Skip to content

[SECURITY] Low: /wallet/history docs and tests conflict with the unified live contract #7513

@FakerHideInBush

Description

@FakerHideInBush

Summary

The merged unified GET /wallet/history implementation returns the response envelope introduced by #997, but the checked-in endpoint tests and API documentation still require the older flat-array transaction contract. This leaves the targeted test suite failing and gives SDK/API consumers conflicting contracts.

This is a low-severity contract and test regression; I found no confidentiality, integrity, or availability impact.

Reproduction

On current main (c7336408997c8cf1ce714911549445baed135f6e):

python -m pytest node/tests/test_wallet_history.py node/tests/test_public_api_disclosure.py -q

Result: 16 failed, 25 passed, 2 errors. The two teardown errors are Windows SQLite file-handle cleanup noise; the wallet-history assertion failures reproduce independently.

Representative mismatch:

  • Route returns {ok: true, miner_id: ..., transactions: [...], total: N}.
  • node/tests/test_wallet_history.py and node/tests/test_public_api_disclosure.py index the response as a flat array and assert legacy fields such as tx_id, direction, status, and raw_status.
  • docs/API.md documents those legacy fields and a flat response.
  • The live node follows the unified envelope. Confirmed ledger rows do not carry the legacy status/raw_status fields, while pending rows carry status.

Impact

Contributors cannot obtain a clean targeted test run for this endpoint, and clients have two incompatible checked-in descriptions of the public API. A client implemented from docs/API.md will parse the live response incorrectly.

Suggested fix

Treat #908/#997's unified envelope as authoritative, then update the wallet-history tests and API docs to assert/document each unified transaction type. Add a small live-contract smoke test so the route, docs, and tests cannot drift independently again.

Bounty program: Scottcjn/rustchain-bounties#71
Payout wallet: RTCe0961d6b54f2fa96db57a373c84d8ad8986153f8

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions