Fix duplicate logger binding, unpaginated issue labeling, fake SEP-10 challenge, and hardcoded e2e secret - #350
Merged
Idaonoli merged 1 commit intoAug 26, 2026
Conversation
… challenge, and hardcoded e2e secret key Closes stellar-compliance-kit#224, stellar-compliance-kit#225, stellar-compliance-kit#226, stellar-compliance-kit#227. - sanctions-oracle: confirm the duplicate `logger` destructuring key in syncSanctionsToDenylist's SyncOptions (issue stellar-compliance-kit#224) was already removed by bcb0a05; the package now builds cleanly via `npm run build`. Closing out the tracking issue since it wasn't marked resolved. - scripts/apply-package-labels.js: applyLabelToOpenIssues now uses octokit.paginate instead of a single per_page:100 request, so labeling covers every open issue instead of silently stopping after the first page. - examples/full-stack-demo: GET /challenge now calls sep10-auth's generateChallenge with a real server keypair instead of returning a hardcoded, unsigned placeholder string. The server keypair is loaded from a new SERVER_SECRET_KEY env var, falling back to an ephemeral in-memory keypair (with a console warning) for local dev; SERVER_ACCOUNT_ID now defaults to that keypair's public key so /challenge and /private stay consistent out of the box. README updated to document the new variable. - e2e-tests/test/setup.ts: TEST_CONFIG.issuer no longer hardcodes a Stellar secret key literal. It's generated fresh via Keypair.random() at setup time (funded via friendbot in the existing test flow), with an optional E2E_ISSUER_SECRET env var to pin a stable identity for CI/docker-compose.
|
@kanengchik Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes four issues:
loggerbinding in syncSanctionsToDenylist's destructured options #224 —sanctions-oracle/src/sync.ts'ssyncSanctionsToDenylistdestructuredloggertwice fromoptions, a duplicate-identifier error that brokenpm run build/Babel/ts-jest parsing. This was already fixed by bcb0a05 (the duplicate binding is gone and the package builds cleanly), but the issue was never closed — this PR closes it out.scripts/apply-package-labels.js'sapplyLabelToOpenIssuesonly fetched the first 100 open issues (per_page: 100, no pagination), silently skipping the rest once the repo grew past that. Switched tooctokit.paginateso every open issue is covered.examples/full-stack-demo's/challengeroute doesn't actually call sep10-auth'sgenerateChallenge#226 —examples/full-stack-demo/server.js'sGET /challengereturned a hardcoded, unsignedSIMULATED-CHALLENGE-FOR-<pubkey>string instead of usingsep10-auth. It now callsgenerateChallengewith a real server keypair. That keypair is loaded from a newSERVER_SECRET_KEYenv var, falling back to an ephemeral in-memory keypair (with a console warning) for local dev, andSERVER_ACCOUNT_IDnow defaults to that keypair's public key so/challengeand/privateverify against the same identity out of the box. README documents the new variable.e2e-tests/test/setup.ts'sTEST_CONFIG.issuerhardcoded a Stellar secret key literal in source. It's now generated fresh viaKeypair.random()at setup time (funded via the existing friendbot flow), with an optionalE2E_ISSUER_SECRETenv var to pin a stable identity for CI/docker-compose if needed.Test plan
npm run build --workspaces --if-present— all packages, includingsanctions-oracleande2e-tests, build/typecheck cleanlynode --checkon both modified.jsfilesnpm run test --workspaces --if-present -- --testPathIgnorePatterns=e2e-tests— no new failures (pre-existing, unrelated failures inhorizon-listener'smetrics.test.ts/eventSource.test.tsandsanctions-oracle's test suite confirmed present onmainbefore this branch's changes)npx eslint sep10-auth/src sanctions-oracle/src horizon-listener/src --ext .ts— cleanexamples/full-stack-demo/server.jsand confirmedGET /challengereturns a real signed SEP-10 challenge XDR instead of the placeholder string