268 siwe admin auth module

README.md

@@ -328,6 +328,7 @@ The solver provides a REST API for interacting with the system and submitting of
 
 - **Orders API**: [`api-spec/orders-api.yaml`](api-spec/orders-api.yaml) - Submit and track cross-chain intent orders
 - **Tokens API**: [`api-spec/tokens-api.yaml`](api-spec/tokens-api.yaml) - Query supported tokens and networks
+- **Admin API**: [`docs/openapi-admin.json`](docs/openapi-admin.json) - Wallet-based admin operations (EIP-712 signed)
 
 ### API Flows
 
@@ -527,6 +528,85 @@ sequenceDiagram
 - **GET `/api/v1/tokens/{chain_id}`** - Get supported tokens for a specific chain
   - Returns network configuration including settler addresses and token list
 
+#### Health
+
+- **GET `/health`** - Health check endpoint
+  - Returns solver health status including Redis connectivity and persistence info
+  - Response:
+    ```json
+    {
+      "status": "healthy",
+      "redis": {
+        "connected": true,
+        "persistence_enabled": true,
+        "rdb_enabled": true,
+        "aof_enabled": false
+      },
+      "solver_id": "my-solver",
+      "version": "0.1.0"
+    }
+    ```
+  - Status codes: `200 OK` (healthy), `503 Service Unavailable` (unhealthy)
+
+#### Admin API (Wallet-Based Authentication)
+
+The admin API enables authorized wallet addresses to perform administrative operations using EIP-712 signed messages. This provides secure, decentralized admin access without shared secrets.
+
+**Setup:** Configure admin addresses in your seed overrides or TOML config:
+
+```json
+{
+  "admin": {
+    "enabled": true,
+    "domain": "solver.example.com",
+    "chain_id": 1,
+    "admin_addresses": ["0xYourAdminWalletAddress"]
+  }
+}
+```
+
+**Endpoints:**
+
+- **GET `/api/v1/admin/nonce`** - Get a nonce for signing admin actions
+  - Response:
+    ```json
+    {
+      "nonce": "1706184000123456",
+      "expiresIn": 300,
+      "domain": "solver.example.com",
+      "chainId": 1
+    }
+    ```
+
+- **GET `/api/v1/admin/types`** - Get EIP-712 type definitions for client-side signing
+  - Returns domain and type definitions for all admin actions (AddToken, RemoveToken, etc.)
+
+- **POST `/api/v1/admin/tokens`** - Add a new token to a network
+  - Request body:
+    ```json
+    {
+      "signature": "0x...",
+      "contents": {
+        "chainId": 10,
+        "symbol": "USDC",
+        "tokenAddress": "0x...",
+        "decimals": 6,
+        "nonce": 1706184000123456,
+        "deadline": 1706184300
+      }
+    }
+    ```
+  - The signature must be an EIP-712 typed data signature from an authorized admin
+  - Changes are hot-reloaded immediately (no restart required)
+
+**Admin Action Flow:**
+
+1. Call `GET /api/v1/admin/nonce` to get a fresh nonce
+2. Call `GET /api/v1/admin/types` to get EIP-712 type definitions
+3. Construct the typed data with the nonce and a deadline
+4. Sign with your admin wallet (EIP-712)
+5. Submit the signed action to the appropriate endpoint
+
 ### Example Usage
 
 ```bash
@@ -592,6 +672,15 @@ curl http://localhost:3000/api/v1/tokens/31338
 
 # Get all supported tokens
 curl http://localhost:3000/api/v1/tokens
+
+# Health check
+curl http://localhost:3000/health
+
+# Admin: Get nonce for signing
+curl http://localhost:3000/api/v1/admin/nonce
+
+# Admin: Get EIP-712 types for signing
+curl http://localhost:3000/api/v1/admin/types
 ```
 
 The API server is enabled by default on port 3000 when the solver is running. You can disable it or change the port in the configuration file.

config/seed-overrides-testnet.json

@@ -1,5 +1,4 @@
 {
-  "solver_id": "oif-solver-testnet",
   "networks": [
     {
       "chain_id": 11155420,
@@ -21,5 +20,10 @@
         }
       ]
     }
-  ]
+  ],
+  "admin": {
+    "enabled": true,
+    "domain": "localhost",
+    "admin_addresses": ["0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266"]
+  }
 }

crates/solver-config/src/builders/config.rs

@@ -19,6 +19,7 @@ pub struct ConfigBuilder {
 	solver_id: String,
 	monitoring_timeout_seconds: u64,
 	min_profitability_pct: Decimal,
+	gas_buffer_bps: u32,
 	storage_primary: String,
 	storage_cleanup_interval_seconds: u64,
 	min_confirmations: u64,
@@ -42,6 +43,7 @@ impl ConfigBuilder {
 			solver_id: "test-solver".to_string(),
 			monitoring_timeout_seconds: 60,
 			min_profitability_pct: Decimal::ZERO,
+			gas_buffer_bps: 1000, // 10% default
 			storage_primary: "memory".to_string(),
 			storage_cleanup_interval_seconds: 60,
 			min_confirmations: 1,
@@ -125,6 +127,7 @@ impl ConfigBuilder {
 			solver: SolverConfig {
 				id: self.solver_id,
 				min_profitability_pct: self.min_profitability_pct,
+				gas_buffer_bps: self.gas_buffer_bps,
 				monitoring_timeout_seconds: self.monitoring_timeout_seconds,
 			},
 			networks: self.networks.unwrap_or_default(),

crates/solver-config/src/lib.rs

@@ -87,6 +87,10 @@ pub struct SolverConfig {
 	pub id: String,
 	/// Minimum profitability percentage required to execute orders.
 	pub min_profitability_pct: Decimal,
+	/// Gas buffer in basis points (e.g., 1000 = 10%).
+	/// Applied as safety margin on gas cost estimates.
+	#[serde(default = "default_gas_buffer_bps")]
+	pub gas_buffer_bps: u32,
 	/// Timeout in seconds for monitoring transactions.
 	/// Defaults to 28800 seconds (8 hours) if not specified.
 	#[serde(default = "default_monitoring_timeout_seconds")]
@@ -283,6 +287,10 @@ pub struct PricingConfig {
 	pub implementations: HashMap<String, toml::Value>,
 }
 
+fn default_gas_buffer_bps() -> u32 {
+	1000 // 10%
+}
+
 /// Gas configuration mapping flow identifiers to gas unit overrides.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct GasConfig {