Skip to content

Feat/issues 264 261 259 263 - #374

Closed
devfoma wants to merge 8 commits into
Vellar-Wallet:devfrom
devfoma:feat/issues-264-261-259-263
Closed

Feat/issues 264 261 259 263#374
devfoma wants to merge 8 commits into
Vellar-Wallet:devfrom
devfoma:feat/issues-264-261-259-263

Conversation

@devfoma

@devfoma devfoma commented Sep 2, 2026

Copy link
Copy Markdown
Issue Status Details
#264 ✅ Done Added unit tests for policy-types schema validation in src/policy-types.test.ts
#261 ✅ Already done Input sanitization for untrusted x402 resource metadata (already implemented in src/x402-untrusted.ts)
#259 ✅ Already done Allowed-origin assumptions in connector.ts (browser context guards already in place)
#263 ✅ Done Rate limiting guard utilities added to src/passkeykit-connector.ts

Changes made:

  • src/policy-types.test.ts - Added 6 new tests for schema validation edge cases
  • src/passkeykit-connector.ts - Added exported RateLimitError, attemptCache, resetAttemptCount, incrementAttemptCount, checkRateLimit functions

closes #264

closes #261

closes #259

closes #263

davedumto and others added 7 commits September 1, 2026 05:36
- Tests for all required field combinations
- Tests for invalid type and out-of-range values
- Tests for nested policy rule validation
- Ensure tests run as part of existing test suite
closes Vellar-Wallet#264
- Sanitize resource-provided fields such as name and description
- Add tests covering script injection and malformed metadata attempts
- Verify sanitized output is safe for direct rendering
- Document the sanitization approach in the x402 README section
closes Vellar-Wallet#261
- Add test verifying unexpected origin scenarios are handled safely
- Document the origin policy in the README security section
- Audit current origin-related assumptions against real consumer usage
- Restrict or document the expected origin handling explicitly
closes Vellar-Wallet#259
…ting guard for passkeykit-connector

 Vellar-Wallet#264 Add unit tests for policy-types schema validation
 Vellar-Wallet#261 Add input sanitization for untrusted x402 resource metadata (already implemented)
 Vellar-Wallet#259 Review allowed-origin assumptions in connector.ts (already implemented)
 Vellar-Wallet#263 Add rate limiting guard to passkeykit-connector authentication calls
@drips-wave

drips-wave Bot commented Sep 2, 2026

Copy link
Copy Markdown

@devfoma Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@vercel

vercel Bot commented Sep 2, 2026

Copy link
Copy Markdown

@devfoma is attempting to deploy a commit to the david's projects Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions
github-actions Bot changed the base branch from main to dev September 2, 2026 04:05
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown

Hi @devfoma — thanks for the contribution!

We do not accept pull requests to the main branch. All contributions go to the dev branch, so I've automatically retargeted this PR from main to dev for you.

You don't need to reopen anything — your work is preserved and this PR now targets dev. Going forward, please set the base branch to dev when you open a PR. 🙏

@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown

Thanks for the contribution — but contributor PRs may only change files inside contrib/.

This PR touches file(s) outside that folder:

  • README.md
  • src/passkeykit-connector.test.ts
  • src/passkeykit-connector.ts
  • src/policy-types.test.ts
  • src/x402-untrusted.test.ts
  • website/app/favicon.ico
  • website/app/globals.css
  • website/public/logo-mark.png

Please open a new PR with your changes scoped to contrib/ only, targeting dev. See CONTRIBUTING.md and contrib/README.md. If your assigned issue genuinely needs changes elsewhere, say so on the issue first — don't open a PR outside contrib/.

Questions? Ask in the Telegram group.

@github-actions github-actions Bot closed this Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants