feat: apply strict CORS and security headers to partial-release endpoint - #399
Merged
godamongstmen897 merged 7 commits intoSep 1, 2026
Conversation
- Add partialReleaseCors middleware with strict origin allowlist enforcement - Add partialReleaseSecurityHeaders with required security headers - Wire CORS and security middlewares to POST and OPTIONS handlers - Fix route logic: fetch source account before cache check to ensure proper error classification - Update partial-release tests to mock getAccount for trusted-origin regression tests - Clean up duplicate declarations in db.ts that blocked test execution Validates: - Unauthorized origins rejected with 403 CORS policy error - Trusted origins receive proper CORS response headers - Security headers set on all successful responses - Account-not-found errors return 404 with proper message - Cache and in-flight request dedup logic continues to work correctly All 30 partial-release regression tests passing.
|
@DeePrincipal-dev-lang Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Contributor
|
@DeePrincipal-dev-lang fix failed CI check |
…ter-pool Optimize poller throttling parameters in database_writer_pool
- Re-introduce insertEvent import in poller for historical event insertion - Tighten mock server call assertions for Jest/TypeScript compatibility - Wrap runMigrations with proper error handling and logging - Cast Jest mock calls to any to bypass strict tuple typing in tests - Resolve all remaining TypeScript compiler blockers - All legacy API contracts now satisfied for backward compatibility
Contributor
Author
|
Cl check fixed👌 |
…the replays
The branch predates the indexer repairs already on main and re-adds
several of the same declarations, so the merge produced 35 type errors:
duplicate logPollDiagnostics, IndexerRunnerFailureMonitor,
verifyLedgerRangeTrackerSchema and assertLedgerRangeTrackerSchemaValid,
plus 18 more in sqlite_vacuum_cleaner.
Those six files are incidental to this PR -- its subject is CORS and
security headers on partial-release -- and main already carries the work
they duplicate, so they were taken from main:
failover-recovery.ts, indexer_runner.ts, ledger-range-tracker.ts,
sqlite_vacuum_cleaner.ts, event_type_filter.ts and the vacuum test
event_type_filter.ts is worth calling out: the branch widens
fetchEventsWithRetry's server parameter from Pick<Server, "getEvents">
to an inline shape typed with `any`. That is a loss of type safety
rather than a fix, so main's signature stands.
One duplicate mattered beyond compilation. The branch re-adds a
partial-release cache key and hit path that main already has, and its
key omits `amount`:
`${contractId}:${index}:${sourceAddress}`
Two releases of different amounts against the same milestone and source
would share a cache entry, so the second caller would be handed the
first one's XDR. main's partialReleaseCacheKey() includes the amount;
its key and its hit path were kept and the branch's removed.
Kept in full: the new job-contract-security middleware, its wiring into
the partial-release route, the 58-line test addition, and the verify-ci
ESM conversion -- that last one is a real fix, since the package is
type: module and the old require() form crashed on startup.
Also ignored the *.exit files verify-ci.js writes, which were otherwise
landing as untracked build artifacts.
tsc 0 errors / 1558 tests across 88 suites / build OK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apply strict CORS and security headers to partial-release endpoint
Summary
Hardens the
POST /api/jobs/:contractId/milestones/:index/partial-releaseendpoint with strict Cross-Origin Resource Sharing (CORS) enforcement and required security headers, bringing it into compliance with the repo's established security patterns used by neighboring endpoints.What Changed
Security Middleware
partialReleaseCors: Enforces strict origin allowlist validationhttp://localhost:3000, production domains) are allowedpartialReleaseSecurityHeaders: Applies required response headersX-Content-Type-Options: nosniffX-Frame-Options: DENYReferrer-Policy: no-referrerX-XSS-Protection: 0Content-Security-Policy: default-src 'none'Permissions-Policywith camera, microphone, and other restrictionsRoute Implementation
partialReleaseCorsandpartialReleaseSecurityHeadersto both OPTIONS and POST handlersTest Coverage
Cleanup
src/indexer/db.tsthat were blocking test executionTesting
All 30 partial-release regression tests passing:
Test Suites: 1 passed, 1 total
Tests: 30 passed, 30 total
Validates:
✅ Unauthorized origins rejected with 403 CORS policy error
✅ Trusted origins receive proper CORS response headers
✅ Security headers set on all successful responses
✅ Account-not-found errors return 404 with proper message
✅ Cache and in-flight request dedup logic continues to work
Files Changed
src/middleware/job-contract-security.ts— AddedpartialReleaseCorsandpartialReleaseSecurityHeaderssrc/routes/jobs.ts— Wired middleware, fixed route logic__tests__/partial-release.test.ts— Updated test mocks and coveragesrc/indexer/db.ts— Removed duplicate declarations__tests__/sqlite-schema-manager.test.ts— Cleaned up importsImplementation Notes
by-wallet,build-tx, etc.)classifySimError()ensures proper HTTP status codes (404/422/500)closes #113