…teLabs#467/StellarGateLabs#469/StellarGateLabs#471 Adds a merchant-keyed rate limiter on POST /payments/:id/webhooks/:delivery_id/redeliver, in addition to the existing IP-keyed "redeliver" bucket. The IP bucket alone doesn't bound a single authenticated merchant issuing requests from many source addresses, which could otherwise drive an unbounded redelivery storm against their own webhook endpoint (or, via our outbound client, against a downstream receiver). The new limiter runs after auth_middleware, inside its own sub-router, so it applies only to the redelivery route and is keyed on AuthenticatedMerchant rather than address. Also fixes a pre-existing `QuantaClock::now()` compile error (missing `governor::clock::Clock` import) hit by both the existing IP limiter and the new one. Audit findings for the other three issues in this batch: - StellarGateLabs#467 (list_webhooks cross-merchant check): already correctly scoped — `list_webhooks` filters on `payment.merchant_id == merchant_id` the same way `get_by_id` does. No code change needed. - StellarGateLabs#471 (lib.rs:104 unwrap on lock): already fixed by a prior merge (PR StellarGateLabs#600) — every TaskHealth lock now uses `.unwrap_or_else(|e| e.into_inner())`. No unwrap() remains in lib.rs. - StellarGateLabs#469 (redeliver_webhooks_bulk batch cap): NOT fixed. That handler, its route, and its DB support no longer exist in this codebase — they were dropped by an unrelated earlier merge (9263a8e, "fix(horizon): honour shutdown, resume stream cursor..."), which reverted large parts of src/api/mod.rs, src/api/payments.rs, src/db.rs, src/lib.rs, and src/metrics.rs well beyond that commit's stated scope. openapi.yaml still documents `POST /v1/payments/webhooks/redeliver` and `GET /v1/payments/webhooks` as live, which no longer matches the router. Recreating the endpoint (previously implemented with a MAX_BULK_DELIVERY_IDS = 100 cap, matching what StellarGateLabs#469 asks for) is a meaningful feature restoration, not a hardening tweak, and is left as follow-up rather than folded into this change. Note: main (both this fork and upstream StellarGateLabs/StellarGate) does not currently compile — ~34 unrelated errors from the same 9263a8e regression (mismatched TaskHealth/metrics APIs, missing AppState/ WebhookDelivery fields, missing horizon.rs functions, etc.). None of those errors are in code this change touches or introduces; cargo build was used before/after to confirm this change doesn't add to the error count. Fixing that regression is out of scope here per direction from the requester. Closes StellarGateLabs#467 Closes StellarGateLabs#468 Closes StellarGateLabs#471 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

API hardening review: GET /payments/:id/webhooks (list_webhooks) #467

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions