fix: resolve issues #980, #982, #983, #984 - security and resilience … - #1007
Open
sandrawillow001-afk wants to merge 1 commit into
Open
Conversation
…ub#983, StellarDevHub#984 - security and resilience improvements ## Issue StellarDevHub#984: SmartContract - Reentrancy Audit - Added reentrancy guards (LOCK mutex) to smart_vault, payment_streaming, and multisig_wallet_timelock contracts - Added fuzz tests for lending_pool reentrancy protection - Created comprehensive audit report at contracts/AUDIT_REENTRANCY.md ## Issue StellarDevHub#983: Security - GraphQL Query-Aware Rate Limiting - Created graphqlRateLimiter.ts with query complexity costing - Integrated with existing Redis rate limiter for cumulative cost budgets - Added persisted operation allowlisting for production queries - Disabled introspection in production with separate rate limits - Integrated into /graphql endpoint in both server.ts and index.ts ## Issue StellarDevHub#982: Resilience - Circuit Breaker Pattern - Enhanced CircuitBreaker with Redis-backed distributed state synchronization - Created externalServices.ts with pre-configured breakers for Stellar Horizon, Soroban RPC, GitHub API, and webhook deliveries - Integrated circuit breakers into GitHub OAuth service and webhook worker - Added degraded response fallbacks for circuit breaker open states ## Issue StellarDevHub#980: Security - Encrypt GitHub OAuth Tokens - Created tokenEncryption.ts with AES-256-GCM encryption - Supports key rotation via TOKEN_ENCRYPTION_KEYS env var - Integrated encryption into github.service.ts (all 5 token storage locations) - Created migration script to encrypt existing plaintext tokens - Added isTokenEncrypted() utility for idempotent migrations Co-authored-by: sandrawillow001-afk <sandrawillow001-afk@users.noreply.github.com>
|
@sandrawillow001-afk is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@sandrawillow001-afk Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…improvements
Issue #984: SmartContract - Reentrancy Audit
Issue #983: Security - GraphQL Query-Aware Rate Limiting
Issue #982: Resilience - Circuit Breaker Pattern
Issue #980: Security - Encrypt GitHub OAuth Tokens
closes [SmartContract-Advanced] Audit all Soroban contracts for reentrancy and cross-contract call vulnerabilities #984
closes [Security-Advanced] Add query-aware rate limiting to GraphQL endpoint #983
closes [Resilience-Advanced] Implement circuit breaker pattern for all external API dependencies #982
closes [Security-Advanced] Encrypt GitHub OAuth access tokens at rest in database #980