Merge branch 'feature_migrate_to_unauthenticated_client' into 'main'

feat(reads): use the SDK's unauthenticated client for public reads

See merge request mobilex/web3/OKOutcomes!23

Author: puderty

skills/okx-outcomes-market/SKILL.md

@@ -31,36 +31,15 @@ markets, candles, CLOB quotes / book, public WebSocket streams.
    If missing: `cargo install --locked --path .`
    or download the prebuilt binary.
 
-2. **Credentials configured** (required for `clob` reads and anything
-   touching account state; `data trending`-class public endpoints work
-   without):
-   ```bash
-   # clob reads need an OAuth session (brokered by okx-auth); config from config.json
-   bash skills/okx-outcomes-market/scripts/preflight.sh | jq -r '.ready_for.clob_reads'
-   ```
-   (Richer detail, optional — emits `ready_for.clob_reads`:
-   `bash "${CLAUDE_PLUGIN_ROOT:-.}/skills/okx-outcomes-market/scripts/preflight.sh"`.)
-   If `false`, route the user to the `okx-outcomes-setup` skill, which owns
-   onboarding: it detects the missing piece and walks the user through
-   region (Global / US) → OAuth sign-in → EOA wallet binding (one step at a
-   time, IM-friendly). It ultimately drives the interactive `okx-outcomes
-   setup` wizard / per-step commands in the user's own terminal — that
-   wizard auto-generates a fresh EIP-712 signing wallet (private key never
-   displayed) and lands credentials in the OS keyring (with an AES-256-GCM
-   encrypted file fallback at `~/.okx-outcomes/keyring.enc`).
-
-3. **OAuth session** (required for `clob` reads; the `account` and
-   private-ws commands that also need it live in the `okx-outcomes-trade`
-   skill):
-   - Established by `okx-outcomes setup` (or a standalone
-     `okx-outcomes auth login`); the token is brokered by `okx-auth` and
-     never displayed. This OAuth bearer token is the only account-auth
-     path — there is no HMAC.
-   - Public endpoints (`data` / `search` / public `ws`) work without
-     any authentication at all.
-   - See `references/env-vars.md`.
-
-4. **Corporate proxy**: if the user mentions VPN / firewall, add
+2. **No credentials needed.** Every command in this skill — `data`,
+   `search`, `clob` reads (price / midpoint / spread / book), and public
+   `ws` streams — hits **public, unauthenticated** endpoints, so there is
+   nothing to set up here and no sign-in to gate on. (Account state and
+   signed writes *do* require auth, but those live in the
+   `okx-outcomes-trade` skill — route there for "my balance" / orders /
+   placing or cancelling trades.)
+
+3. **Corporate proxy**: if the user mentions VPN / firewall, add
    `--proxy <URL>`.
 
 One-shot helper: `bash skills/okx-outcomes-market/scripts/preflight.sh`
@@ -101,7 +80,7 @@ unset unless the user explicitly asks about it.
 | candles / K-line | `$P data candles <assetId> [--bar 1m\|5m\|15m\|1H\|4H\|1D] [--limit 100] [--after <ms>] [--before <ms>] -j` |
 | search events | `$P search <keyword> [--cursor ...] [--limit 20] -j` |
 
-### CLOB reads (OAuth auth, but read-only market data)
+### CLOB reads (public, no auth — read-only market data)
 
 `assetId` is the YES-outcome asset id; pass `--outcome no` (or `--no`)
 for the NO side (derived as `1 - yes`).

skills/okx-outcomes-market/references/cli-reference.md

@@ -119,8 +119,8 @@ $P data candles 101664000 --bar 1H --after 1779462000000 -j
 
 ## CLOB — Read-only
 
-CLOB read commands authenticate with the OAuth bearer token (brokered by
-`okx-auth`), but return only public market data (quotes / depth). They're
+CLOB read commands need **no authentication** — they hit public market-data
+endpoints (quotes / depth) via the SDK's unauthenticated client. They're
 grouped here because they're a price-discovery tool.
 
 `assetId` is the YES-outcome asset id; pass `--outcome no` (or `--no`)

skills/okx-outcomes-market/scripts/preflight.sh

@@ -7,10 +7,11 @@
 #   (or a file-stat fallback if the binary or subcommand is unavailable)
 # - ready_for: public_read / clob_reads / public_ws
 #
-# Auth model: account reads / CLOB reads use an OAuth bearer token brokered
-# by `okx-auth` (no HMAC). The signing key lives in the OS keyring. Config
-# lives in `~/.okx-outcomes/config.json`. There are no `PREDICTIONS_*` env
-# overrides anymore, so this script does not probe them.
+# Auth model: this skill's commands (data / search / CLOB reads / public WS)
+# need NO auth — they hit public endpoints via the SDK's unauthenticated
+# client. (Account reads / private WS, in the trade skill, use an OAuth bearer
+# token brokered by `okx-auth`.) Config lives in `~/.okx-outcomes/config.json`.
+# There are no `PREDICTIONS_*` env overrides, so this script does not probe them.
 #
 # Probing strategy: prefer the CLI's own `auth status` subcommand — it owns
 # the credential resolution logic and sees OS-keyring/OAuth-broker state that
@@ -91,7 +92,7 @@ cat <<EOF
   },
   "ready_for": {
     "public_read": $bin_present,
-    "clob_reads":  $( $bin_present && [ "$account_read_ready" = "true" ] && echo true || echo false ),
+    "clob_reads":  $bin_present,
     "public_ws":   $bin_present
   }
 }

src/app.rs

@@ -243,39 +243,32 @@ async fn cmd_status(args: &[String], json: bool) {
     if json {
         let mut result = serde_json::Map::new();
         let mut failed = false;
-        // Events check (requires auth - all REST endpoints do)
-        match super::util::require_auth(args) {
-            Ok(client) => {
-                let start = std::time::Instant::now();
-                match client
-                    .get_events(None, None, None, None, None, None, None)
-                    .await
-                {
-                    Ok(resp) => {
-                        result.insert(
-                            "events".into(),
-                            serde_json::json!({
-                                "ok": true,
-                                "count": resp.events.len(),
-                                "latency_ms": start.elapsed().as_millis() as u64,
-                            }),
-                        );
-                    }
-                    Err(e) => {
-                        failed = true;
-                        let e = e.to_string();
-                        result.insert(
-                            "events".into(),
-                            serde_json::json!({"ok": false, "error": e}),
-                        );
-                    }
+        // Events check — public endpoint, no auth needed.
+        {
+            let client = super::util::public_client();
+            let start = std::time::Instant::now();
+            match client
+                .get_events(None, None, None, None, None, None, None)
+                .await
+            {
+                Ok(resp) => {
+                    result.insert(
+                        "events".into(),
+                        serde_json::json!({
+                            "ok": true,
+                            "count": resp.events.len(),
+                            "latency_ms": start.elapsed().as_millis() as u64,
+                        }),
+                    );
+                }
+                Err(e) => {
+                    failed = true;
+                    let e = e.to_string();
+                    result.insert(
+                        "events".into(),
+                        serde_json::json!({"ok": false, "error": e}),
+                    );
                 }
-            }
-            Err(e) => {
-                result.insert(
-                    "events".into(),
-                    serde_json::json!({"ok": false, "error": e}),
-                );
             }
         }
         // Balance check
@@ -320,31 +313,27 @@ async fn cmd_status(args: &[String], json: bool) {
         return;
     }
 
-    // Table mode (requires auth - all REST endpoints do)
-    match super::util::require_auth(args) {
-        Ok(client) => {
-            let start = std::time::Instant::now();
-            match client
-                .get_events(None, None, None, None, None, None, None)
-                .await
-            {
-                Ok(resp) => {
-                    let ms = start.elapsed().as_millis();
-                    println!(
-                        "  {} {} events, {}ms",
-                        "OK".with(Color::Green),
-                        resp.events.len(),
-                        ms
-                    );
-                }
-                Err(e) => {
-                    super::util::mark_failed();
-                    println!("  {} {e}", "FAIL".with(Color::Red));
-                }
+    // Table mode — events is a public endpoint (no auth needed).
+    {
+        let client = super::util::public_client();
+        let start = std::time::Instant::now();
+        match client
+            .get_events(None, None, None, None, None, None, None)
+            .await
+        {
+            Ok(resp) => {
+                let ms = start.elapsed().as_millis();
+                println!(
+                    "  {} {} events, {}ms",
+                    "OK".with(Color::Green),
+                    resp.events.len(),
+                    ms
+                );
+            }
+            Err(e) => {
+                super::util::mark_failed();
+                println!("  {} {e}", "FAIL".with(Color::Red));
             }
-        }
-        Err(e) => {
-            println!("  {} events: {e}", "SKIP".with(Color::Yellow));
         }
     }
 

src/clob_cmds.rs

@@ -62,7 +62,7 @@ use okx_outcomes_sdk::signing::{
 };
 
 use super::format;
-use super::util::{extract_flag, require_auth, resolve_signing_key};
+use super::util::{extract_flag, public_client, require_auth, resolve_signing_key};
 
 pub(crate) const MARKET_TYPE_PREDICTION: &str = "prediction";
 pub(crate) const ACTION_TYPE_PLACE_ORDER: &str = "placeOrder";
@@ -233,13 +233,7 @@ async fn cmd_price(_positional: &[&str], args: &[String], json: bool) {
             return;
         }
     };
-    let client = match require_auth(args) {
-        Ok(c) => c,
-        Err(e) => {
-            print_err(&e);
-            return;
-        }
-    };
+    let client = public_client();
     match client.get_ticker(asset_id).await {
         Ok(t) => {
             let view = derive_ticker_for_outcome(&t, outcome);
@@ -341,13 +335,7 @@ async fn run_batch_query<T, F>(
         print_err(usage);
         return;
     }
-    let client = match require_auth(args) {
-        Ok(c) => c,
-        Err(e) => {
-            print_err(&e);
-            return;
-        }
-    };
+    let client = public_client();
 
     let fetches = ids.iter().map(|&id| {
         let client = &client;
@@ -630,13 +618,7 @@ async fn cmd_midpoint(_positional: &[&str], args: &[String], json: bool) {
             return;
         }
     };
-    let client = match require_auth(args) {
-        Ok(c) => c,
-        Err(e) => {
-            print_err(&e);
-            return;
-        }
-    };
+    let client = public_client();
     match client.get_ticker(asset_id).await {
         Ok(t) => {
             let view = derive_ticker_for_outcome(&t, outcome);
@@ -713,13 +695,7 @@ async fn cmd_spread(_positional: &[&str], args: &[String], json: bool) {
             return;
         }
     };
-    let client = match require_auth(args) {
-        Ok(c) => c,
-        Err(e) => {
-            print_err(&e);
-            return;
-        }
-    };
+    let client = public_client();
     match client.get_ticker(asset_id).await {
         Ok(t) => {
             let view = derive_ticker_for_outcome(&t, outcome);
@@ -821,13 +797,7 @@ async fn cmd_book(_positional: &[&str], args: &[String], json: bool) {
             return;
         }
     };
-    let client = match require_auth(args) {
-        Ok(c) => c,
-        Err(e) => {
-            print_err(&e);
-            return;
-        }
-    };
+    let client = public_client();
     match client.get_pm_books(asset_id, Some(sz)).await {
         Ok(book) => {
             let view = derive_book_for_outcome(&book, outcome);