Implemented and validated the separate Monero observation-worker path

2026-10-22 09:38:20 -04:00
parent 12f80fdc53
commit 158981e965
12 changed files with 253 additions and 12 deletions
@@ -1,6 +1,7 @@
 export const CUSTODY_DB_ACTION_ARGUMENT_COUNTS = {
  migrate: 0,
  'grant-runtime': 1,
+  'grant-monero-observer-runtime': 1,
  'grant-monero-credit-runtime': 1,
  'import-sqlite': 1,
  audit: 0,
@@ -17,6 +18,12 @@ export const CUSTODY_DB_ACTION_ARGUMENT_COUNTS = {
 export type CustodyDbAction = keyof typeof CUSTODY_DB_ACTION_ARGUMENT_COUNTS;
 export type CustodyDbArguments = { action: CustodyDbAction; argument?: string; extraArgument?: string };

+export function assertCustodyDbActionAllowedOnNetwork(action: CustodyDbAction, isMainnet: boolean): void {
+  if (isMainnet && action !== 'grant-monero-observer-runtime') {
+    throw new Error('Only the separately scoped Monero observation-role grant is allowed on mainnet');
+  }
+}
+
 export function parseCustodyDbArguments(args: readonly string[]): CustodyDbArguments {
  const [action, ...values] = args;
  if (!action || !Object.hasOwn(CUSTODY_DB_ACTION_ARGUMENT_COUNTS, action)) {