Skip to content

Conversation

@cl-mayowa
Copy link
Collaborator

@cl-mayowa cl-mayowa commented Nov 29, 2025

Closes #OPDATA-5148

Description

This EA exposes nav endpoint that fetches latest NAV via R25’s REST API and returns a single numeric result with timestamps.

......

Changes

  • Added nav endpoint and transport for R25 endpoint
  • Checked for response status failure
  • Added authentication via API key
  • Added tests to verify implementation

Steps to Test

  1. Export api key and secret
export API_KEY=<api_key>
export API_SECRET=<api_secret>
  1. Start endpoint locally
cd packages/sources/r25
 yarn build && yarn start
  1. Test nav endpoint
curl --location 'http://localhost:8080' \
--header 'Content-Type: application/json' \
--data '{
    "data": {
        "endpoint": "nav",
        "chainType": "polygon",
        "tokenName": "rcusdp"
    }
}'

expected response

{
    "result": 1.0176661592,
    "data": {
        "result": 1.0176661592
    },
    "timestamps": {
        "providerDataRequestedUnixMs": 1764374203131,
        "providerDataReceivedUnixMs": 1764374204545,
        "providerIndicatedTimeUnixMs": 1764313200000
    },
    "statusCode": 200,
    "meta": {
        "adapterName": "R25",
        "metrics": {
            "feedId": "{\"chainType\":\"polygon\",\"tokenName\":\"rcusdp\"}"
        }
    }
}
  1. run unit and integration tests

Quality Assurance

  • If a new adapter was made, or an existing one was modified so that its environment variables have changed, update the relevant infra-k8s configuration file.
  • If a new adapter was made, or an existing one was modified so that its environment variables have changed, update the relevant adapter-secrets configuration file.
  • If a new adapter was made, or a new endpoint was added, update the test-payload.json file with relevant requests.
  • The branch naming follows git flow (feature/x, chore/x, release/x, hotfix/x, fix/x) or is created from Jira.
  • This is related to a maximum of one Jira story or GitHub issue.
  • Types are safe (avoid TypeScript/TSLint features like any and disable, instead use more specific types).
  • All code changes have 100% unit and integration test coverage. If testing is not applicable or too difficult to justify doing, the reasoning should be documented explicitly in the PR.

@changeset-bot
Copy link

changeset-bot bot commented Nov 29, 2025

🦋 Changeset detected

Latest commit: 5d717ef

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@chainlink/r25-adapter Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

apiKey,
].join('\n')

const signature = CryptoJS.HmacSHA256(stringToSign, secret).toString(CryptoJS.enc.Hex)

Check failure

Code scanning / CodeQL

Use of password hash with insufficient computational effort High

Password from
an access to apiKey
is hashed insecurely.
Password from
an access to API_KEY
is hashed insecurely.
Password from
an access to apiKey
is hashed insecurely.
Password from
an access to apiKey
is hashed insecurely.
Password from
an access to apiKey
is hashed insecurely.
Password from
an access to apiKey
is hashed insecurely.
Password from
an access to apiKey
is hashed insecurely.
Password from
an access to apiKey
is hashed insecurely.
Password from
an access to apiKey
is hashed insecurely.

Copilot Autofix

AI about 22 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

Copy link
Contributor

@mmcallister-cll mmcallister-cll Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is it doesn't like the use of apiKey in the HmacSHA256, but I'm not sure we have another option since the API requires this, right?
Worth reaching out to security team to sanity check though 🙏

expect(response.json()).toMatchSnapshot()
})

it('should return error for invalid token', async () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe worth expanding this for all of the documented error cases

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are no documented error cases, but I added a test case for an invalid chainType, as well as invalid chainType and tokenName in the payload.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are 8 documented error cases in the API doc in the ticket. Worth seeing if they're reproducible.

apiKey,
].join('\n')

const expectedSignature = CryptoJS.HmacSHA256(expectedStringToSign, secret).toString(

Check failure

Code scanning / CodeQL

Use of password hash with insufficient computational effort High test

Password from
an access to apiKey
is hashed insecurely.

Copilot Autofix

AI about 22 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

* - timestamp: Current UTC timestamp in milliseconds
* - api_key: API key
*/
export const getRequestHeaders = ({
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead of this object{...} argument, can you try something like this

export const getRequestHeaders = (getRequestHeadersParams: GetRequestHeadersParams)...
  // inside the function
  const { method, path, etc, ... } = getRequestHeadersParams

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants