Repository navigation
Harden auth rate limiting, unify validation errors, bound WebSocket rooms, and raise coverage thresholds - #774
Merged
Conversation
…ent and improve challenge reuse fix(validation): unify validation error handling for class-validator and Zod, ensuring consistent 400 responses feat(rate-limit): introduce dynamic rate limit values via thunks for environment-configured limits test(rate-limit): add tests for rate limit headers and thunk-based limits in RateLimitGuard feat(validation): implement validation error DTOs and error handling for Zod validation chore(env): add environment variables for auth route rate limits and WebSocket settings test(outbox): implement tests for OutboxPublisherService and OutboxRelayService to ensure reliable event handling chore(coverage): add Codecov configuration for coverage status checks on backend PRs
fix(ci): make coverage upload failure non-blocking for forked PRs refactor(nonce-store): improve logging for reused live challenges style: format imports and improve readability in various files test: update test descriptions for clarity and consistency
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #369 - Adds stricter env-configurable per-IP limits to /auth/challenge and /auth/verify, and stops a new challenge request from replacing a live one so a third party can't cancel someone else's login.
Adds a documented TRUST_PROXY setting; 429s now carry Retry-After/X-RateLimit-* headers and every rejection is logged and counted in a metric.
closes #368 - Zod and class-validator failures now return the same 400 shape
{ statusCode, message: 'Validation failed', errors: [{ field, message }] }; Zod errors no longer return 500 or get reported to Sentry.GET /auth/challenge validates through ChallengeDto, the bare
throw new Error(...)calls in AuthController are now 400/401, and the error format is documented with a Swagger response type.closes #393 - subscribe:gig / unsubscribe:gig validate the gigId payload and return an error reply instead of throwing; each socket is capped at WS_MAX_ROOMS_PER_CLIENT rooms.
Connection and room counts are exposed through getStats() and logged, the disconnect reason is logged, and the gateway spec covers invalid payloads, the cap and disconnects.
closes #397 - Raises the global Jest coverage floor and adds per-path thresholds for escrow, dispute, auth, gig, outbox, rate-limit and idempotency; *-spec.ts files now run too.
Adds codecov.yml project/patch checks, makes the CI coverage upload fail the build on error, adds outbox relay/publisher specs, and updates CI_SETUP_SUMMARY.md with the real thresholds and testing requirements.