 use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
-use std::fmt::{self, Display, Formatter};
+use std::fmt::{self, Debug, Display, Formatter};
 use std::str::FromStr;
 use thiserror::Error;
 use zeroize::{Zeroize, ZeroizeOnDrop};
@@ -119,12 +119,18 @@ impl PemStorableKeyPair for KeyPair {
 }
 
 /// ed25519 EdDSA Public Key
-#[derive(Debug, Copy, Clone, Eq, PartialEq)]
+#[derive(Copy, Clone, Eq, PartialEq)]
 pub struct PublicKey(ed25519_dalek::VerifyingKey);
 
 impl Display for PublicKey {
     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", self.to_base58_string())
+        Display::fmt(&self.to_base58_string(), f)
+    }
+}
+
+impl Debug for PublicKey {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        Debug::fmt(&self.to_base58_string(), f)
     }
 }
 

common/gateway-stats-storage/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "nym-gateway-stats-storage"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+sqlx = { workspace = true, features = [
+    "runtime-tokio-rustls",
+    "sqlite",
+    "macros",
+    "migrate",
+    "time",
+] }
+time = { workspace = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+
+nym-sphinx = { path = "../nymsphinx" }
+nym-credentials-interface = { path = "../credentials-interface" }
+
+
+[build-dependencies]
+tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+sqlx = { workspace = true, features = [
+    "runtime-tokio-rustls",
+    "sqlite",
+    "macros",
+    "migrate",
+] }

common/gateway-stats-storage/build.rs

@@ -0,0 +1,28 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use sqlx::{Connection, SqliteConnection};
+use std::env;
+
+#[tokio::main]
+async fn main() {
+    let out_dir = env::var("OUT_DIR").unwrap();
+    let database_path = format!("{}/gateway-stats-example.sqlite", out_dir);
+
+    let mut conn = SqliteConnection::connect(&format!("sqlite://{}?mode=rwc", database_path))
+        .await
+        .expect("Failed to create SQLx database connection");
+
+    sqlx::migrate!("./migrations")
+        .run(&mut conn)
+        .await
+        .expect("Failed to perform SQLx migrations");
+
+    #[cfg(target_family = "unix")]
+    println!("cargo:rustc-env=DATABASE_URL=sqlite://{}", &database_path);
+
+    #[cfg(target_family = "windows")]
+    // for some strange reason we need to add a leading `/` to the windows path even though it's
+    // not a valid windows path... but hey, it works...
+    println!("cargo:rustc-env=DATABASE_URL=sqlite:///{}", &database_path);
+}

common/gateway-stats-storage/migrations/20241017120000_create_initial_tables.sql

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+CREATE TABLE sessions_active
+(
+    client_address  TEXT                        NOT NULL PRIMARY KEY UNIQUE,
+    start_time      TIMESTAMP WITHOUT TIME ZONE NOT NULL,
+    typ             TEXT                        NOT NULL
+);
+
+CREATE TABLE sessions_finished
+(
+    id          INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    day         DATE    NOT NULL,
+    duration_ms INTEGER NOT NULL,
+    typ         TEXT    NOT NULL
+);
+
+CREATE TABLE sessions_unique_users
+(
+    day             DATE    NOT NULL,
+    client_address  TEXT    NOT NULL,
+    PRIMARY KEY (day, client_address)
+);

common/gateway-stats-storage/src/error.rs

@@ -0,0 +1,13 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum StatsStorageError {
+    #[error("Database experienced an internal error: {0}")]
+    InternalDatabaseError(#[from] sqlx::Error),
+
+    #[error("Failed to perform database migration: {0}")]
+    MigrationError(#[from] sqlx::migrate::MigrateError),
+}

common/gateway-stats-storage/src/lib.rs

@@ -0,0 +1,195 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use error::StatsStorageError;
+use models::{ActiveSession, FinishedSession, SessionType, StoredFinishedSession};
+use nym_sphinx::DestinationAddressBytes;
+use sessions::SessionManager;
+use sqlx::ConnectOptions;
+use std::path::Path;
+use time::Date;
+use tracing::{debug, error};
+
+pub mod error;
+pub mod models;
+mod sessions;
+
+// note that clone here is fine as upon cloning the same underlying pool will be used
+#[derive(Clone)]
+pub struct PersistentStatsStorage {
+    session_manager: SessionManager,
+}
+
+impl PersistentStatsStorage {
+    /// Initialises `PersistentStatsStorage` using the provided path.
+    ///
+    /// # Arguments
+    ///
+    /// * `database_path`: path to the database.
+    pub async fn init<P: AsRef<Path> + Send>(database_path: P) -> Result<Self, StatsStorageError> {
+        debug!(
+            "Attempting to connect to database {:?}",
+            database_path.as_ref().as_os_str()
+        );
+
+        // TODO: we can inject here more stuff based on our gateway global config
+        // struct. Maybe different pool size or timeout intervals?
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
+            .filename(database_path)
+            .create_if_missing(true)
+            .disable_statement_logging();
+
+        // TODO: do we want auto_vacuum ?
+
+        let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
+            Ok(db) => db,
+            Err(err) => {
+                error!("Failed to connect to SQLx database: {err}");
+                return Err(err.into());
+            }
+        };
+
+        if let Err(err) = sqlx::migrate!("./migrations").run(&connection_pool).await {
+            error!("Failed to perform migration on the SQLx database: {err}");
+            return Err(err.into());
+        }
+
+        // the cloning here are cheap as connection pool is stored behind an Arc
+        Ok(PersistentStatsStorage {
+            session_manager: sessions::SessionManager::new(connection_pool),
+        })
+    }
+
+    //Sessions fn
+    pub async fn insert_finished_session(
+        &self,
+        date: Date,
+        session: FinishedSession,
+    ) -> Result<(), StatsStorageError> {
+        Ok(self
+            .session_manager
+            .insert_finished_session(
+                date,
+                session.duration.whole_milliseconds() as i64,
+                session.typ.to_string().into(),
+            )
+            .await?)
+    }
+
+    pub async fn get_finished_sessions(
+        &self,
+        date: Date,
+    ) -> Result<Vec<StoredFinishedSession>, StatsStorageError> {
+        Ok(self.session_manager.get_finished_sessions(date).await?)
+    }
+
+    pub async fn delete_finished_sessions(
+        &self,
+        before_date: Date,
+    ) -> Result<(), StatsStorageError> {
+        Ok(self
+            .session_manager
+            .delete_finished_sessions(before_date)
+            .await?)
+    }
+
+    pub async fn insert_unique_user(
+        &self,
+        date: Date,
+        client_address_bs58: String,
+    ) -> Result<(), StatsStorageError> {
+        Ok(self
+            .session_manager
+            .insert_unique_user(date, client_address_bs58)
+            .await?)
+    }
+
+    pub async fn get_unique_users_count(&self, date: Date) -> Result<i32, StatsStorageError> {
+        Ok(self.session_manager.get_unique_users_count(date).await?)
+    }
+
+    pub async fn delete_unique_users(&self, before_date: Date) -> Result<(), StatsStorageError> {
+        Ok(self
+            .session_manager
+            .delete_unique_users(before_date)
+            .await?)
+    }
+
+    pub async fn insert_active_session(
+        &self,
+        client_address: DestinationAddressBytes,
+        session: ActiveSession,
+    ) -> Result<(), StatsStorageError> {
+        Ok(self
+            .session_manager
+            .insert_active_session(
+                client_address.as_base58_string(),
+                session.start,
+                session.typ.to_string().into(),
+            )
+            .await?)
+    }
+
+    pub async fn update_active_session_type(
+        &self,
+        client_address: DestinationAddressBytes,
+        session_type: SessionType,
+    ) -> Result<(), StatsStorageError> {
+        Ok(self
+            .session_manager
+            .update_active_session_type(
+                client_address.as_base58_string(),
+                session_type.to_string().into(),
+            )
+            .await?)
+    }
+
+    pub async fn get_active_session(
+        &self,
+        client_address: DestinationAddressBytes,
+    ) -> Result<Option<ActiveSession>, StatsStorageError> {
+        Ok(self
+            .session_manager
+            .get_active_session(client_address.as_base58_string())
+            .await?
+            .map(Into::into))
+    }
+
+    pub async fn get_all_active_sessions(&self) -> Result<Vec<ActiveSession>, StatsStorageError> {
+        Ok(self
+            .session_manager
+            .get_all_active_sessions()
+            .await?
+            .into_iter()
+            .map(Into::into)
+            .collect())
+    }
+
+    pub async fn get_started_sessions_count(
+        &self,
+        start_date: Date,
+    ) -> Result<i32, StatsStorageError> {
+        Ok(self
+            .session_manager
+            .get_started_sessions_count(start_date)
+            .await?)
+    }
+
+    pub async fn get_active_users(&self) -> Result<Vec<String>, StatsStorageError> {
+        Ok(self.session_manager.get_active_users().await?)
+    }
+
+    pub async fn delete_active_session(
+        &self,
+        client_address: DestinationAddressBytes,
+    ) -> Result<(), StatsStorageError> {
+        Ok(self
+            .session_manager
+            .delete_active_session(client_address.as_base58_string())
+            .await?)
+    }
+
+    pub async fn cleanup_active_sessions(&self) -> Result<(), StatsStorageError> {
+        Ok(self.session_manager.cleanup_active_sessions().await?)
+    }
+}

common/gateway-stats-storage/src/models.rs

@@ -0,0 +1,109 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use nym_credentials_interface::TicketType;
+use sqlx::prelude::FromRow;
+use time::{Duration, OffsetDateTime};
+
+#[derive(FromRow)]
+pub struct StoredFinishedSession {
+    duration_ms: i64,
+    typ: String,
+}
+
+impl StoredFinishedSession {
+    pub fn serialize(&self) -> (u64, String) {
+        (
+            self.duration_ms as u64, //we are sure that it fits in a u64, see `fn end_at`
+            self.typ.clone(),
+        )
+    }
+}
+
+pub struct FinishedSession {
+    pub duration: Duration,
+    pub typ: SessionType,
+}
+
+#[derive(PartialEq)]
+pub enum SessionType {
+    Vpn,
+    Mixnet,
+    Unknown,
+}
+
+impl SessionType {
+    pub fn to_string(&self) -> &str {
+        match self {
+            Self::Vpn => "vpn",
+            Self::Mixnet => "mixnet",
+            Self::Unknown => "unknown",
+        }
+    }
+
+    pub fn from_string(s: &str) -> Self {
+        match s {
+            "vpn" => Self::Vpn,
+            "mixnet" => Self::Mixnet,
+            _ => Self::Unknown,
+        }
+    }
+}
+
+impl From<TicketType> for SessionType {
+    fn from(value: TicketType) -> Self {
+        match value {
+            TicketType::V1MixnetEntry => Self::Mixnet,
+            TicketType::V1MixnetExit => Self::Mixnet,
+            TicketType::V1WireguardEntry => Self::Vpn,
+            TicketType::V1WireguardExit => Self::Vpn,
+        }
+    }
+}
+
+#[derive(FromRow)]
+pub(crate) struct StoredActiveSession {
+    start_time: OffsetDateTime,
+    typ: String,
+}
+
+pub struct ActiveSession {
+    pub start: OffsetDateTime,
+    pub typ: SessionType,
+}
+
+impl ActiveSession {
+    pub fn new(start_time: OffsetDateTime) -> Self {
+        ActiveSession {
+            start: start_time,
+            typ: SessionType::Unknown,
+        }
+    }
+
+    pub fn set_type(&mut self, ticket_type: TicketType) {
+        self.typ = ticket_type.into();
+    }
+
+    pub fn end_at(self, stop_time: OffsetDateTime) -> Option<FinishedSession> {
+        let session_duration = stop_time - self.start;
+        //ensure duration is positive to fit in a u64
+        //u64::max milliseconds is 500k millenia so no overflow issue
+        if session_duration > Duration::ZERO {
+            Some(FinishedSession {
+                duration: session_duration,
+                typ: self.typ,
+            })
+        } else {
+            None
+        }
+    }
+}
+
+impl From<StoredActiveSession> for ActiveSession {
+    fn from(value: StoredActiveSession) -> Self {
+        ActiveSession {
+            start: value.start_time,
+            typ: SessionType::from_string(&value.typ),
+        }
+    }
+}

common/gateway-stats-storage/src/sessions.rs

@@ -0,0 +1,177 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use time::{Date, OffsetDateTime};
+
+use crate::models::{StoredActiveSession, StoredFinishedSession};
+
+pub(crate) type Result<T> = std::result::Result<T, sqlx::Error>;
+
+#[derive(Clone)]
+pub(crate) struct SessionManager {
+    connection_pool: sqlx::SqlitePool,
+}
+
+impl SessionManager {
+    /// Creates new instance of the `SessionsManager` with the provided sqlite connection pool.
+    ///
+    /// # Arguments
+    ///
+    /// * `connection_pool`: database connection pool to use.
+    pub(crate) fn new(connection_pool: sqlx::SqlitePool) -> Self {
+        SessionManager { connection_pool }
+    }
+
+    pub(crate) async fn insert_finished_session(
+        &self,
+        date: Date,
+        duration_ms: i64,
+        typ: String,
+    ) -> Result<()> {
+        sqlx::query!(
+            "INSERT INTO sessions_finished (day, duration_ms, typ) VALUES (?, ?, ?)",
+            date,
+            duration_ms,
+            typ
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_finished_sessions(
+        &self,
+        date: Date,
+    ) -> Result<Vec<StoredFinishedSession>> {
+        sqlx::query_as("SELECT duration_ms, typ FROM sessions_finished WHERE day = ?")
+            .bind(date)
+            .fetch_all(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn delete_finished_sessions(&self, before_date: Date) -> Result<()> {
+        sqlx::query!("DELETE FROM sessions_finished WHERE day <= ? ", before_date)
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn insert_unique_user(
+        &self,
+        date: Date,
+        client_address_b58: String,
+    ) -> Result<()> {
+        sqlx::query!(
+            "INSERT OR IGNORE INTO sessions_unique_users (day, client_address) VALUES (?, ?)",
+            date,
+            client_address_b58,
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_unique_users_count(&self, date: Date) -> Result<i32> {
+        Ok(sqlx::query!(
+            "SELECT COUNT(*) as count FROM sessions_unique_users WHERE day = ?",
+            date
+        )
+        .fetch_one(&self.connection_pool)
+        .await?
+        .count)
+    }
+
+    pub(crate) async fn delete_unique_users(&self, before_date: Date) -> Result<()> {
+        sqlx::query!(
+            "DELETE FROM sessions_unique_users WHERE day <= ? ",
+            before_date
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn insert_active_session(
+        &self,
+        client_address_b58: String,
+        start_time: OffsetDateTime,
+        typ: String,
+    ) -> Result<()> {
+        sqlx::query!(
+            "INSERT INTO sessions_active (client_address, start_time, typ) VALUES (?, ?, ?)",
+            client_address_b58,
+            start_time,
+            typ
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn update_active_session_type(
+        &self,
+        client_address_b58: String,
+        typ: String,
+    ) -> Result<()> {
+        sqlx::query!(
+            "UPDATE sessions_active SET typ = ? WHERE client_address = ?",
+            typ,
+            client_address_b58,
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_active_session(
+        &self,
+        client_address_b58: String,
+    ) -> Result<Option<StoredActiveSession>> {
+        sqlx::query_as("SELECT start_time, typ FROM sessions_active WHERE client_address = ?")
+            .bind(client_address_b58)
+            .fetch_optional(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn get_all_active_sessions(&self) -> Result<Vec<StoredActiveSession>> {
+        sqlx::query_as("SELECT start_time, typ FROM sessions_active")
+            .fetch_all(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn get_started_sessions_count(&self, start_date: Date) -> Result<i32> {
+        Ok(sqlx::query!(
+            "SELECT COUNT(*) as count FROM sessions_active WHERE date(start_time) = ?",
+            start_date
+        )
+        .fetch_one(&self.connection_pool)
+        .await?
+        .count)
+    }
+
+    pub(crate) async fn get_active_users(&self) -> Result<Vec<String>> {
+        Ok(sqlx::query!("SELECT client_address from sessions_active")
+            .fetch_all(&self.connection_pool)
+            .await?
+            .into_iter()
+            .map(|record| record.client_address)
+            .collect())
+    }
+
+    pub(crate) async fn delete_active_session(&self, client_address_b58: String) -> Result<()> {
+        sqlx::query!(
+            "DELETE FROM sessions_active WHERE client_address = ?",
+            client_address_b58
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn cleanup_active_sessions(&self) -> Result<()> {
+        sqlx::query!("DELETE FROM sessions_active")
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+}

common/gateway-storage/.sqlx/query-03fe56298a6d60cdd5304a2953811a533d59b4f1f0e4efecd32c09256b657e24.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                    SELECT \n                        id as \"id!\",\n                        client_address_bs58 as \"client_address_bs58!\",\n                        content as \"content!\" \n                    FROM message_store \n                    WHERE client_address_bs58 = ? AND id > ?\n                    ORDER BY id ASC\n                    LIMIT ?;\n                ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id!",
+        "ordinal": 0,
+        "type_info": "Int64"
+      },
+      {
+        "name": "client_address_bs58!",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "content!",
+        "ordinal": 2,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "03fe56298a6d60cdd5304a2953811a533d59b4f1f0e4efecd32c09256b657e24"
+}

common/gateway-storage/.sqlx/query-0aaf87e0bec011910fa23aefa9a487247eb416d4203ab22b787fdcf15e47e586.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM ticket_verification WHERE ticket_id = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "0aaf87e0bec011910fa23aefa9a487247eb416d4203ab22b787fdcf15e47e586"
+}

common/gateway-storage/.sqlx/query-10af1fe50f990be860548c7cc7ff051ab7d5cd812627a17758c0c8922593b9fd.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM message_store WHERE id = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "10af1fe50f990be860548c7cc7ff051ab7d5cd812627a17758c0c8922593b9fd"
+}

common/gateway-storage/.sqlx/query-23775a52dcfb001d53ae045898522a8c19a121f11bae07b80bc88e557eb2275e.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                DELETE FROM ticket_data\n                WHERE ticket_id IN (\n                    SELECT ticket_id\n                    FROM verified_tickets\n                    WHERE proposal_id = ?\n                )\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "23775a52dcfb001d53ae045898522a8c19a121f11bae07b80bc88e557eb2275e"
+}

common/gateway-storage/.sqlx/query-24ce2c053db635df05d98529023a84bf91a622d4b75ad173976e0234c6380a7d.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT OR IGNORE INTO wireguard_peer(public_key, preshared_key, protocol_version, endpoint, last_handshake, tx_bytes, rx_bytes, persistent_keepalive_interval, allowed_ips, client_id)\n                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?);\n\n                UPDATE wireguard_peer \n                SET preshared_key = ?, protocol_version = ?, endpoint = ?, last_handshake = ?, tx_bytes = ?, rx_bytes = ?, persistent_keepalive_interval = ?, allowed_ips = ?, client_id = ?\n                WHERE public_key = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 20
+    },
+    "nullable": []
+  },
+  "hash": "24ce2c053db635df05d98529023a84bf91a622d4b75ad173976e0234c6380a7d"
+}

common/gateway-storage/.sqlx/query-2a55441d4e6134975b2c75f0b43491e9cf7bb52f41644d45c92e4b83f60b65cc.json

@@ -0,0 +1,74 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                    SELECT *\n                    FROM wireguard_peer;\n                ",
+  "describe": {
+    "columns": [
+      {
+        "name": "public_key",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "preshared_key",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "protocol_version",
+        "ordinal": 2,
+        "type_info": "Int64"
+      },
+      {
+        "name": "endpoint",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "last_handshake",
+        "ordinal": 4,
+        "type_info": "Datetime"
+      },
+      {
+        "name": "tx_bytes",
+        "ordinal": 5,
+        "type_info": "Int64"
+      },
+      {
+        "name": "rx_bytes",
+        "ordinal": 6,
+        "type_info": "Int64"
+      },
+      {
+        "name": "persistent_keepalive_interval",
+        "ordinal": 7,
+        "type_info": "Int64"
+      },
+      {
+        "name": "allowed_ips",
+        "ordinal": 8,
+        "type_info": "Blob"
+      },
+      {
+        "name": "client_id",
+        "ordinal": 9,
+        "type_info": "Int64"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "2a55441d4e6134975b2c75f0b43491e9cf7bb52f41644d45c92e4b83f60b65cc"
+}

common/gateway-storage/.sqlx/query-36b5b40e6466b67f6027257068438e4e45dd6506d806a25ce3a4c69723216fd3.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT signer_id FROM ecash_signer WHERE epoch_id = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "signer_id",
+        "ordinal": 0,
+        "type_info": "Int64"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "36b5b40e6466b67f6027257068438e4e45dd6506d806a25ce3a4c69723216fd3"
+}

common/gateway-storage/.sqlx/query-3fa406efeffd9952af3cb044b028eb6d1770c694cf84097222c2bcf299fec680.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE available_bandwidth\n                SET available = available - ?\n                WHERE client_id = (SELECT client_id FROM received_ticket WHERE id = ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "3fa406efeffd9952af3cb044b028eb6d1770c694cf84097222c2bcf299fec680"
+}

common/gateway-storage/.sqlx/query-4642e5d93b4bb38b980d02c4cec2569ee16c78e2a71d9bab04b64314aedf4ac0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM shared_keys WHERE client_address_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "4642e5d93b4bb38b980d02c4cec2569ee16c78e2a71d9bab04b64314aedf4ac0"
+}

common/gateway-storage/.sqlx/query-4a142e21e2646dfcda32ed5dcd3f0b915bda6266a55b83c8c667fdbcfc90745b.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM verified_tickets WHERE proposal_id = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "4a142e21e2646dfcda32ed5dcd3f0b915bda6266a55b83c8c667fdbcfc90745b"
+}

common/gateway-storage/.sqlx/query-52406dc7b69af59d206542105d3b87114e3b9eda6dfaad180f2d154bc258d6bf.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "UPDATE redemption_proposals SET resolved_at = ?, rejected = ? WHERE proposal_id = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "52406dc7b69af59d206542105d3b87114e3b9eda6dfaad180f2d154bc258d6bf"
+}

common/gateway-storage/.sqlx/query-564c7da81081fab34754b76eeeedd48f3bc18842c03ef5a5c331bbee4c41c71c.json

@@ -0,0 +1,38 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM shared_keys WHERE client_address_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "client_id",
+        "ordinal": 0,
+        "type_info": "Int64"
+      },
+      {
+        "name": "client_address_bs58",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 3,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "564c7da81081fab34754b76eeeedd48f3bc18842c03ef5a5c331bbee4c41c71c"
+}

common/gateway-storage/.sqlx/query-58ba6fb669847d7b82440178bc3ffd8de03c0308d0fc9cb8615a5d151e785864.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "INSERT INTO message_store(client_address_bs58, content) VALUES (?, ?)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "58ba6fb669847d7b82440178bc3ffd8de03c0308d0fc9cb8615a5d151e785864"
+}

common/gateway-storage/.sqlx/query-5ee58c3050595614d550558879f54696dfcbddfb1b8575f5cc9690c4c2bffe25.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT client_id FROM shared_keys WHERE client_address_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "client_id",
+        "ordinal": 0,
+        "type_info": "Int64"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5ee58c3050595614d550558879f54696dfcbddfb1b8575f5cc9690c4c2bffe25"
+}

common/gateway-storage/.sqlx/query-61c0a61db0eed4ccbe3c623de183a0df5fbe61dff0048b3ab4b6823a7b248239.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE available_bandwidth\n                SET expiration = ?\n                WHERE client_id = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "61c0a61db0eed4ccbe3c623de183a0df5fbe61dff0048b3ab4b6823a7b248239"
+}

common/gateway-storage/.sqlx/query-6c4a1c08a08714be34fe9bda2d2c9c7fb6a4e25272c1addfad87e26e7b16dfdc.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "INSERT INTO verified_tickets (ticket_id) VALUES (?)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "6c4a1c08a08714be34fe9bda2d2c9c7fb6a4e25272c1addfad87e26e7b16dfdc"
+}

common/gateway-storage/.sqlx/query-72b268030ca7409c86806d6b5b253272629a3ebda7b89feacf8ed07ecf2e2c13.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "\n            SELECT id, client_type as \"client_type: ClientType\"\n            FROM clients\n            WHERE id = ?\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id",
+        "ordinal": 0,
+        "type_info": "Int64"
+      },
+      {
+        "name": "client_type: ClientType",
+        "ordinal": 1,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "72b268030ca7409c86806d6b5b253272629a3ebda7b89feacf8ed07ecf2e2c13"
+}

common/gateway-storage/.sqlx/query-73e111225be2ce63d05f1a439a1fc9cc0359a960fe17a135a1d7f8975ebe38ef.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                SELECT t1.ticket_id, t1.data as \"data!\"\n                    FROM ticket_data as t1\n                LEFT JOIN verified_tickets as t2\n                ON t1.ticket_id = t2.ticket_id\n                WHERE\n                    t2.ticket_id IS NULL\n                AND\n                    t1.data IS NOT NULL\n        ",
+  "describe": {
+    "columns": [
+      {
+        "name": "ticket_id",
+        "ordinal": 0,
+        "type_info": "Int64"
+      },
+      {
+        "name": "data!",
+        "ordinal": 1,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "73e111225be2ce63d05f1a439a1fc9cc0359a960fe17a135a1d7f8975ebe38ef"
+}

common/gateway-storage/.sqlx/query-76b91895b5cd8b4815f4e5b183117c16b6a36c180d9081ab2cce9992792e5a6a.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE available_bandwidth\n                SET available = available + ?\n                WHERE client_id = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "76b91895b5cd8b4815f4e5b183117c16b6a36c180d9081ab2cce9992792e5a6a"
+}

common/gateway-storage/.sqlx/query-7cd38d342eddd578f35116cf024901f94bbf5575595e36345e1d25085a79b039.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "INSERT INTO ticket_data(ticket_id, serial_number, data) VALUES (?, ?, ?)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "7cd38d342eddd578f35116cf024901f94bbf5575595e36345e1d25085a79b039"
+}

common/gateway-storage/.sqlx/query-7f8af0799d7ae5f751b9964e9566589bf768e7079079f584beb0c1ba16d43a5c.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT EXISTS (SELECT 1 FROM ticket_data WHERE serial_number = ?) AS 'exists'",
+  "describe": {
+    "columns": [
+      {
+        "name": "exists",
+        "ordinal": 0,
+        "type_info": "Int"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "7f8af0799d7ae5f751b9964e9566589bf768e7079079f584beb0c1ba16d43a5c"
+}