fix: validate Stellar addresses on whitelist update - #322
Merged
11 commits merged intoAug 30, 2026
Merged
Conversation
…endpoint Validate Stellar address formats (G... and C...) on POST /api/jobs/:contractId/whitelist/update payload using Zod schema validation and StrKey methods from @stellar/stellar-sdk. Rejects invalid or malformed addresses with HTTP 400 Bad Request before processing any whitelist updates. Add comprehensive test suite in __tests__/whitelist-update.test.ts. Co-authored-by: ademolacomfort <227568225+ademolacomfort@users.noreply.github.com>
…dresses fix: validate Stellar addresses on whitelist update
|
@ademolacomfort Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
…locks#241) - Validate contract/job existence via RPC simulation in POST /api/jobs/:contractId/whitelist/update handler - Return 404 Not Found when contract is not found on network - Enforce process.env.API_KEY authentication returning 401 Unauthorized when configured - Standardize unexpected server error handling to return safe 500 responses without stack trace leaks - Add automated unit tests covering 200, 400, 401, 404, and 500 status codes Co-authored-by: ademolacomfort <227568225+ademolacomfort@users.noreply.github.com>
…locks#241) - Validate contract/job existence via RPC simulation in POST /api/jobs/:contractId/whitelist/update handler - Return 404 Not Found when contract is not found on network - Enforce process.env.API_KEY authentication returning 401 Unauthorized when configured - Standardize unexpected server error handling to return safe 500 responses without stack trace leaks - Add automated unit tests covering 200, 400, 401, 404, and 500 status codes Co-authored-by: ademolacomfort <227568225+ademolacomfort@users.noreply.github.com>
…list-response Standardize response formats and status codes for whitelist update endpoint
…ate endpoint Configure updateWhitelistCors and updateWhitelistSecurityHeaders middleware on POST and OPTIONS /api/jobs/:contractId/whitelist/update. Added unit tests for CORS allowed/unauthorized origins, preflight requests, and security headers. Co-authored-by: ademolacomfort <227568225+ademolacomfort@users.noreply.github.com>
Co-authored-by: ademolacomfort <227568225+ademolacomfort@users.noreply.github.com>
Fix Goldii-locks#242: Configure CORS and Security Headers for POST /api/jobs/:contractId/whitelist/update
fix: add custom rate limit to whitelist update endpoint
godamongstmen897
closed this pull request by merging all changes
into
Goldii-locks:main
in
9e42e6f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #240 by adding Stellar address format validation (account
G...or contractC...) to thePOST /api/jobs/:contractId/whitelist/updatepayload.Invalid Stellar addresses now return HTTP 400 Bad Request with clear validation errors before any whitelist updates are processed.
Uses the project's existing Stellar SDK validation utilities and includes comprehensive tests covering valid addresses, invalid addresses, malformed checksums, mixed address arrays, and empty inputs.
All whitelist tests pass (102/102).
closes #240