chore(indexer): verify call with alchemy signing key

[gaboesquivel]

Summary by Sourcery

Update the Alchemy webhook signature validation to use the 'activitySigningKey' from the configuration instead of the previous 'alchemySecretKey'.

Enhancements:

• Update the Alchemy signature validation to use a new signing key configuration.

Summary by CodeRabbit

• New Features

  • Updated configuration for Alchemy integration to enhance security and organization.
  • Introduced a new activity signing key for improved authentication with Alchemy services.

• Bug Fixes

  • Modified key for HMAC generation in the Alchemy signature validation process, ensuring a more secure validation method.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
bitlauncher	🔄 Building (Inspect)	Visit Preview	💬 Add feedback	Aug 21, 2024 10:22pm
smartsale-faucet	🔄 Building (Inspect)	Visit Preview	💬 Add feedback	Aug 21, 2024 10:22pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The recent changes involve a reconfiguration of the Alchemy integration within the application. The key used for authentication has been modified from ALCHEMY_SECRET_KEY to ALCHEMY_ACTIVITY_SIGNING_KEY, indicating an updated approach to security. This adjustment impacts how the application accesses Alchemy services, emphasizing activity signing. Additionally, the configuration structure has been refined for better organization, improving the clarity and scalability of the setup.

Changes

Files	Change Summary
apps/indexer/.env-sample	Changed ALCHEMY_SECRET_KEY to ALCHEMY_ACTIVITY_SIGNING_KEY for updated Alchemy integration.
apps/indexer/src/config.ts	Reorganized appConfig to include a nested alchemy object with activitySigningKey.
apps/indexer/src/routes/alchemy.ts	Updated validateAlchemySignature to use activitySigningKey instead of alchemySecretKey.

Poem

🐰 In a world where keys do gleam,
A signing key now reigns supreme!
With structure neat, like carrot rows,
Our Alchemy dance, it brightly glows.
So hop along, let changes sing,
For boundless joy that they can bring! 🌟

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

• X
• Mastodon
• Reddit
• LinkedIn

Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai generate interesting stats about this repository and render them as a table.
  • @coderabbitai show all the console.log statements in this repository.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (invoked as PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request updates the Alchemy webhook signature verification process in the indexer application. The main changes involve renaming and restructuring the Alchemy secret key configuration, and updating the corresponding code that uses this key for signature validation.

File-Level Changes

Files	Changes
apps/indexer/src/config.ts	Renamed the Alchemy secret key configuration from 'alchemySecretKey' to 'alchemy.activitySigningKey'
apps/indexer/src/routes/alchemy.ts	Updated the HMAC creation to use the new 'alchemy.activitySigningKey' configuration
apps/indexer/src/config.ts	Restructured the Alchemy-related configuration in the appConfig object

---

Tips

• Trigger a new Sourcery review by commenting @sourcery-ai review on the pull request.
• Continue your discussion with Sourcery by replying directly to review comments.
• You can change your review settings at any time by accessing your dashboard:
  • Enable or disable the Sourcery-generated pull request summary or reviewer's guide;
  • Change the review language;
• You can always contact us if you have any questions or feedback.

[sourcery-ai]

Hey @gaboesquivel - I've reviewed your changes and they look great!

Here's what I looked at during the review

• 🟡 General issues: 1 issue found
• 🟢 Security: all looks good
• 🟢 Testing: all looks good
• 🟢 Complexity: all looks good
• 🟢 Documentation: all looks good

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment to tell me if it was helpful.}

[sourcery-ai]

suggestion (bug_risk): Consider more robust error handling for missing environment variables.

Instead of defaulting to an empty string, it might be better to throw an error or use a more explicit default value for critical configuration items like signing keys. This could prevent silent failures and make troubleshooting easier.

Suggested change

	activitySigningKey: process.env.ALCHEMY_ACTIVITY_SIGNING_KEY || '',
	activitySigningKey: process.env.ALCHEMY_ACTIVITY_SIGNING_KEY ?? (() => {
	throw new Error('ALCHEMY_ACTIVITY_SIGNING_KEY is not set in the environment');
	})(),

[github-actions]

⚡️ Lighthouse report

Page: https://bitlauncher-dm9dudeyg-bitcash.vercel.app/
Report undefined

Category	Score
🔴 Performance	31
🟠 Accessibility	59
🟠 Best practices	74
🟠 SEO	79
🔴 PWA	38

Page: https://bitlauncher-dm9dudeyg-bitcash.vercel.app/about
Report undefined

Category	Score
🔴 Performance	11
🟠 Accessibility	59
🟠 Best practices	74
🟠 SEO	79
🔴 PWA	38

Page: https://bitlauncher-dm9dudeyg-bitcash.vercel.app/security
Report undefined

Category	Score
🔴 Performance	11
🟠 Accessibility	59
🟠 Best practices	74
🟠 SEO	79
🔴 PWA	38

Page: https://bitlauncher-dm9dudeyg-bitcash.vercel.app/bitcash-bitlauncher
Report undefined

Category	Score
🔴 Performance	39
🟠 Accessibility	65
🟠 Best practices	74
🟠 SEO	86
🔴 PWA	38

Page: https://bitlauncher-dm9dudeyg-bitcash.vercel.app/blog
Report undefined

Category	Score
🔴 Performance	40
🟠 Accessibility	66
🟠 Best practices	74
🟠 SEO	86
🔴 PWA	38

Page: https://bitlauncher-dm9dudeyg-bitcash.vercel.app/blog/ai
Report undefined

Category	Score
🔴 Performance	43
🟠 Accessibility	59
🟠 Best practices	74
🟠 SEO	79
🔴 PWA	38