Skip to content

Log solve request data transfer#4082

Merged
MartinquaXD merged 11 commits intomainfrom
log-solve-request-data-transfer
Jan 26, 2026
Merged

Log solve request data transfer#4082
MartinquaXD merged 11 commits intomainfrom
log-solve-request-data-transfer

Conversation

@MartinquaXD
Copy link
Copy Markdown
Contributor

@MartinquaXD MartinquaXD commented Jan 23, 2026

Description

Some solvers reported that some requests come significantly delayed (judging by the auction deadline). Currently we have no way to distinguish between receiving the start of the /solve request and streaming the actual data.
This PR makes this possible by making the solve handler take a raw http request and stream the body afterwards.

Changes

Instead of:

  1. collecting the whole body into a String (including utf8 check)
  2. logging that we received a request
  3. putting that String into an Arc to make copying it cheap
  4. deserializing the string into a SolveRequest

We now do:

  1. receive raw http request
  2. log that we received it
  3. stream the body into a cheaply copyable Bytes type
  4. log how long the data transfer took
  5. deserialize raw bytes into SolveRequest

Since handling the raw request seems to bypass axum's request size checks I did it manually for this endpoint.

How to test

Existing tests should suffice

@MartinquaXD MartinquaXD requested a review from a team as a code owner January 23, 2026 10:00
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors the /solve endpoint to measure the duration of request body data transfer, which helps in diagnosing reported delays. The implementation correctly changes the endpoint to accept a raw HTTP request and streams the body to hyper::body::Bytes while timing the operation. However, this change introduces a critical security vulnerability. By processing the raw request body without a size limit, the service is exposed to a Denial of Service attack via memory exhaustion from an overly large request payload. My review includes a comment with a suggested fix to mitigate this vulnerability by applying a size limit to the request body.

Comment thread crates/driver/src/infra/api/routes/solve/mod.rs Outdated
Comment thread crates/driver/src/infra/api/routes/solve/mod.rs Outdated
Comment thread crates/driver/Cargo.toml
Copy link
Copy Markdown
Contributor

@squadgazzz squadgazzz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Just a nit.

It smells like a gRPC API is a better successor for this communication, since I assume a lot of data are bytes-related in any case.

Comment thread crates/driver/src/infra/api/routes/solve/mod.rs Outdated
Comment thread crates/driver/src/infra/api/routes/solve/mod.rs
Comment thread crates/driver/src/infra/api/routes/solve/mod.rs Outdated
@MartinquaXD MartinquaXD enabled auto-merge January 26, 2026 09:59
@MartinquaXD MartinquaXD added this pull request to the merge queue Jan 26, 2026
Merged via the queue into main with commit adda1ae Jan 26, 2026
19 checks passed
@MartinquaXD MartinquaXD deleted the log-solve-request-data-transfer branch January 26, 2026 10:33
@github-actions github-actions Bot locked and limited conversation to collaborators Jan 26, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants