Routes reorganization #23
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WalkthroughThe PR refactors the degenIntel plugin by decomposing a monolithic route file into eight modular route modules, introduces a comprehensive x402 micropayment system with payment validation and wrapping infrastructure, adds payment configuration and validators, and enhances utility functions for email verification and wallet operations. Changes
Sequence DiagramsequenceDiagram
participant Client
participant PaymentProtection as applyPaymentProtection
participant Handler as createPaymentAwareHandler
participant Verify as verifyPayment
participant Route as Original Handler
Client->>PaymentProtection: routes[]
activate PaymentProtection
PaymentProtection->>Handler: wrap each route
deactivate PaymentProtection
Client->>Handler: POST /api/endpoint
activate Handler
Handler->>Handler: validate pre-payment (validator)
alt Payment provided
Handler->>Verify: extract credentials (header/query)
activate Verify
Verify->>Verify: check ERC-3009/Solana/Facilitator paths
Verify-->>Handler: valid ✓
deactivate Verify
Handler->>Route: execute original handler
activate Route
Route-->>Handler: 200 + data
deactivate Route
else No payment provided
Handler-->>Client: 402 + x402 response
end
Handler-->>Client: response
deactivate Handler
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~60 minutes Areas requiring extra attention:
Poem
Pre-merge checks and finishing touches✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@CodeRabbit review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 20
🧹 Nitpick comments (1)
src/plugins/degenIntel/routes/README.md (1)
8-23: Add a fenced-code language hint. Markdown lint flags this block; specify a language such astext(e.g., ```text) so tooling stops warning about it.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (24)
src/plugins/degenIntel/apis.ts(1 hunks)src/plugins/degenIntel/payment-config.ts(1 hunks)src/plugins/degenIntel/payment-wrapper.ts(1 hunks)src/plugins/degenIntel/route-validators.ts(1 hunks)src/plugins/degenIntel/routes/ORGANIZATION.md(1 hunks)src/plugins/degenIntel/routes/README.md(1 hunks)src/plugins/degenIntel/routes/analytics.routes.ts(1 hunks)src/plugins/degenIntel/routes/birdeye.routes.ts(1 hunks)src/plugins/degenIntel/routes/charting.routes.ts(1 hunks)src/plugins/degenIntel/routes/coingecko.routes.ts(1 hunks)src/plugins/degenIntel/routes/facilitator.routes.ts(1 hunks)src/plugins/degenIntel/routes/frontend.routes.ts(1 hunks)src/plugins/degenIntel/routes/index.ts(1 hunks)src/plugins/degenIntel/routes/legacy-data.routes.ts(1 hunks)src/plugins/degenIntel/routes/shared/README.md(1 hunks)src/plugins/degenIntel/routes/shared/index.ts(1 hunks)src/plugins/degenIntel/routes/shared/template-utils.ts(1 hunks)src/plugins/degenIntel/routes/spartan-os.routes.ts(1 hunks)src/plugins/degenIntel/routes/wallet.routes.ts(1 hunks)src/plugins/degenIntel/services/srv_dataprovider.ts(4 hunks)src/plugins/degenIntel/utils.ts(2 hunks)src/plugins/degenIntel/utils/emailVerification.ts(1 hunks)src/plugins/degenIntel/x402-types.ts(1 hunks)src/plugins/trading/interfaces/int_positions.ts(3 hunks)
🧰 Additional context used
🪛 Biome (2.1.2)
src/plugins/degenIntel/payment-config.ts
[error] 70-79: This code will never be reached ...
... because either this statement ...
... or this statement will return from the function beforehand
(lint/correctness/noUnreachable)
🪛 markdownlint-cli2 (0.18.1)
src/plugins/degenIntel/routes/README.md
8-8: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
Comment on lines
+67
to
+79
| return 'https://x402.elizaos.ai' | ||
|
|
||
| // Construct from server settings | ||
| const protocol = process.env.HTTPS === 'true' ? 'https' : 'http'; | ||
| const host = process.env.SERVER_HOST || 'localhost'; | ||
| const port = process.env.SERVER_PORT || '3000'; | ||
|
|
||
| // Don't include port 80 for http or port 443 for https | ||
| if ((protocol === 'http' && port === '80') || (protocol === 'https' && port === '443')) { | ||
| return `${protocol}://${host}`; | ||
| } | ||
|
|
||
| return `${protocol}://${host}:${port}`; |
There was a problem hiding this comment.
