feat: DELETE THIS

This commit is contained in:
2026-05-14 02:23:45 +03:00
parent 2e2af07223
commit bb28fa3574
8 changed files with 63 additions and 45 deletions

View File

@@ -3,6 +3,7 @@ import { env } from '../config/env';
import { logger } from '../lib/logger';
import { WalletModel } from '../models/wallet.model';
import type { ChainCode } from '../lib/address-validators';
import { FIXED_API_USER_ID } from '../middleware/fixed-user';
const router = Router();
const RELAY_API_URL = 'https://api.relay.link';
@@ -57,11 +58,7 @@ async function proxyRelayRequest(req: Request, res: Response, next: NextFunction
// Без этого authenticated user может set recipient=attacker → Relay строит quote →
// victim signs → bridge funds к attacker'у.
if (req.method === 'POST' && (relayPath === '/quote' || relayPath.startsWith('/execute/'))) {
const userId = (req as any).auth?.userId;
if (!userId) {
res.status(401).json({ success: false, error: 'auth required' });
return;
}
const userId = FIXED_API_USER_ID;
const bodyUser = req.body?.user;
const bodyRecipient = req.body?.recipient;
const originChainId = Number(req.body?.originChainId);