Compare commits

..

1 Commits

Author SHA1 Message Date
defiQUG
74b175c2ce Fix address detail loading states 2026-04-16 14:11:18 -07:00
8 changed files with 119 additions and 196 deletions

View File

@@ -1,6 +1,7 @@
package middleware
import (
"context"
"fmt"
"net/http"
"strings"
@@ -30,7 +31,11 @@ func (m *AuthMiddleware) RequireAuth(next http.Handler) http.Handler {
return
}
ctx := ContextWithAuth(r.Context(), address, track, true)
// Add user context
ctx := context.WithValue(r.Context(), "user_address", address)
ctx = context.WithValue(ctx, "user_track", track)
ctx = context.WithValue(ctx, "authenticated", true)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
@@ -39,7 +44,11 @@ func (m *AuthMiddleware) RequireAuth(next http.Handler) http.Handler {
func (m *AuthMiddleware) RequireTrack(requiredTrack int) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
track := UserTrack(r.Context())
// Extract track from context (set by RequireAuth or OptionalAuth)
track, ok := r.Context().Value("user_track").(int)
if !ok {
track = 1 // Default to Track 1 (public)
}
if !featureflags.HasAccess(track, requiredTrack) {
writeForbidden(w, requiredTrack)
@@ -56,33 +65,40 @@ func (m *AuthMiddleware) OptionalAuth(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
address, track, err := m.extractAuth(r)
if err != nil {
// No auth provided (or auth failed) — fall back to Track 1.
ctx := ContextWithAuth(r.Context(), "", defaultTrackLevel, false)
// No auth provided, default to Track 1 (public)
ctx := context.WithValue(r.Context(), "user_address", "")
ctx = context.WithValue(ctx, "user_track", 1)
ctx = context.WithValue(ctx, "authenticated", false)
next.ServeHTTP(w, r.WithContext(ctx))
return
}
ctx := ContextWithAuth(r.Context(), address, track, true)
// Auth provided, add user context
ctx := context.WithValue(r.Context(), "user_address", address)
ctx = context.WithValue(ctx, "user_track", track)
ctx = context.WithValue(ctx, "authenticated", true)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
// extractAuth extracts authentication information from the request.
// Returns ErrMissingAuthorization when no usable Bearer token is present;
// otherwise returns the error from JWT validation.
// extractAuth extracts authentication information from request
func (m *AuthMiddleware) extractAuth(r *http.Request) (string, int, error) {
// Get Authorization header
authHeader := r.Header.Get("Authorization")
if authHeader == "" {
return "", 0, ErrMissingAuthorization
return "", 0, http.ErrMissingFile
}
// Check for Bearer token
parts := strings.Split(authHeader, " ")
if len(parts) != 2 || parts[0] != "Bearer" {
return "", 0, ErrMissingAuthorization
return "", 0, http.ErrMissingFile
}
token := parts[1]
// Validate JWT token
address, track, err := m.walletAuth.ValidateJWT(token)
if err != nil {
return "", 0, err

View File

@@ -1,60 +0,0 @@
package middleware
import (
"context"
"errors"
)
// ctxKey is an unexported type for request-scoped authentication values.
// Using a distinct type (rather than a bare string) keeps our keys out of
// collision range for any other package that also calls context.WithValue,
// and silences go vet's SA1029.
type ctxKey string
const (
ctxKeyUserAddress ctxKey = "user_address"
ctxKeyUserTrack ctxKey = "user_track"
ctxKeyAuthenticated ctxKey = "authenticated"
)
// Default track level applied to unauthenticated requests (Track 1 = public).
const defaultTrackLevel = 1
// ErrMissingAuthorization is returned by extractAuth when no usable
// Authorization header is present on the request. Callers should treat this
// as "no auth supplied" rather than a hard failure for optional-auth routes.
var ErrMissingAuthorization = errors.New("middleware: authorization header missing or malformed")
// ContextWithAuth returns a child context carrying the supplied
// authentication state. It is the single place in the package that writes
// the auth context keys.
func ContextWithAuth(parent context.Context, address string, track int, authenticated bool) context.Context {
ctx := context.WithValue(parent, ctxKeyUserAddress, address)
ctx = context.WithValue(ctx, ctxKeyUserTrack, track)
ctx = context.WithValue(ctx, ctxKeyAuthenticated, authenticated)
return ctx
}
// UserAddress returns the authenticated wallet address stored on ctx, or
// "" if the context is not authenticated.
func UserAddress(ctx context.Context) string {
addr, _ := ctx.Value(ctxKeyUserAddress).(string)
return addr
}
// UserTrack returns the access tier recorded on ctx. If no track was set
// (e.g. the request bypassed all auth middleware) the caller receives
// Track 1 (public) so route-level checks can still make a decision.
func UserTrack(ctx context.Context) int {
if track, ok := ctx.Value(ctxKeyUserTrack).(int); ok {
return track
}
return defaultTrackLevel
}
// IsAuthenticated reports whether the current request carried a valid auth
// token that was successfully parsed by the middleware.
func IsAuthenticated(ctx context.Context) bool {
ok, _ := ctx.Value(ctxKeyAuthenticated).(bool)
return ok
}

View File

@@ -1,62 +0,0 @@
package middleware
import (
"context"
"errors"
"testing"
)
func TestContextWithAuthRoundTrip(t *testing.T) {
ctx := ContextWithAuth(context.Background(), "0xabc", 4, true)
if got := UserAddress(ctx); got != "0xabc" {
t.Fatalf("UserAddress() = %q, want %q", got, "0xabc")
}
if got := UserTrack(ctx); got != 4 {
t.Fatalf("UserTrack() = %d, want 4", got)
}
if !IsAuthenticated(ctx) {
t.Fatal("IsAuthenticated() = false, want true")
}
}
func TestUserTrackDefaultsToTrack1OnBareContext(t *testing.T) {
if got := UserTrack(context.Background()); got != defaultTrackLevel {
t.Fatalf("UserTrack(empty) = %d, want %d", got, defaultTrackLevel)
}
}
func TestUserAddressEmptyOnBareContext(t *testing.T) {
if got := UserAddress(context.Background()); got != "" {
t.Fatalf("UserAddress(empty) = %q, want empty", got)
}
}
func TestIsAuthenticatedFalseOnBareContext(t *testing.T) {
if IsAuthenticated(context.Background()) {
t.Fatal("IsAuthenticated(empty) = true, want false")
}
}
// TestContextKeyIsolation proves that the typed ctxKey values cannot be
// shadowed by a caller using bare-string keys with the same spelling.
// This is the specific class of bug fixed by this PR.
func TestContextKeyIsolation(t *testing.T) {
ctx := context.WithValue(context.Background(), "user_address", "injected")
if got := UserAddress(ctx); got != "" {
t.Fatalf("expected empty address (bare string key must not collide), got %q", got)
}
}
func TestErrMissingAuthorizationIsSentinel(t *testing.T) {
if ErrMissingAuthorization == nil {
t.Fatal("ErrMissingAuthorization must not be nil")
}
wrapped := errors.New("wrapped: " + ErrMissingAuthorization.Error())
if errors.Is(wrapped, ErrMissingAuthorization) {
t.Fatal("string-wrapped error must not satisfy errors.Is (smoke check)")
}
if !errors.Is(ErrMissingAuthorization, ErrMissingAuthorization) {
t.Fatal("ErrMissingAuthorization must satisfy errors.Is against itself")
}
}

View File

@@ -4,7 +4,6 @@ import (
"encoding/json"
"net/http"
"github.com/explorer/backend/api/middleware"
"github.com/explorer/backend/featureflags"
)
@@ -17,8 +16,11 @@ func (s *Server) handleFeatures(w http.ResponseWriter, r *http.Request) {
}
// Extract user track from context (set by auth middleware)
// Default to Track 1 (public) if not authenticated (handled by helper).
userTrack := middleware.UserTrack(r.Context())
// Default to Track 1 (public) if not authenticated
userTrack := 1
if track, ok := r.Context().Value("user_track").(int); ok {
userTrack = track
}
// Get enabled features for this track
enabledFeatures := featureflags.GetEnabledFeatures(userTrack)