Restore the environment-based fallback in getBaseUrl. The early return 'https://x402.elizaos.ai' makes the host/port logic below unreachable, so any deployment relying on SERVER_HOST/SERVER_PORT is ignored. Please remove the premature return and let the function compute the URL from the configured server settings, keeping the hosted URL only as a true fallback.
- return 'https://x402.elizaos.ai'
-
- // Construct from server settings
- const protocol = process.env.HTTPS === 'true' ? 'https' : 'http';
- const host = process.env.SERVER_HOST || 'localhost';
- const port = process.env.SERVER_PORT || '3000';
+ // Construct from server settings
+ const protocol = process.env.HTTPS === 'true' ? 'https' : 'http';
+ const host = process.env.SERVER_HOST || 'localhost';
+ const port = process.env.SERVER_PORT || '3000';
+
+ if (!process.env.SERVER_HOST && !process.env.SERVER_PORT && host === 'localhost') {
+ return 'https://x402.elizaos.ai';
+ }🧰 Tools
🪛 Biome (2.1.2)
[error] 70-79: This code will never be reached ...
... because either this statement ...
... or this statement will return from the function beforehand
(lint/correctness/noUnreachable)
🤖 Prompt for AI Agents
In src/plugins/degenIntel/payment-config.ts around lines 67 to 79, remove the
premature "return 'https://x402.elizaos.ai'" so the environment-based host/port
logic runs; compute protocol, host and port from process.env as written, and
then return the constructed URL (omitting the port for default 80/443) — only if
no SERVER_HOST/ SERVER_PORT (i.e. still using the defaults like localhost:3000)
or if all env settings are absent, return the hosted fallback
'https://x402.elizaos.ai' as the final fallback.
Comment on lines
+569
to
+581
| async function verifyEvmTransaction( | ||
| txHash: string, | ||
| expectedRecipient: string, | ||
| expectedAmount: string, | ||
| network: string, | ||
| runtime: any | ||
| ): Promise<boolean> { | ||
| log('Verifying on-chain transaction:', txHash); | ||
|
|
||
| // TODO: Implement actual EVM transaction verification | ||
| logError('⚠️ EVM transaction verification not fully implemented - accepting valid tx hash format'); | ||
| return true; | ||
| } |
There was a problem hiding this comment.
Do not accept unverified on-chain payments.
This stub returns true for any hex-looking hash, so attackers can skip payment by inventing a tx id. Until the real verification is implemented, fail closed.
Apply this diff:
- // TODO: Implement actual EVM transaction verification
- logError('⚠️ EVM transaction verification not fully implemented - accepting valid tx hash format');
- return true;
+ logError('⚠️ EVM transaction verification not implemented yet');
+ return false;📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| async function verifyEvmTransaction( | |
| txHash: string, | |
| expectedRecipient: string, | |
| expectedAmount: string, | |
| network: string, | |
| runtime: any | |
| ): Promise<boolean> { | |
| log('Verifying on-chain transaction:', txHash); | |
| // TODO: Implement actual EVM transaction verification | |
| logError('⚠️ EVM transaction verification not fully implemented - accepting valid tx hash format'); | |
| return true; | |
| } | |
| async function verifyEvmTransaction( | |
| txHash: string, | |
| expectedRecipient: string, | |
| expectedAmount: string, | |
| network: string, | |
| runtime: any | |
| ): Promise<boolean> { | |
| log('Verifying on-chain transaction:', txHash); | |
| logError('⚠️ EVM transaction verification not implemented yet'); | |
| return false; | |
| } |
🤖 Prompt for AI Agents
In src/plugins/degenIntel/payment-wrapper.ts around lines 569 to 581, the
stubbed verifyEvmTransaction currently logs a warning and returns true (accepts
any hex-like tx hash); change it to fail closed until proper on-chain
verification is implemented by returning false for all calls (optionally keep a
lightweight format check to early-reject obviously invalid hashes but do not
return true), update the logs to clearly state verification is not implemented
and that the transaction is being rejected, and ensure the function signature
and Promise<boolean> return type remain unchanged.
Comment on lines
+938
to
+951
| const autoExecuteTransfer = true; | ||
|
|
||
| log('Auto-execution enabled - executing transfer on-chain'); | ||
|
|
||
| try { | ||
| // Get private key for executing transactions | ||
| const privateKey = runtime.getSetting?.(`${network.toUpperCase()}_PRIVATE_KEY`) || '0x0c34bc2f399a0e1e3b1afd4194d28ce6b73db810b5719c914cbc4a5846efc975'; | ||
| if (!privateKey) { | ||
| logError(`✗ Missing private key for ${network}. Set ${network.toUpperCase()}_PRIVATE_KEY in environment.`); | ||
| logError('⚠️ Accepting payment but cannot execute transfer (no private key)'); | ||
| return true; | ||
| } | ||
|
|
||
| // Import wallet account |
There was a problem hiding this comment.
Remove hard-coded private key fallback.
Falling back to a literal private key both commits a credential and silently signs with it if the env var is missing. That is a severe secret-management flaw—drop the fallback and fail if the key is not provided.
Apply this diff:
- const privateKey = runtime.getSetting?.(`${network.toUpperCase()}_PRIVATE_KEY`) || '0x0c34bc2f399a0e1e3b1afd4194d28ce6b73db810b5719c914cbc4a5846efc975';
- if (!privateKey) {
+ const privateKey = runtime.getSetting?.(`${network.toUpperCase()}_PRIVATE_KEY`);
+ if (!privateKey) {
logError(`✗ Missing private key for ${network}. Set ${network.toUpperCase()}_PRIVATE_KEY in environment.`);
logError('⚠️ Accepting payment but cannot execute transfer (no private key)');
return true;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const autoExecuteTransfer = true; | |
| log('Auto-execution enabled - executing transfer on-chain'); | |
| try { | |
| // Get private key for executing transactions | |
| const privateKey = runtime.getSetting?.(`${network.toUpperCase()}_PRIVATE_KEY`) || '0x0c34bc2f399a0e1e3b1afd4194d28ce6b73db810b5719c914cbc4a5846efc975'; | |
| if (!privateKey) { | |
| logError(`✗ Missing private key for ${network}. Set ${network.toUpperCase()}_PRIVATE_KEY in environment.`); | |
| logError('⚠️ Accepting payment but cannot execute transfer (no private key)'); | |
| return true; | |
| } | |
| // Import wallet account | |
| const autoExecuteTransfer = true; | |
| log('Auto-execution enabled - executing transfer on-chain'); | |
| try { | |
| // Get private key for executing transactions | |
| const privateKey = runtime.getSetting?.(`${network.toUpperCase()}_PRIVATE_KEY`); | |
| if (!privateKey) { | |
| logError(`✗ Missing private key for ${network}. Set ${network.toUpperCase()}_PRIVATE_KEY in environment.`); | |
| logError('⚠️ Accepting payment but cannot execute transfer (no private key)'); | |
| return true; | |
| } | |
| // Import wallet account |
🤖 Prompt for AI Agents
In src/plugins/degenIntel/payment-wrapper.ts around lines 938 to 951, remove the
hard-coded private key fallback and require the env setting; replace the
expression that defaults to the literal key with a call to
runtime.getSetting?.(`${network.toUpperCase()}_PRIVATE_KEY`) only, and if that
returns falsy log a clear error stating the missing env var and abort the
operation (do not proceed to import/use any wallet — return/throw to stop
execution). Ensure no secret literal remains in the file and keep the log
message the same but indicate the operation failed due to missing private key.
Comment on lines
+1113
to
+1123
| try { | ||
| // Convert priceInCents to string format for verifyPayment | ||
| const expectedAmount = String(route.x402.priceInCents); | ||
| const isValid = await verifyPayment({ | ||
| paymentProof: paymentProof as string, | ||
| paymentId: paymentId as string, | ||
| route: route.path, | ||
| expectedAmount, | ||
| runtime, | ||
| req | ||
| }); |
There was a problem hiding this comment.
Fix cents vs USD normalization before verification.
route.x402.priceInCents is passed straight through to verifyPayment, but verifyEip712Authorization treats the string as whole-dollar USD. A $0.10 route therefore requires 100 USDC on-chain and rejects legitimate proofs. Convert the cents amount into USD before calling verifyPayment.
Apply this diff:
- const expectedAmount = String(route.x402.priceInCents);
+ const expectedAmount = (route.x402.priceInCents / 100).toFixed(2);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| try { | |
| // Convert priceInCents to string format for verifyPayment | |
| const expectedAmount = String(route.x402.priceInCents); | |
| const isValid = await verifyPayment({ | |
| paymentProof: paymentProof as string, | |
| paymentId: paymentId as string, | |
| route: route.path, | |
| expectedAmount, | |
| runtime, | |
| req | |
| }); | |
| try { | |
| // Convert priceInCents to string format for verifyPayment | |
| const expectedAmount = (route.x402.priceInCents / 100).toFixed(2); | |
| const isValid = await verifyPayment({ | |
| paymentProof: paymentProof as string, | |
| paymentId: paymentId as string, | |
| route: route.path, | |
| expectedAmount, | |
| runtime, | |
| req | |
| }); |
🤖 Prompt for AI Agents
In src/plugins/degenIntel/payment-wrapper.ts around lines 1113 to 1123, the code
passes route.x402.priceInCents directly to verifyPayment which treats the value
as whole-dollar USD; convert cents to a USD string before calling verifyPayment
by dividing priceInCents by 100 and formatting as a USD amount (e.g. use
(priceInCents / 100).toFixed(2) or equivalent) so expectedAmount is the correct
dollar string for verification.
Comment on lines
+198
to
+207
| // Get trade history from cache | ||
| const trades = (await runtime.getCache<any[]>('transaction_history')) || []; | ||
| const tokenTrades = trades.slice(0, parseInt(limit as string)); | ||
|
|
||
| res.json({ | ||
| success: true, | ||
| data: { | ||
| address, | ||
| trades: tokenTrades, | ||
| count: tokenTrades.length |
There was a problem hiding this comment.
Filter trades by requested token.
The handler slices transaction_history without filtering on address, so it returns trades for unrelated tokens. Apply the address filter before enforcing the limit.
- const trades = (await runtime.getCache<any[]>('transaction_history')) || [];
- const tokenTrades = trades.slice(0, parseInt(limit as string));
+ const trades = (await runtime.getCache<any[]>('transaction_history')) || [];
+ const limitValue = parseInt(limit as string, 10);
+ const tokenTrades = trades
+ .filter(trade => trade.tokenAddress === address || trade.mint === address)
+ .slice(0, Number.isNaN(limitValue) ? undefined : limitValue);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| // Get trade history from cache | |
| const trades = (await runtime.getCache<any[]>('transaction_history')) || []; | |
| const tokenTrades = trades.slice(0, parseInt(limit as string)); | |
| res.json({ | |
| success: true, | |
| data: { | |
| address, | |
| trades: tokenTrades, | |
| count: tokenTrades.length | |
| // Get trade history from cache | |
| const trades = (await runtime.getCache<any[]>('transaction_history')) || []; | |
| const limitValue = parseInt(limit as string, 10); | |
| const tokenTrades = trades | |
| .filter(trade => trade.tokenAddress === address || trade.mint === address) | |
| .slice(0, Number.isNaN(limitValue) ? undefined : limitValue); | |
| res.json({ | |
| success: true, | |
| data: { | |
| address, | |
| trades: tokenTrades, | |
| count: tokenTrades.length |
🤖 Prompt for AI Agents
In src/plugins/degenIntel/routes/birdeye.routes.ts around lines 198 to 207, the
code slices the cached transaction_history before filtering by the requested
token address, causing unrelated trades to be returned; change the flow to first
normalize and filter the cached trades to only those matching the requested
token/address (e.g., compare lowercased addresses or checksum-normalize both
sides), then apply parseInt(limit) to slice the filtered array and build
tokenTrades from that filtered-and-sliced result; ensure you handle a missing or
invalid limit (fallback to a sensible default) and keep the rest of the response
shape unchanged.
Comment on lines
+229
to
231
| const balanceInfo = balances.find(b => b.address === wa && b.caipAssetId === caipAssetId) | ||
| const decimals = balanceInfo?.decimals || 9 // fallback to 9 if not available | ||
| const claimUi = p.position.tokenAmount / (10 ** decimals) |
There was a problem hiding this comment.
Fix decimals fallback logic
Line 231: balanceInfo?.decimals || 9 treats zero-decimal tokens as 9 decimals. Solana tokens can legitimately have decimals === 0; with the new flow we’d divide by 10 ** 9, shrinking claimUi by 1e9 and kicking off spurious position closes. Use nullish coalescing so only null/undefined fall back.
