feat: reject linkings based on wallet geo country (#2580)

libs/clients/reputation/client.go

@@ -24,6 +24,7 @@ type Client interface {
 	IsWalletOnPlatform(ctx context.Context, id uuid.UUID, platform string) (bool, error)
 	UpsertReputationSummary(ctx context.Context, paymentID, geoCountry string) error
 	UpdateReputationSummary(ctx context.Context, paymentID string, verifiedWallet bool) error
+	GetReputationSummary(ctx context.Context, paymentID uuid.UUID) (RepSummaryResponse, error)
 }
 
 // HTTPClient wraps http.Client for interacting with the reputation server
@@ -347,3 +348,21 @@ func (c *HTTPClient) UpdateReputationSummary(ctx context.Context, paymentID stri
 
 	return nil
 }
+
+type RepSummaryResponse struct {
+	GeoCountry string `json:"geoCountry"`
+}
+
+func (c *HTTPClient) GetReputationSummary(ctx context.Context, paymentID uuid.UUID) (RepSummaryResponse, error) {
+	req, err := c.client.NewRequest(ctx, http.MethodGet, "v1/reputation-summary/"+paymentID.String(), nil, nil)
+	if err != nil {
+		return RepSummaryResponse{}, err
+	}
+
+	var resp RepSummaryResponse
+	if _, err := c.client.Do(ctx, req, &resp); err != nil {
+		return RepSummaryResponse{}, err
+	}
+
+	return resp, nil
+}

services/wallet/controllers_v3.go

@@ -505,6 +505,8 @@ func LinkSolanaAddress(s *Service) handlers.AppHandler {
 				return handlers.WrapError(model.ErrChallengeExpired, "linking challenge expired", http.StatusUnauthorized)
 			case errors.Is(err, model.ErrWalletNotFound):
 				return handlers.WrapError(model.ErrWalletNotFound, "rewards wallet not found", http.StatusNotFound)
+			case errors.Is(err, errDisabledRegion):
+				return handlers.WrapError(errDisabledRegion, "region is currently disabled for linking", http.StatusBadRequest)
 			case errors.Is(err, ErrTooManyCardsLinked):
 				return handlers.WrapError(ErrTooManyCardsLinked, "too many wallets linked", http.StatusConflict)
 			case errors.As(err, &solErr):

services/wallet/controllers_v3_test.go

@@ -18,8 +18,10 @@ import (
 	"time"
 
 	"github.com/brave-intl/bat-go/libs/altcurrency"
+	"github.com/brave-intl/bat-go/libs/clients/reputation"
 	mock_reputation "github.com/brave-intl/bat-go/libs/clients/reputation/mock"
 	appctx "github.com/brave-intl/bat-go/libs/context"
+	"github.com/brave-intl/bat-go/libs/custodian"
 	"github.com/brave-intl/bat-go/libs/handlers"
 	"github.com/brave-intl/bat-go/libs/httpsignature"
 	walletutils "github.com/brave-intl/bat-go/libs/wallet"
@@ -519,9 +521,21 @@ func (suite *WalletControllersTestSuite) TestLinkSolanaAddress_Success() {
 		AllowedOrigins: []string{"https://my-dapp.com", "https://my-dapp-2.com"},
 	}
 
-	s, err := wallet.InitService(pg, nil, chlRep, allowList, nil, nil, nil, nil, nil, nil, dac)
+	// mock reputation client
+	ctrl := gomock.NewController(suite.T())
+	defer ctrl.Finish()
+
+	repClient := mock_reputation.NewMockClient(ctrl)
+	repClient.EXPECT().GetReputationSummary(gomock.Any(), paymentID).Return(reputation.RepSummaryResponse{GeoCountry: "US"}, nil)
+
+	s, err := wallet.InitService(pg, nil, chlRep, allowList, repClient, nil, nil, nil, nil, nil, dac)
 	suite.Require().NoError(err)
 
+	cr := custodian.Regions{Solana: custodian.GeoAllowBlockMap{
+		Allow: []string{"US"},
+	}}
+	s.SetCustodianRegions(cr)
+
 	// create linking message
 	solPub, msg, solSig := createAndSignMessage(suite.T(), w.ID, priv, chl.Nonce)
 

services/wallet/service.go

@@ -227,7 +227,7 @@ func SetupService(ctx context.Context) (context.Context, *Service) {
 
 	// setup reputation client
 	repClient, err := reputation.New()
-	// it's okay to not fatally fail if this environment is local and we cant make a rep client
+	// it's okay to not fatally fail if this environment is local, and we cant make a rep client
 	if err != nil && os.Getenv("ENV") != "local" {
 		l.Panic().Err(err).Msg("failed to initialize wallet service")
 	}
@@ -326,7 +326,7 @@ func SetupService(ctx context.Context) (context.Context, *Service) {
 	return ctx, s
 }
 
-func (service *Service) setCustodianRegions(custodianRegions custodian.Regions) {
+func (service *Service) SetCustodianRegions(custodianRegions custodian.Regions) {
 	service.crMu.Lock()
 	defer service.crMu.Unlock()
 	service.custodianRegions = custodianRegions
@@ -734,11 +734,22 @@ func (service *Service) LinkUpholdWallet(ctx context.Context, wallet uphold.Wall
 	return country, nil
 }
 
+const errDisabledRegion model.Error = "disabled region"
+
 func (service *Service) LinkSolanaAddress(ctx context.Context, paymentID uuid.UUID, req linkSolanaAddrRequest) error {
 	if err := isWalletWhitelisted(ctx, service.Datastore.RawDB(), service.allowListRepo, paymentID); err != nil {
 		return err
 	}
 
+	repSum, err := service.repClient.GetReputationSummary(ctx, paymentID)
+	if err != nil {
+		return err
+	}
+
+	if !service.custodianRegions.Solana.Verdict(repSum.GeoCountry) {
+		return errDisabledRegion
+	}
+
 	ctx, txn, rollback, commit, err := getTx(ctx, service.Datastore)
 	if err != nil {
 		return err
@@ -911,7 +922,7 @@ func (service *Service) RefreshCustodianRegionsWorker(ctx context.Context) (bool
 			return true, fmt.Errorf("error running refresh custodian regions: %w", err)
 		}
 		// write custodian regions to service
-		service.setCustodianRegions(*custodianRegions)
+		service.SetCustodianRegions(*custodianRegions)
 		return true, nil
 	}
 }