Add DISABLE-TX-SUB configuration parameter

services/horizon/internal/actions/submit_transaction.go

@@ -24,6 +24,7 @@ type NetworkSubmitter interface {
 type SubmitTransactionHandler struct {
 	Submitter         NetworkSubmitter
 	NetworkPassphrase string
+	DisableTxSub      bool
 	CoreStateGetter
 }
 
@@ -155,6 +156,19 @@ func (handler SubmitTransactionHandler) GetResource(w HeaderWriter, r *http.Requ
 		return nil, hProblem.StaleHistory
 	}
 
+	if handler.DisableTxSub {
+		return nil, &problem.P{
+			Type:   "transaction_submission_disabled",
+			Title:  "Transaction Submission Disabled",
+			Status: http.StatusMethodNotAllowed,
+			Detail: "Transaction submission has been disabled for Horizon. " +
+				"To enable it again, set env variable DISABLE_TX_SUB to false.",
+			Extras: map[string]interface{}{
+				"envelope_xdr": raw,
+			},
+		}
+	}
+
 	submission := handler.Submitter.Submit(r.Context(), info.raw, info.parsed, info.hash)
 
 	select {

services/horizon/internal/actions/submit_transaction_test.go

@@ -20,6 +20,10 @@
 	"github.com/stretchr/testify/require"
 )
 
+const (
+	TransactionEnvelopeXDR = "AAAAAAGUcmKO5465JxTSLQOQljwk2SfqAJmZSG6JH6wtqpwhAAABLAAAAAAAAAABAAAAAAAAAAEAAAALaGVsbG8gd29ybGQAAAAAAwAAAAAAAAAAAAAAABbxCy3mLg3hiTqX4VUEEp60pFOrJNxYM1JtxXTwXhY2AAAAAAvrwgAAAAAAAAAAAQAAAAAW8Qst5i4N4Yk6l+FVBBKetKRTqyTcWDNSbcV08F4WNgAAAAAN4Lazj4x61AAAAAAAAAAFAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABLaqcIQAAAEBKwqWy3TaOxoGnfm9eUjfTRBvPf34dvDA0Nf+B8z4zBob90UXtuCqmQqwMCyH+okOI3c05br3khkH0yP4kCwcE"
+)
+
 func TestStellarCoreMalformedTx(t *testing.T) {
 	handler := SubmitTransactionHandler{}
 
@@ -153,3 +157,52 @@
 	_, err = handler.GetResource(w, request)
 	assert.Equal(t, hProblem.ClientDisconnected, err)
 }
+
+func TestDisableTxSubFlagSubmission(t *testing.T) {
+	mockSubmitChannel := make(chan txsub.Result)
+
+	mock := &coreStateGetterMock{}
+	mock.On("GetCoreState").Return(corestate.State{
+		Synced: true,
+	})
+
+	mockSubmitter := &networkSubmitterMock{}
+	mockSubmitter.On("Submit").Return(mockSubmitChannel)
+
+	handler := SubmitTransactionHandler{
+		Submitter:         mockSubmitter,
+		NetworkPassphrase: network.PublicNetworkPassphrase,
+		DisableTxSub:      true,
+		CoreStateGetter:   mock,
+	}
+
+	form := url.Values{}
+	form.Set("tx", TransactionEnvelopeXDR)
+
+	var p = &problem.P{
+		Type:   "transaction_submission_disabled",
+		Title:  "Transaction Submission Disabled",
+		Status: http.StatusMethodNotAllowed,
+		Detail: "Transaction submission has been disabled for Horizon. " +
+			"To enable it again, set env variable DISABLE_TX_SUB to false.",
+		Extras: map[string]interface{}{
+			"envelope_xdr": TransactionEnvelopeXDR,
+		},
+	}
+
+	request, err := http.NewRequest(
+		"POST",
+		"https://horizon.stellar.org/transactions",
+		strings.NewReader(form.Encode()),
+	)
+
+	require.NoError(t, err)
+	request.Header.Add("Content-Type", "application/x-www-form-urlencoded")
+	ctx, cancel := context.WithCancel(request.Context())
+	cancel()
+	request = request.WithContext(ctx)
+
+	w := httptest.NewRecorder()
+	_, err = handler.GetResource(w, request)
+	assert.Equal(t, p, err)
+}

