fix: enforce stating security in routing#2276
Conversation
WalkthroughThis PR enforces centralized route creation with mandatory security declarations by introducing a wrapper function that re-exports Changes
Sequence DiagramsequenceDiagram
participant Router as Router File
participant CoreLib as `@src/core/lib/create-route`
participant HonoLib as `@hono/zod-openapi`
participant ESLint as ESLint Rule
Note over ESLint: Rule blocks direct imports<br/>from `@hono/zod-openapi`
Router->>CoreLib: import createRoute
CoreLib->>HonoLib: import createOpenApiRoute<br/>(as createOpenApiRoute)
Router->>CoreLib: createRoute(routeConfig)
Note over CoreLib: Enforces security<br/>is required & defined
CoreLib->>HonoLib: createOpenApiRoute(routeConfig)
HonoLib-->>CoreLib: RouteHandler
CoreLib-->>Router: RouteHandler<br/>(with type-safe security)
Router->>Router: Apply security: SECURITY_NONE<br/>to public endpoints
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20–25 minutes
Possibly related PRs
Suggested reviewers
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (55)
🚧 Files skipped from review as they are similar to previous changes (37)
🧰 Additional context used📓 Path-based instructions (1)**/*.{ts,tsx,js}📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Files:
🧠 Learnings (4)📓 Common learnings📚 Learning: 2025-11-12T09:03:40.132ZApplied to files:
📚 Learning: 2025-05-25T19:37:00.800ZApplied to files:
📚 Learning: 2025-09-25T14:31:44.914ZApplied to files:
🧬 Code graph analysis (10)apps/api/src/auth/routes/verify-email/verify-email.router.ts (1)
apps/api/src/dashboard/routes/leases-duration/leases-duration.router.ts (1)
apps/api/src/deployment/routes/deployment-setting/deployment-setting.router.ts (1)
apps/api/src/dashboard/routes/graph-data/graph-data.router.ts (1)
apps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.ts (1)
apps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts (3)
apps/api/src/provider/routes/provider-versions/provider-versions.router.ts (1)
apps/api/src/billing/routes/get-balances/get-balances.router.ts (3)
apps/api/src/block/routes/block-prediction/block-prediction.router.ts (1)
apps/api/src/proposal/routes/proposals/proposals.router.ts (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (21)
Tip 📝 Customizable high-level summaries are now available in beta!You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.
Example instruction:
Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (7)
apps/api/src/deployment/routes/leases/leases.router.ts (1)
45-51: Confirm that fallback lease list is intended to be unauthenticatedMarking
/akash/market/{version}/leases/listwithsecurity: SECURITY_NONEmakes its “public” status explicit in the OpenAPI layer, which matches the PR goal of always stating security. Please just double‑check that this fallback DB listing is truly meant to be accessible without auth; if not, it should likely useSECURITY_BEARER_OR_API_KEYinstead. If this raises follow‑up questions for other similar routes, consider a separate issue for a broader security audit rather than expanding this PR’s scope. Based on learnings, this keeps the PR focused.apps/api/src/billing/routes/stripe-prices/stripe-prices.router.ts (1)
5-5: Use internalcreateRoutewrapper and avoid redundant controller callThe switch to
createRoutefrom@src/core/services/create-route/create-routelooks correct and keeps security metadata explicit.Unrelated but easy win in the same handler:
findPrices()is called twice, which can add unnecessary latency/load if it hits Stripe or a DB. Consider calling it once and reusing the result:-stripePricesRouter.openapi(route, async function routeStripePrices(c) { - await container.resolve(StripeController).findPrices(); - return c.json(await container.resolve(StripeController).findPrices(), 200); -}); +stripePricesRouter.openapi(route, async function routeStripePrices(c) { + const prices = await container.resolve(StripeController).findPrices(); + return c.json(prices, 200); +});apps/api/src/core/services/create-route/create-route.ts (1)
1-11:createRoutewrapper correctly enforces asecurityfield, with room for stricter typingThis wrapper cleanly delegates to
@hono/zod-openapiwhile requiring asecurityproperty in the route config, which is exactly what the PR is aiming for. The eslint suppression on the aliased import is appropriate given the newno-restricted-importsrule.If you want to go one step further and prevent
security: undefined(in addition to preventing it from being omitted), you could tighten the type to a non‑nullable value:export function createRoute< R extends Omit<RouteConfig, "security"> & { security: NonNullable<Required<RouteConfig>["security"]>; } >(routeConfig: R) { return createOpenApiRoute(routeConfig); }This keeps all current usages valid (including
SECURITY_NONE, which is an empty array) but makes it harder to accidentally “opt out” by writingsecurity: undefined.apps/api/src/billing/routes/usage/usage.router.ts (1)
5-7: Explicit SECURITY_NONE for usage routes looks consistent with address‑based accessSwitching to the internal
createRoutehelper and addingsecurity: SECURITY_NONEto both/v1/usage/historyand/v1/usage/history/statsmatches the pattern for public, address‑scoped data and keeps the implementation unchanged. If usage history should ever be tied to the authenticated user rather than a bare address, you could later swap toSECURITY_BEARER_OR_API_KEYand derive the address from auth context instead, but that’s outside this PR’s scope.Also applies to: 14-15, 39-40
apps/api/src/provider/routes/provider-earnings/provider-earnings.router.ts (1)
4-6: SECURITY_NONE on provider earnings matches a public, owner‑address–scoped endpointThe move to the shared
createRoutehelper plussecurity: SECURITY_NONEon/v1/provider-earnings/{owner}is consistent with other address/owner‑scoped endpoints that surface indexer‑style data without auth. If you later standardize on usingc.req.valid("query")instead ofc.req.query()here, that can be handled as a small follow‑up without impacting this security metadata change.Also applies to: 10-16
apps/api/src/billing/routes/get-balances/get-balances.router.ts (1)
5-7: Public balances endpoint with SECURITY_NONE matches address‑scoped usageThe switch to the shared
createRoutehelper and addingsecurity: SECURITY_NONEon/v1/balancesfits the current model of taking an address from the validated query and returning its balances, consistent with other public address‑based endpoints. If product/security requirements ever treat these balances as user‑private rather than purely chain‑visible, you could later move this toSECURITY_BEARER_OR_API_KEYand infer the address from auth instead.Also applies to: 9-15
apps/api/src/provider/routes/provider-graph-data/provider-graph-data.router.ts (1)
4-6: Provider graph-data route aligned with new createRoute + SECURITY_NONEThe switch to the shared
createRoutehelper and addingsecurity: SECURITY_NONEfor/v1/provider-graph-data/{dataName}are consistent with the rest of the analytics endpoints and look correct. As a minor follow-up (not required for this PR), consider replacing theconsole.login this handler with the centralized logging/OTel-based logger used elsewhere, to keep backend logging consistent and trace-friendly. Based on learnings, that sort of cross-cutting cleanup is usually better handled in a separate issue.Also applies to: 13-18
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
package-lock.jsonis excluded by!**/package-lock.jsonpackages/net/src/generated/netConfigData.tsis excluded by!**/generated/**
📒 Files selected for processing (51)
apps/api/.eslintrc.js(1 hunks)apps/api/src/address/routes/address/address.router.ts(3 hunks)apps/api/src/auth/routes/api-keys/api-keys.router.ts(1 hunks)apps/api/src/auth/routes/send-verification-email/send-verification-email.router.ts(2 hunks)apps/api/src/auth/routes/verify-email/verify-email.router.ts(2 hunks)apps/api/src/bid/routes/bids/bids.router.ts(1 hunks)apps/api/src/billing/http-schemas/stripe.schema.ts(1 hunks)apps/api/src/billing/http-schemas/wallet.schema.ts(1 hunks)apps/api/src/billing/routes/checkout/checkout.router.ts(1 hunks)apps/api/src/billing/routes/get-balances/get-balances.router.ts(1 hunks)apps/api/src/billing/routes/get-wallet-list/get-wallet-list.router.ts(1 hunks)apps/api/src/billing/routes/sign-and-broadcast-tx/sign-and-broadcast-tx.router.ts(1 hunks)apps/api/src/billing/routes/start-trial/start-trial.router.ts(2 hunks)apps/api/src/billing/routes/stripe-coupons/stripe-coupons.router.ts(1 hunks)apps/api/src/billing/routes/stripe-customers/stripe-customers.router.ts(1 hunks)apps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts(2 hunks)apps/api/src/billing/routes/stripe-prices/stripe-prices.router.ts(1 hunks)apps/api/src/billing/routes/stripe-transactions/stripe-transactions.router.ts(1 hunks)apps/api/src/billing/routes/stripe-webhook/stripe-webhook.router.ts(2 hunks)apps/api/src/billing/routes/usage/usage.router.ts(2 hunks)apps/api/src/billing/routes/wallet-settings/wallet-settings.router.ts(1 hunks)apps/api/src/block/routes/block-prediction/block-prediction.router.ts(3 hunks)apps/api/src/block/routes/blocks/blocks.router.ts(3 hunks)apps/api/src/certificate/routes/certificate.router.ts(1 hunks)apps/api/src/core/services/create-route/create-route.ts(1 hunks)apps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.ts(2 hunks)apps/api/src/dashboard/routes/graph-data/graph-data.router.ts(2 hunks)apps/api/src/dashboard/routes/market-data/market-data.router.ts(2 hunks)apps/api/src/dashboard/routes/network-capacity/network-capacity.router.ts(2 hunks)apps/api/src/deployment/routes/deployments/deployments.router.ts(5 hunks)apps/api/src/deployment/routes/leases/leases.router.ts(2 hunks)apps/api/src/network/routes/network/network.router.ts(2 hunks)apps/api/src/pricing/routes/pricing/pricing.router.ts(2 hunks)apps/api/src/proposal/routes/proposals/proposals.router.ts(3 hunks)apps/api/src/provider/routes/auditors/auditors.router.ts(1 hunks)apps/api/src/provider/routes/jwt-token/jwt-token.router.ts(1 hunks)apps/api/src/provider/routes/provider-attributes-schema/provider-attributes-schema.router.ts(2 hunks)apps/api/src/provider/routes/provider-dashboard/provider-dashboard.router.ts(2 hunks)apps/api/src/provider/routes/provider-deployments/provider-deployments.router.ts(2 hunks)apps/api/src/provider/routes/provider-earnings/provider-earnings.router.ts(2 hunks)apps/api/src/provider/routes/provider-graph-data/provider-graph-data.router.ts(2 hunks)apps/api/src/provider/routes/provider-regions/provider-regions.router.ts(2 hunks)apps/api/src/provider/routes/provider-versions/provider-versions.router.ts(2 hunks)apps/api/src/provider/routes/providers/providers.router.ts(4 hunks)apps/api/src/template/routes/templates/templates.router.ts(4 hunks)apps/api/src/transaction/routes/transactions/transactions.router.ts(3 hunks)apps/api/src/user/routes/get-anonymous-user/get-anonymous-user.router.ts(2 hunks)apps/api/src/user/routes/get-current-user/get-current-user.router.ts(1 hunks)apps/api/src/user/routes/register-user/register-user.router.ts(2 hunks)apps/api/src/validator/routes/validators/validators.router.ts(3 hunks)apps/provider-proxy/package.json(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
**/*.{ts,tsx,js}: Never use typeanyor cast to typeany. Always define the proper TypeScript types.
Never use deprecated methods from libraries.
