Repository navigation
fix(backend): auth gate strategy switch, read real audit and export data, secure metrics, and unify error responses - #1650
Merged
Junirezz merged 2 commits intoOct 19, 2026
Conversation
…ata, secure metrics, and unify error responses
|
@serverlessdomain-hash Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const authHeader = req.get('Authorization') || req.get('authorization') || ''; | ||
| const apiKeyHeader = req.get('x-api-key'); | ||
| let providedKey = apiKeyHeader; | ||
| const match = authHeader.match(/^ApiKey\s+(.+)$/i) || authHeader.match(/^Bearer\s+(.+)$/i); |
| const authHeader = req.get('Authorization') || req.get('authorization') || ''; | ||
| const apiKeyHeader = req.get('x-api-key'); | ||
| let providedKey = apiKeyHeader; | ||
| const match = authHeader.match(/^ApiKey\s+(.+)$/i) || authHeader.match(/^Bearer\s+(.+)$/i); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request resolves issues #1605, #1606, #1607, and #1611 in
Junirezz/YieldVault-RWA:Gate Strategy Switch Behind Auth & Store Cooldown in DB/Redis (Closes [backend] Gate POST /vault/strategy behind auth and move cooldown state out of process.env #1605):
POST /vault/strategybehind authentication: requires either an adminApiKeyor a signed wallet action (action: 'strategy'), returning 401 for unauthenticated calls.process.env.LAST_STRATEGY_SWITCH_TIMEwith persistent cooldown tracking stored in Prisma (AdminConfigChange) and Redis (vault:strategy:last_switch).Retry-Afterheader when the switch interval has not elapsed.Read Real Data for Audit Logs and Transaction Exports (Closes [backend] Remove or gate public routes serving fabricated audit and transaction export data #1606):
/api/v1/audit-logsnow gates onvalidateApiKeyand reads realprisma.adminAuditLogrecords (with action/actor filtering and pagination) instead of generating synthetic logs.prisma.transactiondirectly with the exact same filters (type, status, date range, wallet address) as/transactions, fully removingMOCK_TRANSACTIONS.listEndpoints.ts.Secure /metrics Behind Scrape Token & Clean Up Metrics Catch Block (Closes [backend] Require auth on /metrics, remove per-vault labels, and fix its error path #1607):
GET /metricsbehind scrape credential check (METRICS_AUTH_TOKEN,METRICS_SCRAPE_TOKEN, orPROMETHEUS_BEARER_TOKEN) accepting Bearer or ApiKey headers. Returns 401text/plainwhen configured and unauthenticated.text/plainwith the error message..env.exampleanddocs/OPERATIONAL_METRICS.md.Unify Error Handling via sendApiError & Type Boundary Cleanups (Closes [backend] Unify the error response contract and remove any-typed error handling #1611):
listEndpoints.ts,referralEndpoints.ts,walletAliasEndpoints.ts,transactionEndpoints.ts,vaultEndpoints.ts, etc.) withsendApiError.POST /admin/emails/replay/:id) now only returns 404 for actual missing emails (NotFoundErrororP2025), and returns 500 for general database failures.anycasts inerrorBoundary.tsandpayloadLimit.tswithunknownand strict type guards.Closes #1605
Closes #1606
Closes #1607
Closes #1611