Repository navigation
Bound and validate the CSV and Parquet exports #185
Description
Background
GET /transfers.csv and /transfers.parquet (src/routes/exports.ts:178-179, mounted at the root in src/api.ts:208) require no filter and cap no rows: streamTransfers (src/routes/exports.ts:52-72) pages the whole TokenTransfer table 500 rows at a time until it runs out. The Parquet path materialises the entire result into a temp file (:116, :137) before sending a byte.
Parameters are unvalidated too — parseInt(String(fromLedger), 10) at :39-40 yields NaN, and new Date(String(fromDate)) at :44-46 yields Invalid Date. Both reach Prisma and surface as a 500.
Acceptance criteria
- Parameters validated with a zod schema; bad input returns 400, not 500
- An env-configurable
maxRowscap is applied and truncation is signalled to the caller - A request with no narrowing filter is either rejected or capped — pick one and document it
- Tests:
?fromLedger=abcreturns 400, and an export over a seeded table stops at the cap
Drips Wave · Complexity: Intermediate · 150 points
How this repo is laid out
Wraith is a Soroban incoming-transfer indexer: it fills the gap Horizon leaves for SAC/SEP-41 token events by recipient address. Roughly 14k lines under src/, REST + GraphQL + WebSocket, Postgres via Prisma, deployed on Render.
- Unit tests are jest (
src/**/__tests__,tests/*.test.ts), with a coverage gate. - Integration tests are vitest (
tests/integration/,vitest.integration.config.ts, Docker). - Don't mix the two runners in one file.
Known state of main before you start
tsc --noEmit and the unit suite are green. The Integration tests CI job is red, and so is Load test — both predate this batch. Open PRs #177 and #178 address them. If the integration job is red when you open a PR, that is not your fault; say so in the PR and carry on.
Four modules are shipped, closed as done, and imported by nothing: src/indexer/checkpoint.ts, src/ingest/reorg.ts, src/middleware/opa.ts, and src/api/candles.ts + src/workers/ohlc-refresh.ts. So the live indexer today has no reorg handling and no atomic checkpointing, despite both features being closed. Two issues below start unpicking that — don't assume a closed issue means a wired feature.
Ground rules
- Every PR needs a test that fails before the change and passes after, unless the issue says otherwise.
- Don't widen a Prometheus label to something unbounded — addresses and contract ids must never become label values.
- Nothing may log or return a raw database error, a connection string, or a provider URL.
- Don't reformat a file you're changing. A diff that is 90% whitespace hides the 10% that matters.
Required: Before submitting, join the contributor Telegram so your work can be tracked and counted toward the Stellar Wave: https://t.me/+fxHXq8f1SwlkZDBk
Activity
felixumeh commentedon Sep 24, 2026
@felixumeh has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @felixumeh to this issue.
funds0033-cmyk commentedon Sep 26, 2026
@funds0033-cmyk has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @funds0033-cmyk to this issue.
drips-wave commentedon Sep 26, 2026
Congratulations, @funds0033-cmyk! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @funds0033-cmyk: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
fix(exports): decide truncation before the body starts, and test the cap
drips-wave commentedon Oct 6, 2026
This issue has been marked as completed by a Drips Wave moderator for @funds0033-cmyk as part of the Stellar Wave Program's 9th Wave 🥳
Moderator's reason: [Auto-assessed] The PR is merged (mergedAt: 2026-10-06T10:43:57Z), closing issue #185. The contributor successfully addressed the feedback from the maintainer, implemented Zod validation for parameters returning 400 instead of 500, added an environment-configurable row cap with truncation signals, and provided comprehensive unit tests in
src/__tests__/routes/exports.test.ts.😎 @funds0033-cmyk: You earned 150 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
ℹ️ Note: This issue was marked complete via moderation. Points were issued even though the GitHub issue remains open.
feat(exports): bound and validate the CSV and Parquet exports (Miracl…