services/horizon/internal/app.go

@@ -512,22 +512,24 @@ func (a *App) init() error {
 	initTxSubMetrics(a)
 
 	routerConfig := httpx.RouterConfig{
-		DBSession:               a.historyQ.SessionInterface,
-		TxSubmitter:             a.submitter,
-		RateQuota:               a.config.RateQuota,
-		BehindCloudflare:        a.config.BehindCloudflare,
-		BehindAWSLoadBalancer:   a.config.BehindAWSLoadBalancer,
-		SSEUpdateFrequency:      a.config.SSEUpdateFrequency,
-		StaleThreshold:          a.config.StaleThreshold,
-		ConnectionTimeout:       a.config.ConnectionTimeout,
-		NetworkPassphrase:       a.config.NetworkPassphrase,
-		MaxPathLength:           a.config.MaxPathLength,
-		MaxAssetsPerPathRequest: a.config.MaxAssetsPerPathRequest,
-		PathFinder:              a.paths,
-		PrometheusRegistry:      a.prometheusRegistry,
-		CoreGetter:              a,
-		HorizonVersion:          a.horizonVersion,
-		FriendbotURL:            a.config.FriendbotURL,
+		DBSession:                a.historyQ.SessionInterface,
+		TxSubmitter:              a.submitter,
+		RateQuota:                a.config.RateQuota,
+		BehindCloudflare:         a.config.BehindCloudflare,
+		BehindAWSLoadBalancer:    a.config.BehindAWSLoadBalancer,
+		SSEUpdateFrequency:       a.config.SSEUpdateFrequency,
+		StaleThreshold:           a.config.StaleThreshold,
+		ConnectionTimeout:        a.config.ConnectionTimeout,
+		NetworkPassphrase:        a.config.NetworkPassphrase,
+		MaxPathLength:            a.config.MaxPathLength,
+		MaxAssetsPerPathRequest:  a.config.MaxAssetsPerPathRequest,
+		PathFinder:               a.paths,
+		PrometheusRegistry:       a.prometheusRegistry,
+		CoreGetter:               a,
+		HorizonVersion:           a.horizonVersion,
+		FriendbotURL:             a.config.FriendbotURL,
+		EnableIngestionFiltering: a.config.EnableIngestionFiltering,
+		DisableTxSub:             a.config.DisableTxSub,
 		HealthCheck: healthCheck{
 			session: a.historyQ.SessionInterface,
 			ctx:     a.ctx,
@@ -537,7 +539,6 @@ func (a *App) init() error {
 			},
 			cache: newHealthCache(healthCacheTTL),
 		},
-		EnableIngestionFiltering: a.config.EnableIngestionFiltering,
 	}
 
 	if a.primaryHistoryQ != nil {

services/horizon/internal/config.go

@@ -114,5 +114,6 @@ type Config struct {
 	// RoundingSlippageFilter excludes trades from /trade_aggregations with rounding slippage >x bps
 	RoundingSlippageFilter int
 	// Stellar network: 'testnet' or 'pubnet'
-	Network string
+	Network      string
+	DisableTxSub bool
 }

services/horizon/internal/flags.go

@@ -51,8 +51,9 @@ const (
 	// HistoryArchiveURLsFlagName is the command line flag for specifying the history archive URLs
 	HistoryArchiveURLsFlagName = "history-archive-urls"
 	// NetworkFlagName is the command line flag for specifying the "network"
-	NetworkFlagName              = "network"
-	EnableIngestionFilteringFlag = "exp-enable-ingestion-filtering"
+	NetworkFlagName                  = "network"
+	EnableIngestionFilteringFlagName = "exp-enable-ingestion-filtering"
+	DisableTxSubFlagName             = "disable-tx-sub"
 