View File

@@ -12,7 +12,6 @@ import (
"strings"
"time"
"github.com/explorer/backend/api/middleware"
"github.com/explorer/backend/auth"
"github.com/jackc/pgx/v5/pgxpool"
)
@@ -186,7 +185,7 @@ func (s *Server) requireOperatorAccess(w http.ResponseWriter, r *http.Request) (
return "", "", false
}
operatorAddr := middleware.UserAddress(r.Context())
operatorAddr, _ := r.Context().Value("user_address").(string)
operatorAddr = strings.TrimSpace(operatorAddr)
if operatorAddr == "" {
writeError(w, http.StatusUnauthorized, "unauthorized", "Operator address required")

View File

@@ -13,8 +13,6 @@ import (
"path/filepath"
"strings"
"time"
"github.com/explorer/backend/api/middleware"
)
type runScriptRequest struct {
@@ -69,7 +67,7 @@ func (s *Server) HandleRunScript(w http.ResponseWriter, r *http.Request) {
return
}
operatorAddr := middleware.UserAddress(r.Context())
operatorAddr, _ := r.Context().Value("user_address").(string)
if operatorAddr == "" {
writeError(w, http.StatusUnauthorized, "unauthorized", "Operator address required")
return

View File

@@ -11,7 +11,6 @@ import (
"net/http"
"net/http/httptest"
"github.com/explorer/backend/api/middleware"
"github.com/stretchr/testify/require"
)
@@ -46,7 +45,7 @@ func TestHandleRunScriptUsesForwardedClientIPAndRunsAllowlistedScript(t *testing
reqBody := []byte(`{"script":"echo.sh","args":["world"]}`)
req := httptest.NewRequest(http.MethodPost, "/api/v1/track4/operator/run-script", bytes.NewReader(reqBody))
req = req.WithContext(middleware.ContextWithAuth(req.Context(), "0x4A666F96fC8764181194447A7dFdb7d471b301C8", 4, true))
req = req.WithContext(context.WithValue(req.Context(), "user_address", "0x4A666F96fC8764181194447A7dFdb7d471b301C8"))
req.RemoteAddr = "10.0.0.10:8080"
req.Header.Set("X-Forwarded-For", "203.0.113.9, 10.0.0.10")
w := httptest.NewRecorder()
@@ -78,7 +77,7 @@ func TestHandleRunScriptRejectsNonAllowlistedScript(t *testing.T) {
s := &Server{roleMgr: &stubRoleManager{allowed: true}, chainID: 138}
req := httptest.NewRequest(http.MethodPost, "/api/v1/track4/operator/run-script", bytes.NewReader([]byte(`{"script":"blocked.sh"}`)))
req = req.WithContext(middleware.ContextWithAuth(req.Context(), "0x4A666F96fC8764181194447A7dFdb7d471b301C8", 4, true))
req = req.WithContext(context.WithValue(req.Context(), "user_address", "0x4A666F96fC8764181194447A7dFdb7d471b301C8"))
req.RemoteAddr = "127.0.0.1:9999"
w := httptest.NewRecorder()
@@ -101,7 +100,7 @@ func TestHandleRunScriptRejectsFilenameCollisionOutsideAllowlistedPath(t *testin
s := &Server{roleMgr: &stubRoleManager{allowed: true}, chainID: 138}
req := httptest.NewRequest(http.MethodPost, "/api/v1/track4/operator/run-script", bytes.NewReader([]byte(`{"script":"unsafe/backup.sh"}`)))
req = req.WithContext(middleware.ContextWithAuth(req.Context(), "0x4A666F96fC8764181194447A7dFdb7d471b301C8", 4, true))
req = req.WithContext(context.WithValue(req.Context(), "user_address", "0x4A666F96fC8764181194447A7dFdb7d471b301C8"))
req.RemoteAddr = "127.0.0.1:9999"
w := httptest.NewRecorder()
@@ -123,7 +122,7 @@ func TestHandleRunScriptTruncatesLargeOutput(t *testing.T) {
s := &Server{roleMgr: &stubRoleManager{allowed: true}, chainID: 138}
req := httptest.NewRequest(http.MethodPost, "/api/v1/track4/operator/run-script", bytes.NewReader([]byte(`{"script":"large.sh"}`)))
req = req.WithContext(middleware.ContextWithAuth(req.Context(), "0x4A666F96fC8764181194447A7dFdb7d471b301C8", 4, true))
req = req.WithContext(context.WithValue(req.Context(), "user_address", "0x4A666F96fC8764181194447A7dFdb7d471b301C8"))
req.RemoteAddr = "127.0.0.1:9999"
w := httptest.NewRecorder()

View File

@@ -51,14 +51,17 @@ export default function AddressDetailPage() {
const [watchlistEntries, setWatchlistEntries] = useState<string[]>([])
const [methodResults, setMethodResults] = useState<Record<string, { loading: boolean; value?: string; error?: string }>>({})
const [methodInputs, setMethodInputs] = useState<Record<string, string[]>>({})
const [loading, setLoading] = useState(true)
const [addressInfoLoading, setAddressInfoLoading] = useState(true)
const [activityLoading, setActivityLoading] = useState(true)
const loadAddressInfo = useCallback(async () => {
setAddressInfoLoading(true)
try {
const { ok, data } = await addressesApi.getSafe(chainId, address)
if (!ok) {
setAddressInfo(null)
setContractProfile(null)
setGruProfile(null)
return
}
setAddressInfo(data ?? null)
@@ -82,10 +85,13 @@ export default function AddressDetailPage() {
setAddressInfo(null)
setContractProfile(null)
setGruProfile(null)
} finally {
setAddressInfoLoading(false)
}
}, [chainId, address])
const loadTransactions = useCallback(async () => {
setActivityLoading(true)
try {
const [transactionsResult, balancesResult, transfersResult] = await Promise.all([
addressesApi.getTransactionsSafe(chainId, address, 1, 20),
@@ -102,27 +108,37 @@ export default function AddressDetailPage() {
setTokenBalances([])
setTokenTransfers([])
} finally {
setLoading(false)
setActivityLoading(false)
}
}, [chainId, address])
useEffect(() => {
if (!router.isReady || !address) {
setLoading(router.isReady ? false : true)
setAddressInfoLoading(!router.isReady)
setActivityLoading(!router.isReady)
if (router.isReady && !address) {
setAddressInfo(null)
setTransactions([])
setTokenBalances([])
setTokenTransfers([])
}
return
}
if (!isValidAddressParam) {
setLoading(false)
setAddressInfoLoading(false)
setActivityLoading(false)
setAddressInfo(null)
setTransactions([])
setTokenBalances([])
setTokenTransfers([])
return
}
loadAddressInfo()
loadTransactions()
setAddressInfo(null)
setTransactions([])
setTokenBalances([])
setTokenTransfers([])
void loadAddressInfo()
void loadTransactions()
}, [address, isValidAddressParam, loadAddressInfo, loadTransactions, router.isReady])
useEffect(() => {
@@ -403,6 +419,8 @@ export default function AddressDetailPage() {
const gruTransferCount = tokenTransfers.filter((transfer) =>
Boolean(getGruExplorerMetadata({ address: transfer.token_address, symbol: transfer.token_symbol })),
).length
const showPrimaryLoadingState = !router.isReady || (addressInfoLoading && !addressInfo)
const resolvedAddressInfo = addressInfo as AddressInfo
return (
<div className="container mx-auto px-4 py-6 sm:py-8">
@@ -426,7 +444,7 @@ export default function AddressDetailPage() {
Search this address
</Link>
)}
{watchlistAddress && router.isReady && !loading && (
{watchlistAddress && router.isReady && !addressInfoLoading && (
<button
type="button"
onClick={handleWatchlistToggle}
@@ -437,7 +455,7 @@ export default function AddressDetailPage() {
)}
</div>
{!router.isReady || loading ? (
{showPrimaryLoadingState ? (
<Card className="mb-6">
<p className="text-sm text-gray-600 dark:text-gray-400">Loading address...</p>
</Card>
@@ -453,7 +471,7 @@ export default function AddressDetailPage() {
</Link>
</div>
</Card>
) : !addressInfo ? (
) : !addressInfoLoading && !addressInfo ? (
<Card className="mb-6">
<p className="text-sm text-gray-600 dark:text-gray-400">Address not found.</p>
<div className="mt-4 flex flex-wrap gap-3 text-sm">
