feat(api,webhooks,store,ci): implement multi-issue updates (#333, #33…

[feyisaralawal]

…2, #335, #331)

Detailed explanation of changes across all four resolved issues:

1. Propagate per-request id through logging for cross-service traceability (Closes Propagate a per-request id through logging for cross-service traceability #333):

   • Audited request handling across crates/api and implemented request_id_middleware in crates/api/src/lib.rs.
   • For every incoming HTTP request, extracts the caller-supplied X-Request-Id header (if valid ASCII and non-empty) or generates a new UUIDv4.
   • Enters an instrumented tracing span info_span!("request", request_id = %request_id) wrapping downstream route handling, store calls, Horizon requests, and webhook dispatch so all log lines carry the correlation id automatically.
   • Attaches x-request-id to response headers so clients can reference request IDs when reporting issues.
   • Added tracing-subscriber dev-dependency and comprehensive tests in crates/api/tests/request_id_tests.rs:
     • every_response_carries_an_x_request_id_header
     • a_caller_supplied_x_request_id_is_echoed_back_unchanged * log_output_for_a_request_consistently_carries_the_same_request_id_across_nested_spans

2. Consolidate is_safe_url into comprehensive edge-case test suite (Closes Add a dedicated test suite for is_safe_url covering IPv6, IPv4-mapped, and loopback edge cases #332):

   • Hardened is_safe_url in crates/webhooks/src/lib.rs against SSRF vectors across all IP encoding classes: * Dotted-decimal IPv4, loopback range (127.0.0.0/8), private (RFC 1918), carrier-grade NAT (100.64.0.0/10), link-local (169.254.0.0/16), broadcast (255.255.255.255), and unspecified (0.0.0.0/8). * Alternative representations including raw decimal integer (2130706433), hex integer (0x7f000001), hex-dotted (0x7f.0.0.1), and octal-dotted (0177.0.0.1). * IPv6 loopback (::1), unspecified (::), link-local (fe80::/10), unique-local (fc00::/7), IPv4-mapped IPv6 (::ffff:x), and IPv4-compatible IPv6 (::x).
   • Documented explicit DNS scope boundary: is_safe_url handles syntactic validation and IP literal filtering, while DNS resolution and DNS rebind defense are delegated to the HTTP client and egress network policies.
   • Organized tests into structured test modules by encoding class:
     • test_standard_public_urls
     • test_ipv4_literal_forms * test_ipv6_forms * test_ipv4_mapped_and_compatible_ipv6_forms * test_link_local_addresses * test_unspecified_addresses * test_hostnames_and_dns_scope_boundary * test_invalid_and_malformed_urls

3. Add migration-order regression test on fresh database (Closes Add a migration-order regression test asserting every migration applies cleanly on an empty database #335):

   • Added migrate_applies_cleanly_from_a_genuinely_empty_database in crates/store/tests/store_tests.rs.
   • Dynamically provisions a fresh, isolated PostgreSQL database from the base instance rather than reusing an existing or pre-migrated schema.
   • Runs Store::connect and Store::migrate (MIGRATOR.run) to verify all 20 sequential migrations apply cleanly in order from scratch.
   • Asserts key database tables exist (wallets, addresses, transactions, withdrawals, webhook_endpoints, webhook_deliveries, _sqlx_migrations) and drops the temporary test database upon completion.

4. Add cargo-audit and cargo-deny result caching to speed up CI (Closes Add cargo-audit and cargo-deny result caching to speed up CI #331):

   • Updated .github/workflows/ci.yml for both audit and deny jobs.
   • Added actions/cache@v4 steps caching tool binaries (~/.cargo/bin/cargo-audit) and advisory databases (~/.cargo/advisory-db for cargo-audit, ~/.cargo/advisory-dbs for cargo-deny).
   • Configured daily rotating cache keys (${{ runner.os }}-cargo-audit-${{ steps.cache-date.outputs.date }} and ${{ runner.os }}-cargo-deny-${{ steps.cache-date.outputs.date }}) with prefix restore keys to prevent cache drift and ensure advisory freshness.
   • Preserved active advisory fetching so incremental fetches occur fast against warm caches rather than downloading full databases from scratch on every CI run.

Summary

Related step / issue

Checklist

• cargo fmt --all -- --check passes
• cargo clippy --workspace --all-targets -- -D warnings passes
• cargo test --workspace passes
• No secrets (seeds/keys) logged or persisted in plaintext
• Added/updated tests (test vectors for crypto/derivation changes)
• Updated docs / CHANGELOG if behavior changed

How to test

[drips-wave]

@feyisaralawal Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits