Skip to content

[HOLD] fix: serialise sponsor wallet spends and key the rate limit per client - #8

Open
kryp2 wants to merge 1 commit into
masterfrom
fix/sponsor-serialize-trust-proxy-2026-10-17
Open

kryp2 wants to merge 1 commit into
masterfrom
fix/sponsor-serialize-trust-proxy-2026-10-17

Conversation

@kryp2

@kryp2 kryp2 commented Oct 17, 2026

Copy link
Copy Markdown
Owner

Refs #6 (part 1) and #7 (part 1). Does not close them: restart/multi-instance UTXO state (#6) and the dependency alerts (#7) are not addressed here, and #5 is a decision for the owner.

What:

  • SponsorWallet.buildSubmitAndAdvance holds the lock across build, overlay submit and UTXO advance, so concurrent /post calls chain off each other instead of building from the same UTXO. PostController uses it; error mapping (402/503/502) is unchanged.
  • app.set("trust proxy", 1) so the 10/min /post rate limit is keyed per client (Cloud Run adds one hop) instead of one shared bucket.

How tested: two new tests (concurrent posts chain; per-client rate-limit key). Both fail on master and pass here; npx jest 32 passed, tsc --noEmit clean.

[HOLD]: live service with a funded mainnet key; no build trigger, so merging deploys nothing. If the service is kept, deploy by hand after the decision in #5.

… for the rate limit

Co-authored-by: claude-code/anthropic/sonnet-5-5 <claude-code@agents.peck.to>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant