Skip to content

fix(api): harden admin rate limit, newsletter subscribe, market resolve - #1831

Merged
hman38705 merged 1 commit into
solutions-plug:mainfrom
knytcomics-ui:fix/1725-1726-1727-1732-api-hardening
Oct 20, 2026
Merged

hman38705 merged 1 commit into
solutions-plug:mainfrom
knytcomics-ui:fix/1725-1726-1727-1732-api-hardening

Conversation

@knytcomics-ui

Copy link
Copy Markdown
Contributor

Closes #1725
Closes #1726
Closes #1727
Closes #1732

  • Admin rate limiter now uses extract_client_ip_cidrs with configured proxy settings (limit already configurable).
  • Newsletter: one confirmation email per address per hour (Redis cooldown); disposable domains get the uniform 202, match subdomains, list extendable via DISPOSABLE_EMAIL_DOMAINS.
  • Resolve: i32::try_from instead of cast; outcome checked against on-chain resolved outcome.
  • Added a unit test for the disposable-domain matcher.

Validation: Rust toolchain unavailable in this environment, so cargo fmt/clippy/check were not run; CI should confirm.

Closes solutions-plug#1725
Closes solutions-plug#1726
Closes solutions-plug#1727
Closes solutions-plug#1732

- admin limiter honours TRUST_PROXY and trusted CIDRs
- per-email confirmation cooldown (1/hour) via Redis
- disposable-email check matches subdomains, extendable via
  DISPOSABLE_EMAIL_DOMAINS, and returns the uniform 202
- resolve_market validates outcome_index (i32::try_from) and checks the
  on-chain resolved outcome
@drips-wave

drips-wave Bot commented Oct 20, 2026

Copy link
Copy Markdown

@knytcomics-ui Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@hman38705
hman38705 merged commit 8233c99 into solutions-plug:main Oct 20, 2026
14 of 61 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment