Skip to content

Conversation

@tcsenpai
Copy link
Contributor

@tcsenpai tcsenpai commented Nov 4, 2025

PR Type

Enhancement, Tests


Description

  • Implement Storage Programs Phase 2-4: Complete CRUD operations with access control

  • Add transaction handlers for CREATE, WRITE, UPDATE_ACCESS_CONTROL, DELETE operations

  • Implement access control validator with 4 modes (private, public, restricted, deployer-only)

  • Add size validators (128KB limit, 64-level nesting, 256-char keys)

  • Integrate Storage Programs into GCR edit application and RPC endpoints

  • Add getStorageProgram RPC query endpoint with access control enforcement

  • Update SDK dependency to v2.4.24 for Storage Programs support


Diagram Walkthrough

flowchart LR
  A["Client Transaction"] --> B["handleStorageProgramTransaction"]
  B --> C["Validate & Generate GCREdit"]
  C --> D["HandleGCR.applyStorageProgramEdit"]
  D --> E["Access Control Check"]
  E --> F["Size Validation"]
  F --> G["GCR_Main.data Updated"]
  H["RPC Query"] --> I["manageNodeCall.getStorageProgram"]
  I --> J["validateStorageProgramAccess"]
  J --> K["Return Data"]
Loading

File Walkthrough

Relevant files
Enhancement
8 files
handleStorageProgramTransaction.ts
Storage Program transaction handler with 5 operations       
+418/-0 
handleGCR.ts
Add Storage Program GCR edit application logic                     
+278/-0 
validateStorageProgramAccess.ts
Access control validator for 4 permission modes                   
+128/-0 
validateStorageProgramSize.ts
Size and structure validators for Storage Programs             
+172/-0 
manageNodeCall.ts
Add getStorageProgram RPC query endpoint                                 
+73/-3   
endpointHandlers.ts
Route storageProgram transactions to handler                         
+55/-0   
GCR_Main.ts
Add data JSONB column for Storage Programs                             
+23/-0   
server_rpc.ts
Pass sender context to manageNodeCall                                       
+1/-1     
Dependencies
1 files
package.json
Update demosdk dependency to v2.4.24                                         
+1/-1     
Documentation
8 files
storage_programs.md
Complete Storage Programs implementation reference             
+227/-0 
_index.md
Serena memory index with consolidation guide                         
+148/-0 
telegram_identity.md
Telegram Identity System complete implementation                 
+172/-0 
session_storage_review_2025_10_11.md
Storage Programs review session findings                                 
+138/-0 
pr_review_tg_identities_complete.md
Telegram identities PR review resolution                                 
+131/-0 
development_guidelines.md
Development guidelines and best practices                               
+150/-0 
session_final_2025_01_31.md
Final session checkpoint for Telegram identities                 
+127/-0 
project_core.md
Core project context and architecture overview                     
+89/-0   
Additional files
23 files
code_style_conventions.md +0/-52   
codebase_structure.md +0/-87   
data_structure_robustness_completed.md +0/-44   
development_patterns.md +0/-148 
genesis_caching_security_dismissed.md +0/-38   
input_validation_improvements_completed.md +0/-80   
pr_review_all_high_priority_completed.md +0/-56   
pr_review_analysis_complete.md +0/-70   
pr_review_corrected_analysis.md +0/-73   
pr_review_import_fix_completed.md +0/-38   
pr_review_json_canonicalization_dismissed.md +0/-31   
pr_review_point_system_fixes_completed.md +0/-70   
project_context_consolidated.md +0/-75   
project_patterns_telegram_identity_system.md +0/-135 
project_purpose.md +0/-29   
session_2025_10_10_telegram_group_membership.md +0/-94   
session_checkpoint_2025_01_31.md +0/-53   
session_final_checkpoint_2025_01_31.md +0/-59   
task_completion_guidelines.md +0/-82   
tech_stack.md +0/-50   
telegram_identity_system_complete.md +0/-105 
telegram_points_conditional_requirement.md +0/-30   
telegram_points_implementation_decision.md +0/-75   

Summary by CodeRabbit

  • New Features

    • Added Storage Programs feature enabling decentralized key-value data storage with CREATE, READ, WRITE, DELETE, and UPDATE_ACCESS_CONTROL operations.
    • Implemented access control modes (private, public, restricted, deployer-only) and size/nesting constraints for storage program data.
  • Dependencies

    • Updated @kynesyslabs/demosdk from ^2.4.18 to ^2.4.24.
  • Chores

    • Updated project documentation and development guidelines.
    • Added build artifacts to .gitignore.

cwilvx and others added 5 commits October 21, 2025 10:30
+ check if twitter is connected before awarding points in PointSystem.ts
Fixed misleading error messages in crosschainOperation case that incorrectly referenced "storageProgram". The error logs and console output now correctly identify crosschainOperation failures.

