Skip to content

Fix price history query amplification - #15

Merged
NateIsern merged 1 commit into
mainfrom
codex/fix-price-history-api-availability-vulnerability
Jun 25, 2026
Merged

Fix price history query amplification#15
NateIsern merged 1 commit into
mainfrom
codex/fix-price-history-api-availability-vulnerability

Conversation

@NateIsern

Copy link
Copy Markdown
Member

Motivation

  • The bounded history sampler previously escalated one request into hundreds of concurrent indexed findOne lookups, which can saturate a small MongoDB connection pool and cause availability issues on the public /api/price/history endpoint.
  • The expensive path was reachable for normal windows (default 7d) once the sampled series exceeded HISTORY_MAX_POINTS, making the amplification the common case rather than an edge case.
  • The fix must eliminate massive DB fanout while preserving the capped, evenly-thinned history returned to clients.

Description

  • Replace the over-threshold per-target findOne fanout with a single sorted PricePoint.find({ timestamp: { $gte: cutoff } }) query and in-memory processing to thin the series.
  • Implement an efficient linear pass that walks the retrieved docs and selects nearest documents for each evenly spaced target time, then ensures the newest point is retained; this preserves the HISTORY_MAX_POINTS-bounded, oldest→newest output.
  • Change localized to server/routes/price.ts in the fetchBoundedPriceHistory helper, removing the Promise.all multi-query approach and keeping external behavior and response shape unchanged.

Testing

  • Ran npm run typecheck, which completed successfully.
  • Ran the test suite with npm test (Vitest), and all tests passed (4 files, 42 tests).
  • Attempted npm test -- --runInBand which failed because Vitest does not accept Jest-style --runInBand options (this is a test runner option mismatch, not a functional regression).

Codex Task

@NateIsern
NateIsern merged commit b08997e into main Jun 25, 2026
1 check passed
@NateIsern
NateIsern deleted the codex/fix-price-history-api-availability-vulnerability branch June 25, 2026 19:18
NateIsern added a commit that referenced this pull request Jun 25, 2026
Document the merged hardening PRs and bump version:
- restrict trusted proxy headers via TRUSTED_PROXY_CIDRS (#16)
- redact public peer topology from /api/peers (#17)
- single bounded price-history query (no findOne fan-out) (#15)

Also note the TRUSTED_PROXY_CIDRS deployment requirement in the README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant