Implement Request Replay Tool Safety Guardrails

[maugauwi-hash]

Labels: bug, security, testing
Priority: High
Estimated Time: 1.5 hours

Description:
backend/src/replay.rs and docs/request-replay.md support replaying captured requests for debugging, but replaying a captured write request (e.g., a withdrawal request) against production could cause unintended state changes.

Tasks:

• Add a dry-run mode that reports intended effects without executing writes
• Require explicit confirmation and elevated auth for replaying write requests
• Add tests for read-only replay and gated write replay
• Document safety guardrails in docs/request-replay.md

[KingDavid9999]

@KingDavid9999 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer, I'd very much appreciate the opportunity to work on this issue.
Having reviewed the acceptance criteria, I'm confident that I'd be able to have a PR up shortly after being assigned.
Kindly assign this issue to me.
Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @KingDavid9999 to this issue.

[Neziahtech]

@Neziahtech has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello,

I’d love to take this issue on. I’m a full-stack developer with experience across Drips Waves 3–7, and the GrantFox oficiall 1 and2 campaign.

My stack includes Rust, Soroban, Solidity, and TypeScript. I can deliver a clean, tested, and well-documented solution within 24 hours of assignment.

Happy to start immediately.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Neziahtech to this issue.

[Alimzy]

@Alimzy has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi! I'd like to work on this issue.

I'm a software engineer with hands-on experience in testing, debugging, and building reliable features across the stack. I'm confident I can take this on and deliver a solid, well-tested solution that follows the project's existing conventions.

I'll make sure to cover the core functionality as well as relevant edge cases to keep things reliable and regression-resistant.

Let me know if I can get started, and I'll provide updates as I progress.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Alimzy to this issue.

[DEVBFF15]

@DEVBFF15 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I understand your project issue as stated below and let me know if i'm missing anything:
The replay.rs / request-replay.md tooling lets developers replay captured requests for debugging but there's no distinction between read and write requests. If someone replays a captured write request (like a withdrawal) against production, it will actually re-execute that state change. There's a real risk of accidental double-withdrawals, duplicate transactions, or other unintended side effects, since replay was built for debugging convenience, not safety.

I investigated the reported issue already and have a solid understanding of the expected result. I'll ensure the implementation is both efficient and maintainable.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @DEVBFF15 to this issue.