- Updated log.error message
- Updated result.extra field
- Updated console.log message
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Nov 4, 2025

Caution

Review failed

Failed to post review comments

Walkthrough

Implements Storage Programs feature with comprehensive access control and size validation. Adds new RPC endpoint for querying storage data. Updates GCR entity schema to support storage metadata. Consolidates documentation. Bumps SDK dependency version. Updates gitignore.

Changes

Cohort / File(s) Summary
gitignore
.gitignore
Added five entries: build scripts, capture files, and traffic logs.
Documentation consolidation
.serena/memories/_index.md, .serena/memories/project_core.md, .serena/memories/development_guidelines.md, .serena/memories/project_purpose.md (deleted), .serena/memories/codebase_structure.md (deleted), .serena/memories/task_completion_guidelines.md (deleted), .serena/memories/tech_stack.md (deleted), .serena/memories/development_patterns.md (deleted), .serena/memories/session_final_2025_01_31.md, .serena/memories/session_final_checkpoint_2025_01_31.md (deleted), .serena/memories/session_checkpoint_2025_01_31.md (deleted), .serena/memories/project_patterns_telegram_identity_system.md (deleted), .serena/memories/telegram_identity_system_complete.md (deleted), .serena/memories/telegram_identity.md, .serena/memories/session_storage_review_2025_10_11.md, .serena/memories/storage_programs.md, .serena/memories/session_2025_10_10_telegram_group_membership.md (deleted), and 8 other memory files (deleted)
Consolidates memory system with new index, project core context, development guidelines, session checkpoints, and feature documentation. Removes deprecated memory records for completed tasks and superseded analyses.
Storage Programs feature
src/libs/blockchain/validators/validateStorageProgramAccess.ts (new), src/libs/blockchain/validators/validateStorageProgramSize.ts (new), src/libs/blockchain/gcr/handleGCR.ts, src/libs/network/routines/transactions/handleStorageProgramTransaction.ts (new), src/libs/network/endpointHandlers.ts, src/libs/network/manageNodeCall.ts, src/libs/network/server_rpc.ts
Implements storage program operations with access control (private/public/restricted/deployer-only modes), size/nesting/key-length validation, and GCR edit integration. Adds RPC endpoint for querying storage data with sender-based access checks.
Entity schema
src/model/entities/GCRv2/GCR_Main.ts
Added JSONB data column to GCRMain entity with nested structure for variables and metadata (programName, deployer, accessControl, allowedAddresses, timestamps, size).
Dependencies
package.json
Updated @kynesyslabs/demosdk from ^2.4.18 to ^2.4.24.

Sequence Diagram

sequenceDiagram
    participant Client
    participant RPC as server_rpc.ts
    participant Handler as handleStorageProgramTransaction.ts
    participant Validator as Validators
    participant GCR as handleGCR.ts
    participant DB as Database

    Client->>RPC: Execute storage program transaction
    RPC->>Handler: handleStorageProgramTransaction(payload, sender)
    Handler->>Validator: Validate operation & access control
    Validator-->>Handler: Validation result
    alt Validation fails
        Handler-->>RPC: Error response
        RPC-->>Client: Failed result
    else Validation succeeds
        Handler->>Validator: validateStorageProgramData(size/depth/keys)
        Validator-->>Handler: Data constraints valid
        Handler->>Handler: Create GCREdit (CREATE/WRITE/UPDATE_ACCESS_CONTROL/DELETE)
        Handler-->>RPC: { success, gcrEdits }
        RPC->>GCR: Apply storage program edits
        GCR->>Validator: Enforce access & size limits
        GCR->>DB: Persist GCRMain with data
        GCR-->>RPC: Success
        RPC-->>Client: Transaction confirmed
    end

    Client->>RPC: Query getStorageProgram (sender, address)
    RPC->>RPC: manageNodeCall(payload, sender)
    RPC->>DB: Load GCRMain
    RPC->>Validator: validateStorageProgramAccess(READ_STORAGE, sender)
    Validator-->>RPC: Access granted/denied
    alt Access denied
        RPC-->>Client: 403 Forbidden
    else Access granted
        RPC-->>Client: Program data + metadata
    end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

  • Access control model validation: Verify all four access modes (private, public, restricted, deployer-only) are correctly enforced across CREATE, WRITE, UPDATE_ACCESS_CONTROL, and DELETE operations.
  • Size validation integration: Confirm validateStorageProgramSize checks (MAX_SIZE_BYTES, MAX_NESTING_DEPTH, MAX_KEY_LENGTH) are applied consistently in both transaction and query paths, and defensive size validation in handleGCR.
  • GCR edit application logic: Review applyStorageProgramEdit method for state consistency, metadata updates (lastModified, size), and simulation vs. persistence logic across all operation types.
  • RPC endpoint sender handling: Verify sender parameter flows correctly through server_rpc → manageNodeCall → validateStorageProgramAccess for unauthenticated (UNAUTHENTICATED_SENDER) access scenarios.
  • Payload validation: Cross-check handleStorageProgramTransaction validation (programName format, data constraints, allowedAddresses patterns) for robustness against edge cases.
  • SDK compatibility: Confirm StorageProgramPayload and related types from @kynesyslabs/demosdk@2.4.24 align with current usage patterns.

Possibly related PRs

  • Integrated Discord Identity #464: Modifies manageNodeCall.ts and sender parameter forwarding — direct code-level integration with this PR's RPC sender handling.
  • Backup & Restore #404: Updates HandleGCR.ts and GCR entity schema — shares GCR edit application and entity structure patterns with this storage programs implementation.
  • Unified Crypto refactor #281: Modifies network RPC and node-call code paths for sender/signature handling — related at network request routing level.

Suggested labels

storage-programs, access-control, validation, rpc-feature, Review effort 4/5

Suggested reviewers

  • cwilvx

Poem

🐰 A storage program hatched,
With access guards well-matched,
Size and nesting checks take flight,
RPC endpoints burning bright,
Memory consolidated right,
Demos Network shines tonight!

Pre-merge checks and finishing touches

❌ Failed checks (1 inconclusive)
Check name Status Explanation Resolution
Title check ❓ Inconclusive The PR title 'Fixed error message duplication' is vague and does not clearly match the extensive changeset, which primarily involves storage program feature implementation (validators, transaction handlers, GCR extensions, endpoint integration), dependency updates, and large-scale documentation reorganization in .serena/memories/. Revise the title to reflect the primary changes, such as 'Add storage programs feature with validation and GCR integration' or 'Implement storage program transactions and update documentation structure' to better convey the scope of changes.
✅ Passed checks (1 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch claude/review-branches-011CUoGvVNuYb3xbJi5cdCUg

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link

github-actions bot commented Nov 4, 2025

⚠️ MCP Memory Files Detected

This PR modifies .serena/ files. After merge, these changes will be automatically reverted to preserve branch-specific MCP memories.

Files that will be reverted:

  • .serena/memories/_index.md
  • .serena/memories/code_style_conventions.md
  • .serena/memories/codebase_structure.md
  • .serena/memories/data_structure_robustness_completed.md
  • .serena/memories/development_guidelines.md
  • .serena/memories/development_patterns.md
  • .serena/memories/genesis_caching_security_dismissed.md
  • .serena/memories/input_validation_improvements_completed.md
  • .serena/memories/pr_review_all_high_priority_completed.md
  • .serena/memories/pr_review_analysis_complete.md
  • .serena/memories/pr_review_corrected_analysis.md
  • .serena/memories/pr_review_import_fix_completed.md
  • .serena/memories/pr_review_json_canonicalization_dismissed.md
  • .serena/memories/pr_review_point_system_fixes_completed.md
  • .serena/memories/pr_review_tg_identities_complete.md
  • .serena/memories/project_context_consolidated.md
  • .serena/memories/project_core.md
  • .serena/memories/project_patterns_telegram_identity_system.md
  • .serena/memories/project_purpose.md
  • .serena/memories/session_2025_10_10_telegram_group_membership.md
  • .serena/memories/session_checkpoint_2025_01_31.md
  • .serena/memories/session_final_2025_01_31.md
  • .serena/memories/session_final_checkpoint_2025_01_31.md
  • .serena/memories/session_storage_review_2025_10_11.md
  • .serena/memories/storage_programs.md
  • .serena/memories/task_completion_guidelines.md
  • .serena/memories/tech_stack.md
  • .serena/memories/telegram_identity.md
  • .serena/memories/telegram_identity_system_complete.md
  • .serena/memories/telegram_points_conditional_requirement.md
  • .serena/memories/telegram_points_implementation_decision.md

@qodo-code-review
Copy link
Contributor

qodo-code-review bot commented Nov 4, 2025

PR Compliance Guide 🔍

(Compliance updated until commit 32a34b5)

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

Previous compliance checks

Compliance check up to commit 32a34b5
Security Compliance
Log injection vulnerability

Description: Array payload validation occurs after logging potentially malicious data, allowing
injection of arbitrary content into logs before security checks are performed. endpointHandlers.ts [291-297]

Referred Code
if (!Array.isArray(payload) || payload.length < 2) {
    log.error("[handleExecuteTransaction] Invalid crosschainOperation payload structure")
    result.success = false
    result.response = { message: "Invalid payload structure" }
    result.extra = "Invalid crosschainOperation payload"
    break
}
Authentication bypass risk

Description: Empty string used as sentinel value for unauthenticated requests could be confused with
legitimate empty address, potentially bypassing access control if address validation is
not strict elsewhere. manageNodeCall.ts [216-220]

Referred Code
const accessCheck = validateStorageProgramAccess(
    "READ_STORAGE",
    sender || UNAUTHENTICATED_SENDER,
    storageProgram.data,
)
Denial of service risk

Description: JSON.stringify can throw on circular references or BigInt values without custom
serializer, potentially causing denial of service if malicious data structures are
submitted. validateStorageProgramSize.ts [19-28]

Referred Code
export function getDataSize(data: Record<string, any>): number {
    try {
        const jsonString = JSON.stringify(data)
        return new TextEncoder().encode(jsonString).length
    } catch (error) {
        throw new Error(
            `Cannot calculate data size: ${error instanceof Error ? error.message : String(error)}`,
        )
    }
}
Null pointer exception risk

Description: Setting metadata to null to signal deletion could cause null pointer exceptions in code
that expects metadata object to exist, potentially leading to application crashes. handleGCR.ts [535-538]

Referred Code
account.data = {
    variables: {},
    metadata: null, // Null metadata indicates the storage program has been deleted
}
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

🔴
Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status:
Stack Trace Exposure: Error handling exposes stack traces in error messages that could reveal internal
implementation details to users

Referred Code
            log.error(`[StorageProgram] Error applying edit: ${error instanceof Error ? `${error.message}
Stack: ${error.stack || "N/A"}` : String(error)}`)

@qodo-code-review
Copy link
Contributor

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
General
Use a flag for deletion

Instead of setting metadata to null upon deletion, add a deleted: true flag
within the metadata object to maintain a consistent data structure.

src/libs/blockchain/gcr/handleGCR.ts [535-538]

-account.data = {
-    variables: {},
-    metadata: null, // Null metadata indicates the storage program has been deleted
-}
+account.data.variables = {}
+account.data.metadata.deleted = true
+account.data.metadata.lastModified = Date.now()
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: The suggestion proposes a good practice for soft deletion by using a flag instead of nullifying an object, which improves data structure consistency and simplifies client-side logic.

Low
Avoid using magic numbers

Replace the hardcoded 128 for programName length validation with a named
constant defined in STORAGE_LIMITS to avoid using a magic number.

src/libs/network/routines/transactions/handleStorageProgramTransaction.ts [179-184]

-if (programName.length > 128) {
+if (programName.length > STORAGE_LIMITS.MAX_PROGRAM_NAME_LENGTH) {
     return {
         success: false,
-        message: "programName exceeds maximum length of 128 characters",
+        message: `programName exceeds maximum length of ${STORAGE_LIMITS.MAX_PROGRAM_NAME_LENGTH} characters`,
     }
 }
  • Apply / Chat
Suggestion importance[1-10]: 5

__

Why: This is a good suggestion for improving code maintainability by replacing a hardcoded magic number with a named constant, centralizing it with other related limits.

Low
Remove console logs from code

Remove the console.log statements from the crosschainOperation case to clean up
debugging code.

src/libs/network/endpointHandlers.ts [299-301]

 case "crosschainOperation":
     payload = tx.content.data
     if (!Array.isArray(payload) || payload.length < 2) {
         log.error("[handleExecuteTransaction] Invalid crosschainOperation payload structure")
         result.success = false
         result.response = { message: "Invalid payload structure" }
         result.extra = "Invalid crosschainOperation payload"
         break
     }
-    console.log("[Included CrossChain Operation Payload]")
-    console.log("[Included XM Chainscript]")
-    console.log(payload[1])
     // TODO Better types on answers
     var xmResult = await ServerHandlers.handleXMChainOperation(
         payload[0],
         payload[1],
         validatedData.data.transaction,
     )
     result.success = xmResult.success
     result.response = xmResult
     break

[To ensure code accuracy, apply this suggestion manually]

Suggestion importance[1-10]: 4

__

Why: The suggestion correctly identifies and recommends removing debugging console.log statements, which is a good practice for code hygiene before merging to production.

Low
  • More

@tcsenpai tcsenpai changed the base branch from testnet to storage November 4, 2025 18:04
@tcsenpai tcsenpai merged commit 75c8209 into storage Nov 4, 2025
4 of 5 checks passed
@tcsenpai tcsenpai deleted the claude/review-branches-011CUoGvVNuYb3xbJi5cdCUg branch November 4, 2025 18:05
This was referenced Nov 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants