Release all changes to master - #372
Merged
Merged
Conversation
Drops chain v7 support; the SDK now targets chain v8 only. Also bumps polymesh-types to ^7.5.0, which the SDK requires. BREAKING CHANGE: chain v7 is no longer supported. The SDK throws on initialization when pointed at a v7 node, so deployments must run a chain 8.0.x or 8.1.x node.
AccountManagement.subsidizeAccount is removed in SDK v31. The approve/accept subsidy pair replaces the authorization based flow. BREAKING CHANGE: POST /accounts/subsidy/create is removed. Use POST /accounts/subsidy/approve followed by POST /accounts/subsidy/accept.
Instruction.withdraw and withdrawAsMediator are removed in SDK v31 with no v8 equivalent. BREAKING CHANGE: POST /instructions/:id/withdraw and POST /instructions/:id/withdraw-as-mediator are removed. Reject the instruction instead, via POST /instructions/:id/reject or POST /instructions/:id/reject-as-mediator.
Claims.getCddClaims is removed in SDK v31. BREAKING CHANGE: GET /identities/:did/cdd-claims is removed. It already threw NotSupported against a v8 chain, so it has not been functional since the v8 migration.
InvalidSenderCdd and ScopeClaimMissing are removed, as transfers are no longer CDD gated on v8. Use InvalidReceiverIdentity, a new member the chain now reports for an inactive receiving Identity.
Assets.transferFunds now resolves to Instruction | undefined, since the holders may belong to different Identities. It settles in the same transaction when the receiver affirms automatically, otherwise a pending Instruction is returned for the receiver to affirm.
Context.isV7 is removed in v31, so the v7 branches are dropped. The cddServiceProviders pallet no longer exists either, which would have thrown at runtime, so test admins are now added via didRegistrars. This branch was previously gated on isChainV7, meaning create-test-admins granted nothing at all on a v8 chain.
TxGroup.RelayerManagement is removed, since every relayer extrinsic is ensure_signed only and the group never gated anything. DidRegistration and InstructionMediation are new.
AccountBalance gained reserved and frozen fields in SDK v30.2, and locked now includes held funds (e.g. bonded for staking) rather than only the chain's frozen value. Add a dedicated AccountBalanceModel for GET /accounts/:account/balance so these are documented and serialized, rather than reusing the generic asset BalanceModel which has no staking-specific semantics.
Transfers are no longer CDD gated on chain v8, so the receiver can no longer fail a POLYX transfer for lacking a CDD claim.
As of chain v8, createCdd and expiry no longer have any on-chain effect on identity.cddRegisterDid/cddRegisterDidWithCdd, so requiring createCdd in the request body no longer reflects reality. Both fields are now optional and marked deprecated, and the stale "Expiry cannot be set unless a CDD claim is being created" failure doc is dropped.
Chain v8 is now the only supported chain, so qualifiers like "on chain v8" and references to v7-only behavior no longer add information.
ScopeClaimProof was removed from the SDK in v31, since Investor Uniqueness has been removed from the chain for some time. The DTO was unreferenced anywhere in this codebase.
A Portfolio can now pre-approve receiving a specific Asset, so incoming transfers of it auto-affirm without a manual affirm step. Adds POST /identities/:did/portfolios/:id/pre-approve-asset, POST .../remove-pre-approval, GET .../is-pre-approved and GET .../pre-approved-assets, mirroring the existing Identity-level pre-approval endpoints.
Instruction.lockForExecution existed in the SDK since v30 but was never wired up, and unlockForExecution/getRelockStatus are new in v31. Adds POST /instructions/:id/lock, POST /instructions/:id/unlock and GET /instructions/:id/relock-status, completing the lock/relock cycle a mediator uses to pause and resume execution of a pending Instruction.
Adds GET /instructions/:id/legs/:legId/status, returning the execution status of a specific leg (PendingTokenLock, ExecutionPending, or ExecutionToBeSkipped with the skipping signer and receipt UID).
Adds POST /identities/register-did, wrapping the new SDK Identities.registerDid procedure. Unlike the existing register endpoint, this only takes a targetAccount and does not support secondary keys or CDD claims.
Adds GET /venues/:id/signer-count, wrapping the new SDK Venue.getSignerCount procedure.
Adds GET /assets/:asset/funding-rounds/:round/issued, wrapping the new SDK BaseAsset.getIssuedInFundingRound procedure.
Adds GET /assets/:asset/checkpoints/schedules/next, wrapping the new SDK Schedules.getNextCheckpoint procedure. Returns the closest upcoming Checkpoint across all of an Asset's active Schedules in a single query, or null if the Asset has no active Schedules.
Adds GET /assets/:asset/corporate-actions/:id/documents, wrapping the new SDK CorporateActionBase.getDocuments procedure. This is the missing read-side counterpart to the existing documents/link endpoint.
Dropped during commit splitting; this mock class isn't currently referenced by any spec (they use an inline mock object instead), so this had no test impact, but it belongs alongside the rest of the class's methods.
Adds GET /ticker-reservations/config, wrapping the new SDK Assets.getTickerRegistrationConfig procedure. Returns the chain-wide maxTickerLength and registrationLength rules used to validate ticker registrations.
CreateInstructionDto only exposed endBlock/endAfterBlock, so there was no way to create a SettleAfterLock Instruction through the REST API, meaning the lock/unlock/relock-status endpoints had no reachable happy path. Adds endAfterLock, matching the SDK's AddInstructionParams. Verified end-to-end against a local chain: create with endAfterLock, affirm, lock, check relock-status, unlock, and confirm the cooldown window populates correctly.
31.0.0-beta.8 was promoted to the stable v31.0.0 release with no code changes beyond the version bump itself (confirmed by diffing the two published packages). No other dependency versions changed.
Between beta.7 and the stable v31.0.0 release, the SDK made expiresAt required (previously optional) on Instruction.generateOffChainAffirmationReceipt and OffChainAffirmationReceipt, for both the server-generated and the already-signed passthrough case. OffChainAffirmationReceiptDto now mirrors that. BREAKING CHANGE: expiresAt on a receipt in AffirmInstructionDto.receipts is now required; previously it could be omitted.
…ints SonarCloud flagged a 31-line duplicate block between preApproveAsset and removeAssetPreApproval (PR #369) - their ApiParam/ApiTransactionResponse/ ApiTransactionFailedResponse decorators were identical apart from two short strings. Extracted into ApiPortfolioAssetPreApprovalResponses, parameterized by the id description and the unprocessable entity message, following the applyDecorators pattern already used elsewhere in this codebase (e.g. ApiTransactionResponse itself). No behavior change: same decorators applied with the same arguments, just composed rather than stacked inline. Full suite still 1071/1071 passing with unchanged coverage.
Returning null from a Nest controller produces a zero-length response body, not the JSON literal "null" - any client doing response.json() or JSON.parse() on it throws.
…ength The shared @FromBigNumber() decorator does value?.toString(), which turns null into undefined - and undefined-valued properties are dropped by JSON serialization entirely. That silently defeats the `nullable: true` swagger annotation: clients can no longer distinguish "registrations never expire" (null) from "field not supported" (absent). Replaced with a dedicated transform that preserves null, verified through the actual class-transformer serialization pipeline rather than plain object construction, which wouldn't have caught this.
The final image stage's `COPY --chown=node:node . /home/node` copies the whole build context over the top of the fresh `./dist` the builder stage just produced. `dist` is gitignored but wasn't dockerignored, so a stale local `dist/` (e.g. from a prior `yarn build`) silently wins over the actual build with no warning - same image digest whether cached or --no-cache, since the COPY step's content hash matches.
Pulls in Ethereum wallet signing and EVM address mapping, wider staking coverage (era progress, historical era reads, validator set, chill, rebond, total issuance), issuing NFTs directly to an Account, ordering POLYX transaction history, an optional middleware API key, transaction broadcast/watch with submission timeouts, and connecting from runtimes that disallow WASM compilation. Also fixes several bugs: BigNumber.isBigNumber checks across duplicate package copies, includeExpired being silently ignored on Authorizations.getReceived, a POLYX transaction count of NaN, on-chain failure reasons collapsing to "Unknown error", staking's totalStaked being off by 1e6, staking actions applying permission checks the chain doesn't make, withdraw failing when the controller isn't the stash, and DividendDistribution.claim() rejecting a genuine participant when the signing Identity is resolved from a shared Context - the exact pattern this REST API uses. No breaking changes: tsc, lint and the full test suite pass unchanged.
NftCollection.issue now accepts an optional account, mirroring the account option FungibleAsset.issue already offers on IssueDto. Omitted, the NFT is issued to the signer's default portfolio as before.
middlewareV2 always connected with key: '', with no way to supply one - POLYMESH_MIDDLEWARE_API_KEY only ever wired into the deprecated middleware (V1) config. Adds POLYMESH_MIDDLEWARE_V2_API_KEY, and stops hardcoding an empty key: the SDK now omits the x-api-key header entirely when none is given, rather than sending it empty.
DEVELOPER_UTILS never disabled the developer testing endpoints. ConfigModule writes validated values back to process.env as strings, so the Joi default became "false", and `!!"false"` is true - the routes were mounted in every deployment regardless of the setting. The flag is now enabled only by an explicit `true`, and the coverage interceptor only runs when it is. IdentitiesModule no longer registers DeveloperTestingModule a second time at import time, before .env loads. Adds AUTH_MANAGEMENT_ENABLED (`/users/create`, `/auth/api-key/*`) and SIGNER_MANAGEMENT_ENABLED (`POST /signer`). When disabled, the controllers are not registered, so the routes 404 and are left out of the Swagger document. Both default to disabled when AUTH_STRATEGY includes `open`, where any caller could otherwise create users, mint API keys or load signing keys, and to enabled otherwise. BREAKING CHANGE: with the `open` auth strategy, `/users/create`, `/auth/api-key/*` and `POST /signer` are no longer exposed unless AUTH_MANAGEMENT_ENABLED=true or SIGNER_MANAGEMENT_ENABLED=true is set. DEVELOPER_UTILS must now be exactly `true` to expose `/developer-testing`.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
F-OBrien
previously approved these changes
Sep 17, 2026
Mark the PortfoliosController logger as readonly and extract the duplicated Identity setup in the registerIdentity/registerDid controller specs into a shared helper.
3 tasks
|
F-OBrien
approved these changes
Sep 18, 2026
|
/fast-forward |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA Link
Insert JIRA url here
Changelog / Description
Add description in points. Use bulleting/numbering to list the changes/features.
Checklist -