Priority Lane Access
for Solana Transactions

[dependencies]
quinn = "0.11"
rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
tokio = { version = "1", features = ["full"] }
arc-swap = "1"
anyhow = "1"
bincode = "1"

use anyhow::{Context as _, Result};
use arc_swap::ArcSwap;
use quinn::{
    crypto::rustls::QuicClientConfig, ClientConfig, Connection, Endpoint,
    IdleTimeout, TransportConfig,
};
use std::net::SocketAddr;
use std::sync::Arc;
use std::time::Duration;
use tokio::sync::Mutex;

const ALPN: &[u8] = b"moonland/1";
const SERVER_NAME: &str = "moonland";
const KEEP_ALIVE: Duration = Duration::from_secs(5);
const MAX_IDLE: Duration = Duration::from_secs(30);
const AUTH_OK: u8 = 0x00;

pub struct MoonLandClient {
    endpoint: Endpoint,
    client_config: ClientConfig,
    addr: SocketAddr,
    api_key_hex: String,
    connection: ArcSwap<Connection>,
    reconnect: Mutex<()>,
}

impl MoonLandClient {
    /// Connect and authenticate. Contact @MoonLandSol on Telegram for endpoint and API key.
    pub async fn connect(server_addr: &str, api_key_hex: &str) -> Result<Self> {
        let addr: SocketAddr = server_addr.parse()?;

        let mut crypto = rustls::ClientConfig::builder()
            .dangerous()
            .with_custom_certificate_verifier(Arc::new(SkipServerVerification))
            .with_no_client_auth();
        crypto.alpn_protocols = vec![ALPN.to_vec()];

        let client_crypto = QuicClientConfig::try_from(crypto)?;
        let mut client_config = ClientConfig::new(Arc::new(client_crypto));
        let mut transport = TransportConfig::default();
        transport.keep_alive_interval(Some(KEEP_ALIVE));
        transport.max_idle_timeout(Some(IdleTimeout::try_from(MAX_IDLE)?));
        client_config.transport_config(Arc::new(transport));

        let mut endpoint = Endpoint::client("0.0.0.0:0".parse()?)?;
        endpoint.set_default_client_config(client_config.clone());
        let connection = endpoint.connect(addr, SERVER_NAME)?.await?;

        // Auth handshake: bidi stream → send API key → read 1-byte response
        Self::do_auth(&connection, api_key_hex).await?;

        Ok(Self {
            endpoint, client_config, addr,
            api_key_hex: api_key_hex.to_string(),
            connection: ArcSwap::from_pointee(connection),
            reconnect: Mutex::new(()),
        })
    }

    /// Send raw serialized transaction bytes. Auto-reconnects on failure.
    pub async fn send_transaction(&self, tx_bytes: &[u8]) -> Result<()> {
        let connection = self.connection.load_full();
        if Self::try_send(&connection, tx_bytes).await.is_ok() {
            return Ok(());
        }
        self.reconnect().await?;
        let connection = self.connection.load_full();
        Self::try_send(&connection, tx_bytes).await
    }

    async fn do_auth(connection: &Connection, api_key_hex: &str) -> Result<()> {
        let (mut send, mut recv) = connection.open_bi().await
            .context("failed to open auth stream")?;
        send.write_all(api_key_hex.as_bytes()).await
            .context("failed to send API key")?;
        send.finish().context("failed to finish auth stream")?;

        let mut response = [0u8; 1];
        recv.read_exact(&mut response).await
            .context("failed to read auth response")?;
        if response[0] != AUTH_OK {
            anyhow::bail!("authentication rejected (code: {})", response[0]);
        }
        Ok(())
    }

    async fn try_send(conn: &Connection, tx_bytes: &[u8]) -> Result<()> {
        let mut stream = conn.open_uni().await?;
        stream.write_all(tx_bytes).await?;
        stream.finish()?;
        Ok(())
    }

    async fn reconnect(&self) -> Result<()> {
        let _guard = self.reconnect.lock().await;
        let current = self.connection.load_full();
        if current.close_reason().is_none() { return Ok(()); }
        let connection = self.endpoint
            .connect_with(self.client_config.clone(), self.addr, SERVER_NAME)?
            .await?;
        // Re-authenticate on new connection
        Self::do_auth(&connection, &self.api_key_hex).await?;
        self.connection.store(Arc::new(connection));
        Ok(())
    }
}

// TLS: skip server cert verification (self-signed relay)
#[derive(Debug)]
struct SkipServerVerification;
impl rustls::client::danger::ServerCertVerifier for SkipServerVerification {
    fn verify_server_cert(&self, _: &rustls::pki_types::CertificateDer,
        _: &[rustls::pki_types::CertificateDer], _: &rustls::pki_types::ServerName,
        _: &[u8], _: rustls::pki_types::UnixTime,
    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
        Ok(rustls::client::danger::ServerCertVerified::assertion())
    }
    fn verify_tls12_signature(&self, _: &[u8],
        _: &rustls::pki_types::CertificateDer, _: &rustls::DigitallySignedStruct,
    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
    }
    fn verify_tls13_signature(&self, _: &[u8],
        _: &rustls::pki_types::CertificateDer, _: &rustls::DigitallySignedStruct,
    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
    }
    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
        rustls::crypto::ring::default_provider()
            .signature_verification_algorithms.supported_schemes()
    }
}

// At startup — connect once, auth is automatic
let client = MoonLandClient::connect(
    "<endpoint>",     // Regional endpoint — provided by Moon Land team
    "<api-key>",      // 32 hex chars — provided by Moon Land team
).await?;

// Per transaction — fire and forget
let tx_bytes = bincode::serialize(&my_signed_transaction)?;
client.send_transaction(&tx_bytes).await?;

// Each transaction must include a tip: System Program transfer
// of >= 0.001 SOL to a Moon Land tip address.
// Tip addresses provided with your API key.