Don't add unnecessary comments to the code.
Files:
apps/api/src/provider/routes/providers/providers.router.tsapps/api/src/billing/http-schemas/stripe.schema.tsapps/api/src/billing/routes/checkout/checkout.router.tsapps/api/src/block/routes/block-prediction/block-prediction.router.tsapps/api/src/deployment/routes/leases/leases.router.tsapps/api/src/auth/routes/api-keys/api-keys.router.tsapps/api/src/proposal/routes/proposals/proposals.router.tsapps/api/src/provider/routes/provider-versions/provider-versions.router.tsapps/api/src/provider/routes/provider-dashboard/provider-dashboard.router.tsapps/api/src/billing/routes/wallet-settings/wallet-settings.router.tsapps/api/src/billing/http-schemas/wallet.schema.tsapps/api/src/certificate/routes/certificate.router.tsapps/api/src/provider/routes/jwt-token/jwt-token.router.tsapps/api/src/network/routes/network/network.router.tsapps/api/src/bid/routes/bids/bids.router.tsapps/api/src/billing/routes/stripe-coupons/stripe-coupons.router.tsapps/api/src/user/routes/register-user/register-user.router.tsapps/api/src/dashboard/routes/graph-data/graph-data.router.tsapps/api/src/billing/routes/sign-and-broadcast-tx/sign-and-broadcast-tx.router.tsapps/api/src/template/routes/templates/templates.router.tsapps/api/src/billing/routes/usage/usage.router.tsapps/api/src/billing/routes/stripe-transactions/stripe-transactions.router.tsapps/api/src/provider/routes/auditors/auditors.router.tsapps/api/src/provider/routes/provider-deployments/provider-deployments.router.tsapps/api/src/user/routes/get-anonymous-user/get-anonymous-user.router.tsapps/api/src/address/routes/address/address.router.tsapps/api/src/billing/routes/stripe-customers/stripe-customers.router.tsapps/api/src/transaction/routes/transactions/transactions.router.tsapps/api/src/validator/routes/validators/validators.router.tsapps/api/src/auth/routes/send-verification-email/send-verification-email.router.tsapps/api/src/provider/routes/provider-earnings/provider-earnings.router.tsapps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.tsapps/api/src/provider/routes/provider-regions/provider-regions.router.tsapps/api/src/billing/routes/get-balances/get-balances.router.tsapps/api/src/billing/routes/stripe-webhook/stripe-webhook.router.tsapps/api/src/billing/routes/stripe-prices/stripe-prices.router.tsapps/api/src/billing/routes/start-trial/start-trial.router.tsapps/api/src/dashboard/routes/network-capacity/network-capacity.router.tsapps/api/src/provider/routes/provider-attributes-schema/provider-attributes-schema.router.tsapps/api/src/auth/routes/verify-email/verify-email.router.tsapps/api/src/provider/routes/provider-graph-data/provider-graph-data.router.tsapps/api/src/pricing/routes/pricing/pricing.router.tsapps/api/src/deployment/routes/deployments/deployments.router.tsapps/api/src/billing/routes/get-wallet-list/get-wallet-list.router.tsapps/api/src/dashboard/routes/market-data/market-data.router.tsapps/api/src/user/routes/get-current-user/get-current-user.router.tsapps/api/src/core/services/create-route/create-route.tsapps/api/src/block/routes/blocks/blocks.router.tsapps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts
🧠 Learnings (6)
📓 Common learnings
Learnt from: baktun14
Repo: akash-network/console PR: 1725
File: apps/api/src/utils/constants.ts:5-5
Timestamp: 2025-07-24T17:00:52.361Z
Learning: In the Akash Network Console project, when cross-cutting concerns or broader refactoring issues are identified during PR review, the preferred approach is to create a separate GitHub issue to track the work rather than expanding the scope of the current PR. This maintains focus and allows for proper planning of architectural improvements.
📚 Learning: 2025-09-25T14:31:44.914Z
Learnt from: baktun14
Repo: akash-network/console PR: 1969
File: apps/deploy-web/src/pages/payment.tsx:179-191
Timestamp: 2025-09-25T14:31:44.914Z
Learning: The payment confirmation endpoint in apps/api/src/billing/http-schemas/stripe.schema.ts uses zod schema validation with `amount: z.number().gte(20, "Amount must be greater or equal to $20")` to ensure all payment requests meet the minimum amount requirement, preventing zero-amount or invalid payments from reaching Stripe.
Applied to files:
apps/api/src/billing/http-schemas/stripe.schema.tsapps/api/src/billing/http-schemas/wallet.schema.tsapps/api/src/billing/routes/stripe-transactions/stripe-transactions.router.tsapps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts
📚 Learning: 2025-11-12T09:03:40.132Z
Learnt from: stalniy
Repo: akash-network/console PR: 0
File: :0-0
Timestamp: 2025-11-12T09:03:40.132Z
Learning: For backend services (like the Indexer), prefer using createOtelLogger from "akashnetwork/logging/otel" to include OpenTelemetry trace context in logs.
Applied to files:
apps/api/src/dashboard/routes/graph-data/graph-data.router.ts
📚 Learning: 2025-05-25T19:37:00.800Z
Learnt from: jzsfkzm
Repo: akash-network/console PR: 1364
File: apps/api/src/provider/routes/provider-deployments/provider-deployments.router.ts:38-44
Timestamp: 2025-05-25T19:37:00.800Z
Learning: The Akash Console API uses centralized error handling through the OpenApiHonoHandler's defaultHook, which automatically processes errors via HonoErrorHandlerService. Individual route handlers do not use explicit try-catch blocks and instead rely on this framework-level error handling mechanism.
Applied to files:
apps/api/src/dashboard/routes/graph-data/graph-data.router.ts
📚 Learning: 2025-06-04T19:02:02.168Z
Learnt from: jzsfkzm
Repo: akash-network/console PR: 1433
File: apps/api/src/pricing/services/pricing/pricing.service.ts:0-0
Timestamp: 2025-06-04T19:02:02.168Z
Learning: In the Akash Console API codebase, input validation is handled at the router level using zod schemas rather than duplicating validation in service layers. The PricingService relies on the router's schema validation to ensure valid inputs.
Applied to files:
apps/api/src/pricing/routes/pricing/pricing.router.ts
📚 Learning: 2025-06-03T15:06:34.211Z
Learnt from: baktun14
Repo: akash-network/console PR: 1428
File: apps/api/src/deployment/controllers/deployment/deployment.controller.ts:0-0
Timestamp: 2025-06-03T15:06:34.211Z
Learning: The `getByOwnerAndDseq` method in `apps/api/src/deployment/controllers/deployment/deployment.controller.ts` is intentionally public without the `Protected` decorator because it serves public blockchain data from an indexer, following the pattern of public blockchain APIs.
Applied to files:
apps/api/src/deployment/routes/deployments/deployments.router.ts
🧬 Code graph analysis (28)
apps/api/src/provider/routes/providers/providers.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/deployment/routes/leases/leases.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/proposal/routes/proposals/proposals.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-versions/provider-versions.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-dashboard/provider-dashboard.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/network/routes/network/network.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/user/routes/register-user/register-user.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/dashboard/routes/graph-data/graph-data.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/template/routes/templates/templates.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/billing/routes/usage/usage.router.ts (2)
apps/api/src/core/services/create-route/create-route.ts (1)
createRoute(5-11)apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/auditors/auditors.router.ts (2)
apps/api/src/core/services/create-route/create-route.ts (1)
createRoute(5-11)apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-deployments/provider-deployments.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/address/routes/address/address.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/transaction/routes/transactions/transactions.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/validator/routes/validators/validators.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/auth/routes/send-verification-email/send-verification-email.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-earnings/provider-earnings.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-regions/provider-regions.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/billing/routes/stripe-webhook/stripe-webhook.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/billing/routes/start-trial/start-trial.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/dashboard/routes/network-capacity/network-capacity.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-attributes-schema/provider-attributes-schema.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/auth/routes/verify-email/verify-email.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/pricing/routes/pricing/pricing.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/deployment/routes/deployments/deployments.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/block/routes/blocks/blocks.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts (4)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_BEARER_OR_API_KEY(5-5)apps/api/src/billing/http-schemas/stripe.schema.ts (1)
RemovePaymentMethodParamsSchema(218-227)apps/api/src/billing/controllers/stripe/stripe.controller.ts (1)
removePaymentMethod(129-151)packages/http-sdk/src/stripe/stripe.service.ts (1)
removePaymentMethod(32-34)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: test-build
- GitHub Check: Validate local packages
jzsfkzm
force-pushed
the
bugfixes/1701-enforce-stating-api-security
branch
2 times, most recently
from
f068d7c to
d645dd0
Compare
jzsfkzm
force-pushed
the
bugfixes/1701-enforce-stating-api-security
branch
from
d645dd0 to
2f2cf59
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
apps/api/src/billing/routes/stripe-prices/stripe-prices.router.ts (1)
42-44: Remove duplicatefindPrices()call.Line 43 calls
findPrices()without using the result, then line 44 calls it again. The first call is wasteful and should be removed.Apply this diff:
stripePricesRouter.openapi(route, async function routeStripePrices(c) { - await container.resolve(StripeController).findPrices(); return c.json(await container.resolve(StripeController).findPrices(), 200); });apps/api/src/provider/routes/provider-dashboard/provider-dashboard.router.ts (1)
4-15: Verify authentication strategy: provider dashboard should not be marked asSECURITY_NONEwithout clear justificationThe switch to the local
createRoutewrapper aligns with the ESLint rule and is appropriate. However, marking/v1/provider-dashboard/{owner}withsecurity: SECURITY_NONEcontradicts API security best practices for dashboard endpoints.Dashboard endpoints typically expose sensitive data (metrics, configuration, usage). Per industry standards, all such endpoints should enforce authentication and authorization at both the API layer and any upstream gateway/reverse proxy.
