fix(api): improve commitment API route authorization and validation b… - #1865
Open
Gabugo-tech wants to merge 5 commits into
Open
Gabugo-tech wants to merge 5 commits into
Gabugo-tech wants to merge 5 commits into
Conversation
|
@Gabugo-tech is attempting to deploy a commit to the 1nonly's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@Gabugo-tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
…oundaries - Enforce session authentication and ownership check against session address (Refs Commitlabs-Org#1758) - Validate Stellar public key regex, supported asset codes, and numeric creation bounds - Add comprehensive automated unit test suites for route.ts and search/route.ts Refs Commitlabs-Org#1758
Gabugo-tech
force-pushed
the
fix/issue-1758-api-validation
branch
from
August 30, 2026 20:59
959bf51 to
1c112e1
Compare
…n and hostile-input boundary
- Enforce server-side session auth via verifyAuth(); callerAddress in body
is now optional and cross-checked against the session identity rather
than trusted directly, preventing tampered-body spoofing.
- Validate callerAddress format against the Stellar public-key regex
(G[A-Z2-7]{55}) before it reaches any business logic.
- Add network passphrase check: optional
etwork field in body must
match server-configured networkPassphrase; rejects wrong-network wallets.
- Cap idempotency key length at 128 chars to prevent storage inflation.
- Validate commitment.amount from chain is finite and positive; rejects
zero, negative, and non-numeric values from malformed chain responses.
- Validate chain service response shape: commitmentId echo must match
requested id, txHash must be a string when present.
- Activate route.test.ts in vitest.config.ts (was excluded as pre-migration
placeholder); 46/46 tests pass covering: success, idempotency replay,
disconnected-wallet 401, tampered address 403, wrong-network 400,
address format 400, key length boundary, numeric amount boundary,
malformed server response, SETTLED/VIOLATED replay 409, CSRF 403.
Refs Commitlabs-Org#1762
- Hoist idempotencyKey declaration above try block so the catch handler can always call idempotencyService.fail() regardless of where the error was thrown (was ReferenceError at runtime) - Switch vi.clearAllMocks() to vi.resetAllMocks() in beforeEach/afterEach to wipe mock implementations between tests, preventing state bleed that caused order-dependent 403 failures in 409/429/502 tests - Fix 'special characters' test: mock fundEscrowOnChain to echo the requested id so the response shape check (commitmentId echo) passes All 67 tests pass.
…dation
- Add ForbiddenError import and capture requireAuth() return value;
cross-check ownerAddress query param against session identity (fixes
403 for ownership mismatch — was silently passing through)
- Strengthen ownerAddress Zod schema from min(1) to full Stellar public
key regex G[A-HJ-NP-Z0-9]{55} (fixes 400 for invalid key format)
- Fix test fixtures: replace addresses containing invalid base32 char 'O'
with valid Stellar keys so regex validation passes for authorized cases
Refs Commitlabs-Org#1758
Author
|
@sasasamaes please review and merge, if there are any issues please call my attention to it |
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[#1758] Improve commitment API route validation: authorization and hostile-input boundary
Description
This PR addresses #1758 by implementing strict authorization boundaries, input schema validation, network checks, and response structure validation for the commitment API endpoints anchored at
src/app/api/commitments/route.tsandsrc/app/api/commitments/search/route.ts.Changes Made
requireAuth/verifyAuthonGETandPOSThandlers prior to parsing parameters or making external chain calls.ownerAddressagainst the verified sessionaddress, returning403 FORBIDDENon identity mismatch to prevent identity spoofing or tampering./^G[A-Z2-7]{55}$/) forownerAddress.XLM,USDC) and verified client-suppliednetworkpassphrase against server configuration (getBackendConfig()).amount > 0).src/app/api/commitments/route.test.tsandsrc/app/api/commitments/search/route.test.tscovering authentication failures (401), authorization mismatches (403), invalid formats (400), and successful execution (200/201).Acceptance Criteria Verification
Validation Results
Executed test suite:
pnpm vitest run --environment node src/app/api/commitments/route.test.ts src/app/api/commitments/search/route.test.ts closes #1758