fix(network): use curated node lists for CORS-compatible endpoints#3046
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughScript now fetches optional Changes
Sequence Diagram(s)sequenceDiagram
participant Script as Script (generate.ts)
participant Host as Remote Host
participant RPC as RPC Endpoint
Script->>Host: GET meta.json, faucet-url.txt, api-nodes.txt, rpc-nodes.txt
Host-->>Script: meta.json, faucet-url.txt, api-nodes.txt, rpc-nodes.txt (404 allowed -> null)
Script->>Script: parseNodesTxt(api-nodes.txt / rpc-nodes.txt)
Script->>Script: mergeUrls(parsedTxt, meta.apis)
alt rpcUrls available
Script->>RPC: request app version via first rpcUrl
RPC-->>Script: app version
else no rpcUrls
Script-->>Script: app version = null
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3046 +/- ##
==========================================
- Coverage 59.72% 58.84% -0.89%
==========================================
Files 1035 995 -40
Lines 24304 23348 -956
Branches 6025 5874 -151
==========================================
- Hits 14515 13738 -777
+ Misses 8539 8372 -167
+ Partials 1250 1238 -12
*This pull request uses carry forward flags. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/net/scripts/generate.ts (1)
95-101: Harden TXT parsing to keep only valid HTTP(S) URLs.At Line 95–101,
startsWith("http")is too permissive and can pass malformed entries into generated config.Suggested refactor
function parseNodesTxt(content: string | null): string[] { if (!content) return []; - return content + return [...new Set(content .split("\n") .map(line => line.trim()) - .filter(line => line.length > 0 && line.startsWith("http")); + .filter(line => { + if (!line) return false; + try { + const url = new URL(line); + return url.protocol === "http:" || url.protocol === "https:"; + } catch { + return false; + } + }))]; }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/net/scripts/generate.ts` around lines 95 - 101, The parseNodesTxt function is too permissive using startsWith("http"); update parseNodesTxt to only return properly formed HTTP/HTTPS URLs by parsing each trimmed line with a URL validator (e.g., using the URL constructor or a strict regex), filtering out lines that throw or whose protocol is not "http:" or "https:", and still ignoring empty/comment lines; this ensures parseNodesTxt returns only valid http(s) URLs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@packages/net/scripts/generate.ts`:
- Around line 95-101: The parseNodesTxt function is too permissive using
startsWith("http"); update parseNodesTxt to only return properly formed
HTTP/HTTPS URLs by parsing each trimmed line with a URL validator (e.g., using
the URL constructor or a strict regex), filtering out lines that throw or whose
protocol is not "http:" or "https:", and still ignoring empty/comment lines;
this ensures parseNodesTxt returns only valid http(s) URLs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 134ba5e2-827d-4bab-a675-181159586a1a
⛔ Files ignored due to path filters (1)
packages/net/src/generated/netConfigData.tsis excluded by!**/generated/**
📒 Files selected for processing (1)
packages/net/scripts/generate.ts
The generate script now fetches api-nodes.txt and rpc-nodes.txt from the akash-network/net repo and merges them with meta.json entries. Curated txt file nodes are placed first (CORS-friendly, prioritized), followed by remaining meta.json nodes deduplicated by normalized URL. Falls back to meta.json only when txt files are unavailable.
baktun14
force-pushed
the
fix/net-cors-friendly-node-urls
branch
from
April 8, 2026 01:17
1ea29cd to
c63a02f
Compare
Only return null on 404 (file doesn't exist), throw on other errors to avoid silently falling back to meta.json during transient failures.
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/net/scripts/generate.ts (1)
113-117: Consider defensive error handling for malformed URLs.
new URL(url)throws aTypeErrorif the input is malformed. Since the URLs originate from external txt files, a malformed entry (e.g.,"http:// invalid") would crash the entire generate script. While these files are curated, adding a try/catch or validating URLs inparseNodesTxtwould make the script more resilient and provide clearer error messages.💡 Optional: wrap in try/catch to skip invalid URLs
function normalizeUrl(url: string): string { + try { const parsed = new URL(url); const defaultPort = parsed.protocol === "https:" ? "443" : "80"; return `${parsed.protocol}//${parsed.hostname}:${parsed.port || defaultPort}${parsed.pathname.replace(/\/$/, "")}`; + } catch { + console.warn(`Skipping malformed URL: ${url}`); + return url; // return as-is to allow downstream deduplication + } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/net/scripts/generate.ts` around lines 113 - 117, The normalizeUrl function calls new URL(url) which can throw for malformed inputs; wrap the parsing in a try/catch (or validate earlier in parseNodesTxt) so the generate script doesn't crash on a bad entry: inside normalizeUrl (or in parseNodesTxt before calling it) catch URL parsing errors, log a clear warning including the offending string and skip/return a safe fallback (e.g., null or throw a custom error handled by the caller) so callers like parseNodesTxt can filter out invalid entries instead of letting a TypeError bubble up.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@packages/net/scripts/generate.ts`:
- Around line 113-117: The normalizeUrl function calls new URL(url) which can
throw for malformed inputs; wrap the parsing in a try/catch (or validate earlier
in parseNodesTxt) so the generate script doesn't crash on a bad entry: inside
normalizeUrl (or in parseNodesTxt before calling it) catch URL parsing errors,
log a clear warning including the offending string and skip/return a safe
fallback (e.g., null or throw a custom error handled by the caller) so callers
like parseNodesTxt can filter out invalid entries instead of letting a TypeError
bubble up.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6ce59281-0faf-4531-94ab-544dbd84ab61
📒 Files selected for processing (1)
packages/net/scripts/generate.ts
ygrishajev
approved these changes
Apr 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Users are experiencing CORS errors in the browser when the console tries to reach REST API nodes. The root cause is that the generate script in
packages/netpulls endpoint lists frommeta.json, which includes many nodes that don't handle CORS preflight (OPTIONS) correctly — e.g. ecostake REST returns 501 on OPTIONS, which browsers reject even though it sendsAccess-Control-Allow-Origin: *.The
akash-network/netrepo maintains curatedapi-nodes.txtandrpc-nodes.txtfiles with CORS-friendly nodes, but the generate script wasn't using them.What
api-nodes.txtandrpc-nodes.txtfrom theakash-network/netrepometa.jsonAPI lists when availablemeta.jsonif the txt files don't exist (e.g. sandbox/testnet)netConfigData.ts— mainnet REST goes from 12 endpoints (8 CORS-broken) to 4 (all CORS-verified), RPC from 9 to 6Summary by CodeRabbit