@@ -470,68 +488,69 @@ export default function AddressDetailPage() {
<Card title="Address Information" className="mb-6">
<dl className="space-y-4">
<DetailRow label="Address">
<Address address={addressInfo.address} />
<Address address={resolvedAddressInfo.address} />
</DetailRow>
{addressInfo.balance && (
<DetailRow label="Coin Balance">{formatWeiAsEth(addressInfo.balance)}</DetailRow>
{resolvedAddressInfo.balance && (
<DetailRow label="Coin Balance">{formatWeiAsEth(resolvedAddressInfo.balance)}</DetailRow>
)}
<DetailRow label="Watchlist">
{isSavedToWatchlist ? 'Saved for quick access' : 'Not saved yet'}
</DetailRow>
<DetailRow label="Verification">
<div className="flex flex-wrap gap-2">
<EntityBadge label={addressInfo.is_contract ? (addressInfo.is_verified ? 'verified' : 'contract') : 'eoa'} />
<EntityBadge label={resolvedAddressInfo.is_contract ? (resolvedAddressInfo.is_verified ? 'verified' : 'contract') : 'eoa'} />
{contractProfile?.source_verified ? <EntityBadge label="source available" tone="success" /> : null}
{contractProfile?.abi_available ? <EntityBadge label="abi available" tone="info" /> : null}
{addressInfo.token_contract ? <EntityBadge label={addressInfo.token_contract.type || 'token'} tone="info" /> : null}
{resolvedAddressInfo.token_contract ? <EntityBadge label={resolvedAddressInfo.token_contract.type || 'token'} tone="info" /> : null}
</div>
</DetailRow>
{addressInfo.token_contract && (
{resolvedAddressInfo.token_contract && (
<DetailRow label="Token Contract">
<div className="space-y-2">
<div>
{addressInfo.token_contract.symbol || addressInfo.token_contract.name || 'Token contract'} · {addressInfo.token_contract.type || 'Token'}
{resolvedAddressInfo.token_contract.symbol || resolvedAddressInfo.token_contract.name || 'Token contract'} · {resolvedAddressInfo.token_contract.type || 'Token'}
</div>
<Link href={`/tokens/${addressInfo.token_contract.address}`} className="text-primary-600 hover:underline">
<Link href={`/tokens/${resolvedAddressInfo.token_contract.address}`} className="text-primary-600 hover:underline">
Open token detail
</Link>
</div>
</DetailRow>
)}
{addressInfo.tags.length > 0 && (
{resolvedAddressInfo.tags.length > 0 && (
<DetailRow label="Tags" valueClassName="flex flex-wrap gap-2">
{addressInfo.tags.map((tag, i) => (
{resolvedAddressInfo.tags.map((tag, i) => (
<EntityBadge key={i} label={tag} className="px-2 py-1 text-[11px]" />
))}
</DetailRow>
)}
<DetailRow label="Transactions">{addressInfo.transaction_count}</DetailRow>
<DetailRow label="Tokens">{addressInfo.token_count}</DetailRow>
<DetailRow label="Type">{addressInfo.is_contract ? 'Contract' : 'EOA'}</DetailRow>
<DetailRow label="Transactions">{resolvedAddressInfo.transaction_count}</DetailRow>
<DetailRow label="Tokens">{resolvedAddressInfo.token_count}</DetailRow>
<DetailRow label="Type">{resolvedAddressInfo.is_contract ? 'Contract' : 'EOA'}</DetailRow>
<DetailRow label="Recent Activity">
{incomingTransactions} incoming / {outgoingTransactions} outgoing txs
{activityLoading ? 'Loading recent activity...' : `${incomingTransactions} incoming / ${outgoingTransactions} outgoing txs`}
</DetailRow>
{addressInfo.internal_transaction_count != null && (
<DetailRow label="Internal Calls">{addressInfo.internal_transaction_count}</DetailRow>
{resolvedAddressInfo.internal_transaction_count != null && (
<DetailRow label="Internal Calls">{resolvedAddressInfo.internal_transaction_count}</DetailRow>
)}
{addressInfo.logs_count != null && (
<DetailRow label="Indexed Logs">{addressInfo.logs_count}</DetailRow>
{resolvedAddressInfo.logs_count != null && (
<DetailRow label="Indexed Logs">{resolvedAddressInfo.logs_count}</DetailRow>
)}
<DetailRow label="Token Flow">
{incomingTokenTransfers} incoming / {outgoingTokenTransfers} outgoing token transfers
{addressInfo.token_transfer_count != null ? ` · ${addressInfo.token_transfer_count} total indexed` : ''}
{activityLoading
? 'Loading token transfer activity...'
: `${incomingTokenTransfers} incoming / ${outgoingTokenTransfers} outgoing token transfers${resolvedAddressInfo.token_transfer_count != null ? ` · ${resolvedAddressInfo.token_transfer_count} total indexed` : ''}`}
</DetailRow>
{addressInfo.creation_transaction_hash && (
{resolvedAddressInfo.creation_transaction_hash && (
<DetailRow label="Created In">
<Link href={`/transactions/${addressInfo.creation_transaction_hash}`} className="text-primary-600 hover:underline">
<Address address={addressInfo.creation_transaction_hash} truncate showCopy={false} />
<Link href={`/transactions/${resolvedAddressInfo.creation_transaction_hash}`} className="text-primary-600 hover:underline">
<Address address={resolvedAddressInfo.creation_transaction_hash} truncate showCopy={false} />
</Link>
</DetailRow>
)}
</dl>
</Card>
{addressInfo.is_contract && (
{resolvedAddressInfo.is_contract && (
<Card title="Contract Profile" className="mb-6">
<dl className="space-y-4">
<DetailRow label="Interaction Surface">
@@ -771,12 +790,16 @@ export default function AddressDetailPage() {
</Link>
</div>
) : null}
<Table
columns={tokenBalanceColumns}
data={tokenBalances}
emptyMessage="No token balances were indexed for this address."
keyExtractor={(balance) => balance.token_address || `${balance.token_symbol}-${balance.value}`}
/>
{activityLoading ? (
<p className="text-sm text-gray-600 dark:text-gray-400">Loading token balances...</p>
) : (
<Table
columns={tokenBalanceColumns}
data={tokenBalances}
emptyMessage="No token balances were indexed for this address."
keyExtractor={(balance) => balance.token_address || `${balance.token_symbol}-${balance.value}`}
/>
)}
</Card>
<Card title="Recent Token Transfers" className="mb-6">
@@ -791,21 +814,29 @@ export default function AddressDetailPage() {
</Link>
</div>
) : null}
<Table
columns={tokenTransferColumns}
data={tokenTransfers}
emptyMessage="No token transfers were found for this address."
keyExtractor={(transfer) => `${transfer.transaction_hash}-${transfer.token_address}-${transfer.value}`}
/>
{activityLoading ? (
<p className="text-sm text-gray-600 dark:text-gray-400">Loading token transfers...</p>
) : (
<Table
columns={tokenTransferColumns}
data={tokenTransfers}
emptyMessage="No token transfers were found for this address."
keyExtractor={(transfer) => `${transfer.transaction_hash}-${transfer.token_address}-${transfer.value}`}
/>
)}
</Card>
<Card title="Transactions">
<Table
columns={transactionColumns}
data={transactions}
emptyMessage="No recent transactions were found for this address."
keyExtractor={(tx) => tx.hash}
/>
{activityLoading ? (
<p className="text-sm text-gray-600 dark:text-gray-400">Loading recent transactions...</p>
) : (
<Table
columns={transactionColumns}
data={transactions}
emptyMessage="No recent transactions were found for this address."
keyExtractor={(tx) => tx.hash}
/>
)}
</Card>
</>
)}