 	captiveCoreMigrationHint = "If you are migrating from Horizon 1.x.y, start with the Migration Guide here: https://developers.stellar.org/docs/run-api-server/migrating/"
 	// StellarPubnet is a constant representing the Stellar public network
@@ -146,6 +147,15 @@ func Flags() (*Config, support.ConfigOptions) {
 			Usage:       "path to stellar core binary, look for the stellar-core binary in $PATH by default.",
 			ConfigKey:   &config.CaptiveCoreBinaryPath,
 		},
+		&support.ConfigOption{
+			Name:        DisableTxSubFlagName,
+			OptType:     types.Bool,
+			FlagDefault: false,
+			Required:    false,
+			Usage:       "disables the transaction submission functionality of Horizon.",
+			ConfigKey:   &config.DisableTxSub,
+			Hidden:      true,
+		},
 		&support.ConfigOption{
 			Name:        captiveCoreConfigAppendPathName,
 			OptType:     types.String,
@@ -211,7 +221,7 @@ func Flags() (*Config, support.ConfigOptions) {
 			ConfigKey:   &config.EnableCaptiveCoreIngestion,
 		},
 		&support.ConfigOption{
-			Name:        EnableIngestionFilteringFlag,
+			Name:        EnableIngestionFilteringFlagName,
 			OptType:     types.Bool,
 			FlagDefault: true,
 			Required:    false,
@@ -251,7 +261,7 @@ func Flags() (*Config, support.ConfigOptions) {
 				if existingValue == "" || existingValue == "." {
 					cwd, err := os.Getwd()
 					if err != nil {
-						return fmt.Errorf("Unable to determine the current directory: %s", err)
+						return fmt.Errorf("unable to determine the current directory: %s", err)
 					}
 					existingValue = cwd
 				}
@@ -388,7 +398,7 @@ func Flags() (*Config, support.ConfigOptions) {
 			CustomSetValue: func(co *support.ConfigOption) error {
 				ll, err := logrus.ParseLevel(viper.GetString(co.Name))
 				if err != nil {
-					return fmt.Errorf("Could not parse log-level: %v", viper.GetString(co.Name))
+					return fmt.Errorf("could not parse log-level: %v", viper.GetString(co.Name))
 				}
 				*(co.ConfigKey.(*logrus.Level)) = ll
 				return nil
@@ -798,6 +808,14 @@ func setCaptiveCoreConfiguration(config *Config) error {
 		config.StellarCoreURL = fmt.Sprintf("http://localhost:%d", config.CaptiveCoreToml.HTTPPort)
 	}
 
+	if !config.DisableTxSub {
+		if config.Network == "" && (config.NetworkPassphrase == "" || len(config.HistoryArchiveURLs) == 0) {
+			return fmt.Errorf("invalid config: --%s set to false but no --%s flag or "+
+				"ingestion parameters set (--%s and --%s)", DisableTxSubFlagName, NetworkFlagName,
+				NetworkPassphraseFlagName, HistoryArchiveURLsFlagName)
+		}
+	}
+
 	return nil
 }
 
@@ -820,8 +838,6 @@ func ApplyFlags(config *Config, flags support.ConfigOptions, options ApplyOption
 		config.Ingest = true
 	}
 
-	config.EnableIngestionFiltering = true
-
 	if config.Ingest {
 		// Migrations should be checked as early as possible. Apply and check
 		// only on ingesting instances which are required to have write-access
@@ -849,11 +865,12 @@ func ApplyFlags(config *Config, flags support.ConfigOptions, options ApplyOption
 			if viper.GetString(CaptiveCoreConfigPathName) != "" {
 				captiveCoreConfigFlag = CaptiveCoreConfigPathName
 			}
-			return fmt.Errorf("Invalid config: one or more captive core params passed (--%s or --%s) but --ingest not set. "+captiveCoreMigrationHint,
+			return fmt.Errorf("invalid config: one or more captive core params passed (--%s or --%s) but --ingest not set"+captiveCoreMigrationHint,
 				StellarCoreBinaryPathName, captiveCoreConfigFlag)
 		}
 		if config.StellarCoreDatabaseURL != "" {
-			return fmt.Errorf("Invalid config: --%s passed but --ingest not set. ", StellarCoreDBURLFlagName)
+			return fmt.Errorf("invalid config: --%s passed but --ingest not setcccccbgkvrnudnhglgvtnbcnunfghkgkjrdvrcekflli"+
+				"", StellarCoreDBURLFlagName)
 		}
 	}
 
@@ -863,7 +880,7 @@ func ApplyFlags(config *Config, flags support.ConfigOptions, options ApplyOption
 		if err == nil {
 			log.DefaultLogger.SetOutput(logFile)
 		} else {
-			return fmt.Errorf("Failed to open file to log: %s", err)
+			return fmt.Errorf("failed to open file to log: %s", err)
 		}
 	}
 
@@ -878,7 +895,8 @@ func ApplyFlags(config *Config, flags support.ConfigOptions, options ApplyOption
 	}
 
 	if config.BehindCloudflare && config.BehindAWSLoadBalancer {
-		return fmt.Errorf("Invalid config: Only one option of --behind-cloudflare and --behind-aws-load-balancer is allowed. If Horizon is behind both, use --behind-cloudflare only.")
+		return fmt.Errorf("invalid config: Only one option of --behind-cloudflare and --behind-aws-load-balancer is allowed." +
+			" If Horizon is behind both, use --behind-cloudflare only")
 	}
 
 	return nil

services/horizon/internal/flags_test.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"testing"
 
+	support "github.com/stellar/go/support/config"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -131,3 +132,34 @@ func Test_createCaptiveCoreConfig(t *testing.T) {
 		})
 	}
 }
+
+func TestInvalidConfigOutputFromApplyFlags(t *testing.T) {
+	_, flags := Flags()
+
+	tests := []struct {
+		name    string
+		config  Config
+		flags   support.ConfigOptions
+		options ApplyOptions
+		errStr  string
+	}{
+		{
+			name: "disable-tx-sub set to false and no network and ingestion params set",
+			config: Config{
+				NetworkPassphrase:  "",
+				HistoryArchiveURLs: []string{},
+				DisableTxSub:       false,
+			},
+			flags:   flags,
+			options: ApplyOptions{RequireCaptiveCoreConfig: true, AlwaysIngest: false},
+			errStr: "invalid config: --disable-tx-sub set to false but ingestion has been disabled." +
+				"Set INGEST=true to enable transaction submission functionality",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := ApplyFlags(&tt.config, tt.flags, tt.options)
+			assert.Error(t, e, tt.errStr)
+		})
+	}
+}

services/horizon/internal/httpx/router.go

@@ -48,6 +48,7 @@ type RouterConfig struct {
 	FriendbotURL             *url.URL
 	HealthCheck              http.Handler
 	EnableIngestionFiltering bool
+	DisableTxSub             bool
 }
 
 type Router struct {
@@ -319,6 +320,7 @@ func (r *Router) addRoutes(config *RouterConfig, rateLimiter *throttled.HTTPRate
 	r.Method(http.MethodPost, "/transactions", ObjectActionHandler{actions.SubmitTransactionHandler{
 		Submitter:         config.TxSubmitter,
 		NetworkPassphrase: config.NetworkPassphrase,
+		DisableTxSub:      config.DisableTxSub,
 		CoreStateGetter:   config.CoreGetter,
 	}})
 

services/horizon/internal/integration/parameters_test.go

@@ -433,7 +433,7 @@ func TestDeprecatedOutputForIngestionFilteringFlag(t *testing.T) {
 		"the same no-filtering result. Remove usage of this flag in all cases.")
 }
 
-func TestHelpOutputForNoIngestionFilteringFlag(t *testing.T) {
+func TestHelpOutput(t *testing.T) {
 	config, flags := horizon.Flags()
 
 	horizonCmd := &cobra.Command{
@@ -461,9 +461,9 @@ func TestHelpOutputForNoIngestionFilteringFlag(t *testing.T) {
 	if err := horizonCmd.Execute(); err != nil {
 		fmt.Println(err)
 	}
-
 	output := writer.(*bytes.Buffer).String()
 	assert.NotContains(t, output, "--exp-enable-ingestion-filtering")
+	assert.NotContains(t, output, "--disable-tx-sub")
 }
 
 // validateNoBucketDirPath ensures the Stellar Core auto-generated configuration