Skip to content

Ord/tx verification endpoints#44

Open
Neurvinch wants to merge 7 commits intoOWASP-BLT:mainfrom
Neurvinch:ord/tx-verification-endpoints
Open

Ord/tx verification endpoints#44
Neurvinch wants to merge 7 commits intoOWASP-BLT:mainfrom
Neurvinch:ord/tx-verification-endpoints

Conversation

@Neurvinch
Copy link
Copy Markdown
Contributor

@Neurvinch Neurvinch commented Mar 17, 2026

Summary

Add /mainnet/verify-transaction and /regtest/verify-transaction GET endpoints to check on-chain confirmation status of Bitcoin transactions.

How it works

  1. Calls Bitcoin Core RPC (getrawtransaction) to get confirmation count
  2. Looks up block height via getblockheader if confirmed
  3. Queries ord server REST API for Runes-specific data (best-effort)
  4. Returns structured response with status label

Response fields

Field Description
status "mempool" / "confirming" / "confirmed"
confirmations Number of block confirmations
block_hash Hash of containing block (null if unconfirmed)
block_height Block height (null if unconfirmed)
runes Runes data from ord server, when available

Changes

  • ord-server/ord-api.py — bitcoin_rpc(), ord_server_tx(), _verify_transaction() + 2 route endpoints
  • import requests added for Bitcoin RPC and ord server HTTP calls

Test plan

  • Valid txid → returns status, confirmations, block info
  • Invalid txid format → 400
  • Unknown txid → 404
  • Bitcoin node unreachable → 502
  • Ord server unavailable → response still works (runes field omitted)

Neurvinch and others added 7 commits March 17, 2026 12:39
@Neurvinch @claude
feat(worker): add serverless API gateway with HMAC auth and backend p…
1364465 
…roxy

Replace placeholder worker with a real Cloudflare Worker that:
- Routes /mainnet/* and /regtest/* as API calls, everything else as static site
- Validates X-Signature-256 HMAC-SHA256 signature before forwarding
- Proxies authenticated API requests to the private ord backend (ORD_BACKEND_URL)
- Returns JSON errors for missing config or invalid signatures
- Add ORD_BACKEND_URL to wrangler.toml [vars]

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Neurvinch @claude
feat(ord-server): add retry logic, error sanitization, and temp YAML …
9b8131a 
…helpers

- run_ord_command: exponential-backoff retry on transient errors
  (connection refused, timeout, etc.)
- sanitize_error: strip RPC passwords from stderr before returning
- write_temp_yaml: UUID-suffixed temp files to avoid race conditions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Neurvinch @claude
feat(ord-server): add shared command builders and fee rate validator
6009ef8 
- make_base_command: build ord CLI prefix for mainnet/regtest
- make_wallet_args: build wallet sub-command args per network
- validate_fee_rate: range check (1-10000 sat/vbyte)
- Fix mainnet RPC URL default port (8332, not 18443)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Neurvinch @claude
refactor(ord-server): use shared helpers, add timing-safe auth
01e7f72 
- validate_live_auth: constant-time password check via hmac.compare_digest
  (prevents timing side-channel attacks on the wallet password)
- Refactor all 3 endpoints to use make_base_command, make_wallet_args,
  run_ord_command, sanitize_error, write_temp_yaml, validate_fee_rate
- Temp YAML files are cleaned up after each request
- Add requests to requirements.txt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Neurvinch @claude
feat(ord-server): add Rune etching (creation) endpoints
de99974 
Add /mainnet/etch-rune and /regtest/etch-rune POST endpoints for
creating new Runes on Bitcoin. Supports rune name, symbol, divisibility,
premine, open-mint terms (cap, amount, height/offset windows), turbo
flag, and dry-run mode.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Neurvinch @claude
feat(ord-server): add Rune minting (open-mint claim) endpoints
d9cb914 
Add /mainnet/mint-rune and /regtest/mint-rune POST endpoints for
claiming open-mint cycles of existing Runes. Supports rune name,
fee rate, optional postage, destination address, and dry-run mode.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Neurvinch @claude
feat(ord-server): add transaction verification endpoints
3e82ae9 
- bitcoin_rpc(): JSON-RPC 1.0 helper for Bitcoin Core calls
- ord_server_tx(): best-effort Runes data from ord server REST API
- _verify_transaction(): status (mempool/confirming/confirmed),
  confirmation count, block hash/height, and Runes data
- /mainnet/verify-transaction and /regtest/verify-transaction GET endpoints
- Fix duplicate import lines (hmac/hashlib)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@owasp-blt
Copy link
Copy Markdown

owasp-blt bot commented Mar 17, 2026

📊 Monthly Leaderboard

Hi @Neurvinch! Here's how you rank for March 2026:

Rank User Open PRs PRs (merged) PRs (closed) Reviews Comments Total
30 ramansh18 @ramansh18 0 3 0 0 7 44
31 Neurvinch @Neurvinch ✨ 14 2 0 0 2 38
32 snk-git-hub @snk-git-hub 3 1 0 1 9 36

Scoring this month (across OWASP-BLT org): Open PRs (+1 each), Merged PRs (+10), Closed (not merged) (−2), Reviews (+5; first two per PR in-month), Comments (+2, excludes CodeRabbit). Run /leaderboard on any issue or PR to see your rank!

@owasp-blt
Copy link
Copy Markdown

owasp-blt bot commented Mar 17, 2026

👋 Hi @Neurvinch!

This pull request needs a peer review before it can be merged. Please request a review from a team member who is not:

  • The PR author
  • coderabbitai
  • copilot

Once a valid peer review is submitted, this check will pass automatically. Thank you!

⚠️ Peer review enforcement is active.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 17, 2026

Warning

Rate limit exceeded

@Neurvinch has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 14 minutes and 11 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: OWASP-BLT/coderabbit/.coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 17899de8-dba0-4789-8c95-7be82f9fe9c9

📥 Commits

Reviewing files that changed from the base of the PR and between 9a1b356 and 3e82ae9.

📒 Files selected for processing (5)
  • ord-server/.env.example
  • ord-server/ord-api.py
  • ord-server/requirements.txt
  • src/index.py
  • wrangler.toml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

needs-peer-review PR needs peer review unresolved-conversations: 0

Projects

📌 OWASP BLT Project Board
Status: Backlog

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Neurvinch