feat(content-node): CID allowlist and takedown denylist for the public gateway
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 30/100
Research direction
Start with dependency #71 and the spike it produces; the issue does not identify implementation files or tests. Decide whether Kubo configuration, a reverse proxy rule, or a Boxo-based gateway fits the spike, then trace how the audit collection and provenance storage provide allowed CIDs and how admins maintain the denylist. Done means unlisted and denylisted CIDs are refused, with behavior covered by a test.
Written by the indexing model from the issue text.
Description
Summary
Make sure the public gateway only serves platform-published content and can drop content on request.
Estimated size: M
Motivation
Otherwise the gateway is an open proxy to the IPFS network at our cost.
Proposal
- Implement in the form the spike recommends (reverse-proxy rule, Kubo setting or a small Boxo-based gateway).
- Allowlist fed from the audit collection and the provenance storage references; denylist maintained by admins.
Acceptance criteria
- A request for a CID not on the allowlist is refused.
- Denylisted CIDs are refused even if allowlisted.
- Behavior is covered by a test.
Technical notes and risks
- Conditional: if the spike shows Kubo configuration is enough, adapt the scope to that.
Dependencies
- #71
Part of #43. Ground rules for the content layer: no secrets in the repo, content-layer failures must never block or discard quantum execution, and tests and docs ship with every PR.
- Dominant language
- Python
- Stars
- 2
- Forks
- 4
- Avg merge
- 6h 54m
- Merged PRs (30d)
- 7
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from QMeshPy/distributed-quantum
-
enhancement good first issue helia storage tier-1
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
QMeshPy/distributed-quantum#53 ·
Maintainers usually reply within 1 day
-
chain-integration enhancement payments research-spike tier-2
Difficulty 4/5 3-5 days Newbie friendliness 55/100
QMeshPy/distributed-quantum#78 ·
Maintainers usually reply within 1 day
-
chain-integration enhancement payments research-spike tier-2
Difficulty 3/5 1-2 days Newbie friendliness 66/100
QMeshPy/distributed-quantum#77 ·
Maintainers usually reply within 1 day
-
chain-integration enhancement payments tier-2
Difficulty 5/5 Over a week Newbie friendliness 35/100
QMeshPy/distributed-quantum#76 ·
Maintainers usually reply within 1 day
-
documentation good first issue kubo storage tier-1
Difficulty 2/5 1-3 hours Newbie friendliness 42/100
QMeshPy/distributed-quantum#75 ·
Maintainers usually reply within 1 day
All issues in QMeshPy/distributed-quantum
Similar issues
-
comp/tools P2 type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
NousResearch/hermes-agent#142908 · 1 comment ·
-
[oblt-aw][autodoc] Fix malformed headings in new Buildkite docs pagesPossibly taken @github-actions claimed this today. Opendocumentation
Difficulty 1/5 Under an hour Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
[Bug]: fileUploadMatrix.test.ts URL case does a real DNS lookup and fails offlinePossibly taken @r2jaff claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ComposioHQ/composio#5054 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
pytorch/tensordict#3286 ·
Maintainers usually reply within 1 day