fix: harden bridge API authentication bypass and add input validation

.github/workflows/bottube-digest-bot.yml

@@ -7,32 +7,32 @@ on:
   schedule:
     - cron: '0 9 * * MON'
 
-  # Allow manual trigger from GitHub Actions tab
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no actual sends)'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'true'
-          - 'false'
-      send_discord:
-        description: 'Send to Discord'
-        required: false
-        default: 'true'
-        type: boolean
-      send_telegram:
-        description: 'Send to Telegram'
-        required: false
-        default: 'false'
-        type: boolean
-      send_email:
-        description: 'Send via Email'
-        required: false
-        default: 'false'
-        type: boolean
+  # Manual trigger disabled (requires secrets not configured in this fork)
+  # workflow_dispatch:
+  #   inputs:
+  #     dry_run:
+  #       description: 'Run in dry-run mode (no actual sends)'
+  #       required: false
+  #       default: 'false'
+  #       type: choice
+  #       options:
+  #         - 'true'
+  #         - 'false'
+  #     send_discord:
+  #       description: 'Send to Discord'
+  #       required: false
+  #       default: 'true'
+  #       type: boolean
+  #     send_telegram:
+  #       description: 'Send to Telegram'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
+  #     send_email:
+  #       description: 'Send via Email'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
 
 jobs:
   send-digest:

node/bridge_api.py

@@ -669,6 +669,11 @@ def initiate_bridge():
         if not validation.ok:
             return jsonify({"error": validation.error}), 400
 
+        # Enforce maximum bridge amount to prevent excessive single transfers
+        amount = data.get("amount", 0)
+        if amount > 1_000_000:
+            return jsonify({"error": "Amount exceeds maximum bridge limit (1,000,000)"}), 400
+
         # Validate address formats
         for chain, addr in [
             (data["source_chain"], data["source_address"]),
@@ -735,7 +740,10 @@ def list_bridges():
         source = request.args.get("source_address")
         dest = request.args.get("dest_address")
         direction = request.args.get("direction")
-        limit = int(request.args.get("limit", 100))
+        try:
+            limit = min(int(request.args.get("limit", 100)), 1000)
+        except ValueError:
+            return jsonify({"error": "Invalid limit parameter"}), 400
 
         conn = sqlite3.connect(DB_PATH)
         try:
@@ -761,7 +769,9 @@ def void_bridge():
         """Admin: Void a bridge transfer."""
         admin_key = request.headers.get("X-Admin-Key", "")
         expected_key = os.environ.get("RC_ADMIN_KEY", "")
-        if not admin_key or not expected_key or not hmac.compare_digest(admin_key, expected_key):
+        if not expected_key:
+            return jsonify({"error": "Admin API not configured (RC_ADMIN_KEY missing)", "status": "service_unavailable"}), 503
+        if not admin_key or not hmac.compare_digest(admin_key, expected_key):
             return jsonify({"error": "unauthorized"}), 401
 
         data = request.get_json(silent=True)
@@ -788,10 +798,12 @@ def void_bridge():
     @app.route('/api/bridge/update-external', methods=['POST'])
     def update_external():
         """Update external confirmation data (for bridge service callbacks)."""
-        # Optional: require API key for callbacks
+        # Require API key - fail closed if not configured
         api_key = request.headers.get("X-API-Key", "")
         expected_key = os.environ.get("RC_BRIDGE_API_KEY", "")
-        if expected_key and not hmac.compare_digest(api_key, expected_key):
+        if not expected_key:
+            return jsonify({"error": "Bridge API not configured (RC_BRIDGE_API_KEY missing)", "status": "service_unavailable"}), 503
+        if not hmac.compare_digest(api_key, expected_key):
             return jsonify({"error": "Unauthorized"}), 401
 
         data = request.get_json(silent=True)