feat: add guarded Base Sepolia encore

2026-08-21 16:01:35 -06:00
parent 94f2ad6e09
commit 90b0a11b8a
16 changed files with 784 additions and 25 deletions
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+case ${1-} in
+  deploy|upgrade|transfer) ;;
+  *) fail 'usage: require-base-config.sh <deploy|upgrade|transfer>' ;;
+esac
+
+for variable in \
+  BASE_SEPOLIA_RPC_URL \
+  BASE_SEPOLIA_PUBLIC_RPC_URL \
+  BASE_SEPOLIA_ACCOUNT \
+  BASE_SEPOLIA_SENDER \
+  BASE_SEPOLIA_RECIPIENT; do
+  [[ -n ${!variable-} ]] || fail "$variable is required"
+done
+
+[[ $BASE_SEPOLIA_ACCOUNT =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$ ]] || \
+  fail 'BASE_SEPOLIA_ACCOUNT must be a conservative Foundry account identifier'
+
+address_pattern='^0x[[:xdigit:]]{40}$'
+[[ $BASE_SEPOLIA_SENDER =~ $address_pattern ]] || fail 'BASE_SEPOLIA_SENDER must be an address'
+[[ $BASE_SEPOLIA_RECIPIENT =~ $address_pattern ]] || fail 'BASE_SEPOLIA_RECIPIENT must be an address'
+[[ ${BASE_SEPOLIA_SENDER,,} != 0x0000000000000000000000000000000000000000 ]] || \
+  fail 'BASE_SEPOLIA_SENDER must be nonzero'
+[[ ${BASE_SEPOLIA_RECIPIENT,,} != 0x0000000000000000000000000000000000000000 ]] || \
+  fail 'BASE_SEPOLIA_RECIPIENT must be nonzero'
+[[ ${BASE_SEPOLIA_SENDER,,} != "${BASE_SEPOLIA_RECIPIENT,,}" ]] || \
+  fail 'BASE_SEPOLIA_SENDER and BASE_SEPOLIA_RECIPIENT must differ'
+
+[[ $BASE_SEPOLIA_RPC_URL =~ ^https://[^[:space:]]+$ ]] || \
+  fail 'BASE_SEPOLIA_RPC_URL must use HTTPS'
+[[ $BASE_SEPOLIA_PUBLIC_RPC_URL =~ ^https://[^[:space:]]+$ ]] || \
+  fail 'BASE_SEPOLIA_PUBLIC_RPC_URL must use HTTPS'
+
+public_remainder=${BASE_SEPOLIA_PUBLIC_RPC_URL#https://}
+public_authority=${public_remainder%%[/?#]*}
+[[ -n $public_authority && $public_authority != *@* ]] || \
+  fail 'BASE_SEPOLIA_PUBLIC_RPC_URL must not contain user info'
+
+if [[ $BASE_SEPOLIA_PUBLIC_RPC_URL == *\?* ]]; then
+  public_query=${BASE_SEPOLIA_PUBLIC_RPC_URL#*\?}
+  public_query=${public_query%%#*}
+  IFS='&' read -r -a parameters <<<"$public_query"
+  for parameter in "${parameters[@]}"; do
+    key=${parameter%%=*}
+    if [[ ${key,,} =~ (key|token|secret|password|credential) ]]; then
+      fail 'BASE_SEPOLIA_PUBLIC_RPC_URL must not contain credential query parameters'
+    fi
+  done
+fi