stop service as node admin

docs/API.md

@@ -2616,9 +2616,12 @@ provided.
 
 #### Description
 
-Tear down the service container and network. Owner-gated. The paid reservation is kept until
-`expiresAt`; optional `release: true` ends the paid window now so the expiry sweep frees it
-instead — no refund, no restart.
+Tear down the service container and network. Owner-gated, with one exception: a **node
+admin** (an address in `ALLOWED_ADMINS` or on an `ALLOWED_ADMINS_LIST` access list) may stop
+**any** service on the node by signing as itself in `consumerAddress` — the operator does not
+need the tenant's key. The paid reservation is kept until `expiresAt`; optional
+`release: true` ends the paid window now so the expiry sweep frees it instead — no refund,
+no restart.
 
 #### Request Body
 
@@ -2636,6 +2639,15 @@ instead — no refund, no restart.
 
 The `ServiceJob` with `status: 70` (Stopped).
 
+#### Response (400)
+
+No such service. An admin caller gets this too when the `serviceId` does not exist on the
+node at all; a non-admin caller gets it for any service it does not own.
+
+#### Response (401)
+
+Missing/invalid auth, or `consumerAddress` is neither the service owner nor a node admin.
+
 ---
 
 ### `HTTP` GET /api/services/serviceStreamableLogs

docs/services.md

@@ -34,7 +34,7 @@ and `signature` as query parameters (or an auth-token `Authorization` header).
 | `SERVICE_LIST` | `/api/services/serviceList` | GET | Node-wide service listing — authenticated, **not** owner-scoped. Default: only services currently holding a resource reservation; `status=<n>` filters to one specific status, `includeAllStatuses=true` returns everything, `fromTimestamp` keeps services created at/after that moment. Output is listing-sanitized (no `userData`, no `dockerCmd`/`dockerEntrypoint`, no Dockerfile) but keeps user `metadata` |
 | `SERVICE_EXTEND` | `/api/services/serviceExtend` | POST | Pay to push the expiry further out |
 | `SERVICE_RESTART` | `/api/services/serviceRestart` | POST | Recreate the container (no extra charge); asynchronous like start — returns once the job is `Restarting`, poll `serviceStatus`. Optionally restart on a **new image spec** (bug-fix flow) — see below |
-| `SERVICE_STOP` | `/api/services/serviceStop` | POST | Tear down the container; the paid resource reservation (cpu/ram/gpu + host ports) is kept until `expiresAt`, so the service can be restarted anytime on the same endpoints. `release: true` ends the paid window now and frees it instead (no refund, no restart) |
+| `SERVICE_STOP` | `/api/services/serviceStop` | POST | Tear down the container; the paid resource reservation (cpu/ram/gpu + host ports) is kept until `expiresAt`, so the service can be restarted anytime on the same endpoints. `release: true` ends the paid window now and frees it instead (no refund, no restart). Callable by the owner **or** by a node admin (`ALLOWED_ADMINS` / `ALLOWED_ADMINS_LIST`), who may stop any service on the node |
 | `SERVICE_GET_TEMPLATES` | `/api/services/serviceTemplates` | GET | List operator-published service templates |
 | `SERVICE_GET_STREAMABLE_LOGS` | `/api/services/serviceStreamableLogs` | GET | Stream the container's live stdout/stderr logs — authenticated, owner-scoped; available while `Running` or `Error`; optional `since` to skip history |
 

