fix(erpc:PLA-1613): isolate vendor cache keys

[0x666c6f]

Summary

• Scope remote catalog cache keys by provider id plus vendor-specific inputs for QuickNode, Chainstack, and Repository.
• Carry provider id through vendor call context, so provider settings stay unmodified and are not copied for cache-key isolation.
• Replace raw secret key parts with opaque process-local tokens so cache keys do not expose or digest API keys.
• Update provider docs for QuickNode tag-based endpoint groups.

Linear: https://linear.app/morpho-labs/issue/PLA-1613/fix-erpc-provider-mapping-vendor-cache-and-repository-method

Validation

• go test ./thirdparty -count=1
• go vet ./thirdparty
• git diff --check
• go test ./... -count=1 attempted locally; Docker-backed data tests fail on this host with rootless Docker not found, failed to create Docker provider, then the run was stopped after no further package output.

Notes

• golangci-lint is not installed locally (command not found); CI runs the repository gates.

[Copilot]

Pull request overview

Scopes vendor remote-catalog cache keys by provider id and vendor-specific inputs (and hashes secret-bearing parts) so multiple providers can safely share the same vendor account credentials without RemoteDataCache snapshot collisions.

Changes:

• Introduces a shared cache-key helper (vendorCapabilityCacheKey) that mixes vendor name + provider id + hashed parts (with secretCachePart).
• Updates QuickNode, Chainstack, and Repository vendors to use provider-scoped cache keys (and adjusts tests accordingly).
• Updates provider docs to reflect the new QuickNode tag-group behavior (with examples).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
thirdparty/vendor_cache_key.go	Adds helper utilities for provider-scoped, secret-safe remote cache keys.
thirdparty/vendor_cache_key_test.go	Adds focused tests ensuring provider isolation and secret redaction in keys.
thirdparty/repository.go	Scopes repository remote cache entries by provider id + repository URL (hashed into key).
thirdparty/quicknode.go	Scopes QuickNode endpoint snapshots by provider id + apiKey (hashed) + tag filters.
thirdparty/quicknode_test.go	Updates snapshot keys to match new QuickNode cache-key scheme; adds reuse test.
thirdparty/provider.go	Injects provider id into vendor settings to enable provider-scoped cache keys.
thirdparty/provider_test.go	Verifies provider id injection does not mutate original settings; adds template test.
thirdparty/chainstack.go	Scopes Chainstack node snapshots by provider id + apiKey (hashed) + filters.
thirdparty/chainstack_test.go	Updates cache-key test to assert provider scoping and no raw apiKey leakage.
docs/pages/config/projects/providers.mdx	Updates QuickNode guidance and examples for provider-id + tag-based isolation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b04d2e4bf2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

thirdparty/provider.go:165

• applyUpstreamIDTemplate now substitutes <EVM_CHAIN_ID> with the literal string N/A for non-evm: networks. This changes upstream ID generation behavior (previously the placeholder would typically be removed/empty), which can be a breaking change for deployments relying on stable IDs/metrics naming, and it’s not mentioned in the PR description (which focuses on vendor cache keys). Consider either (a) reverting to the prior empty-string behavior for backward compatibility, or (b) explicitly calling out this behavior change in the PR description/release notes so users can opt in by updating templates.

	// If network is in "evm:<someChainId>" format, then <EVM_CHAIN_ID> = <someChainId>.
	// Otherwise, we replace that placeholder with N/A.
	if strings.HasPrefix(networkId, "evm:") {
		evmChainId := strings.TrimPrefix(networkId, "evm:")
		result = strings.ReplaceAll(result, "<EVM_CHAIN_ID>", evmChainId)
	} else {
		result = strings.ReplaceAll(result, "<EVM_CHAIN_ID>", "N/A")
	}

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

thirdparty/provider.go:162

• applyUpstreamIDTemplate now replaces <EVM_CHAIN_ID> with the literal "N/A" for non-evm: networks, which changes generated upstream IDs compared to the previous "empty string" behavior and could be a breaking change for existing configs that include <EVM_CHAIN_ID> in their template. The PR description focuses on vendor remote-cache keys; please confirm this upstream-ID change is intended and either (a) call it out explicitly in the PR description / docs as a behavior change, or (b) revert to the previous empty-string substitution to preserve backward compatibility.

	if strings.HasPrefix(networkId, "evm:") {
		evmChainId := strings.TrimPrefix(networkId, "evm:")
		result = strings.ReplaceAll(result, "<EVM_CHAIN_ID>", evmChainId)
	} else {
		result = strings.ReplaceAll(result, "<EVM_CHAIN_ID>", "N/A")