- const decimals = balanceInfo?.decimals || 9 // fallback to 9 if not available
+ const decimals = balanceInfo?.decimals ?? 9 // fallback to 9 if not available📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const balanceInfo = balances.find(b => b.address === wa && b.caipAssetId === caipAssetId) | |
| const decimals = balanceInfo?.decimals || 9 // fallback to 9 if not available | |
| const claimUi = p.position.tokenAmount / (10 ** decimals) | |
| const balanceInfo = balances.find(b => b.address === wa && b.caipAssetId === caipAssetId) | |
| const decimals = balanceInfo?.decimals ?? 9 // fallback to 9 if not available | |
| const claimUi = p.position.tokenAmount / (10 ** decimals) |
🤖 Prompt for AI Agents
In src/plugins/degenIntel/services/srv_dataprovider.ts around lines 229 to 231,
the fallback uses `balanceInfo?.decimals || 9` which treats a valid 0 decimals
as falsy and incorrectly falls back to 9; change the fallback to use the nullish
coalescing operator so only null/undefined fall back: replace `|| 9` with `?? 9`
(ensuring decimals is a number) so zero-decimal tokens are handled correctly
when computing claimUi.
Comment on lines
+53
to
+58
| export function generateVerificationToken(): string { | ||
| // Use existing generateRandomString function with CONSTANTS.useCodeLength | ||
| const token = generateRandomString(CONSTANTS.useCodeLength); | ||
| console.log('Generated verification token:', token); | ||
| return token; | ||
| } |
There was a problem hiding this comment.
Stop logging verification tokens.
Printing the verification code leaks it to logs and monitoring systems. Treat these codes as secrets and drop the log.
Apply this diff:
- const token = generateRandomString(CONSTANTS.useCodeLength);
- console.log('Generated verification token:', token);
- return token;
+ return generateRandomString(CONSTANTS.useCodeLength);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| export function generateVerificationToken(): string { | |
| // Use existing generateRandomString function with CONSTANTS.useCodeLength | |
| const token = generateRandomString(CONSTANTS.useCodeLength); | |
| console.log('Generated verification token:', token); | |
| return token; | |
| } | |
| export function generateVerificationToken(): string { | |
| // Use existing generateRandomString function with CONSTANTS.useCodeLength | |
| return generateRandomString(CONSTANTS.useCodeLength); | |
| } |
🤖 Prompt for AI Agents
In src/plugins/degenIntel/utils.ts around lines 53 to 58, the function generates
a verification token then logs it to the console; remove the console.log so
verification tokens are not written to logs or monitoring systems and simply
return the generated token (keep using
generateRandomString(CONSTANTS.useCodeLength)). Ensure no other debug logging
prints the token and run tests/lint to validate no leftover references.
Comment on lines
+125
to
+158
| console.log('createOrUpdateVerificationToken called with:'); | ||
| console.log('Email:', email); | ||
| console.log('accountEntityId:', accountEntityId); | ||
|
|
||
| const token = generateVerificationToken(); | ||
| console.log('Generated token:', token); | ||
|
|
||
| const tokenExpiry = Date.now() + (10 * 60 * 1000); // 10 minutes | ||
| console.log('Token expiry:', new Date(tokenExpiry)); | ||
|
|
||
| // Store token in cache with expiry (using existing pattern) | ||
| const tokenKey = `verification_token_${email}`; | ||
| console.log('Token key for storage:', tokenKey); | ||
|
|
||
| const tokenData = { | ||
| token, | ||
| email, | ||
| //userEntityId, | ||
| accountEntityId, | ||
| expiry: tokenExpiry, | ||
| createdAt: Date.now() | ||
| }; | ||
| console.log('Token data to store:', tokenData); | ||
|
|
||
| await runtime.setCache(tokenKey, tokenData); | ||
| console.log('Token stored in cache successfully'); | ||
|
|
||
| // Send verification email using existing infrastructure | ||
| const emailSent = await sendVerificationEmail(email, token); | ||
|
|
||
| if (!emailSent) { | ||
| return { success: false, error: 'Failed to send verification email' }; | ||
| } | ||
|
|
There was a problem hiding this comment.
Do not log user emails or tokens.
These console logs dump email addresses, verification tokens, and expirations—sensitive data that should never reach logs. Please remove them (and rely on structured logging without secrets if needed).
Apply this diff:
- console.log('createOrUpdateVerificationToken called with:');
- console.log('Email:', email);
- console.log('accountEntityId:', accountEntityId);
-
- const token = generateVerificationToken();
- console.log('Generated token:', token);
-
- const tokenExpiry = Date.now() + (10 * 60 * 1000); // 10 minutes
- console.log('Token expiry:', new Date(tokenExpiry));
-
- // Store token in cache with expiry (using existing pattern)
- const tokenKey = `verification_token_${email}`;
- console.log('Token key for storage:', tokenKey);
-
- const tokenData = {
+ const token = generateVerificationToken();
+ const tokenExpiry = Date.now() + (10 * 60 * 1000); // 10 minutes
+
+ const tokenKey = `verification_token_${email}`;
+
+ const tokenData = {
token,
email,
//userEntityId,
accountEntityId,
expiry: tokenExpiry,
createdAt: Date.now()
};
- console.log('Token data to store:', tokenData);
await runtime.setCache(tokenKey, tokenData);
- console.log('Token stored in cache successfully');🤖 Prompt for AI Agents
In src/plugins/degenIntel/utils.ts around lines 125 to 158, the current
console.log calls print sensitive data (email, verification token, token expiry,
accountEntityId, and token contents) to logs; remove all console.log statements
that output PII or secret tokens and instead log only non-sensitive operational
events (e.g., "createOrUpdateVerificationToken called", "token stored",
"verification email sent/failed") or use structured logging with no secret
fields; ensure the token and email are not included in any logs, and if you need
traceability, log a non-reversible identifier (hash) or request ID rather than
raw values.
Comment on lines
+172
to
+181
| console.log('verifyEmailToken called with:'); | ||
| console.log('Email:', email); | ||
| console.log('Token:', token); | ||
|
|
||
| const tokenKey = `verification_token_${email}`; | ||
| console.log('Token key:', tokenKey); | ||
|
|
||
| const cachedTokenData = await runtime.getCache(tokenKey); | ||
| console.log('Cached token data:', cachedTokenData); | ||
|
|
There was a problem hiding this comment.
Scrub sensitive data from verifyEmailToken logging.
These logs echo user email, the submitted token, and cached token payloads. That’s private information and must stay out of logs.
Apply this diff:
- console.log('verifyEmailToken called with:');
- console.log('Email:', email);
- console.log('Token:', token);
-
- const tokenKey = `verification_token_${email}`;
- console.log('Token key:', tokenKey);
-
- const cachedTokenData = await runtime.getCache(tokenKey);
- console.log('Cached token data:', cachedTokenData);
+ const tokenKey = `verification_token_${email}`;
+ const cachedTokenData = await runtime.getCache(tokenKey);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| console.log('verifyEmailToken called with:'); | |
| console.log('Email:', email); | |
| console.log('Token:', token); | |
| const tokenKey = `verification_token_${email}`; | |
| console.log('Token key:', tokenKey); | |
| const cachedTokenData = await runtime.getCache(tokenKey); | |
| console.log('Cached token data:', cachedTokenData); | |
| const tokenKey = `verification_token_${email}`; | |
| const cachedTokenData = await runtime.getCache(tokenKey); |
🤖 Prompt for AI Agents
In src/plugins/degenIntel/utils.ts around lines 172 to 181, the current
console.log calls print sensitive user data (email, token, cached token
payload). Remove direct logging of those values; instead log only non-sensitive
indicators such as "verifyEmailToken called" and whether a cached token exists
and whether it matched. If you need to reference the email, log a redacted form
(e.g., show only first char and domain or a hash) and never log the raw token or
cached payload. Implement or call a small redaction helper for emails and
replace the detailed console.logs with these minimal, scrubbed messages.
Comment on lines
+150
to
171
| const chains = options.chain ? [options.chain] : Object.keys(metaWallets[0]?.keypairs || { solana: true }) | ||
|
|
||
| for(const mw of metaWallets) { | ||
| //console.log('listPositions - mw', mw) | ||
| if (mw.keypairs.solana.positions?.length) { | ||
| //console.log('listPositions - solana positions', mw.keypairs.solana.positions.length) | ||
| // filter open positions? | ||
| for(const p of mw.keypairs.solana.positions) { | ||
| positions.push({ position: p, entityId: mw.entityId, mw }) | ||
| for (const chain of chains) { | ||
| if (mw.keypairs[chain]?.positions?.length) { | ||
| //console.log('listPositions - ' + chain + ' positions', mw.keypairs[chain].positions.length) | ||
| // Apply filters | ||
| for(const p of mw.keypairs[chain].positions) { | ||
| // Filter by token if specified | ||
| if (options.token && p.token !== options.token) continue | ||
|
|
||
| // Filter by open/closed status | ||
| if (options.openOnly && p.close) continue | ||
| if (options.closedOnly && !p.close) continue | ||
|
|
||
| // Filter by public key if specified | ||
| if (options.publicKey && p.publicKey !== options.publicKey) continue | ||
|
|
||
| positions.push({ position: p, entityId: mw.entityId, mw }) | ||
| } | ||
| } |
There was a problem hiding this comment.
Fix chain selection to avoid dropping positions.
Right now we build chains from metaWallets[0] when no options.chain is supplied. If the first metawallet only has, say, a Solana keypair but another wallet in the list holds an Ethereum keypair, every Ethereum position is silently skipped. That’s a correctness bug. Please derive the chain list across all metawallets (and still fall back to ['solana'] when nothing is configured) before iterating.
- const chains = options.chain ? [options.chain] : Object.keys(metaWallets[0]?.keypairs || { solana: true })
+ const resolvedChains = options.chain
+ ? [options.chain]
+ : Array.from(
+ new Set(
+ (metaWallets ?? []).flatMap(mw => Object.keys(mw.keypairs ?? {}))
+ ),
+ );
+ const chains = resolvedChains.length ? resolvedChains : ['solana'];
-
- for (const chain of chains) {
+ for (const chain of chains) {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const chains = options.chain ? [options.chain] : Object.keys(metaWallets[0]?.keypairs || { solana: true }) | |
| for(const mw of metaWallets) { | |
| //console.log('listPositions - mw', mw) | |
| if (mw.keypairs.solana.positions?.length) { | |
| //console.log('listPositions - solana positions', mw.keypairs.solana.positions.length) | |
| // filter open positions? | |
| for(const p of mw.keypairs.solana.positions) { | |
| positions.push({ position: p, entityId: mw.entityId, mw }) | |
| for (const chain of chains) { | |
| if (mw.keypairs[chain]?.positions?.length) { | |
| //console.log('listPositions - ' + chain + ' positions', mw.keypairs[chain].positions.length) | |
| // Apply filters | |
| for(const p of mw.keypairs[chain].positions) { | |
| // Filter by token if specified | |
| if (options.token && p.token !== options.token) continue | |
| // Filter by open/closed status | |
| if (options.openOnly && p.close) continue | |
| if (options.closedOnly && !p.close) continue | |
| // Filter by public key if specified | |
| if (options.publicKey && p.publicKey !== options.publicKey) continue | |
| positions.push({ position: p, entityId: mw.entityId, mw }) | |
| } | |
| } | |
| const resolvedChains = options.chain | |
| ? [options.chain] | |
| : Array.from( | |
| new Set( | |
| (metaWallets ?? []).flatMap(mw => Object.keys(mw.keypairs ?? {})) | |
| ), | |
| ); | |
| const chains = resolvedChains.length ? resolvedChains : ['solana']; | |
| for(const mw of metaWallets) { | |
| //console.log('listPositions - mw', mw) | |
| for (const chain of chains) { | |
| if (mw.keypairs[chain]?.positions?.length) { | |
| //console.log('listPositions - ' + chain + ' positions', mw.keypairs[chain].positions.length) | |
| // Apply filters | |
| for(const p of mw.keypairs[chain].positions) { | |
| // Filter by token if specified | |
| if (options.token && p.token !== options.token) continue | |
| // Filter by open/closed status | |
| if (options.openOnly && p.close) continue | |
| if (options.closedOnly && !p.close) continue | |
| // Filter by public key if specified | |
| if (options.publicKey && p.publicKey !== options.publicKey) continue | |
| positions.push({ position: p, entityId: mw.entityId, mw }) | |
| } | |
| } |
🤖 Prompt for AI Agents
In src/plugins/trading/interfaces/int_positions.ts around lines 150 to 171, the
current chains array is derived from metaWallets[0] which can omit chains
present on other metaWallets and cause positions to be skipped; replace that
logic so chains is either [options.chain] when provided or the union of all key
names present in every metaWallet.keypairs (collect keys from each mw.keypairs
across metaWallets), and if that union is empty fall back to ['solana']; then
iterate using this computed chains array as before so all positions across all
wallets are considered.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Release Notes
New Features
Improvements