Feature/rest user usage - #188
Merged
greatest0fallt1me merged 5 commits intoMar 27, 2026
Merged
Conversation
added 5 commits
March 27, 2026 10:38
- Upgrade from SHA-256 to bcrypt for secure key hashing with salt - Implement constant-time comparison using crypto.timingSafeEqual() - Add secure key verification method with data redaction - Implement key rotation functionality with authorization checks - Add comprehensive security test suite (25+ tests) - Cover timing attacks, data exposure, and edge cases - Ensure no raw keys are logged or exposed - Add regression tests for common security mistakes Security improvements: - Prevent rainbow table attacks with bcrypt - Prevent timing attacks with constant-time comparison - Proper authorization checks on all operations - Graceful error handling without information leakage
- Add comprehensive unit tests for InMemorySettlementStore - Test persistence semantics, deduplication keys, and status transitions - Verify data integrity and corruption resistance - Document concurrency expectations and limitations - Add integration tests with RevenueSettlementService - Include detailed documentation of invariants and security considerations
- Implement production-safe Helmet security headers with environment-based configuration - Add comprehensive Content Security Policy (CSP) with strict production settings - Implement HTTP Strict Transport Security (HSTS) for production only - Add X-Frame-Options, X-Content-Type-Options, Referrer-Policy headers - Configure Cross-Origin Embedder Policy for production - Enhance CORS with environment-based origin validation - Add production logging for blocked CORS attempts - Optimize preflight cache times (10min prod, 24hrs dev) - Add comprehensive unit and integration tests for security headers - Create detailed security configuration documentation - Maintain development ergonomics while ensuring production safety
Implement GET /api/usage (authenticated) with query params (from, to, limit, apiId). Return usage events for current user (from JWT), total spent in period, and optional breakdown by API. Use usage_events repository and requireAuth. - Add UserUsageEventQuery interface and findByUser/aggregateByUser methods - Implement authenticated route with comprehensive parameter validation - Support smart default period handling (last 30 days) - Add pagination with limit parameter - Return structured response with events, stats, and period info - Include comprehensive test suite with 12 test cases
|
@olaleyeolajide81-sketch Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#29 Add REST Route: Get Current User Usage and Stats
Repo Avatar
CalloraOrg/Callora-Backend
Description
Implement GET /api/usage (authenticated): query params (from, to, limit). Return usage events for the current user (from JWT), total spent in period, and optional breakdown by API. Use usage_events repository and requireAuth.
Requirements and context
Must require wallet auth (JWT)
Default period: current month or last 30 days
Suggested execution
Fork the repo and create a branch
git checkout -b feature/rest-user-usage
Implement changes
Route GET /api/usage with requireAuth; validate query; return events and aggregates
Add tests
Test and commit
Run tests
Example commit message: feat: REST user usage and stats
Guidelines
Clear documentation
Timeframe: 96 hours
Project details: ##29 Add REST Route: Get Current User Usage and Stats
Repo Avatar
CalloraOrg/Callora-Backend
Description
Implement GET /api/usage (authenticated): query params (from, to, limit). Return usage events for the current user (from JWT), total spent in period, and optional breakdown by API. Use usage_events repository and requireAuth.
Requirements and context
Must require wallet auth (JWT)
Default period: current month or last 30 days
Suggested execution
Fork the repo and create a branch
git checkout -b feature/rest-user-usage
Implement changes
Route GET /api/usage with requireAuth; validate query; return events and aggregates
Add tests
Test and commit
Run tests
Example commit message: feat: REST user usage and stats
Guidelines
Clear documentation
Timeframe: 96 hours
Project details: #
closes #29