src/components/core/admin/adminHandler.ts

@@ -18,6 +18,78 @@ import { CommonValidation } from '../../../utils/validators.js'
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
 import { normalizeCommandAddresses } from '../../../utils/evmAddress.js'
 import { isAddress } from 'ethers'
+import type { OceanNode } from '../../../OceanNode.js'
+
+// Membership test for the node's admin set: the ALLOWED_ADMINS address list first, then
+// each configured admin access list (ALLOWED_ADMINS_LIST), per chain. Says nothing about
+// authentication — the caller must have already proven it owns `address` (signature or
+// auth token). Exported because handlers outside the admin family (SERVICE_STOP) also
+// grant the node operator a privileged path and must not re-implement these checks.
+export async function isAllowedAdminAddress(
+  oceanNode: OceanNode,
+  address: string
+): Promise<boolean> {
+  const allowedAdmins = oceanNode.getAdminAddresses()
+  if (!allowedAdmins || !address) {
+    return false
+  }
+  const { addresses, accessLists } = allowedAdmins
+  const isListedAddress = await checkSingleCredential(
+    { type: CREDENTIALS_TYPES.ADDRESS, values: addresses },
+    address,
+    null
+  )
+  if (isListedAddress) {
+    return true
+  }
+  if (accessLists) {
+    for (const chainId of Object.keys(accessLists)) {
+      // Need an on-chain signer/provider to call balanceOf on the access list
+      // contract. getBlockchain() returns null when that chain has no RPC configured.
+      const blockchain = oceanNode.getBlockchain(parseInt(chainId))
+      if (!blockchain) {
+        CORE_LOGGER.error(
+          `Cannot check admin access list for chain ${chainId}: no RPC configured for that chain. Skipping.`
+        )
+        continue
+      }
+      // Fail closed on misconfiguration: an empty or malformed contract address
+      // would make checkAddressOnAccessListWithSigner return `true` (it treats a
+      // falsy address as "no access list"), silently authorizing ANY authenticated
+      // caller as admin. Only keep well-formed contract addresses.
+      const validContracts = accessLists[chainId].filter((addr: string) =>
+        isAddress(addr)
+      )
+      if (validContracts.length === 0) {
+        CORE_LOGGER.error(
+          `No valid access list contract address configured for admin check on chain ${chainId}. Skipping.`
+        )
+        continue
+      }
+      try {
+        const signer = await blockchain.getSigner()
+        // Pass only the validated contracts for this chain; checkCredentialOnAccessList
+        // iterates the array and checks each one with an on-chain balanceOf.
+        const isOnAccessList = await checkCredentialOnAccessList(
+          { [chainId]: validContracts },
+          chainId,
+          address,
+          signer
+        )
+        if (isOnAccessList) {
+          return true
+        }
+      } catch (error) {
+        // Isolate per-chain failures (RPC rate limit / downtime) so one bad
+        // chain does not abort the whole loop and deny an otherwise-valid admin.
+        CORE_LOGGER.error(
+          `Error checking admin access list for chain ${chainId}: ${error}`
+        )
+      }
+    }
+  }
+  return false
+}
 
 export abstract class AdminCommandHandler
   extends BaseHandler
@@ -73,64 +145,9 @@ export abstract class AdminCommandHandler
       }
     }
     try {
-      const allowedAdmins = oceanNode.getAdminAddresses()
-
-      const { addresses, accessLists } = allowedAdmins
-      let allowed = await checkSingleCredential(
-        { type: CREDENTIALS_TYPES.ADDRESS, values: addresses },
-        address,
-        null
-      )
-      if (allowed) {
+      if (await isAllowedAdminAddress(oceanNode, address)) {
         return { valid: true, error: '' }
       }
-      if (accessLists) {
-        for (const chainId of Object.keys(accessLists)) {
-          // Need an on-chain signer/provider to call balanceOf on the access list
-          // contract. getBlockchain() returns null when that chain has no RPC configured.
-          const blockchain = oceanNode.getBlockchain(parseInt(chainId))
-          if (!blockchain) {
-            CORE_LOGGER.error(
-              `Cannot check admin access list for chain ${chainId}: no RPC configured for that chain. Skipping.`
-            )
-            continue
-          }
-          // Fail closed on misconfiguration: an empty or malformed contract address
-          // would make checkAddressOnAccessListWithSigner return `true` (it treats a
-          // falsy address as "no access list"), silently authorizing ANY authenticated
-          // caller as admin. Only keep well-formed contract addresses.
-          const validContracts = accessLists[chainId].filter((addr: string) =>
-            isAddress(addr)
-          )
-          if (validContracts.length === 0) {
-            CORE_LOGGER.error(
-              `No valid access list contract address configured for admin check on chain ${chainId}. Skipping.`
-            )
-            continue
-          }
-          try {
-            const signer = await blockchain.getSigner()
-            // Pass only the validated contracts for this chain; checkCredentialOnAccessList
-            // iterates the array and checks each one with an on-chain balanceOf.
-            allowed = await checkCredentialOnAccessList(
-              { [chainId]: validContracts },
-              chainId,
-              address,
-              signer
-            )
-          } catch (error) {
-            // Isolate per-chain failures (RPC rate limit / downtime) so one bad
-            // chain does not abort the whole loop and deny an otherwise-valid admin.
-            CORE_LOGGER.error(
-              `Error checking admin access list for chain ${chainId}: ${error}`
-            )
-            continue
-          }
-          if (allowed) {
-            return { valid: true, error: '' }
-          }
-        }
-      }
 
       const errorMsg = `The address which signed the message is not on the allowed admins list. Therefore signature ${signature} is rejected`
       CORE_LOGGER.logMessage(errorMsg)

src/components/core/service/stopService.ts

@@ -9,6 +9,7 @@ import {
   buildInvalidRequestMessage
 } from '../../httpRoutes/validateCommands.js'
 import { CORE_LOGGER } from '../../../utils/logging/common.js'
+import { isAllowedAdminAddress } from '../admin/adminHandler.js'
 import { findServiceJobAndEngine, toPublicServiceJob } from './utils.js'
 
 export class ServiceStopHandler extends CommandHandler {
@@ -36,12 +37,24 @@ export class ServiceStopHandler extends CommandHandler {
         status: { httpStatus: 503, error: 'Compute engines not configured' }
       }
 
-    // Find the job and the engine that owns it (by clusterHash — see helper)
-    const { job, engine } = await findServiceJobAndEngine(
+    // Find the job and the engine that owns it (by clusterHash — see helper). Scoped to
+    // the caller first, so a stranger cannot tell an existing service from a missing one.
+    let { job, engine } = await findServiceJobAndEngine(
       engines,
       task.serviceId,
       task.consumerAddress
     )
+    // Node admins (ALLOWED_ADMINS / ALLOWED_ADMINS_LIST) may stop ANY service on this
+    // node — the operator has to be able to tear down a tenant's container without its
+    // key. Only consulted when the owner-scoped path did not already grant access, so the
+    // common owner call never pays for the access-list lookups.
+    let asAdmin = false
+    if (!job || job.owner.toLowerCase() !== task.consumerAddress.toLowerCase()) {
+      asAdmin = await isAllowedAdminAddress(this.getOceanNode(), task.consumerAddress)
+      // Admin caller: redo the lookup unfiltered, since the job belongs to someone else.
+      if (asAdmin && !job)
+        ({ job, engine } = await findServiceJobAndEngine(engines, task.serviceId))
+    }
     if (!job)
       return buildInvalidParametersResponse(
         buildInvalidRequestMessage('Service job not found: ' + task.serviceId)
@@ -54,13 +67,21 @@ export class ServiceStopHandler extends CommandHandler {
           error: `No compute engine owns service ${task.serviceId} (cluster ${job.clusterHash}) — the node's compute configuration may have changed`
         }
       }
-    if (job.owner.toLowerCase() !== task.consumerAddress.toLowerCase())
+    if (!asAdmin && job.owner.toLowerCase() !== task.consumerAddress.toLowerCase())
       return { stream: null, status: { httpStatus: 401, error: 'Not the service owner' } }
 
+    if (asAdmin)
+      CORE_LOGGER.logMessage(
+        `Admin ${task.consumerAddress} is stopping service ${task.serviceId} owned by ${job.owner} (release=${task.release === true})`,
+        true
+      )
+
     try {
       const stopped = await engine.stopService(
         task.serviceId,
-        task.consumerAddress,
+        // The job's own owner, not the caller: an admin stop must still resolve the row
+        // the owner-scoped engine lookup expects.
+        job.owner,
         false, // onlyIfExpired
         task.release === true
       )