feat: rate limiter wiring, revoke tests, admin activity page, admin guard - #1218
Conversation
|
@oladev2026-tech is attempting to deploy a commit to the Mftee's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@oladev2026-tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
mftee
left a comment
mftee
left a comment
There was a problem hiding this comment.
Reviewed. Good work:
- Rate limiter (CT-37) wired as a real global
axum::middleware::from_fn_with_statelayer, backed bygovernor-basedDefaultRateLimiter, returns 429 with a clear body. Integration tests drive the actualapp()router viaaxum_test::TestServerand assert burst/refill behavior across routes, not just unit-level. /revokeintegration tests (CT-32) cover invalid hash, missing prior anchor, the happy path (verifies the cache is updated to reflectrevoked: trueafter a successful revoke), and a Stellar-failure path returning 502.- Admin activity page (FE-64) rewritten from a mock-data stub to a real paginated, filterable (
userId/actionType) feed with a proper 403 → 'Admin access required' state, matching the guard added to the documents page (FE-44).
Approving. Note for the merge: this branch and #1216/#1217 (already merged) both extend AppState, and this PR's test files construct AppState { ... } literals directly — I'll need to add the webhook_urls/webhook_secret fields to those test fixtures when resolving the merge conflict so the crate still compiles.
Resolve conflicts in contract/src/lib.rs and contract/src/main.rs between the rate limiter (PR CodeGirlsInc#1218) and the webhook fields (PR CodeGirlsInc#1216): both are additive AppState fields, so both are kept. Also fixes a compile break in the test suite left by PR CodeGirlsInc#1216: two pre-existing AppState test fixtures (contract/src/health.rs, contract/src/tests/integration.rs) were never updated for the webhook_urls/webhook_secret fields it added, so 'cargo test' has not compiled since that PR merged. Backfilled those fixtures plus this PR's own new fixtures (rate_limit.rs, revoke.rs) with the new fields, using permissive rate-limiter values so existing tests are unaffected.
2 participants
Summary
RATE_LIMIT_PER_SECOND/RATE_LIMIT_BURST) is now built inmain.rs, stored onAppState, and applied as a router middleware returning429 Too Many Requestswhen the quota is exceeded, with integration tests.POST /revoke: invalid-hash 400, unanchored 404, and a revoke-then-verify flow (mocked Horizon) asserting the cached verify entry reflectsrevoked: truewith the real transaction id, plus a Stellar-failure 502 path./admin/activityas a paginated user-action timeline (most recent first) withuserIdandactionTypefilters and an admin-only guard./admin/documents: non-admin responses (403) now show an Admin access required state instead of a generic error.Closes #942
Closes #937
Closes #935
Closes #933