fix: Scheduled Transaction Routes Have No Authentication or Ownership Checks - #917
Merged
Topmatrixmor2014 merged 2 commits intoAug 27, 2026
Merged
Conversation
🤖 Greptile AI Code ReviewGreptile will automatically review this PR (4 file(s) changed). Review gates:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
|
please fix these ci issues and resolve all the issues identified from the review comments |
Contributor
Author
@Topmatrixmor2014 fixed |
| * If publicKey is provided, it must match the authenticated user's publicKey. | ||
| */ | ||
| router.post("/", validate(scheduleTransactionSchema), async (req, res, next) => { | ||
| router.post("/", sensitiveLimiter, userLimiter, verifyJWT, validate(scheduleTransactionSchema), async (req, res, next) => { |
| * non-empty string). Service treats it as opaque. | ||
| */ | ||
| router.post("/pending/:id/submit", validate(idParamSchema, "params"), async (req, res, next) => { | ||
| router.post("/pending/:id/submit", sensitiveLimiter, userLimiter, verifyJWT, validate(idParamSchema, "params"), async (req, res, next) => { |
| * Lists pending executions for a given public key with standardized pagination. | ||
| */ | ||
| router.get("/:publicKey/pending", async (req, res, next) => { | ||
| router.get("/:publicKey/pending", sensitiveLimiter, userLimiter, verifyJWT, requireOwnSchedule, async (req, res, next) => { |
| * Lists all schedules for a given public key with standardized pagination. | ||
| */ | ||
| router.get("/:publicKey", validate(loosePublicKeyParamSchema, "params"), async (req, res, next) => { | ||
| router.get("/:publicKey", sensitiveLimiter, userLimiter, verifyJWT, requireOwnSchedule, validate(loosePublicKeyParamSchema, "params"), async (req, res, next) => { |
| * non-empty string), so the service can treat it as opaque. | ||
| */ | ||
| router.put("/:id", validate(idParamSchema, "params"), async (req, res, next) => { | ||
| router.put("/:id", sensitiveLimiter, userLimiter, verifyJWT, requireScheduleOwner, validate(idParamSchema, "params"), async (req, res, next) => { |
| * Deletes or cancels a scheduled transaction by ID. | ||
| */ | ||
| router.delete("/:id", validate(idParamSchema, "params"), async (req, res, next) => { | ||
| router.delete("/:id", sensitiveLimiter, userLimiter, verifyJWT, requireScheduleOwner, validate(idParamSchema, "params"), async (req, res, next) => { |
| * regardless of its scheduled time. | ||
| */ | ||
| router.post("/:id/execute-now", validate(idParamSchema, "params"), async (req, res, next) => { | ||
| router.post("/:id/execute-now", sensitiveLimiter, userLimiter, verifyJWT, requireScheduleOwner, validate(idParamSchema, "params"), async (req, res, next) => { |
| * Shows all execution attempts, retries, and failures. | ||
| */ | ||
| router.get("/:id/executions", validate(idParamSchema, "params"), async (req, res, next) => { | ||
| router.get("/:id/executions", sensitiveLimiter, userLimiter, verifyJWT, requireScheduleOwner, validate(idParamSchema, "params"), async (req, res, next) => { |
…p checks - Add verifyJWT middleware to all scheduled-transaction routes - Add requireOwnSchedule middleware for :publicKey routes (GET /:publicKey, GET /:publicKey/pending) - Add requireScheduleOwner middleware for :id routes (PUT, DELETE, POST /execute-now, GET /executions) - Add ownership check for POST /pending/:id/submit - Use req.user.publicKey as owner for createSchedule (ignore/reject body publicKey) - Add getScheduleById and getPendingExecutionById service helpers - Add 28 tests: 8x 401 unauthenticated, 7x 403 cross-user, 8x 200 owner, 5x 404 not found Closes: backend auth security bug high-priority
- Add sensitiveLimiter and userLimiter to all scheduled-transaction routes - Mock rate limiters in tests to avoid hitting limits during test runs - Follows the same pattern as accounts.js routes (sensitiveLimiter + userLimiter + verifyJWT)
Skinny001
force-pushed
the
fix/scheduled-tx-auth
branch
from
August 26, 2026 07:47
ef738b7 to
e575442
Compare
Contributor
Author
@Topmatrixmor2014 The CodeQL warnings were from analyzing the old main branch code - the PR will pass once updated with this branch. so, check now |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request significantly refactors and expands the tests for scheduled transaction routes, and updates the route handlers to enforce strict authentication and authorization. The changes ensure that only the authenticated user can access or modify their own scheduled transactions and pending executions. Additionally, the tests now cover both authorization failures and successful "happy path" operations, as well as error handling for missing resources.
The most important changes are:
Authorization & Authentication Enforcement:
verifyJWTmiddleware to all scheduled transaction routes to require authentication, and introducedrequireOwnScheduleandrequireScheduleOwnermiddleware to restrict access to only the authenticated user's data. [1] [2] [3]/api/scheduled-transactionsroute to derive the owner from the JWT and ensure any providedpublicKeymatches the authenticated user.Test Suite Overhaul:
Route Handler Improvements:
These changes greatly improve the security and correctness of the scheduled transactions API, ensuring robust access control and comprehensive test coverage.…p checks
Summary
Type of change
Related issue
Closes #886
Changes
Testing
Screenshots (if UI change)
Checklist
main