Repository navigation
ledger: improve browser compatibility - #281
Merged
Merged
Conversation
rvolosatovs
force-pushed
the
roman/ledger/server-fixes
branch
from
October 22, 2026 14:55
85ced7c to
5f975c1
Compare
rvolosatovs
marked this pull request as draft
October 22, 2026 14:56
rvolosatovs
force-pushed
the
roman/ledger/server-fixes
branch
3 times, most recently
from
October 22, 2026 16:21
7c275c2 to
bbab6d6
Compare
The ledger stores a posted transaction as signed, so the digests in it are kept exactly as submitted. Input transaction digests were accepted in any multibase base and output contract digests were not checked at all, so a transaction naming a contract as `BCIQ...` was accepted and then served back in a form clients that only accept the canonical base32-lower encoding reject. Reject input transaction and output contract digests that are not in the canonical form produced by `encode_digest`, with a distinct error for each. Lookups still accept any base. Genesis outputs are served the same way, so `Ledger::new` now panics on a genesis output contract digest that is malformed or not canonical. The client named outputs of imported UTXO contracts by the import's `external-id` verbatim, so a contract importing another as `BCIQ...` would produce transactions the ledger now rejects. Name them by the canonical encoding of the resolved digest instead. Assisted-by: anthropic:claude-opus-5-5 Signed-off-by: Roman Volosatovs <rvolosatovs@riseup.net>
Browsers send a CORS preflight before a `POST /rpc` with `content-type: application/x.wrpc`, and the ledger answered it with `405 Method Not Allowed` and no `Access-Control-*` headers, so a page on another origin (such as the website sandbox) could not query the ledger at all. Answer `OPTIONS` on each known path with `Allow` and `Access-Control-Allow-Methods` listing the methods it accepts (now including `OPTIONS`, also in `405` responses), `*` allowed headers and a one-day `Access-Control-Max-Age`, and add `Access-Control-Allow-Origin: *` and `Access-Control-Expose-Headers: *` to every response. Unknown paths still get `404 Not Found`. Any origin is allowed: requests carry no credentials, and writes are authorized by their signed envelopes. The headers are constant per path, so they are set in-tree rather than via tower-http's `CorsLayer`, which answers every `OPTIONS` request as a preflight and is cloned with its configuration for each request when served through hyper-util's `TowerToHyperService`. Assisted-by: anthropic:claude-opus-5-5 Signed-off-by: Roman Volosatovs <rvolosatovs@riseup.net>
rvolosatovs
force-pushed
the
roman/ledger/server-fixes
branch
from
October 22, 2026 16:27
bbab6d6 to
0151e0b
Compare
rvolosatovs
marked this pull request as ready for review
October 22, 2026 16:28
SpaceManiac
approved these changes
Oct 22, 2026
|
|
||
| ## HTTP API | ||
|
|
||
| CORS is permissive: any origin and request header other than |
Contributor
There was a problem hiding this comment.
I suppose a real ledger might not want this? But it makes sense for the mock ledger.
Contributor
Author
There was a problem hiding this comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.