Repository navigation
feat(gateway): read order books and balances without signing in - #1452
Conversation
Time Submission Status
Submit or update total time with: Add time on top of previous submission with: See available commands to help comply with our Guidelines. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Expose exempt actions setting deployments/gateway/gateway-compose.yaml |
The kwil-gateway service now accepts AUTHN_EXEMPT_ACTIONS, defaulting to empty. Its comment describes a comma-separated value that replaces the default list in kgw-config.pkl. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Feature · Severity of issue fixed: Medium
Possibly related issues
- trufnetwork/node#1436 — The new environment setting allows configuring authentication-exempt actions, addressing part of the issue’s gateway configuration objective.
Merge Risk: 
511ee
-
No concrete merge-blocking risk remains.
Pre-merge checks: 
-
Check name Status Explanation Resolution Linked Issues check [ #1451] Requirements: testnet and mainnet gateways must serve order book, market, and wallet balance and position reads without a session. Reads that depend on the caller must still require a session.…Provide reviewable evidence of the exempt action list. Needed items: the default list in deployments/gateway/kgw-config.pkl at head (or a reviewable copy), and the source of each listed action with its called actions. The source must show w… Out of Scope Changes check The reviewed change in deployments/gateway/gateway-compose.yaml is in scope. It passes the new AUTHN_EXEMPT_ACTIONS override to the kwil-gateway service, which the feature for #1451requires.
The mai…Provide reviewable contents of deployments/gateway/kgw-config.pkl at head. This allows a check that each listed action matches the scope of #1451. Reassess after this evidence is available.-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly summarizes the primary change: allowing gateway reads of order books and balances without signing in. Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Full details: Linked Issues check
-
Explanation
[
#1451] Requirements: testnet and mainnet gateways must serve order book, market, and wallet balance and position reads without a session. Reads that depend on the caller must still require a session.The exempt action list is in deployments/gateway/kgw-config.pkl. That path is excluded by the rule
!**/*.pklwith no inclusion rule, so its contents were not reviewed.Reviewed evidence: deployments/gateway/gateway-compose.yaml adds AUTHN_EXEMPT_ACTIONS to the kwil-gateway service. The default is empty. The comment states that the value replaces the default list in kgw-config.pkl. This wiring matches the feature, but it does not show which actions are exempt.
The PR description names 18 actions and reports checks of their live definitions on testnet and mainnet. These are author claims. They are not reviewable evidence in this assessment.
Unresolved: whether the exempt list covers the requested reads, and whether it excludes identity-dependent reads such as whoami, get_user_positions, get_user_collateral, and stream reads that check
@caller.Resolution
Provide reviewable evidence of the exempt action list. Needed items: the default list in deployments/gateway/kgw-config.pkl at head (or a reviewable copy), and the source of each listed action with its called actions. The source must show whether each action reads
@calleror@signer. Reassess after this evidence is available.
Full details: Out of Scope Changes check
-
Explanation
The reviewed change in deployments/gateway/gateway-compose.yaml is in scope. It passes the new AUTHN_EXEMPT_ACTIONS override to the kwil-gateway service, which the feature for
#1451requires.The main change, the exempt action list in deployments/gateway/kgw-config.pkl, is excluded by the rule
!**/*.pklwith no inclusion rule. Its contents were not reviewed. Whether it lists only the reads named in#1451is unknown.No unrelated change was found in the reviewed evidence. That evidence covers the whole-PR summary and the compose file only.
Resolution
Provide reviewable contents of deployments/gateway/kgw-config.pkl at head. This allows a check that each listed action matches the scope of
#1451. Reassess after this evidence is available.
-
Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
@holdex pr submit-time 1h |
Related:
Summary
@caller, directly or through an action it calls, so a session added nothing to them.@callerfor private streams, andwhoami,get_user_positionsandget_user_collateralanswer for the caller.kgw-config.pkl, so it is reviewed here. One list covers both networks, because a name a network does not have is ignored.AUTHN_EXEMPT_ACTIONS(comma separated, no spaces) replaces the list for one deployment.How I checked
authn_exempt_actionsis the only new key in the output.info.actionson testnet and mainnet, together with every action it calls. None of them reads@calleror@signer. The same check does flagwhoami,get_user_positionsandget_record.--test-configdry run, keeping the old file as a backup.list_markets,get_market_info,get_order_book,get_positions_by_walletand the bridge balance view now answer 200, both with no wallet and with a wallet that never signed in. Before the change they answered 400sender not setor 401cookie not found.whoamiandget_user_positionsstill answer 401 without a session, and signing in with the cookie works as before.Summary by CodeRabbit
AUTHN_EXEMPT_ACTIONSenvironment variable. Provide a comma-separated list to replace the default actions; if unset, the value is empty.