chore(indexer): security improvements

[gaboesquivel]

Summary by Sourcery

Enhance the indexer application by adding a new Alchemy webhook handler and improving security with rate limiting and environment variable validation. Remove obsolete code related to Alchemy context and signature validation.

New Features:

• Introduce a new Alchemy webhook handler to process incoming webhook requests, validate signatures, and trigger address activity tasks.

Enhancements:

• Enhance security by adding rate limiting to the Express app, limiting each IP to 100 requests per minute.
• Improve environment variable validation using a schema to ensure correct format and presence of required variables.

Chores:

• Remove unused imports and code related to Alchemy context and signature validation from the indexer routes.

Summary by CodeRabbit

• New Features

  • Introduced webhook handling functionality for processing incoming requests from Alchemy, improving interaction with the webhook system.
  • Added validation for critical environment variables to enhance application reliability.

• Bug Fixes

  • Improved error handling in the address activity task for more consistent logging of error messages.

• Chores

  • Streamlined middleware configuration to enhance security and request handling.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
bitlauncher	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 23, 2024 5:18am
smartsale-faucet	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 23, 2024 5:18am

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The recent changes introduce functionality for handling Alchemy webhook requests, enhance error handling in the address activity task, and implement environment variable validation using the zod library. Middleware configurations in the Express application have been adjusted, including improved request body size handling and updated rate limiting settings. Logging functionality has been commented out, reflecting a shift in logging strategy.

Changes

File Path	Change Summary
.../routes/alchemy.ts	Introduced alchemyWebhook function for processing Alchemy webhooks, validating signatures, and logging events. Defined AlchemyWebhookEvent interface and AlchemyWebhookType type.
.../routes/index.ts	Modified middleware configuration: set request body size limit to '1mb', updated rate limiting options, and commented out pinoHttp logging. Sentry error handler repositioned.
.../trigger/config.ts	Added zod validation for ISSUER_KEY and ISSUER_ADDRESS environment variables; updated appenv to use validated values.
.../trigger/activity.ts	Enhanced error handling in addressActivityTask by using getErrorMessage for standardized error message logging.

Sequence Diagram(s)

sequenceDiagram
    participant Webhook as Alchemy Webhook
    participant Server as Express Server
    participant Task as Address Activity Task
    participant Logger as Logger

    Webhook->>Server: Send webhook request
    Server->>Server: Validate signature
    alt Signature valid
        Server->>Task: Trigger address activity task
        Task->>Logger: Log activity
        Server-->>Webhook: Respond 200 OK
    else Signature invalid
        Server-->>Webhook: Respond 401 Unauthorized
    end

Loading

🐰 In the meadow, changes bloom,
New webhooks sing, dispelling gloom.
With validated keys, we hop with glee,
Errors now clearer, as they should be!
Middleware dances, logging takes flight,
In this sprightly code, all feels just right! ✨

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

• X
• Mastodon
• Reddit
• LinkedIn

Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai generate interesting stats about this repository and render them as a table.
  • @coderabbitai show all the console.log statements in this repository.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (invoked as PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request implements security improvements in the indexer application. The changes focus on enhancing input validation, improving error handling, and refactoring the Alchemy webhook handling process. The modifications also include updates to the Express server setup, environment variable validation, and minor adjustments to the trigger application.

File-Level Changes

Change	Details	Files
Improved Express server setup with enhanced security measures	Added body size limit to express.json middleware Updated rate limiting configuration with standard and legacy headers Reordered middleware setup for better security Commented out and updated logging middleware to reduce sensitive information exposure	apps/indexer/src/routes/index.ts
Implemented environment variable validation using Zod	Added Zod schema for environment variables Implemented validation check for ISSUER_KEY and ISSUER_ADDRESS Updated appenv object to use validated environment variables	apps/trigger/src/config.ts
Refactored Alchemy webhook handling	Created a new file for Alchemy webhook handling Implemented signature validation for Alchemy webhooks Added types for Alchemy webhook events	apps/indexer/src/routes/alchemy.ts
Removed deprecated Alchemy helper files	Deleted alchemy/helpers.ts Deleted alchemy/index.ts	apps/indexer/src/routes/alchemy/helpers.ts apps/indexer/src/routes/alchemy/index.ts
Updated error handling in trigger activity	Replaced direct error message access with getErrorMessage function	apps/trigger/src/trigger/activity.ts

---

Tips

• Trigger a new Sourcery review by commenting @sourcery-ai review on the pull request.
• Continue your discussion with Sourcery by replying directly to review comments.
• You can change your review settings at any time by accessing your dashboard:
  • Enable or disable the Sourcery-generated pull request summary or reviewer's guide;
  • Change the review language;
• You can always contact us if you have any questions or feedback.

[sourcery-ai]

Hey @gaboesquivel - I've reviewed your changes and found some issues that need to be addressed.

Blocking issues:

• Hard-coded secret key found in code. (link)

Overall Comments:

• Consider either implementing the improved logging middleware or removing the commented-out code entirely. Commented-out code in production can lead to confusion and maintenance issues.
• It would be helpful to add comments explaining the rationale behind some of the security changes, particularly the rate limiting configuration. This can help future maintainers understand the reasoning behind these choices.

Here's what I looked at during the review

• 🟡 General issues: 1 issue found
• 🔴 Security: 1 blocking issue, 3 other issues
• 🟢 Testing: all looks good
• 🟢 Complexity: all looks good
• 🟢 Documentation: all looks good

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment to tell me if it was helpful.}

[github-actions]

⚡️ Lighthouse report

Page: https://bitlauncher-5v4ap9rfq-bitcash.vercel.app/
Report undefined

Category	Score
🔴 Performance	37
🟠 Accessibility	59
🟠 Best practices	74
🟠 SEO	79
🟠 PWA	63

Page: https://bitlauncher-5v4ap9rfq-bitcash.vercel.app/about
Report undefined

Category	Score
🔴 Performance	33
🟠 Accessibility	59
🟠 Best practices	74
🟠 SEO	79
🔴 PWA	38

Page: https://bitlauncher-5v4ap9rfq-bitcash.vercel.app/security
Report undefined

Category	Score
🔴 Performance	34
🟠 Accessibility	61
🟠 Best practices	74
🟠 SEO	79
🔴 PWA	38

Page: https://bitlauncher-5v4ap9rfq-bitcash.vercel.app/bitcash-bitlauncher
Report undefined

Category	Score
🔴 Performance	39
🟠 Accessibility	65
🟠 Best practices	74
🟠 SEO	86
🔴 PWA	38

Page: https://bitlauncher-5v4ap9rfq-bitcash.vercel.app/blog
Report undefined

Category	Score
🔴 Performance	39
🟠 Accessibility	66
🟠 Best practices	74
🟠 SEO	86
🔴 PWA	38

Page: https://bitlauncher-5v4ap9rfq-bitcash.vercel.app/blog/ai
Report undefined

Category	Score
🔴 Performance	43
🟠 Accessibility	59
🟠 Best practices	74
🟠 SEO	79
🔴 PWA	38