Before merging, confirm one of the following:
- If this endpoint should be protected, replace
SECURITY_NONEwith the appropriate security scheme (e.g.,SECURITY_BEARER_OR_API_KEY)- If relying on upstream gateway authentication, document this decision in a code comment and update the OpenAPI spec to reflect the actual security requirement
- If this is intentionally public (unlikely for a dashboard), document the business justification in a comment
🧹 Nitpick comments (3)
apps/api/src/billing/http-schemas/stripe.schema.ts (1)
218-227: New RemovePaymentMethodParamsSchema aligns with existing schema patternsThe
RemovePaymentMethodParamsSchemadefinition and OpenAPI metadata for thepaymentMethodIdpath parameter look correct and consistent with the rest of the Stripe schemas. For consistency with the other schemas in this file, you might also export a matching inferred type, e.g. placed alongside the other type exports at the bottom:export type RemovePaymentMethodParams = z.infer<typeof RemovePaymentMethodParamsSchema>;apps/api/src/core/services/create-route/create-route.ts (1)
1-11: createRoute wrapper correctly enforces presence ofsecurity(consider excludingundefined)Wrapping
@hono/zod-openapi’screateRoutewith aRouteConfigvariant that requiressecurityis a clean way to force explicit security declarations across the API without changing runtime behavior. If you want to be stricter and preventsecurity: undefinedfrom type‑checking, you could tweak the constraint slightly:export function createRoute< R extends Omit<RouteConfig, "security"> & { security: Exclude<Required<RouteConfig>["security"], undefined>; } >(routeConfig: R) { return createOpenApiRoute(routeConfig); }That’s optional, but would fully enforce “security must be explicitly set to a concrete value” at the type level.
apps/api/.eslintrc.js (1)
3-16: Consider hardening theno-restricted-importsrule against namespace/default importsCurrent config blocks only named imports of
createRoutefrom@hono/zod-openapi. A developer could still doimport * as zopenapi from "@hono/zod-openapi";and callzopenapi.createRoute, bypassing the rule.If you want to fully enforce using the local wrapper, consider adding an additional restricted path entry without
importNamesso any import from@hono/zod-openapiis disallowed, or extend the rule accordingly.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
apps/api/test/functional/__snapshots__/docs.spec.ts.snapis excluded by!**/*.snap
📒 Files selected for processing (57)
apps/api/.eslintrc.js(1 hunks)apps/api/src/address/routes/address/address.router.ts(3 hunks)apps/api/src/auth/routes/api-keys/api-keys.router.ts(1 hunks)apps/api/src/auth/routes/send-verification-email/send-verification-email.router.ts(2 hunks)apps/api/src/auth/routes/verify-email/verify-email.router.ts(2 hunks)apps/api/src/bid/routes/bids/bids.router.ts(1 hunks)apps/api/src/billing/http-schemas/stripe.schema.ts(1 hunks)apps/api/src/billing/http-schemas/wallet.schema.ts(1 hunks)apps/api/src/billing/routes/checkout/checkout.router.ts(1 hunks)apps/api/src/billing/routes/get-balances/get-balances.router.ts(1 hunks)apps/api/src/billing/routes/get-wallet-list/get-wallet-list.router.ts(1 hunks)apps/api/src/billing/routes/sign-and-broadcast-tx/sign-and-broadcast-tx.router.ts(1 hunks)apps/api/src/billing/routes/start-trial/start-trial.router.ts(2 hunks)apps/api/src/billing/routes/stripe-coupons/stripe-coupons.router.ts(1 hunks)apps/api/src/billing/routes/stripe-customers/stripe-customers.router.ts(1 hunks)apps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts(2 hunks)apps/api/src/billing/routes/stripe-prices/stripe-prices.router.ts(1 hunks)apps/api/src/billing/routes/stripe-transactions/stripe-transactions.router.ts(1 hunks)apps/api/src/billing/routes/stripe-webhook/stripe-webhook.router.ts(2 hunks)apps/api/src/billing/routes/usage/usage.router.ts(2 hunks)apps/api/src/billing/routes/wallet-settings/wallet-settings.router.ts(1 hunks)apps/api/src/block/routes/block-prediction/block-prediction.router.ts(3 hunks)apps/api/src/block/routes/blocks/blocks.router.ts(3 hunks)apps/api/src/certificate/routes/certificate.router.ts(1 hunks)apps/api/src/core/services/create-route/create-route.ts(1 hunks)apps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.ts(2 hunks)apps/api/src/dashboard/routes/graph-data/graph-data.router.ts(2 hunks)apps/api/src/dashboard/routes/leases-duration/leases-duration.router.ts(2 hunks)apps/api/src/dashboard/routes/market-data/market-data.router.ts(2 hunks)apps/api/src/dashboard/routes/network-capacity/network-capacity.router.ts(2 hunks)apps/api/src/deployment/routes/deployment-setting/deployment-setting.router.ts(4 hunks)apps/api/src/deployment/routes/deployments/deployments.router.ts(5 hunks)apps/api/src/deployment/routes/leases/leases.router.ts(2 hunks)apps/api/src/gpu/routes/gpu.router.ts(5 hunks)apps/api/src/healthz/routes/healthz.router.ts(2 hunks)apps/api/src/network/routes/network/network.router.ts(2 hunks)apps/api/src/pricing/routes/pricing/pricing.router.ts(2 hunks)apps/api/src/proposal/routes/proposals/proposals.router.ts(3 hunks)apps/api/src/provider/routes/auditors/auditors.router.ts(1 hunks)apps/api/src/provider/routes/jwt-token/jwt-token.router.ts(1 hunks)apps/api/src/provider/routes/provider-attributes-schema/provider-attributes-schema.router.ts(2 hunks)apps/api/src/provider/routes/provider-dashboard/provider-dashboard.router.ts(2 hunks)apps/api/src/provider/routes/provider-deployments/provider-deployments.router.ts(2 