Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

feat(vault): server-side pinning broker routes

Abierto
  • ¿Algo no está bien?
#45 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
54/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
next.js, typescript
Área
api, backend, security

Línea de trabajo

Start by locating the existing /api/vault/pin* and /api/vault/quota/* route handlers, the session authentication and user-scoping code, and the Pinata and Lighthouse service adapters. Then read the route handler tests and run them to understand the current conventions. Done means adding authenticated broker routes for pin, unpin, and quota, with mocked-provider tests for success, auth, size limits, and typed errors that do not leak tokens.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement helia storage tier-2

Summary

Add session-authenticated routes that perform pin, unpin and quota calls to Pinata and Lighthouse on the server, so provider credentials never reach the browser.

Estimated size: M

Motivation

Provider tokens are currently shipped to every browser as NEXT_PUBLIC_* variables.

Current state in this repo

  • services/pinata.ts reads NEXT_PUBLIC_PINATA_JWT and services/lighthouse.ts reads NEXT_PUBLIC_LIGHTHOUSE_KEY in the browser.
  • /api/vault/pin* and /api/vault/quota/* only record audit data; they do not call the providers.

Proposal

  • Add /api/vault/broker/pin, /unpin and /quota route handlers, authenticated with the existing session and scoped to the user.
  • Read credentials from server-only env vars (for example PINATA_JWT, LIGHTHOUSE_API_KEY); choose the provider by request parameter.
  • Enforce a request body size limit and basic rate limiting.
  • Additive only: leave the browser adapters untouched in this PR (they switch over in the follow-up).

Acceptance criteria

  • Unauthenticated requests get 401.
  • A pin, unpin and quota call succeeds through the broker against mocked providers.
  • No provider secret is read from a NEXT_PUBLIC_* variable on the broker path.
  • Errors from the provider are mapped to typed responses without leaking tokens into logs.

Out of scope

  • Switching the browser adapters over (separate issue).
  • New providers.

Dependencies

  • None; can be picked up independently.

Testing plan

  • Route handler tests with mocked provider HTTP; auth and size-limit cases.

Part of #43. Ground rules for the content layer: no secrets in the repo, content-layer failures must never block or discard quantum execution, and tests and docs ship with every PR.

Lenguaje dominante
Python
Estrellas
2
Forks
4
Merge medio
6 h 54 min
PR fusionados (30 d)
7

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de QMeshPy/distributed-quantum

Todos los issues de QMeshPy/distributed-quantum

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.