diff --git a/BUGS.md b/BUGS.md index 58ecb62..c58f377 100644 --- a/BUGS.md +++ b/BUGS.md @@ -1,11 +1,11 @@ # Known bugs A second full-codebase audit on 2026-07-27 found **25 further issues** (4 critical, 6 high, -7 medium, 8 low), listed below as B-45 … B-49. B-25 through B-44 are fixed (see "Previously -fixed" below) — no Critical-, High- or Medium-severity finding remains open; the remaining 5 are +7 medium, 8 low), listed below as B-46 … B-49. B-25 through B-45 are fixed (see "Previously +fixed" below) — no Critical-, High- or Medium-severity finding remains open; the remaining 4 are Low/hygiene. The 139-test suite was green at the time of the audit, so none of these were caught -by existing coverage — every fix lands with a regression test (the twenty fixes so far brought -the suite from 139 to 232). +by existing coverage — every fix lands with a regression test (the twenty-one fixes so far brought +the suite from 139 to 245). The recurring pattern across the open findings is worth stating once: the code is rigorous about the failure modes that have actually been hit, and silent about the ones that have not. @@ -18,14 +18,6 @@ admin auth, single-process assumptions, no user-facing history, etc.) are docume ## Low / hygiene -### B-45 — Unvalidated and unpaginated admin list endpoints - -`limit: int = 50` on `/admin/rounds` and `/admin/audit-log` has no bounds (`-1` means -"everything" on SQLite), and `/admin/pending-transactions` has no limit at all — it grows -without end. -**Fix:** `Query(default=50, ge=1, le=500)` on both, and the same treatment plus a status filter -on the pending-transaction list. - ### B-46 — `secrets.compare_digest` on a `str` raises on non-ASCII input `api/routes/admin.py:27` raises `TypeError` — a 500 instead of a 403 — when the header contains @@ -68,6 +60,7 @@ already does. - **B-42** — Swagger/ReDoc/the raw OpenAPI JSON enumerated the entire API surface, admin endpoints included, to anyone who requested them; now off by default and gated behind `ENABLE_API_DOCS` - **B-43** — the Caddyfile sent no CSP, no `X-Frame-Options`/`frame-ancestors`, and no HSTS, on a page whose JWT lives in `localStorage` - **B-44** — README's Quick start documented a bare `uvicorn --reload` workflow, and `docs/running-the-server.md` still had a matching "Locale / venv" section, both contradicting CLAUDE.md's Docker-only policy +- **B-45** — `/admin/rounds`/`/admin/audit-log`'s `limit` had no bounds (`-1` means "everything" on SQLite), and `/admin/pending-transactions` had no limit or status filter at all - **B-32** — an RBF bump could retry forever below BIP125's relay-mandated minimum fee delta, with no ceiling on the fee rate either - **B-33** — `POST /auth/login` had no rate limiting, so a password could be brute-forced against an enumerable username list - **B-34** — password change/reset didn't invalidate already-issued JWTs, so a stolen token survived a change meant to lock it out @@ -80,7 +73,7 @@ already does. - **B-41** — confirmation/reconciliation depended on a verbose `blockchain.transaction.get` reply many Electrum servers reject, and abandonment relied on fragile substring-matching of an error message See git history for the fix-by-fix breakdown (commits `f13f685`, `50a43ae`, `933760e`, and the -B-28/B-29/B-30/B-31/B-32/B-33/B-34/B-35/B-36/B-37/B-38/B-39/B-40/B-41/B-42/B-43/B-44 fixes). Suite grew from 139 to 232 tests over the twenty. +B-28/B-29/B-30/B-31/B-32/B-33/B-34/B-35/B-36/B-37/B-38/B-39/B-40/B-41/B-42/B-43/B-44/B-45 fixes). Suite grew from 139 to 245 tests over the twenty-one. A full-codebase audit on 2026-07-26 (commit `d4e0974`) found 24 bugs across every Python module under `app/`, both static frontends, and the Docker/Caddy deployment — 5 critical, diff --git a/CLAUDE.md b/CLAUDE.md index fba738c..563fb95 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -12,7 +12,7 @@ All 10 stages of the original build order are code-complete and unit-tested — Verified on mainnet with real money: registration + address derivation, deposit crediting (1-conf), a real 10 PLM bet (broadcast → confirmed → change credited back), and one full round cycle (close → draw on a real block hash → 70/30 payout with sat math checked against the broadcast tx → confirmation → close → next round auto-opened). **Withdrawal and the RBF bump path have never been exercised against a live broadcast** — unit-tested only. -**Read [BUGS.md](BUGS.md) before trusting any behaviour here.** Two audits: 2026-07-26 found 24 bugs (5 critical), all fixed; 2026-07-27 found 25 more (B-25 … B-49), of which **5 are still open** — no Critical, High or Medium remains, only Low/hygiene: an admin list endpoint with no pagination bound (B-45), unbounded `String` columns for large text (B-47), among others. BUGS.md is the live open list with a proposed fix per finding; "Known gaps" at the end of this file is for limitations accepted **by design** instead. Don't fix a BUGS.md item silently as a side effect of other work — each fix lands with its own regression test. +**Read [BUGS.md](BUGS.md) before trusting any behaviour here.** Two audits: 2026-07-26 found 24 bugs (5 critical), all fixed; 2026-07-27 found 25 more (B-25 … B-49), of which **4 are still open** — no Critical, High or Medium remains, only Low/hygiene: unbounded `String` columns for large text (B-47), no cap on input count in `select_utxos` (B-48), among others. BUGS.md is the live open list with a proposed fix per finding; "Known gaps" at the end of this file is for limitations accepted **by design** instead. Don't fix a BUGS.md item silently as a side effect of other work — each fix lands with its own regression test. Before writing code, read the "Architecture" section below in full plus the diagrams in [flowchart/](flowchart/): [platform-overview.mmd](flowchart/platform-overview.mmd) (the 5-phase flow) and [round-lifecycle.mmd](flowchart/round-lifecycle.mmd) (the round/draw lifecycle). Every node **and edge label** (conditions, retries, loops) is a behaviour that must be implemented as described. Regenerate the companion PDFs with `flowchart/render-pdf.sh .mmd` after editing either. @@ -233,7 +233,7 @@ Explicit design choices, not derivable from any single file — respect them: ## Known gaps / TODO -Accepted **by design**. For actual bugs see [BUGS.md](BUGS.md) (5 open) — not duplicated here. +Accepted **by design**. For actual bugs see [BUGS.md](BUGS.md) (4 open) — not duplicated here. - **`drawing` doesn't resume after a restart.** `_tick()` handles `open`, `closing` and `paying_out` (the last via `_retry_payout_if_due`); nothing re-enters `_wait_for_next_block` after a crash. That wait is unbounded by design (the draw's entropy genuinely depends on a future block) but no longer silent — past `_DRAW_STALL_THRESHOLD_SECONDS` it logs progress and writes a `draw_stalled` audit entry, and `GET /rounds/current`'s `draw_waiting_since` surfaces it live (B-36). Restart-resumption itself remains the last prerequisite for running unattended. - **RBF handles one shape only**: a single change output, back to the tx's own sender, big enough to absorb the increase. No extra-input fallback — an exact-amount tx or too-small change raises `RbfError`. Not permanent, though: an unbumpable tx that never confirms is eventually abandoned and its UTXOs released. diff --git a/app/api/routes/admin.py b/app/api/routes/admin.py index 9dde0b0..49790db 100644 --- a/app/api/routes/admin.py +++ b/app/api/routes/admin.py @@ -1,7 +1,7 @@ import json import secrets -from fastapi import APIRouter, Depends, Header, HTTPException, status +from fastapi import APIRouter, Depends, Header, HTTPException, Query, status from pydantic import BaseModel, Field, field_validator from sqlalchemy import select from sqlalchemy.ext.asyncio import AsyncSession @@ -242,7 +242,9 @@ class AdminRoundResponse(BaseModel): @router.get("/rounds", response_model=list[AdminRoundResponse], dependencies=[Depends(require_admin)]) -async def list_rounds(session: AsyncSession = Depends(get_session), limit: int = 50) -> list[AdminRoundResponse]: +async def list_rounds( + session: AsyncSession = Depends(get_session), limit: int = Query(default=50, ge=1, le=500) +) -> list[AdminRoundResponse]: rounds = (await session.scalars(select(Round).order_by(Round.id.desc()).limit(limit))).all() winner_ids = {r.winner_user_id for r in rounds if r.winner_user_id is not None} winners = {} @@ -282,7 +284,7 @@ class AdminAuditLogResponse(BaseModel): "/audit-log", response_model=list[AdminAuditLogResponse], dependencies=[Depends(require_admin)] ) async def list_audit_log( - session: AsyncSession = Depends(get_session), limit: int = 200 + session: AsyncSession = Depends(get_session), limit: int = Query(default=200, ge=1, le=500) ) -> list[AdminAuditLogResponse]: entries = (await session.scalars(select(AuditLog).order_by(AuditLog.id.desc()).limit(limit))).all() return [ @@ -319,10 +321,13 @@ class AdminPendingTransactionResponse(BaseModel): ) async def list_pending_transactions( session: AsyncSession = Depends(get_session), + limit: int = Query(default=50, ge=1, le=500), + status_filter: str | None = Query(default=None, alias="status"), ) -> list[AdminPendingTransactionResponse]: - entries = ( - await session.scalars(select(PendingTransaction).order_by(PendingTransaction.id.desc())) - ).all() + query = select(PendingTransaction).order_by(PendingTransaction.id.desc()) + if status_filter is not None: + query = query.where(PendingTransaction.status == status_filter) + entries = (await session.scalars(query.limit(limit))).all() return [ AdminPendingTransactionResponse( id=p.id, diff --git a/tests/unit/test_admin.py b/tests/unit/test_admin.py index bdf8b95..24fc08f 100644 --- a/tests/unit/test_admin.py +++ b/tests/unit/test_admin.py @@ -277,3 +277,90 @@ async def test_pause_cannot_be_toggled_through_the_config_endpoint(client): resp = await client.put("/admin/config", headers=headers, json={"paused": True}) assert resp.status_code in (200, 422) # ignored or refused, but never applied assert (await client.get("/admin/config", headers=headers)).json()["paused"] is False + + +@pytest.mark.parametrize("endpoint", ["/admin/rounds", "/admin/audit-log", "/admin/pending-transactions"]) +@pytest.mark.parametrize("bad_limit", [0, -1, 501]) +async def test_admin_list_endpoints_reject_out_of_range_limit(client, endpoint, bad_limit): + """B-45: `limit` had no bounds — `-1` means "everything" on SQLite, so an + unvalidated limit could dump the entire table in one response.""" + headers = {"X-Admin-Token": "test-admin-token"} + resp = await client.get(endpoint, headers=headers, params={"limit": bad_limit}) + assert resp.status_code == 422 + + +async def test_admin_list_rounds_respects_limit(client): + from app.db import base as db_base + from app.db.models import Round + + async with db_base.AsyncSessionLocal() as session: + session.add_all([Round(status="closed") for _ in range(3)]) + await session.commit() + + headers = {"X-Admin-Token": "test-admin-token"} + resp = await client.get("/admin/rounds", headers=headers, params={"limit": 2}) + assert resp.status_code == 200 + assert len(resp.json()) == 2 + + +async def test_admin_audit_log_respects_limit(client): + from app.db import base as db_base + from app.audit.log import write_audit_log + + async with db_base.AsyncSessionLocal() as session: + for _ in range(3): + await write_audit_log(session, "test_event", {}) + await session.commit() + + headers = {"X-Admin-Token": "test-admin-token"} + resp = await client.get("/admin/audit-log", headers=headers, params={"limit": 2}) + assert resp.status_code == 200 + assert len(resp.json()) == 2 + + +async def _make_pending_transaction(session, *, kind="bet", status="pending"): + from app.db.models import PendingTransaction + import secrets as _secrets + + tx = PendingTransaction( + kind=kind, + current_txid=_secrets.token_hex(32), + fee_rate_sat_vb=1, + raw_tx_hex="00", + status=status, + ) + session.add(tx) + return tx + + +async def test_admin_pending_transactions_respects_limit(client): + from app.db import base as db_base + + async with db_base.AsyncSessionLocal() as session: + for _ in range(3): + await _make_pending_transaction(session) + await session.commit() + + headers = {"X-Admin-Token": "test-admin-token"} + resp = await client.get("/admin/pending-transactions", headers=headers, params={"limit": 2}) + assert resp.status_code == 200 + assert len(resp.json()) == 2 + + +async def test_admin_pending_transactions_status_filter(client): + from app.db import base as db_base + + async with db_base.AsyncSessionLocal() as session: + await _make_pending_transaction(session, status="pending") + await _make_pending_transaction(session, status="confirmed") + await _make_pending_transaction(session, status="failed") + await session.commit() + + headers = {"X-Admin-Token": "test-admin-token"} + resp = await client.get( + "/admin/pending-transactions", headers=headers, params={"status": "confirmed"} + ) + assert resp.status_code == 200 + entries = resp.json() + assert len(entries) == 1 + assert entries[0]["status"] == "confirmed"