✨ server: add bridge fee window tracking

Author: mainqueg

.changeset/swift-foxes-track.md

@@ -0,0 +1,5 @@
+---
+"@exactly/server": patch
+---
+
+✨ add bridge fee window tracking

server/api/ramp.ts

@@ -5,6 +5,7 @@ import { Hono } from "hono";
 import {
   array,
   literal,
+  number,
   object,
   optional,
   parse,
@@ -371,6 +372,13 @@ const ProviderInfo = variant("provider", [
           ]),
         ]),
       ),
+      sponsoredFees: optional(
+        object({
+          windowMs: number(),
+          volume: object({ available: string(), threshold: string(), symbol: string() }),
+          count: object({ available: string(), threshold: string() }),
+        }),
+      ),
     }),
     status: ProviderStatus,
     tosLink: optional(string()),

server/hooks/bridge.ts

@@ -5,14 +5,14 @@ import { and, DrizzleQueryError, eq, isNull } from "drizzle-orm";
 import { Hono } from "hono";
 import { validator } from "hono/validator";
 import { createHash, createVerify } from "node:crypto";
-import { literal, object, parse, picklist, string, unknown, variant } from "valibot";
+import { check, literal, object, parse, picklist, pipe, string, unknown, variant } from "valibot";
 
 import { Address } from "@exactly/common/validation";
 
 import database, { credentials } from "../database";
 import { sendPushNotification } from "../utils/onesignal";
 import { searchAccounts } from "../utils/persona";
-import { BridgeCurrency, getCustomer, publicKey } from "../utils/ramps/bridge";
+import { BridgeCurrency, feeWindow, getCustomer, publicKey } from "../utils/ramps/bridge";
 import { track } from "../utils/segment";
 import validatorHook from "../utils/validatorHook";
 
@@ -52,6 +52,10 @@ export default new Hono().post(
       object({
         event_type: literal("liquidation_address.drain.updated.status_transitioned"),
         event_object: object({
+          created_at: pipe(
+            string(),
+            check((v) => !Number.isNaN(new Date(v).getTime()), "invalid date"),
+          ),
           currency: picklist(BridgeCurrency),
           customer_id: string(),
           id: string(),
@@ -77,6 +81,10 @@ export default new Hono().post(
             receipt: object({ initial_amount: string(), final_amount: string() }),
           }),
           object({
+            created_at: pipe(
+              string(),
+              check((v) => !Number.isNaN(new Date(v).getTime()), "invalid date"),
+            ),
             customer_id: string(),
             currency: picklist(BridgeCurrency),
             id: string(),
@@ -181,6 +189,10 @@ export default new Hono().post(
         return c.json({ code: "ok" }, 200);
       case "virtual_account.activity.created":
         if (payload.event_object.type === "payment_submitted") {
+          await feeWindow.report(
+            { bridgeId, eventId: payload.event_object.id, amount: payload.event_object.receipt.initial_amount },
+            new Date(payload.event_object.created_at),
+          );
           sendPushNotification({
             userId: account,
             headings: { en: "Deposited funds" },
@@ -205,6 +217,10 @@ export default new Hono().post(
         return c.json({ code: "ok" }, 200);
       case "liquidation_address.drain.updated.status_transitioned":
         if (payload.event_object.state !== "payment_submitted") return c.json({ code: "ok" }, 200);
+        await feeWindow.report(
+          { bridgeId, eventId: payload.event_object.id, amount: payload.event_object.receipt.outgoing_amount },
+          new Date(payload.event_object.created_at),
+        );
         sendPushNotification({
           userId: account,
           headings: { en: "Deposited funds" },

server/index.ts

@@ -20,6 +20,7 @@ import panda from "./hooks/panda";
 import persona from "./hooks/persona";
 import androidFingerprints from "./utils/android/fingerprints";
 import appOrigin from "./utils/appOrigin";
+import { feeWindow } from "./utils/ramps/bridge";
 import { close as closeRedis } from "./utils/redis";
 import { closeAndFlush as closeSegment } from "./utils/segment";
 
@@ -322,8 +323,9 @@ const server = serve(app);
 export async function close() {
   return new Promise((resolve, reject) => {
     server.close((error) => {
-      Promise.allSettled([closeSentry(), closeRedis(), closeSegment(), database.$client.end()])
-        .then((results) => {
+      Promise.allSettled([feeWindow.stop(), closeSentry(), closeSegment(), database.$client.end()])
+        .then(async (results) => {
+          await closeRedis();
           if (error) reject(error);
           else if (results.some((result) => result.status === "rejected")) reject(new Error("closing services failed"));
           else resolve(null);

server/test/api/ramp.test.ts

@@ -7,7 +7,7 @@ import { HTTPException } from "hono/http-exception";
 import { testClient } from "hono/testing";
 import { hexToBytes, padHex, zeroHash } from "viem";
 import { privateKeyToAddress } from "viem/accounts";
-import { afterEach, beforeAll, describe, expect, inject, it, vi } from "vitest";
+import { afterAll, afterEach, beforeAll, describe, expect, inject, it, vi } from "vitest";
 
 import deriveAddress from "@exactly/common/deriveAddress";
 
@@ -16,6 +16,7 @@ import database, { credentials } from "../../database";
 import * as persona from "../../utils/persona";
 import * as bridge from "../../utils/ramps/bridge";
 import * as manteca from "../../utils/ramps/manteca";
+import { close as closeRedis } from "../../utils/redis";
 
 const appClient = testClient(app);
 
@@ -38,6 +39,11 @@ describe("ramp api", () => {
     ]);
   });
 
+  afterAll(async () => {
+    await bridge.feeWindow.stop();
+    await closeRedis();
+  });
+
   afterEach(() => {
     vi.clearAllMocks();
     vi.restoreAllMocks();

server/test/hooks/bridge.test.ts

@@ -7,7 +7,7 @@ import { testClient } from "hono/testing";
 import { createHash, createPrivateKey, createSign, generateKeyPairSync } from "node:crypto";
 import { hexToBytes, padHex, zeroHash } from "viem";
 import { privateKeyToAddress } from "viem/accounts";
-import { afterEach, beforeAll, describe, expect, inject, it, vi } from "vitest";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, inject, it, vi } from "vitest";
 
 import deriveAddress from "@exactly/common/deriveAddress";
 
@@ -16,6 +16,8 @@ import app from "../../hooks/bridge";
 import * as onesignal from "../../utils/onesignal";
 import * as persona from "../../utils/persona";
 import * as bridge from "../../utils/ramps/bridge";
+import { feeWindow } from "../../utils/ramps/bridge";
+import redis, { close as closeRedis } from "../../utils/redis";
 import * as segment from "../../utils/segment";
 
 const appClient = testClient(app);
@@ -54,11 +56,21 @@ describe("bridge hook", () => {
     ]);
   });
 
+  beforeEach(async () => {
+    const keys = await redis.keys("wr:bridge-fees:*");
+    if (keys.length > 0) await redis.del(...keys);
+  });
+
   afterEach(() => {
     vi.clearAllMocks();
     vi.restoreAllMocks();
   });
 
+  afterAll(async () => {
+    await feeWindow.stop();
+    await closeRedis();
+  });
+
   it("returns 200 with valid signature and payload", async () => {
     vi.spyOn(segment, "track").mockReturnValue();
     const response = await appClient.index.$post({
@@ -138,6 +150,39 @@ describe("bridge hook", () => {
     await expect(response.json()).resolves.toMatchObject({ code: "bad bridge" });
   });
 
+  it("rejects payment_submitted with invalid created_at", async () => {
+    const payload = {
+      ...paymentSubmitted,
+      event_object: { ...paymentSubmitted.event_object, created_at: "not-a-date" },
+    };
+    const response = await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(payload) },
+      json: payload as never,
+    });
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toStrictEqual({
+      code: "bad bridge",
+      legacy: "bad bridge",
+      message: expect.arrayContaining([expect.stringContaining("invalid date")]), // eslint-disable-line @typescript-eslint/no-unsafe-assignment
+    });
+  });
+
+  it("rejects drain with invalid created_at", async () => {
+    const payload = { ...drain, event_object: { ...drain.event_object, created_at: "invalid" } };
+    const response = await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(payload) },
+      json: payload as never,
+    });
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toStrictEqual({
+      code: "bad bridge",
+      legacy: "bad bridge",
+      message: expect.arrayContaining([expect.stringContaining("invalid date")]), // eslint-disable-line @typescript-eslint/no-unsafe-assignment
+    });
+  });
+
   it("returns 200 without side effects for non-payment virtual account types", async () => {
     vi.spyOn(segment, "track").mockReturnValue();
     const sendPushNotification = vi.spyOn(onesignal, "sendPushNotification");
@@ -153,6 +198,36 @@ describe("bridge hook", () => {
     expect(captureException).not.toHaveBeenCalled();
   });
 
+  it("returns 500 when feeWindow.report fails on payment_submitted", async () => {
+    vi.spyOn(segment, "track").mockReturnValue();
+    const sendPushNotification = vi.spyOn(onesignal, "sendPushNotification");
+    vi.spyOn(feeWindow, "report").mockRejectedValue(new Error("redis down"));
+    const response = await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(paymentSubmitted) },
+      json: paymentSubmitted as never,
+    });
+
+    expect(response.status).toBe(500);
+    expect(sendPushNotification).not.toHaveBeenCalled();
+    expect(segment.track).not.toHaveBeenCalled();
+    expect(captureException).not.toHaveBeenCalled();
+  });
+
+  it("returns 500 when feeWindow.report fails on drain", async () => {
+    vi.spyOn(segment, "track").mockReturnValue();
+    const sendPushNotification = vi.spyOn(onesignal, "sendPushNotification");
+    vi.spyOn(feeWindow, "report").mockRejectedValue(new Error("redis down"));
+    const response = await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(drain) },
+      json: drain as never,
+    });
+
+    expect(response.status).toBe(500);
+    expect(sendPushNotification).not.toHaveBeenCalled();
+    expect(segment.track).not.toHaveBeenCalled();
+    expect(captureException).not.toHaveBeenCalled();
+  });
+
   it("does not track onramp for payment_submitted virtual account", async () => {
     vi.spyOn(segment, "track").mockReturnValue();
     const response = await appClient.index.$post({
@@ -185,6 +260,7 @@ describe("bridge hook", () => {
   it("tracks onramp for payment_processed virtual account", async () => {
     vi.spyOn(segment, "track").mockReturnValue();
     const sendPushNotification = vi.spyOn(onesignal, "sendPushNotification");
+    const reportSpy = vi.spyOn(feeWindow, "report");
     const response = await appClient.index.$post({
       header: { "x-webhook-signature": createSignature(paymentProcessed) },
       json: paymentProcessed as never,
@@ -198,6 +274,7 @@ describe("bridge hook", () => {
       properties: { currency: "usd", amount: 1000, provider: "bridge", source: null, usdcAmount: 995 },
     });
     expect(sendPushNotification).not.toHaveBeenCalled();
+    expect(reportSpy).not.toHaveBeenCalled();
     expect(captureException).not.toHaveBeenCalled();
   });
 
@@ -600,6 +677,78 @@ describe("bridge hook", () => {
     expect(sendPushNotification).not.toHaveBeenCalled();
     expect(captureException).not.toHaveBeenCalled();
   });
+
+  it("tracks ramp amount via feeWindow.report on payment_submitted", async () => {
+    vi.spyOn(segment, "track").mockReturnValue();
+    const reportSpy = vi.spyOn(feeWindow, "report");
+    await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(paymentSubmitted) },
+      json: paymentSubmitted as never,
+    });
+
+    expect(reportSpy).toHaveBeenCalledExactlyOnceWith(
+      { amount: "1000", bridgeId: "bridgeCustomerId", eventId: "evt_123" },
+      new Date("2026-03-01T00:00:00.000Z"),
+    );
+  });
+
+  it("tracks ramp amount via feeWindow.report on drain payment_submitted", async () => {
+    vi.spyOn(segment, "track").mockReturnValue();
+    const reportSpy = vi.spyOn(feeWindow, "report");
+    await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(drain) },
+      json: drain as never,
+    });
+
+    expect(reportSpy).toHaveBeenCalledExactlyOnceWith(
+      { amount: "500", bridgeId: "bridgeCustomerId", eventId: "drain_123" },
+      new Date("2026-03-01T00:00:00.000Z"),
+    );
+  });
+
+  it("passes fractional amount to feeWindow.report on payment_submitted", async () => {
+    vi.spyOn(segment, "track").mockReturnValue();
+    const reportSpy = vi.spyOn(feeWindow, "report");
+    const payload = {
+      ...paymentSubmitted,
+      event_object: {
+        ...paymentSubmitted.event_object,
+        id: "evt_frac_1",
+        receipt: { initial_amount: "99.999", final_amount: "99.999" },
+      },
+    };
+    await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(payload) },
+      json: payload as never,
+    });
+
+    expect(reportSpy).toHaveBeenCalledExactlyOnceWith(
+      { amount: "99.999", bridgeId: "bridgeCustomerId", eventId: "evt_frac_1" },
+      expect.any(Date),
+    );
+  });
+
+  it("passes fractional amount to feeWindow.report on drain", async () => {
+    vi.spyOn(segment, "track").mockReturnValue();
+    const reportSpy = vi.spyOn(feeWindow, "report");
+    const payload = {
+      ...drain,
+      event_object: {
+        ...drain.event_object,
+        id: "drain_frac_1",
+        receipt: { initial_amount: "49.991", outgoing_amount: "49.991" },
+      },
+    };
+    await appClient.index.$post({
+      header: { "x-webhook-signature": createSignature(payload) },
+      json: payload as never,
+    });
+
+    expect(reportSpy).toHaveBeenCalledExactlyOnceWith(
+      { amount: "49.991", bridgeId: "bridgeCustomerId", eventId: "drain_frac_1" },
+      expect.any(Date),
+    );
+  });
 });
 
 const testSigningKey = createPrivateKey(`-----BEGIN PRIVATE KEY-----
@@ -651,6 +800,7 @@ const fundsReceived = {
 const paymentSubmitted = {
   event_type: "virtual_account.activity.created",
   event_object: {
+    created_at: "2026-03-01T00:00:00.000Z",
     id: "evt_123",
     type: "payment_submitted",
     currency: "usd",
@@ -678,6 +828,7 @@ const statusTransitioned = {
 const drain = {
   event_type: "liquidation_address.drain.updated.status_transitioned",
   event_object: {
+    created_at: "2026-03-01T00:00:00.000Z",
     id: "drain_123",
     state: "payment_submitted",
     currency: "usdc",
@@ -687,3 +838,8 @@ const drain = {
 };
 
 vi.mock("@sentry/core", { spy: true });
+vi.mock("../../utils/ramps/bridge", async (importOriginal) => ({
+  ...(await importOriginal()),
+  enableFees: vi.fn(),
+  disableFees: vi.fn(),
+}));