refactor: remove eq_outputs from validator receipts #1529
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| """double free tier rate limits | ||
|
|
||
| Revision ID: c3d7f2a8b104 | ||
| Revises: b1c3e5f7a902 | ||
| Create Date: 2026-03-16 12:00:00.000000 | ||
|
|
||
| """ | ||
|
|
||
| from typing import Sequence, Union | ||
|
|
||
| from alembic import op | ||
|
|
||
|
|
||
| # revision identifiers, used by Alembic. | ||
| revision: str = "c3d7f2a8b104" | ||
| down_revision: Union[str, None] = "b1c3e5f7a902" | ||
| branch_labels: Union[str, Sequence[str], None] = None | ||
| depends_on: Union[str, Sequence[str], None] = None | ||
|
|
||
|
|
||
| def upgrade() -> None: | ||
| op.execute( | ||
| """ | ||
| UPDATE api_tiers | ||
| SET rate_limit_minute = 60, | ||
| rate_limit_hour = 1000, | ||
| rate_limit_day = 10000 | ||
| WHERE name = 'free' | ||
| """ | ||
| ) | ||
|
|
||
|
|
||
| def downgrade() -> None: | ||
| op.execute( | ||
| """ | ||
| UPDATE api_tiers | ||
| SET rate_limit_minute = 30, | ||
| rate_limit_hour = 500, | ||
| rate_limit_day = 5000 | ||
| WHERE name = 'free' | ||
| """ | ||
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| <script setup lang="ts"> | ||
| import { ref, onMounted } from 'vue'; | ||
| import { notify } from '@kyvg/vue3-notification'; | ||
| import PageSection from '@/components/Simulator/PageSection.vue'; | ||
| import { KeyIcon } from 'lucide-vue-next'; | ||
|
|
||
| const API_KEY_STORAGE_KEY = 'settingsStore.apiKey'; | ||
|
|
||
| const apiKey = ref(''); | ||
| const isMasked = ref(true); | ||
|
|
||
| onMounted(() => { | ||
| apiKey.value = localStorage.getItem(API_KEY_STORAGE_KEY) || ''; | ||
| }); | ||
|
|
||
| function saveApiKey() { | ||
| localStorage.setItem(API_KEY_STORAGE_KEY, apiKey.value.trim()); | ||
Check failureCode scanning / CodeQL Clear text storage of sensitive information High
Copilot AutofixAI 1 day ago In general, to fix this kind of problem you should avoid storing secrets directly in browser storage; instead, store either (a) nothing, requiring re‑entry, (b) a short-lived opaque token from a backend, or (c) an encrypted form of the secret, where the encryption key is not stored alongside the ciphertext (e.g., derived from a user-provided passphrase). For this specific component, the minimal invasive fix is:
To keep the change constrained to the given file:
Suggested changeset
1
frontend/src/components/Simulator/settings/ApiKeySection.vue
Copilot is powered by AI and may make mistakes. Always verify output.
|
||
| notify({ | ||
|
Comment on lines
+16
to
+18
Contributor
There was a problem hiding this comment. Normalize On Line 17 the trimmed value is persisted, but Proposed fix function saveApiKey() {
- localStorage.setItem(API_KEY_STORAGE_KEY, apiKey.value.trim());
+ apiKey.value = apiKey.value.trim();
+ if (apiKey.value) {
+ localStorage.setItem(API_KEY_STORAGE_KEY, apiKey.value);
+ } else {
+ localStorage.removeItem(API_KEY_STORAGE_KEY);
+ }
notify({
title: 'API key saved',
type: 'success',
});
}Also applies to: 71-71 🤖 Prompt for AI Agents |
||
| title: 'API key saved', | ||
| type: 'success', | ||
| }); | ||
| } | ||
|
|
||
| function clearApiKey() { | ||
| apiKey.value = ''; | ||
| localStorage.removeItem(API_KEY_STORAGE_KEY); | ||
| notify({ | ||
| title: 'API key removed', | ||
| type: 'success', | ||
| }); | ||
| } | ||
| </script> | ||
|
|
||
| <template> | ||
| <PageSection> | ||
| <template #title>API Key</template> | ||
|
|
||
| <p class="text-muted-foreground mb-3 text-sm"> | ||
| Enter your API key to use authenticated rate limits. Without a key, | ||
| anonymous rate limits apply. | ||
| </p> | ||
|
|
||
| <div class="flex items-center gap-2"> | ||
| <input | ||
| v-model="apiKey" | ||
| :type="isMasked ? 'password' : 'text'" | ||
| placeholder="glk_..." | ||
| class="border-border bg-background focus:ring-ring flex-1 rounded border px-3 py-2 font-mono text-sm focus:outline-none focus:ring-1" | ||
| data-testid="input-api-key" | ||
| /> | ||
| <Btn | ||
| @click="isMasked = !isMasked" | ||
| secondary | ||
| size="sm" | ||
| data-testid="btn-toggle-api-key-visibility" | ||
| > | ||
| {{ isMasked ? 'Show' : 'Hide' }} | ||
| </Btn> | ||
| </div> | ||
|
|
||
| <div class="mt-3 flex gap-2"> | ||
| <Btn | ||
| @click="saveApiKey" | ||
| :icon="KeyIcon" | ||
| size="sm" | ||
| data-testid="btn-save-api-key" | ||
| > | ||
| Save | ||
| </Btn> | ||
| <Btn | ||
| v-if="apiKey" | ||
| @click="clearApiKey" | ||
| secondary | ||
| size="sm" | ||
| data-testid="btn-clear-api-key" | ||
| > | ||
| Clear | ||
| </Btn> | ||
| </div> | ||
| </PageSection> | ||
| </template> | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| import { getRuntimeConfig } from '@/utils/runtimeConfig'; | ||
|
|
||
| const API_KEY_STORAGE_KEY = 'settingsStore.apiKey'; | ||
|
|
||
| export function getApiKey(): string | null { | ||
| return localStorage.getItem(API_KEY_STORAGE_KEY); | ||
| } | ||
|
|
||
| export function getApiKeyHeaders(): Record<string, string> { | ||
| const apiKey = getApiKey(); | ||
| return apiKey ? { 'X-API-Key': apiKey } : {}; | ||
| } | ||
|
|
||
| /** | ||
| * Patches globalThis.fetch to inject the X-API-Key header on requests | ||
| * to the JSON-RPC endpoint. This is needed because the genlayer-js SDK | ||
| * makes its own fetch calls with no extension point for custom headers. | ||
| */ | ||
| export function installApiKeyFetchInterceptor(): void { | ||
| const rpcUrl = getRuntimeConfig( | ||
| 'VITE_JSON_RPC_SERVER_URL', | ||
| 'http://127.0.0.1:4000/api', | ||
| ); | ||
| const originalFetch = globalThis.fetch; | ||
|
|
||
| globalThis.fetch = function ( | ||
| input: RequestInfo | URL, | ||
| init?: RequestInit, | ||
| ): Promise<Response> { | ||
| const url = input instanceof Request ? input.url : input.toString(); | ||
|
|
||
| if (url === rpcUrl) { | ||
| const apiKey = getApiKey(); | ||
| if (apiKey) { | ||
| const headers = new Headers(init?.headers); | ||
| if (!headers.has('X-API-Key')) { | ||
| headers.set('X-API-Key', apiKey); | ||
| } | ||
| init = { ...init, headers }; | ||
| } | ||
|
Comment on lines
+35
to
+40
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Verify whether Request objects are used with fetch in frontend code paths.
rg -nP --type=ts --type=tsx --type=vue -C2 '\bnew\s+Request\s*\('
rg -nP --type=ts --type=tsx --type=vue -C2 '\bfetch\s*\(\s*new\s+Request\s*\('Repository: genlayerlabs/genlayer-studio Length of output: 127 🏁 Script executed: #!/bin/bash
# First, let's check if the file exists and read it
echo "=== Checking apiKey.ts file ==="
cat -n frontend/src/utils/apiKey.ts | head -50
echo ""
echo "=== Searching for Request object instantiation ==="
rg -n 'new\s+Request' --type=ts -C2
echo ""
echo "=== Searching for fetch calls with Request ==="
rg -n 'fetch\s*\(' --type=ts -C3 | grep -A3 -B3 "Request"
echo ""
echo "=== Checking for fetch usage patterns in frontend ==="
fd -e ts -e js frontend/src | xargs rg -l 'fetch' | head -10Repository: genlayerlabs/genlayer-studio Length of output: 2632 🏁 Script executed: #!/bin/bash
# Let's check how the SDK is being used and if Request objects could be passed
echo "=== Searching for installApiKeyFetchInterceptor usage ==="
rg -n 'installApiKeyFetchInterceptor' --type=ts
echo ""
echo "=== Searching for genlayer-js SDK usage ==="
rg -n 'from.*genlayer' --type=ts
echo ""
echo "=== Checking package.json for genlayer-js ==="
cat package.json | grep -A2 -B2 'genlayer'Repository: genlayerlabs/genlayer-studio Length of output: 2817 🏁 Script executed: #!/bin/bash
# Let's examine how the genlayer-js SDK might be making fetch calls
echo "=== Looking for GenLayerClient usage ==="
rg -n 'createClient' --type=ts -A 5 | head -30
echo ""
echo "=== Checking useGenlayer hook ==="
cat -n frontend/src/hooks/useGenlayer.ts | head -40Repository: genlayerlabs/genlayer-studio Length of output: 2420 🏁 Script executed: #!/bin/bash
# Let's verify the actual Fetch API behavior and check if there's any documentation
echo "=== Looking at how fetch is being called in the interceptor context ==="
cat -n frontend/src/utils/apiKey.ts
echo ""
echo "=== Checking if there are any direct fetch calls in the codebase ==="
rg -n 'fetch\s*\(' --type=ts frontend/src | head -20Repository: genlayerlabs/genlayer-studio Length of output: 1924 🏁 Script executed: #!/bin/bash
# Let's check the rpc.ts file to see how fetch is being used
echo "=== Checking rpc.ts fetch usage ==="
cat -n frontend/src/clients/rpc.ts | sed -n '35,50p'
echo ""
echo "=== Verify the Fetch API spec behavior documentation ==="
cat -n frontend/src/utils/apiKey.ts | sed -n '26,43p'Repository: genlayerlabs/genlayer-studio Length of output: 1277 Preserve existing request headers when On Line 35, headers are built from Proposed fix- const headers = new Headers(init?.headers);
+ const headers = new Headers();
+ if (input instanceof Request) {
+ input.headers.forEach((value, key) => headers.set(key, value));
+ }
+ if (init?.headers) {
+ new Headers(init.headers).forEach((value, key) =>
+ headers.set(key, value),
+ );
+ }
if (!headers.has('X-API-Key')) {
headers.set('X-API-Key', apiKey);
}
init = { ...init, headers };🤖 Prompt for AI Agents |
||
| } | ||
|
|
||
| return originalFetch.call(globalThis, input, init); | ||
| }; | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| import json | ||
|
|
||
| import pytest | ||
| import requests | ||
|
|
||
|
|
||
| @pytest.fixture(scope="session", autouse=True) | ||
| def ensure_rate_limiting_disabled(): | ||
| """Fail fast if the backend has rate limiting enabled. | ||
|
|
||
| RATE_LIMIT_ENABLED defaults to false, so integration tests run without | ||
| rate limits unless someone explicitly enables it. This guard prevents | ||
| confusing 429 errors during test runs. | ||
| """ | ||
| url = "http://localhost:4000/api" | ||
| # Send a burst of rapid requests — if we get a 429, rate limiting is on. | ||
| for _ in range(15): | ||
| resp = requests.post( | ||
| url, | ||
| data=json.dumps( | ||
| {"jsonrpc": "2.0", "method": "eth_chainId", "params": [], "id": 1} | ||
| ), | ||
| headers={"Content-Type": "application/json"}, | ||
| ) | ||
| if resp.status_code == 429: | ||
| pytest.exit( | ||
| "Rate limiting is enabled on the backend. " | ||
| "Set RATE_LIMIT_ENABLED=false in .env and restart containers " | ||
| "before running integration tests.", | ||
| returncode=1, | ||
| ) | ||
|
Comment on lines
+18
to
+31
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Verify requests.* calls in this file include an explicit timeout keyword.
python - <<'PY'
import ast
from pathlib import Path
path = Path("tests/integration/conftest.py")
tree = ast.parse(path.read_text())
for node in ast.walk(tree):
if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
if isinstance(node.func.value, ast.Name) and node.func.value.id == "requests":
has_timeout = any(k.arg == "timeout" for k in node.keywords if isinstance(k, ast.keyword))
print(f"{path}:{node.lineno} requests.{node.func.attr} timeout={has_timeout}")
PYRepository: genlayerlabs/genlayer-studio Length of output: 132 Add timeout and connection-error handling to the probe request. The Suggested patch for _ in range(15):
- resp = requests.post(
- url,
- data=json.dumps(
- {"jsonrpc": "2.0", "method": "eth_chainId", "params": [], "id": 1}
- ),
- headers={"Content-Type": "application/json"},
- )
+ try:
+ resp = requests.post(
+ url,
+ json={"jsonrpc": "2.0", "method": "eth_chainId", "params": [], "id": 1},
+ timeout=(2, 5),
+ )
+ except requests.RequestException as exc:
+ pytest.exit(
+ f"Cannot reach backend at {url}: {exc}. "
+ "Ensure containers are running before integration tests.",
+ returncode=1,
+ )
if resp.status_code == 429:
pytest.exit(
"Rate limiting is enabled on the backend. "
"Set RATE_LIMIT_ENABLED=false in .env and restart containers "
"before running integration tests.",
returncode=1,
)🧰 Tools🪛 Ruff (0.15.6)[error] 18-18: Probable use of (S113) 🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.