fix(foundation): always include a result key in json-rpc responses - #24840
Merged
Conversation
The safe json-rpc server built success responses as { jsonrpc, id, result }; when a handler returned undefined, JSON.stringify dropped the key, yielding a response with neither result nor error — a JSON-RPC 2.0 violation that left raw callers unable to distinguish 'not found' from a malformed reply. Coerce undefined to null so result is always present. Affects every method that can return undefined (e.g. node getContract/getTxEffect/getBlock/witness getters) across all servers on this framework. TS clients are unaffected: the client already short-circuits null/undefined identically before schema validation.
aminsammara
force-pushed
the
as/jsonrpc-null-result
branch
from
July 21, 2026 14:34
79a84cc to
a960ca8
Compare
aminsammara
requested review from
a team,
IlyasRidhuan,
LeilaWang,
MirandaWood,
Thunkar,
charlielye,
just-mitch,
nventuro and
sirasistant
as code owners
July 21, 2026 14:34
aminsammara
changed the base branch from
merge-train/spartan
to
merge-train/spartan-v5
July 21, 2026 14:34
…al schemas The safe client validates results against zod schemas where optional returns use .optional(), which rejects null. A result: null (now always sent by the server for undefined returns) is only safe because the client short-circuits null before validation. Pin that behavior: assert the wire response carries an explicit result: null end-to-end, and that a client with an optional result schema resolves undefined instead of throwing when any server responds with null.
spalladino
approved these changes
Jul 21, 2026
spalladino
enabled auto-merge (squash)
July 21, 2026 16:06
alexghr
approved these changes
Jul 21, 2026
aminsammara
added a commit
that referenced
this pull request
Jul 22, 2026
Promotes `v5-next` onto `v5` for the **v5.1.0** release. - Merges `v5-next` into `v5`; the resulting tree is **identical to `v5-next`** and `.release-please-manifest.json` is set to **5.1.0** (the only merge conflict was the manifest — v5 held 5.0.1, resolved to v5-next's 5.1.0). - Merge via **merge commit** (v5 ruleset allows `merge` only). - After this merges, `v5` HEAD is tagged `v5.1.0`. Does not include #24840 (json-rpc result key), which is still on `merge-train/spartan-v5` and not in `v5-next`.
Collaborator
|
✅ Successfully ported to port-to-next-staging #24964. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The safe JSON-RPC server built success responses as
{ jsonrpc, id, result }. When a handler returnsundefined,JSON.stringifydrops theresultkey, producing{"jsonrpc":"2.0","id":N}— a response with neitherresultnorerror, which violates JSON-RPC 2.0 and leaves raw/external callers unable to tell "not found" from a malformed reply.Surfaced via
node_getContracton an undeployed (but valid) address: the response had noresultfield at all.Fix
One line in the shared server (
safe_json_rpc_server.ts): coerce anundefinedreturn tonull(result: result ?? null, so0/false/''are preserved). Theresultkey is now always present.Blast radius
Framework-level, so it fixes every method that can return
undefined— ~20 on the node interface (getContract,getContractClass,getTxEffect,getTxByHash,getBlock, the witness getters, synced slot/epoch, validator stats, …) plus every other server on this framework (PXE, prover-node, archiver). Void methods now also returnresult: null.Why it's safe for existing clients
The TS client short-circuits
null/undefined/'null'/'undefined'before schema validation, so it never runsnullthrough an.optional()schema — omitted vsresult: nullboth resolve toundefinedclient-side. Only raw/external callers change, and they now get a spec-compliant response.Testing
undefinednow yields{ jsonrpc, result: null }(red before, green after).clear) assertions, single and batch, to the new shape.test/integration.test.ts) pinning that optional result schemas toleratenullresponses:result: null, and the safe client resolves it toundefined;result: nullverbatim resolves toundefinedagainst an.optional()schema instead of throwing aZodError. Both go red if the client's null short-circuit is removed (verified:Invalid input: expected object, received null).json-rpcsuite: 102 passed;foundationlint clean.