feat: admin authentication for explorer admin endpoints#1545
Draft
danieljrc888 wants to merge 8 commits intomainfrom
Draft
feat: admin authentication for explorer admin endpoints#1545danieljrc888 wants to merge 8 commits intomainfrom
danieljrc888 wants to merge 8 commits intomainfrom
Conversation
- Replace correlated subqueries with separate count query and batch stats fetch, reducing contracts list from O(N*contracts) to O(page_size) - Disable Next.js link prefetching app-wide via AppLink wrapper to prevent dozens of _rsc requests on pages with many links - Remove unused state data field from contracts list API response and UI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The contract_snapshot JSONB blob is never needed by the explorer frontend. Stop serializing it and defer loading it on all explorer queries. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…" link - Backend: return tx_count in contract detail response, add address filter param to transactions list endpoint - Frontend: show "Latest N from a total of X transactions" on address pages when transactions exceed the 50-item limit, with a "VIEW ALL TRANSACTIONS" link to /transactions?address=... - Transactions page: support ?address= query param for filtering Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…scan Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…rendering in MethodForm
- Remove State tab from contract detail view
- Backend: exclude state data JSONB from contract detail response
- Fix MethodForm crashing when method params/return types are objects
(e.g. {$dict: ...}) instead of plain strings
- Center "Latest N from total" text vertically with icon
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reuse existing ADMIN_API_KEY env var as a FastAPI dependency to protect explorer admin routes via X-Admin-Key header, keeping the same 3-mode logic (key required, hosted-blocked, local-open) as the JSON-RPC layer. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
require_admin_keyFastAPI dependency that reuses the existingADMIN_API_KEYenv var to protect explorer admin routes viaX-Admin-Keyheaderexplorer_admin_routerat/api/explorer/admin/with auth applied to all routes/api/explorer/admin/verifyendpoint for testing admin accessADMIN_API_KEYin.env.exampleSame 3-mode logic as the JSON-RPC
@require_admin_accessdecorator:ADMIN_API_KEYset → requires matching key (401)Test plan
/api/explorer/admin/verifyreturns 200 withoutADMIN_API_KEYset (local dev)ADMIN_API_KEY=test-key, verify 401 without header and 200 withX-Admin-Key: test-keyVITE_IS_HOSTED=truewithoutADMIN_API_KEY, verify 403🤖 Generated with Claude Code