fix(foundation): always include a result key in json-rpc responses - #24840
Merged
Conversation
The safe json-rpc server built success responses as { jsonrpc, id, result }; when a handler returned undefined, JSON.stringify dropped the key, yielding a response with neither result nor error — a JSON-RPC 2.0 violation that left raw callers unable to distinguish 'not found' from a malformed reply. Coerce undefined to null so result is always present. Affects every method that can return undefined (e.g. node getContract/getTxEffect/getBlock/witness getters) across all servers on this framework. TS clients are unaffected: the client already short-circuits null/undefined identically before schema validation.
aminsammara
force-pushed
the
as/jsonrpc-null-result
branch
from
July 21, 2026 14:34
79a84cc to
a960ca8
Compare
aminsammara
requested review from
a team,
IlyasRidhuan,
LeilaWang,
MirandaWood,
Thunkar,
charlielye,
just-mitch,
nventuro and
sirasistant
as code owners
July 21, 2026 14:34
aminsammara
changed the base branch from
merge-train/spartan
to
merge-train/spartan-v5
July 21, 2026 14:34
…al schemas The safe client validates results against zod schemas where optional returns use .optional(), which rejects null. A result: null (now always sent by the server for undefined returns) is only safe because the client short-circuits null before validation. Pin that behavior: assert the wire response carries an explicit result: null end-to-end, and that a client with an optional result schema resolves undefined instead of throwing when any server responds with null.
spalladino
approved these changes
Jul 21, 2026
spalladino
enabled auto-merge (squash)
July 21, 2026 16:06
alexghr
approved these changes
Jul 21, 2026
aminsammara
added a commit
that referenced
this pull request
Jul 22, 2026
Promotes `v5-next` onto `v5` for the **v5.1.0** release. - Merges `v5-next` into `v5`; the resulting tree is **identical to `v5-next`** and `.release-please-manifest.json` is set to **5.1.0** (the only merge conflict was the manifest — v5 held 5.0.1, resolved to v5-next's 5.1.0). - Merge via **merge commit** (v5 ruleset allows `merge` only). - After this merges, `v5` HEAD is tagged `v5.1.0`. Does not include #24840 (json-rpc result key), which is still on `merge-train/spartan-v5` and not in `v5-next`.
Collaborator
|
✅ Successfully ported to port-to-next-staging #24964. |
rangozd
pushed a commit
to rangozd/aztec-packages
that referenced
this pull request
Aug 5, 2026
…ztecProtocol#24840) ## Problem The safe JSON-RPC server built success responses as `{ jsonrpc, id, result }`. When a handler returns `undefined`, `JSON.stringify` drops the `result` key, producing `{"jsonrpc":"2.0","id":N}` — a response with **neither `result` nor `error`**, which violates JSON-RPC 2.0 and leaves raw/external callers unable to tell "not found" from a malformed reply. Surfaced via `node_getContract` on an undeployed (but valid) address: the response had no `result` field at all. ## Fix One line in the shared server (`safe_json_rpc_server.ts`): coerce an `undefined` return to `null` (`result: result ?? null`, so `0`/`false`/`''` are preserved). The `result` key is now always present. ## Blast radius Framework-level, so it fixes every method that can return `undefined` — ~20 on the node interface (`getContract`, `getContractClass`, `getTxEffect`, `getTxByHash`, `getBlock`, the witness getters, synced slot/epoch, validator stats, …) plus every other server on this framework (PXE, prover-node, archiver). Void methods now also return `result: null`. ## Why it's safe for existing clients The TS client short-circuits `null`/`undefined`/`'null'`/`'undefined'` **before** schema validation, so it never runs `null` through an `.optional()` schema — omitted vs `result: null` both resolve to `undefined` client-side. Only raw/external callers change, and they now get a spec-compliant response. ## Testing - Added a test: a handler returning `undefined` now yields `{ jsonrpc, result: null }` (red before, green after). - Updated the existing void-method (`clear`) assertions, single and batch, to the new shape. - Added integration tests (`test/integration.test.ts`) pinning that optional result schemas tolerate `null` responses: - end-to-end: the wire response for an undefined return carries an explicit `result: null`, and the safe client resolves it to `undefined`; - client-isolated: a stubbed fetch returning `result: null` verbatim resolves to `undefined` against an `.optional()` schema instead of throwing a `ZodError`. Both go red if the client's null short-circuit is removed (verified: `Invalid input: expected object, received null`). - Full `json-rpc` suite: 102 passed; `foundation` lint clean.
rangozd
pushed a commit
to rangozd/aztec-packages
that referenced
this pull request
Aug 5, 2026
BEGIN_COMMIT_OVERRIDE fix(foundation): always include a result key in json-rpc responses (AztecProtocol#24840) fix(pxe): cap fresh secret pending tag indexes to the probed window (port AztecProtocol#24667) (AztecProtocol#24977) fix(archiver): resolve L2-to-L1 witness from a single store snapshot (AztecProtocol#24754) fix(sequencer): stop signalling already-executed governance payloads (AztecProtocol#24764) fix(archiver): clean up removed blocks from raw rows and ownership-check tx-effect deletes (AztecProtocol#24765) fix(node): warm KZG trusted setup at startup (AztecProtocol#24775) feat(prover-node): stop caching checkpoint txs; re-fetch from the pool for failure upload (A-1216) (AztecProtocol#24983) fix(sequencer): log tx failure reason at warn when dropping from mempool (AztecProtocol#25000) feat(prover-client): stop duplicating broker job inputs/results in memory (A-1215) (AztecProtocol#24990) fix(prover-client): don't retain inline job inputs in the facade without a failed-proof store (A-1517) (AztecProtocol#25027) END_COMMIT_OVERRIDE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The safe JSON-RPC server built success responses as
{ jsonrpc, id, result }. When a handler returnsundefined,JSON.stringifydrops theresultkey, producing{"jsonrpc":"2.0","id":N}— a response with neitherresultnorerror, which violates JSON-RPC 2.0 and leaves raw/external callers unable to tell "not found" from a malformed reply.Surfaced via
node_getContracton an undeployed (but valid) address: the response had noresultfield at all.Fix
One line in the shared server (
safe_json_rpc_server.ts): coerce anundefinedreturn tonull(result: result ?? null, so0/false/''are preserved). Theresultkey is now always present.Blast radius
Framework-level, so it fixes every method that can return
undefined— ~20 on the node interface (getContract,getContractClass,getTxEffect,getTxByHash,getBlock, the witness getters, synced slot/epoch, validator stats, …) plus every other server on this framework (PXE, prover-node, archiver). Void methods now also returnresult: null.Why it's safe for existing clients
The TS client short-circuits
null/undefined/'null'/'undefined'before schema validation, so it never runsnullthrough an.optional()schema — omitted vsresult: nullboth resolve toundefinedclient-side. Only raw/external callers change, and they now get a spec-compliant response.Testing
undefinednow yields{ jsonrpc, result: null }(red before, green after).clear) assertions, single and batch, to the new shape.test/integration.test.ts) pinning that optional result schemas toleratenullresponses:result: null, and the safe client resolves it toundefined;result: nullverbatim resolves toundefinedagainst an.optional()schema instead of throwing aZodError. Both go red if the client's null short-circuit is removed (verified:Invalid input: expected object, received null).json-rpcsuite: 102 passed;foundationlint clean.