Expose authenticated settlement reserve identities

machine-funding-server/src/http.rs

@@ -90,6 +90,14 @@ where
             get(erc20_usdc_readiness::<S, D, B>),
         )
         .route("/api/internal/base/gas", post(base_gas::<S, D, B>))
+        .route(
+            "/api/internal/base/settlement",
+            get(base_settlement::<S, D, B>),
+        )
+        .route(
+            "/api/internal/erc20-usdc/settlement",
+            get(erc20_settlement::<S, D, B>),
+        )
         .route(
             "/api/internal/base/erc20-usdc/transfers",
             post(base_erc20_usdc_transfer::<S, D, B>),
@@ -105,6 +113,49 @@ where
         }))
 }
 
+#[derive(Serialize)]
+struct SettlementIdentity {
+    chain_id: u64,
+    token_address: Address,
+    treasury_address: Address,
+}
+
+async fn base_settlement<S: FundingStore, D: ChainDriver, B: ChainDriver>(
+    State(state): State<Arc<RouterState<S, D, B>>>,
+    headers: HeaderMap,
+) -> Result<Json<SettlementIdentity>, ServiceError> {
+    authorize(&headers, &state.legacy.config().token)?;
+    let service = base_service(&state)?;
+    let config = service
+        .config()
+        .base
+        .enabled()
+        .ok_or_else(base_unavailable)?;
+    Ok(Json(SettlementIdentity {
+        chain_id: config.chain_id,
+        token_address: config.token_address,
+        treasury_address: config.reserve_address,
+    }))
+}
+
+async fn erc20_settlement<S: FundingStore, D: ChainDriver, B: ChainDriver>(
+    State(state): State<Arc<RouterState<S, D, B>>>,
+    headers: HeaderMap,
+) -> Result<Json<SettlementIdentity>, ServiceError> {
+    authorize(&headers, &state.legacy.config().token)?;
+    let service = erc20_service(&state)?;
+    let config = service
+        .config()
+        .erc20_usdc
+        .enabled()
+        .ok_or_else(erc20_unavailable)?;
+    Ok(Json(SettlementIdentity {
+        chain_id: service.config().chain_id,
+        token_address: config.token_address,
+        treasury_address: config.faucet_address,
+    }))
+}
+
 async fn transfer<S, D, B>(
     State(state): State<Arc<RouterState<S, D, B>>>,
     headers: HeaderMap,

machine-funding-server/tests/redis_semantics.rs

@@ -1141,6 +1141,44 @@ async fn json_body(response: axum::response::Response) -> serde_json::Value {
     serde_json::from_slice(&response.into_body().collect().await.unwrap().to_bytes()).unwrap()
 }
 
+#[tokio::test]
+async fn settlement_identity_is_authenticated_and_uses_the_actual_token_holder() {
+    let redis = TestRedis::start().await;
+    let legacy = FundingService::new(
+        redis.store().await,
+        FakeDriver::new([]),
+        config(redis.url.clone()),
+    );
+    let mut erc20_config = config(redis.url.clone());
+    enable_erc20_usdc(&mut erc20_config);
+    let expected = erc20_config.erc20_usdc.enabled().unwrap().faucet_address;
+    let erc20 = FundingService::new(redis.store().await, FakeDriver::new([]), erc20_config);
+    let app = router_with_erc20(legacy, Erc20FundingService::Enabled(Box::new(erc20)));
+    let path = "/api/internal/erc20-usdc/settlement";
+    let response = app
+        .clone()
+        .oneshot(Request::get(path).body(Body::empty()).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    let response = app
+        .oneshot(
+            Request::get(path)
+                .header(
+                    header::AUTHORIZATION,
+                    "Bearer a-secure-machine-token-with-32-characters",
+                )
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = json_body(response).await;
+    assert_eq!(body["treasury_address"], expected.to_string());
+    assert_eq!(body.as_object().unwrap().len(), 3);
+}
+
 #[tokio::test]
 async fn base_routes_preserve_the_machine_funding_wire_and_report_reserves() {
     let redis = TestRedis::start().await;
@@ -1161,6 +1199,24 @@ async fn base_routes_preserve_the_machine_funding_wire_and_report_reserves() {
     );
     let auth = "Bearer a-secure-machine-token-with-32-characters";
 
+    let identity = app
+        .clone()
+        .oneshot(
+            Request::get("/api/internal/base/settlement")
+                .header(header::AUTHORIZATION, auth)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(identity.status(), StatusCode::OK);
+    let identity = json_body(identity).await;
+    assert_eq!(identity["chain_id"], 84532);
+    assert_eq!(
+        identity["treasury_address"],
+        healthy_reserves().reserve_address.to_lowercase()
+    );
+
     let gas = app
         .clone()
         .oneshot(