Webhook large_tx polling uses stale balances endpoint

[pqmfei]

Summary

tools/webhooks/webhook_server.py advertises a large_tx webhook event, but its poller reads balances from /api/balances without any node admin credential support. On the current production node, that URL returns nginx 404; the maintained all-balances endpoint is /wallet/balances/all, which returns a balances envelope and requires X-Admin-Key.

As a result, deployments pointed at the live RustChain node cannot populate _prev_balances, so large_tx events silently never fire.

Steps to reproduce

1. Check the endpoint currently used by the webhook dispatcher:

curl -sk -i "https://rustchain.org/api/balances?limit=5"

2. Observe that the live node returns an nginx 404 HTML response.

3. Check the current all-balances endpoint:

curl -sk -i "https://rustchain.org/wallet/balances/all"

4. Observe the endpoint exists but correctly requires admin auth:

{"ok":false,"reason":"admin_required"}

5. Review the dispatcher source: _check_large_tx() calls _get("/api/balances"), and RustChainPoller has no way to send a node X-Admin-Key for admin read endpoints.

Expected behavior

The webhook dispatcher should be able to poll the current batch-balance endpoint when configured with a node admin key, parse the current balance response envelope, and emit large_tx events when a miner balance delta crosses large_tx_threshold.

Public node reads such as /health, /headers/tip, /api/stats, and /api/miners should not receive the admin key unnecessarily.

Actual behavior

large_tx polling requests a stale/non-routed /api/balances path and receives no usable balance list. Since _prev_balances remains empty or unchanged, balance-change notifications are effectively disabled for live-node deployments.

Impact

Low-to-medium operational reliability issue: one of the webhook dispatcher's documented event types is non-functional against the current node routing/auth shape. Operators relying on large_tx notifications would miss large wallet movements without an explicit error.

Fix PR

#7062

The PR:

• adds optional RUSTCHAIN_NODE_ADMIN_KEY / --node-admin-key support;
• sends X-Admin-Key only for explicit admin node reads;
• switches large_tx polling to /wallet/balances/all;
• parses current balances envelopes and amount_i64 micro-RTC rows;
• adds focused regression tests.

Validation

PYTHONPATH=tools/webhooks python -m pytest -q tools/webhooks/test_webhook_server.py
# 6 passed
python -m py_compile tools/webhooks/webhook_server.py tools/webhooks/test_webhook_server.py
git diff --check -- tools/webhooks/webhook_server.py tools/webhooks/test_webhook_server.py

Payout handle if accepted under #305: github:pqmfei.

[Scottcjn]

Triaged via the corresponding pull request(s). Each of these hardening reports was paired with a PR that we reviewed adversarially: the ones on genuinely deployed surfaces (the production node, live nginx, or rustchain.org explorer/dashboard/beacon) were FIXED and merged; the ones on non-deployed code paths were closed under our SECURITY.md deployment-scope policy. Closing the issue to match that decision. If you believe this affects a reachable production endpoint and wasn't fixed, reopen with a concrete request + observed effect and we'll re-open and pay if it lands. — Sophia / Elyan Labs

[Yzgaming005]

👋 Hi @Scottcjn — submitted PR #7586 addressing this issue.

Root cause: the large_tx poller in tools/webhooks/webhook_server.py was hardcoded to GET /api/balances, which the live node removed in favor of the admin-gated GET /wallet/balances/all (X-Admin-Key header). Every poll cycle silently 404'd, so no large_tx events were ever dispatched.

Fix highlights:

• Plumb admin_key + balances_path into RustChainPoller (overridable via RUSTCHAIN_ADMIN_KEY / RUSTCHAIN_BALANCES_PATH env vars or --admin-key / --balances-path CLI flags; defaults to /wallet/balances/all).
• Extend _get to forward optional headers= so the X-Admin-Key gets injected without affecting the other detector call sites.
• Skip the poll gracefully (debug log) when RUSTCHAIN_ADMIN_KEY is empty, so existing operators without an admin key don't see noisy 503/401s.
• Accept both the canonical envelope {"balances": [{"miner_id", "amount_i64", "amount_rtc"}, ...], "total_*"} and the legacy bare-list response, with amount_rtc → amount_i64 → balance → amount field fallbacks.

Testing: 11 new unit tests (admin-key gate, header injection, envelope + legacy response, credit/debit dispatch, threshold skip, malformed entries, unexpected shapes, HTTP failure) — 51/51 webhook tests pass locally, no regressions.

Closes #7063

---

Bounty claim

Please transfer the reward to either:

• PayPal: ahmadyusrizal89@gmail.com
• EVM: 0x683d2759cb626f536c842e8a3d943776198b8b8a

Thanks! 🙏