Expose indexed_through_block on arena timer and podium APIs (#344) #517

Merged

PlasticDigits merged 1 commit from issue-344-indexer-ingest-lag-api into main

2026-06-25 21:53:29 +00:00

PlasticDigits commented

2026-06-25 20:55:44 +00:00

(Migrated from gitlab.com)

Summary

Related to #344 (parent #342).

Expose indexed_through_block on GET /v1/arena/timers and GET /v1/arena/podiums — the latest fully ingested block from Postgres chain_pointer, alongside existing head read_block_number. When ingest trails the chain-timer poller, clients can detect lag (indexed_through_block < read_block_number) without ops-only /v1/status fields.

Schema version bumped to 2.19.0
TypeScript types updated in frontend/src/lib/indexerApi.ts
Integration test api_arena_ingest_lag_fields_smoke asserts lag visibility
Docs/invariants/skills cross-linked (INV-INDEXER-344-INGEST-LAG)

Acceptance checklist

Criterion	Command / step	Result
Timers and podiums JSON include indexed-through block	`cd indexer && YIELDOMEGA_PG_TEST_URL=… cargo test --test integration_stage2 api_arena_ingest_lag_fields_smoke` (via full integration)	PASS
Field populated when ingest lags behind head poller	`integration_stage2.rs::api_arena_ingest_lag_fields_smoke` (pointer=50, head=100)	PASS
TypeScript types updated	`cd frontend && npm run typecheck`	PASS
No regression in verify scripts	`bash scripts/verify-podium-timers-anvil.sh`	PASS
No regression in verify scripts	`bash scripts/verify-podium-live-anvil.sh`	PASS
Indexer unit + integration	`cd indexer && cargo clippy --all-targets -- -D warnings && cargo test`	PASS

Verification for third parties

Start local Anvil stack with indexer (bash scripts/verify-podium-live-anvil.sh or full QA stack).
curl -s http://127.0.0.1:3100/v1/arena/timers | jq '{read_block_number, indexed_through_block}'
curl -s http://127.0.0.1:3100/v1/arena/podiums | jq '{read_block_number, indexed_through_block}'
Confirm both fields are present (schema x-schema-version ≥ 2.19.0).
When caught up, indexed_through_block should be ≤ read_block_number (typically equal or within a block).
Run cd indexer && cargo test --test integration_stage2 with YIELDOMEGA_PG_TEST_URL set.

## Summary Related to [#344](https://gitlab.com/PlasticDigits/yieldomega/-/issues/344) (parent [#342](https://gitlab.com/PlasticDigits/yieldomega/-/issues/342)). Expose **`indexed_through_block`** on **`GET /v1/arena/timers`** and **`GET /v1/arena/podiums`** — the latest fully ingested block from Postgres **`chain_pointer`**, alongside existing head **`read_block_number`**. When ingest trails the chain-timer poller, clients can detect lag (`indexed_through_block` < `read_block_number`) without ops-only `/v1/status` fields. - Schema version bumped to **2.19.0** - TypeScript types updated in `frontend/src/lib/indexerApi.ts` - Integration test `api_arena_ingest_lag_fields_smoke` asserts lag visibility - Docs/invariants/skills cross-linked (`INV-INDEXER-344-INGEST-LAG`) ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | Timers and podiums JSON include indexed-through block | `cd indexer && YIELDOMEGA_PG_TEST_URL=… cargo test --test integration_stage2 api_arena_ingest_lag_fields_smoke` (via full integration) | PASS | | Field populated when ingest lags behind head poller | `integration_stage2.rs::api_arena_ingest_lag_fields_smoke` (pointer=50, head=100) | PASS | | TypeScript types updated | `cd frontend && npm run typecheck` | PASS | | No regression in verify scripts | `bash scripts/verify-podium-timers-anvil.sh` | PASS | | No regression in verify scripts | `bash scripts/verify-podium-live-anvil.sh` | PASS | | Indexer unit + integration | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | PASS | ## Verification for third parties 1. Start local Anvil stack with indexer (`bash scripts/verify-podium-live-anvil.sh` or full QA stack). 2. `curl -s http://127.0.0.1:3100/v1/arena/timers | jq '{read_block_number, indexed_through_block}'` 3. `curl -s http://127.0.0.1:3100/v1/arena/podiums | jq '{read_block_number, indexed_through_block}'` 4. Confirm both fields are present (schema `x-schema-version` ≥ 2.19.0). 5. When caught up, `indexed_through_block` should be ≤ `read_block_number` (typically equal or within a block). 6. Run `cd indexer && cargo test --test integration_stage2` with `YIELDOMEGA_PG_TEST_URL` set.

PlasticDigits commented

2026-06-25 20:58:09 +00:00

(Migrated from gitlab.com)

Security review — MR !517

Commit reviewed: 8a886e7a756844c54779fb5c637384b4fce6e298
Scope: indexed_through_block on GET /v1/arena/timers and GET /v1/arena/podiums (schema 2.19.0); supporting types, integration test, docs.

Outcome: FINDINGS: 0 medium+

Summary

Reviewed the MR diff and traced data flow from indexer_state.chain_pointer through indexed_through_block() into the two public arena GET handlers. No prior security-review threads on this MR.

Attack-surface notes (no findings):

No attacker-controlled input — new field is a static SQL read (key = 'chain_pointer') with block_number parsed as u64 and emitted as a decimal string via serde_json. No injection path (SQL/shell/SSRF/deserialization).
No authn/authz change — endpoints remain unauthenticated read-only; the field exposes only the ingested block height (subset of ops chain_pointer), not block hash or RPC metrics. Public /v1/status already exposes max_indexed_block; this aligns ingest-lag visibility with arena consumers per #344.
No EVM/contract impact — indexer HTTP only; on-chain settlement and submit-time preflight unchanged.
Pre-existing head-vs-ingest skew — documented in MR; the new field mitigates client confusion rather than introducing a new trust boundary. External actors cannot influence chain_pointer via these routes.

Inline threads: none (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review — MR !517 **Commit reviewed:** `8a886e7a756844c54779fb5c637384b4fce6e298` **Scope:** `indexed_through_block` on `GET /v1/arena/timers` and `GET /v1/arena/podiums` (schema 2.19.0); supporting types, integration test, docs. **Outcome:** `FINDINGS: 0` medium+ ### Summary Reviewed the MR diff and traced data flow from `indexer_state.chain_pointer` through `indexed_through_block()` into the two public arena GET handlers. No prior security-review threads on this MR. **Attack-surface notes (no findings):** - **No attacker-controlled input** — new field is a static SQL read (`key = 'chain_pointer'`) with `block_number` parsed as `u64` and emitted as a decimal string via `serde_json`. No injection path (SQL/shell/SSRF/deserialization). - **No authn/authz change** — endpoints remain unauthenticated read-only; the field exposes only the ingested block height (subset of ops `chain_pointer`), not block hash or RPC metrics. Public `/v1/status` already exposes `max_indexed_block`; this aligns ingest-lag visibility with arena consumers per #344. - **No EVM/contract impact** — indexer HTTP only; on-chain settlement and submit-time preflight unchanged. - **Pre-existing head-vs-ingest skew** — documented in MR; the new field mitigates client confusion rather than introducing a new trust boundary. External actors cannot influence `chain_pointer` via these routes. **Inline threads:** none (no medium+ findings). Security review: no medium+ findings on this diff.

PlasticDigits (Migrated from gitlab.com) merged commit 2b5d0240a5 into main

2026-06-25 21:53:29 +00:00

PlasticDigits commented

2026-06-25 21:53:30 +00:00

(Migrated from gitlab.com)

mentioned in commit 2b5d0240a5

mentioned in commit 2b5d0240a524dcc01d41a9fda55d3501635e2180

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!517

No description provided.

Rows
Columns