hunks)apps/api/src/provider/routes/provider-earnings/provider-earnings.router.ts(2 hunks)apps/api/src/provider/routes/provider-graph-data/provider-graph-data.router.ts(2 hunks)apps/api/src/provider/routes/provider-regions/provider-regions.router.ts(2 hunks)apps/api/src/provider/routes/provider-versions/provider-versions.router.ts(2 hunks)apps/api/src/provider/routes/providers/providers.router.ts(4 hunks)apps/api/src/routes/internal/financial.ts(1 hunks)apps/api/src/routes/v1/trialProviders.ts(1 hunks)apps/api/src/template/routes/templates/templates.router.ts(4 hunks)apps/api/src/transaction/routes/transactions/transactions.router.ts(3 hunks)apps/api/src/user/routes/create-anonymous-user/create-anonymous-user.router.ts(2 hunks)apps/api/src/user/routes/get-anonymous-user/get-anonymous-user.router.ts(2 hunks)apps/api/src/user/routes/get-current-user/get-current-user.router.ts(1 hunks)apps/api/src/user/routes/register-user/register-user.router.ts(2 hunks)apps/api/src/validator/routes/validators/validators.router.ts(3 hunks)
🚧 Files skipped from review as they are similar to previous changes (35)
- apps/api/src/routes/v1/trialProviders.ts
- apps/api/src/dashboard/routes/network-capacity/network-capacity.router.ts
- apps/api/src/user/routes/get-current-user/get-current-user.router.ts
- apps/api/src/auth/routes/verify-email/verify-email.router.ts
- apps/api/src/user/routes/create-anonymous-user/create-anonymous-user.router.ts
- apps/api/src/dashboard/routes/leases-duration/leases-duration.router.ts
- apps/api/src/provider/routes/auditors/auditors.router.ts
- apps/api/src/billing/http-schemas/wallet.schema.ts
- apps/api/src/address/routes/address/address.router.ts
- apps/api/src/proposal/routes/proposals/proposals.router.ts
- apps/api/src/provider/routes/provider-earnings/provider-earnings.router.ts
- apps/api/src/provider/routes/providers/providers.router.ts
- apps/api/src/block/routes/blocks/blocks.router.ts
- apps/api/src/billing/routes/stripe-customers/stripe-customers.router.ts
- apps/api/src/network/routes/network/network.router.ts
- apps/api/src/deployment/routes/deployment-setting/deployment-setting.router.ts
- apps/api/src/bid/routes/bids/bids.router.ts
- apps/api/src/dashboard/routes/graph-data/graph-data.router.ts
- apps/api/src/provider/routes/provider-regions/provider-regions.router.ts
- apps/api/src/gpu/routes/gpu.router.ts
- apps/api/src/deployment/routes/deployments/deployments.router.ts
- apps/api/src/dashboard/routes/market-data/market-data.router.ts
- apps/api/src/provider/routes/provider-attributes-schema/provider-attributes-schema.router.ts
- apps/api/src/provider/routes/provider-versions/provider-versions.router.ts
- apps/api/src/user/routes/register-user/register-user.router.ts
- apps/api/src/validator/routes/validators/validators.router.ts
- apps/api/src/billing/routes/get-wallet-list/get-wallet-list.router.ts
- apps/api/src/auth/routes/api-keys/api-keys.router.ts
- apps/api/src/billing/routes/stripe-coupons/stripe-coupons.router.ts
- apps/api/src/billing/routes/stripe-transactions/stripe-transactions.router.ts
- apps/api/src/billing/routes/stripe-webhook/stripe-webhook.router.ts
- apps/api/src/routes/internal/financial.ts
- apps/api/src/billing/routes/wallet-settings/wallet-settings.router.ts
- apps/api/src/billing/routes/start-trial/start-trial.router.ts
- apps/api/src/provider/routes/provider-graph-data/provider-graph-data.router.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
**/*.{ts,tsx,js}: Never use typeanyor cast to typeany. Always define the proper TypeScript types.
Never use deprecated methods from libraries.
Don't add unnecessary comments to the code.
Files:
apps/api/src/template/routes/templates/templates.router.tsapps/api/src/billing/routes/stripe-prices/stripe-prices.router.tsapps/api/src/billing/http-schemas/stripe.schema.tsapps/api/src/block/routes/block-prediction/block-prediction.router.tsapps/api/src/pricing/routes/pricing/pricing.router.tsapps/api/src/core/services/create-route/create-route.tsapps/api/src/billing/routes/usage/usage.router.tsapps/api/src/healthz/routes/healthz.router.tsapps/api/src/provider/routes/jwt-token/jwt-token.router.tsapps/api/src/billing/routes/checkout/checkout.router.tsapps/api/src/provider/routes/provider-deployments/provider-deployments.router.tsapps/api/src/deployment/routes/leases/leases.router.tsapps/api/src/user/routes/get-anonymous-user/get-anonymous-user.router.tsapps/api/src/certificate/routes/certificate.router.tsapps/api/src/auth/routes/send-verification-email/send-verification-email.router.tsapps/api/src/billing/routes/sign-and-broadcast-tx/sign-and-broadcast-tx.router.tsapps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.tsapps/api/src/billing/routes/get-balances/get-balances.router.tsapps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.tsapps/api/src/transaction/routes/transactions/transactions.router.tsapps/api/src/provider/routes/provider-dashboard/provider-dashboard.router.ts
🧠 Learnings (3)
📓 Common learnings
Learnt from: baktun14
Repo: akash-network/console PR: 1725
File: apps/api/src/utils/constants.ts:5-5
Timestamp: 2025-07-24T17:00:52.361Z
Learning: In the Akash Network Console project, when cross-cutting concerns or broader refactoring issues are identified during PR review, the preferred approach is to create a separate GitHub issue to track the work rather than expanding the scope of the current PR. This maintains focus and allows for proper planning of architectural improvements.
📚 Learning: 2025-09-25T14:31:44.914Z
Learnt from: baktun14
Repo: akash-network/console PR: 1969
File: apps/deploy-web/src/pages/payment.tsx:179-191
Timestamp: 2025-09-25T14:31:44.914Z
Learning: The payment confirmation endpoint in apps/api/src/billing/http-schemas/stripe.schema.ts uses zod schema validation with `amount: z.number().gte(20, "Amount must be greater or equal to $20")` to ensure all payment requests meet the minimum amount requirement, preventing zero-amount or invalid payments from reaching Stripe.
Applied to files:
apps/api/src/billing/http-schemas/stripe.schema.tsapps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts
📚 Learning: 2025-06-04T19:02:02.168Z
Learnt from: jzsfkzm
Repo: akash-network/console PR: 1433
File: apps/api/src/pricing/services/pricing/pricing.service.ts:0-0
Timestamp: 2025-06-04T19:02:02.168Z
Learning: In the Akash Console API codebase, input validation is handled at the router level using zod schemas rather than duplicating validation in service layers. The PricingService relies on the router's schema validation to ensure valid inputs.
Applied to files:
apps/api/src/pricing/routes/pricing/pricing.router.ts
🧬 Code graph analysis (13)
apps/api/src/template/routes/templates/templates.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/block/routes/block-prediction/block-prediction.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/pricing/routes/pricing/pricing.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/billing/routes/usage/usage.router.ts (2)
apps/api/src/core/services/create-route/create-route.ts (1)
createRoute(5-11)apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/healthz/routes/healthz.router.ts (2)
apps/api/src/core/services/create-route/create-route.ts (1)
createRoute(5-11)apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-deployments/provider-deployments.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/deployment/routes/leases/leases.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/auth/routes/send-verification-email/send-verification-email.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts (4)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_BEARER_OR_API_KEY(5-5)apps/api/src/billing/http-schemas/stripe.schema.ts (1)
RemovePaymentMethodParamsSchema(218-227)apps/api/src/billing/controllers/stripe/stripe.controller.ts (1)
removePaymentMethod(129-151)packages/http-sdk/src/stripe/stripe.service.ts (1)
removePaymentMethod(32-34)
apps/api/src/billing/routes/get-balances/get-balances.router.ts (3)
apps/api/src/dashboard/routes/leases-duration/leases-duration.router.ts (1)
route(17-40)apps/api/src/core/services/create-route/create-route.ts (1)
createRoute(5-11)apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/transaction/routes/transactions/transactions.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
apps/api/src/provider/routes/provider-dashboard/provider-dashboard.router.ts (1)
apps/api/src/core/services/openapi-docs/openapi-security.ts (1)
SECURITY_NONE(6-6)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: validate / validate-app
- GitHub Check: test-build
🔇 Additional comments (24)
apps/api/src/transaction/routes/transactions/transactions.router.ts (3)
3-5: LGTM! Import migration successfully implements security enforcement.The migration from the external
@hono/zod-openapito the localcreateRoutewrapper, along with the addition ofSECURITY_NONE, aligns with the PR objective to enforce explicit security declarations in routing.
16-35: LGTM! Appropriate security configuration for public transaction list endpoint.The explicit
security: SECURITY_NONEdeclaration correctly identifies this as a public endpoint, which is appropriate for a read-only blockchain transaction list API.
43-65: LGTM! Appropriate security configuration for public transaction lookup endpoint.The explicit
security: SECURITY_NONEdeclaration correctly identifies this as a public endpoint, which is appropriate for a read-only blockchain transaction lookup API.apps/api/src/billing/routes/stripe-prices/stripe-prices.router.ts (1)
5-5: LGTM! Import migration to internal wrapper.The import change aligns with the PR objective to use the internal
createRoutewrapper for enforcing security metadata.apps/api/src/user/routes/get-anonymous-user/get-anonymous-user.router.ts (2)
4-4: LGTM! Import migration to internal wrapper.The import change aligns with the PR objective.
18-18: LGTM! Path parameter syntax updated to OpenAPI standard.The change from
:idto{id}aligns with OpenAPI path parameter conventions, which the internalcreateRoutewrapper likely enforces.apps/api/src/provider/routes/jwt-token/jwt-token.router.ts (1)
4-4: LGTM! Import migration to internal wrapper.The import change aligns with the PR objective to use the internal
createRoutewrapper.apps/api/src/billing/routes/sign-and-broadcast-tx/sign-and-broadcast-tx.router.ts (1)
5-5: LGTM! Import migration to internal wrapper.The import change aligns with the PR objective.
apps/api/src/certificate/routes/certificate.router.ts (1)
3-3: LGTM! Import migration to internal wrapper.The import change aligns with the PR objective.
apps/api/src/dashboard/routes/dashboard-data/dashboard-data.router.ts (2)
3-5: LGTM! Import migration and security metadata added.The changes align perfectly with the PR objective:
- Migrated to internal
createRoutewrapper- Added explicit
SECURITY_NONEimport
15-15: LGTM! Explicit security metadata enforced.Adding
security: SECURITY_NONEmakes it clear that this public dashboard endpoint requires no authentication. This enhances code clarity and aligns with the PR's security enforcement goal.apps/api/src/pricing/routes/pricing/pricing.router.ts (2)
3-5: LGTM! Import migration and security metadata added.The changes align with the PR objective:
- Migrated to internal
createRoutewrapper- Added explicit
SECURITY_NONEimport
15-15: LGTM! Explicit security metadata enforced.Adding
security: SECURITY_NONEmakes it clear that this pricing estimation endpoint is public. This enhances security awareness and aligns with the PR's enforcement goal.apps/api/src/provider/routes/provider-deployments/provider-deployments.router.ts (2)
3-5: LGTM! Import migration and security metadata added.The changes align with the PR objective:
- Migrated to internal
createRoutewrapper- Added explicit
SECURITY_NONEimport
18-18: LGTM! Explicit security metadata enforced.Adding
security: SECURITY_NONEmakes it clear that this provider deployments endpoint is public. This enhances security awareness and aligns with the PR's enforcement goal.apps/api/src/block/routes/block-prediction/block-prediction.router.ts (1)
11-55: Prediction routes: createRoute wrapper + SECURITY_NONE usage look correctSwitching to the local
createRoutewrapper and explicitly settingsecurity: SECURITY_NONEon both prediction endpoints keeps behavior (public, read‑only) while satisfying the new typing/linting constraints; this is consistent with how other public analytics-style routes are modeled in this codebase. If you later decide these should be authenticated, it’s probably worth tracking that as a separate security-policy issue rather than expanding this PR’s scope. Based on learnings, …apps/api/src/billing/routes/checkout/checkout.router.ts (1)
5-17: Checkout route correctly migrated to local createRoute wrapperThe import swap to
@src/core/services/create-route/create-routeis consistent with the new pattern, and the existingsecurity: SECURITY_BEARER_OR_API_KEYsatisfies the wrapper’s requirement without changing behavior.apps/api/src/billing/routes/usage/usage.router.ts (1)
5-40: Usage history routes: explicit SECURITY_NONE matches the wrapper, confirm intended exposureUsing the local
createRouteand settingsecurity: SECURITY_NONEon both/v1/usage/historyand/v1/usage/history/statscleanly satisfies the new requirement to always declare security and matches their read‑only nature. Please just double‑check that unauthenticated access to per‑address usage history is still the desired behavior, since this PR is making that policy explicit in the OpenAPI surface.apps/api/src/deployment/routes/leases/leases.router.ts (1)
3-51: Leases routes: migration to createRoute and explicit SECURITY_ settings look good*Using the shared
createRoutewrapper here and keepingsecurity: SECURITY_BEARER_OR_API_KEYon the create‑lease route while addingsecurity: SECURITY_NONEto the fallback list endpoint cleanly documents the intended security for both operations and aligns with the new enforced pattern.apps/api/src/healthz/routes/healthz.router.ts (1)
4-25: Healthz routes: explicit unauthenticated security via createRoute is appropriateSwitching to the shared
createRoutehelper and settingsecurity: SECURITY_NONEfor both readiness and liveness probes matches typical health‑check expectations and aligns these endpoints with the new “security must be declared” rule.apps/api/src/billing/routes/get-balances/get-balances.router.ts (1)
5-15: Get-balances route: createRoute migration + SECURITY_NONE are consistent with public lookup semanticsThe move to the shared
createRoutewrapper and addingsecurity: SECURITY_NONEfor/v1/balancesis consistent with other read-only, address-based endpoints; it keeps the route unauthenticated while making the security posture explicit in types and OpenAPI. As with the usage routes, it’s worth quickly confirming that unauthenticated balance lookups remain the desired behavior.apps/api/src/template/routes/templates/templates.router.ts (1)
3-65: Templates routes security and wrapper migration look consistentUsing the local
createRoutewrapper and explicitly attachingsecurity: SECURITY_NONEto the three public template endpoints is consistent with the project-wide security declaration pattern. These routes only expose template metadata, so documenting them as unauthenticated makes sense.No issues spotted with the refactor.
apps/api/src/auth/routes/send-verification-email/send-verification-email.router.ts (1)
5-25: Confirm that resend verification email should be unauthenticatedThe migration to the local
createRoutewrapper and addingsecurity: SECURITY_NONEis technically sound and matches the new security-typing approach.Since
/v1/send-verification-emailaccepts auserIdand sends an email, please just double-check that exposing this as an unauthenticated endpoint is intentional and that any rate limiting/abuse protections live elsewhere (if needed). No code changes required here if that behavior is by design.apps/api/src/billing/routes/stripe-payment-methods/stripe-payment-methods.router.ts (1)
3-12: Stripe remove payment method route refactor looks correct and improves validationImporting
RemovePaymentMethodParamsSchema, switching the delete path to/v1/stripe/payment-methods/{paymentMethodId}, wiringrequest: { params: RemovePaymentMethodParamsSchema }, and readingconst { paymentMethodId } = c.req.valid("param");all line up with the schema snippet and keep the route protected withSECURITY_BEARER_OR_API_KEY.This brings the route in sync with the OpenAPI schema and ensures the parameter is validated before use.
Also applies to: 67-85
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2276 +/- ##
==========================================
- Coverage 47.56% 47.31% -0.26%
==========================================
Files 1033 1024 -9
Lines 29249 28945 -304
Branches 7587 7546 -41
==========================================
- Hits 13912 13694 -218
- Misses 14843 14858 +15
+ Partials 494 393 -101
*This pull request uses carry forward flags. Click here to find out more.
🚀 New features to boost your workflow:
|
2 participants
refs #1701
Summary by CodeRabbit
Release Notes
{id}instead of:id)✏️ Tip: You can customize this high-level summary in your review settings.