ODIS 2.0.0

[alecps]

Description

• Implements CIP40, which extends ODIS to support "domain" specific queries. A domain is a struct which specifies rate limiting information and uniquely identifies the context of the secret to be hashed. This enables granular rate limiting with the goal of hardening passwords for use as encryption keys in the PEAR Account Recovery protocol, as well as other future use cases.
• Adds support for a new on-chain payment based rate limit to ODIS, to enable more seamless onboarding in the Federated Attestations identity protocol (ASv2). For sequence diagrams and technical details on how ODIS fits into ASv2, please refer to the ASv2 User Flows doc.
• This is a major refactor of ODIS that introduces a new class structure (+ dependency injection) to maximize code reuse and modularity across both the ASv2 and PEAR use cases. The following diagram gives a rough illustration of how the main classes fit together.
  

Other changes

• Adds io-ts type safety checks for all incoming requests and responses throughout the codebase
• Adds support for multiple key versions and key rotations
• Adds support for ODIS to be queried by web clients
• Deletes legacy matchmaking code from the combiner, common package, and SDK
• Adds support for querying a user's remaining quota (based off on-chain payments) to both the combiner and identity SDK

Tested

• Adds integration tests that utilize in-memory nodes and databases to easily test the system's end-to-end behavior without requiring a deployment.
• Adds unit tests for critical rate limiting, key versioning and monitoring functionality
• Enforces new code coverage requirements in CI
• DOES NOT add new e2e tests. These will be added in a subsequent PR that will be written while deploying and testing against our staging environment.

Backwards compatibility

• The Signer is backwards compatible, but the Combiner is not. Signers must be upgraded before the Combiner.
• SDK changes are not backwards compatible with old versions of ODIS. The SDK should be released after ODIS is upgraded.

Documentation

• Signer README is updated with key-rotation instructions
• All other relevant documentation linked above
• There's an ongoing epic to develop client-facing tooling and documentation for ASv2

[nategraf]

I love the huge improvements to ODIS being made in this PR. This really is the culmination of a lot of work to improve the quality, safety, and maintainability of this service. Very excited to have this PR merged at last!

I didn't have time to do the kind of through review I usually like to do, but I did leave some comments where I could. I had a number of comments about minor issues around coding practices. I think it's time this PR be merged so the intention is not to require refactoring. I decided to leave the comments anyway because it might be useful for future work.

I did have a couple of questions around quota accounting. In particular, the fail open mechanism is still something I understand pragmatically, but always gives me pause. I left a thought on whether we could install a mitigation for by having the system "circuit break" at some number of failed open requests.

I think we may have talked about this before, but is the intention with the legacy and on-chain payment versions of quota accounting to shut down the legacy version in the near future? If so, I wish you god speed in doing so.