Merge branch 'staging' into 270-sim-contract-methods

.github/workflows/backend_integration_tests_pr.yml

@@ -67,15 +67,28 @@ jobs:
       - name: Wait for services to be up
         timeout-minutes: 5
         run: |
-          while ! curl -X POST -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"ping","params":[],"id":1}' http://0.0.0.0:4000/api > /dev/null; do
-            echo "Waiting for rpc server..."
-            sleep 5
+          timeout=60
+          counter=0
+          while [[ "$counter" -lt "$timeout" ]]; do
+            if curl -X POST -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"ping","params":[],"id":1}' http://0.0.0.0:4000/api | grep -q "OK"; then
+              echo "RPC server is up!"
+              break
+            else
+              echo "Waiting for RPC server... ($counter/$timeout)"
+              sleep 5
+              counter=$((counter+1))
+            fi
           done
+          # Fail if the service didn't start within the timeout
+          if [[ "$counter" -ge "$timeout" ]]; then
+            echo "Error: Timeout while waiting for RPC server"
+            exit 1
+          fi
 
       - name: Set up Python
         uses: actions/setup-python@v2
         with:
-          python-version: 3.12.2
+          python-version: 3.12.4
 
       - name: Install dependencies
         run: |

.github/workflows/test-semgrep.yml

@@ -0,0 +1,36 @@
+name: Semgrep OSS scan
+
+on:
+  push:
+    branches:
+      - main
+      - staging
+  schedule:
+    - cron: '00 18 * * *' # Sets Semgrep to scan every day at 18:00 UTC.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  semgrep:
+    name: semgrep-oss/scan
+    runs-on: ubuntu-latest
+    container:
+      # A Docker image with Semgrep installed. Do not change this.
+      image: semgrep/semgrep
+
+    # Skip any PR created by dependabot to avoid permission issues:
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: semgrep_scan
+        run: semgrep scan --config auto --sarif > semgrep.sarif
+
+      - name: Upload SARIF file for GitHub Advanced Security Dashboard
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: semgrep.sarif
+        if: always()

.github/workflows/test-sonarqube.yml

@@ -0,0 +1,20 @@
+name: Run SonarCloud Scan
+
+on:
+  push:
+    branches:
+      - staging
+  workflow_dispatch:
+
+jobs:
+  SonarCloud-Scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: SonarCloud Scan
+        uses: sonarsource/[email protected]
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

backend/database_handler/migration/README.md

@@ -1,18 +1,22 @@
 ## Pre-requisites
 
-1. set your virtual environment
-1. `pip install -r requirements.txt`
+### Window One
+1. Launch the simulator
 
-## User guide
-
-1. Change the `model`
-1. Set your current working directory to `backend/database_handler`
-1. Run `alembic revision --autogenerate -m "migration name here"` to generate the migration file
-1. Modify the migration file if needed
-1. Apply the migration: we have different options here
-   - [preferred] If using `docker-compose`, run `docker-compose up database-migration --build`
+### Window Two
+1. Set your virtual environment
+2. Pip install `pip install -r backend/database_handler/requirements.txt`
+3. Update the "models" at `models.py` with your preferences
+4. Set your current working directory to `backend/database_handler`
+5. Run `alembic revision --autogenerate -m "migration name here"` to generate the migration file
+6. Modify the migration file if needed
+7. Apply the migration: we have different options here
+   - [preferred] If using `docker-compose`, run `docker compose up database-migration --build`
    - Run `alembic upgrade head` to "manually" apply the migration
 
+## Revert migrations
+To revert the latest migration, run `alembic downgrade -1`
+
 ## Docs
 
 - [Alembic](https://alembic.sqlalchemy.org/en/latest/)

backend/database_handler/migration/versions/d9ddc7436122_changed_validators_stage_property_to_int.py

@@ -0,0 +1,65 @@
+"""changed validators stage property to int
+
+Revision ID: d9ddc7436122
+Revises: 02aa0c34a463
+Create Date: 2024-08-06 14:26:15.737405
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "d9ddc7436122"
+down_revision: Union[str, None] = "02aa0c34a463"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    connection = op.get_bind()
+
+    column_name = "stake"
+    id_column = "id"
+    table_name = "validators"
+
+    result = connection.execute(
+        sa.text(f"SELECT {id_column}, {column_name} FROM {table_name}")
+    )
+
+    for [id, value] in result:
+        int_value = int(value)
+        new_value = int_value if int_value > 0 else 1
+        print(f"Updating {table_name} {id} with `{new_value}`")
+        # Update the row
+        connection.execute(
+            sa.text(
+                f"UPDATE {table_name} SET {column_name} = :value WHERE {id_column} = :id"
+            ),
+            {"value": new_value, id_column: id},
+        )
+
+    op.alter_column(
+        "validators",
+        "stake",
+        existing_type=sa.NUMERIC(),
+        type_=sa.Integer(),
+        existing_nullable=False,
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column(
+        "validators",
+        "stake",
+        existing_type=sa.Integer(),
+        type_=sa.NUMERIC(),
+        existing_nullable=False,
+    )
+    # ### end Alembic commands ###

backend/database_handler/models.py

@@ -85,10 +85,13 @@ class TransactionsAudit(Base):
 
 class Validators(Base):
     __tablename__ = "validators"
-    __table_args__ = (PrimaryKeyConstraint("id", name="validators_pkey"),)
+    __table_args__ = (
+        PrimaryKeyConstraint("id", name="validators_pkey"),
+        CheckConstraint("stake >= 0", name="stake_unsigned_int"),
+    )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True)
-    stake: Mapped[decimal.Decimal] = mapped_column(Numeric)
+    stake: Mapped[int] = mapped_column(Integer)
     config: Mapped[dict] = mapped_column(JSONB)
     address: Mapped[Optional[str]] = mapped_column(String(255))
     provider: Mapped[Optional[str]] = mapped_column(String(255))

docker-compose.yml

@@ -11,6 +11,7 @@ services:
       - jsonrpc
     expose:
       - "${FRONTEND_PORT}"
+
   jsonrpc:
     build:
       context: ./
@@ -59,6 +60,7 @@ services:
     pull_policy: always
     tty: true
     restart: always
+
   postgres:
     build:
       context: ./

docker/Dockerfile.backend

@@ -2,21 +2,24 @@ FROM python:3.12.2-slim AS base
 
 ARG path=/app
 
+RUN mkdir $path
 WORKDIR $path
 
 ADD backend/protocol_rpc/requirements.txt backend/protocol_rpc/requirements.txt
 RUN pip install --no-cache-dir -r backend/protocol_rpc/requirements.txt
 
 ENV PYTHONPATH "${PYTHONPATH}:/${path}"
 ENV FLASK_APP=backend/protocol_rpc/server.py
+RUN groupadd -r backend-user && useradd -r -g backend-user backend-user \
+    && chown -R backend-user:backend-user $path
 
 COPY ../.env .
 COPY backend $path/backend
 
 ###########START NEW IMAGE : DEBUGGER ###################
 FROM base AS debug
 RUN pip install --no-cache-dir debugpy watchdog
-
+USER backend-user
 CMD watchmedo auto-restart --recursive --pattern="*.py" --ignore-patterns="*.pyc;*__pycache__*" -- python -m debugpy --listen 0.0.0.0:${RPCDEBUGPORT} -m flask run -h 0.0.0.0 -p ${FLASK_SERVER_PORT}
 
 ###########START NEW IMAGE: PRODUCTION ###################

docker/Dockerfile.database

@@ -1,9 +1,9 @@
-# Use the official PostgreSQL image from the Docker Hub
-FROM postgres:12.17
+# Use the official PostgreSQL image with Alpine linux from the Docker Hub
+FROM postgres:12.19-alpine
 
 # Set the working directory in the container
 WORKDIR /docker-entrypoint-initdb.d
 
 # Copy the initialization script or SQL file into the container
 # It should be an SQL file or a shell script that runs SQL commands
-COPY ./backend/database_handler/initialization/init-db.sql /docker-entrypoint-initdb.d/
+COPY ./backend/database_handler/initialization/init-db.sql /docker-entrypoint-initdb.d/

docker/Dockerfile.frontend

@@ -1,16 +1,21 @@
-FROM node:21.5.0-slim
-
+FROM node:21.7.3-alpine3.20 AS builder
+RUN 
 WORKDIR /app
-
-COPY /frontend/package*.json .
-
-RUN npm i
-
+COPY ./frontend/package*.json .
+RUN npm ci --cache /tmp/empty-cache && \
+    npm cache clean --force && \
+    rm -rf /tmp/empty-cache
 COPY ./frontend .
 COPY ./examples src/assets/examples
 COPY ./.env .
 RUN npm run build
 
+FROM alpine:latest AS final
+RUN apk add --no-cache nodejs npm && \
+    addgroup --system frontend-user && adduser --system --ingroup frontend-user frontend-user && \
+    mkdir /app && chown -R frontend-user:frontend-user /app
+WORKDIR /app
+COPY --from=builder --chown=frontend-user:frontend-user /app /app
+USER frontend-user
 EXPOSE 8080
-
 CMD [ "npm", "run", "preview" ]

docker/Dockerfile.webrequest

@@ -1,33 +1,25 @@
-FROM --platform=linux/amd64 python:3.8
-
-RUN apt update
-RUN apt upgrade -y
-
-RUN apt install wget python3 pip -y
-
-RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add -
-RUN echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list
-RUN apt-get update && apt-get install -y google-chrome-stable
-RUN google-chrome --version
-
-ARG base=/app
-ARG path=webrequest
-
-RUN mkdir $base
+FROM --platform=linux/amd64 python:3.12-slim
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends wget gnupg && \
+    wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - && \
+    echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends google-chrome-stable && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    useradd -m appuser
+
+ENV base=/app
+ENV path=webrequest
+ENV PYTHONPATH="${base}/${path}"
+ENV PATH="${PATH}:${base}"
+RUN mkdir -p $base && chown -R appuser:appuser $base
+
+USER appuser
 WORKDIR $base
-
-COPY ../.env .
-# TODO: Logging loaded here
-
-ADD $path $base/$path
-#ADD common $path/common
-
+COPY --chown=appuser:appuser ../.env .
+COPY --chown=appuser:appuser $path $base/$path
 RUN pip install --no-cache-dir -r $path/requirements.txt
-
-ENV PYTHONPATH "${base}/${path}"
-ENV PATH "${PATH}:/${base}"
-
 WORKDIR $path
-
-# You only need to specify python3 because it is an ubuntu image
-CMD ["python3", "server.py"]
+CMD ["python3", "server.py"]

frontend/src/components/Simulator/ValidatorModal.vue

@@ -161,11 +161,12 @@ const tryInitValues = () => {
         :step="1"
         :invalid="newValidatorData.stake < 1"
         v-model="newValidatorData.stake"
+        :forceInteger="true"
         required
         testId="input-stake"
       />
       <FieldError v-if="newValidatorData.stake < 1"
-        >Please enter a number greater than 0.</FieldError
+        >Please enter an integer greater than 0.</FieldError
       >
     </div>