Repository navigation
feat: liquidation alerting and dry-run, query-performance CI gate, re… - #630
Merged
Conversation
…curring withdrawal idempotency, webhook SSRF hardening - liquidation: alerts via alerting service on threshold crossing and liquidation success/failure, LIQUIDATION_DRY_RUN flag, force-liquidate with idempotency key, runbook in docs/LENDING.md - ci: Prisma hot-query regression gate that fails on removed indexes or blown timing budgets and prints the plan diff - recurring withdrawals: unique execution window constraint, outbox-only money movement, exactly-once kill-and-retry test, extended outbox structural test - webhooks: send-time URL revalidation with IP pinning, blocked private/link-local/CGNAT ranges, redirect and port checks, adversarial tests, docs/WEBHOOK_SECURITY.md Closes Neurowealth#593 Closes Neurowealth#594 Closes Neurowealth#592 Closes Neurowealth#591
|
@coderDom-x Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR resolves four related backend reliability and security issues in one change set.
Closes #593
Closes #594
Closes #592
Closes #591
Changes
#593 Loan liquidation monitor: alerting and dry-run
src/jobs/loanLiquidationMonitor.ts: alerts throughsrc/services/alerting.tswhen a loan crosses the liquidation threshold and when liquidation succeeds or fails.LIQUIDATION_DRY_RUNenv flag that logs intended liquidations without executing transfers.docs/LENDING.md.Closes Loan liquidation monitor: wire alerting and add dry-run mode #593
Closes Add Prisma query-performance regression gate to CI #594
Closes Recurring withdrawals: verify idempotency and outbox-only money movement #592
Closes SSRF protection review for user-configured outbound webhook URLs #591
#594 Prisma query-performance regression gate
npm run profile:hot-queriesagainst a seeded database on migration and route changes.docs/PRISMA_QUERY_PERFORMANCE.md.#592 Recurring withdrawals: idempotency and outbox-only money movement
src/outbox/, and the structural test now covers the new job.withdrawal-controls.serviceapply on every execution.Closes Notify users when the liquidity floor blocks an action #622
Closes Push provider: purge stale device tokens on invalid-registration responses #624
Closes Agent circuit breaker: persist breaker state across restarts #623
Closes CORS origin-matching fuzz tests for credentialed requests #599
#591 SSRF protection for outbound webhook URLs
::1,fc00::/7, and cloud metadata endpoints.docs/WEBHOOK_SECURITY.md.Testing
npm run lintnpm run buildnpm test(dry-run, exactly-once, outbox structural, SSRF adversarial)npm run profile:hot-queriesNotes
LIQUIDATION_DRY_RUN(defaults to off, so existing behavior is unchanged).