Reject unsupported wallet list filters

[LarryHu0217]

Related issue #1011

Summary

• Keeps /wallets scoped to its supported q search parameter.
• Rejects nearby wallet, account, and transfer filters such as type, tx_type, from_address, to_address, account, status, limit, and sort with clear 400 responses instead of silently ignoring them.
• Adds focused regression coverage for the wallet-list query guard.

Duplicate Check

Existing #1011 submissions I found cover transfer prefill, /me account shortcuts, account/wallet navigation, wallet search notice rendering, and wallet action links. I did not find an open PR covering unsupported query-filter rejection on the /wallets list route.

Validation

• ./.venv/bin/python -m pytest tests/test_wallet_api.py::test_wallet_pages_reject_control_character_filters tests/test_wallet_api.py::test_wallet_list_rejects_unsupported_filters -q -> 9 passed, 1 existing Starlette/httpx warning.
• ./.venv/bin/python -m pytest tests/test_wallet_api.py tests/test_public_routes.py tests/test_account_routes.py -q -> 69 passed, 1 existing Starlette/httpx warning.
• ./.venv/bin/ruff check app/public_routes.py tests/test_wallet_api.py -> passed.
• ./.venv/bin/ruff format --check app/public_routes.py tests/test_wallet_api.py -> 2 files already formatted.
• ./.venv/bin/python -m mypy app/public_routes.py -> success.
• ./.venv/bin/python scripts/docs_smoke.py -> docs smoke ok.
• git diff --check -> clean.
• git merge-tree --write-tree origin/main HEAD -> clean tree 7762447113c0e738c8786f302ccb0b9ba7e09cef.

Scope Boundary

This is limited to public wallet-list query validation and route tests. It does not change wallet signing payloads, nonce/replay checks, transfer execution, ledger mutation, balance accounting, wallet custody, treasury/admin-token behavior, bridge and exchange behavior, MRWK price behavior, private data, or secrets.

Summary by CodeRabbit

• Bug Fixes
  • The wallet list page now rejects unsupported filter parameters and returns a clear 400 error instead of proceeding with the request.
  • Requests using invalid wallet list filters now receive specific messages indicating which filter is not available.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change introduces a WALLET_LIST_UNSUPPORTED_FILTERS tuple in app/public_routes.py and wires it into the /wallets route handler via reject_unsupported_query_params, causing requests with disallowed query filters to return HTTP 400. A parametrized test validates the rejection behavior across multiple filter names.

Changes

Wallet List Filter Rejection

Layer / File(s)	Summary
Constant and handler wiring app/public_routes.py	Adds WALLET_LIST_UNSUPPORTED_FILTERS tuple and calls reject_unsupported_query_params with it in the /wallets handler before building page context.
Rejection test coverage tests/test_wallet_api.py	Adds a parametrized test asserting GET /wallets returns HTTP 400 with specific detail messages for filters like type, tx_type, from_address, to_address, account, status, limit, sort.

Possibly related PRs

• ramimbo/mergework#775: Both PRs modify /wallets query validation in app/public_routes.py and corresponding tests in tests/test_wallet_api.py, rejecting invalid wallet filters with 400 responses.
• ramimbo/mergework#859: Both PRs add new rejection rules for /wallets query parameters with matching test assertions in tests/test_wallet_api.py.
• ramimbo/mergework#1026: Both PRs extend the same reject_unsupported_query_params guard mechanism, applied to different route handlers.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Mergework Public Artifact Hygiene	✅ Passed	Changed public-facing text is limited to wallet filter validation; I found no investment, price, cash-out, payout, or private-security claims in the PR description or touched files.
Bounty Pr Focus	✅ Passed	PASS: Diff is confined to app/public_routes.py and tests/test_wallet_api.py, adding /wallets query-guard plus targeted regression tests for unsupported filters.
Title check	✅ Passed	The title is short, concrete, and accurately names the changed wallet-list filter handling.
Description check	✅ Passed	The description is mostly complete, covering summary, validation, and scope, though it does not follow the template's exact section headings.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LarryHu0217]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 38cb82ef-8e62-4184-be25-6766dfde42b2

📥 Commits

Reviewing files that changed from the base of the PR and between 3bc87d2 and 508dbbd.

📒 Files selected for processing (2)

• app/public_routes.py
• tests/test_wallet_api.py

[qingfeng312]

Refs #1009. Reviewed current head f13087225ded3b6fb326b3eb175ff6c64c57803c for PR #1195.

Verdict: approve. The change keeps /wallets scoped to its supported q parameter by adding WALLET_LIST_UNSUPPORTED_FILTERS and calling reject_unsupported_query_params(..., context="wallet list") before rendering the wallet list. The helper already returns deterministic 400 responses for present-but-unsupported query names, and the PR adds regression coverage for representative wallet/account/transfer/list filters plus a positive /wallets?q=mrwk1abc case.

Evidence inspected: app/public_routes.py, app/query_validation.py, tests/test_wallet_api.py, current PR diff, PR body validation notes, and visible check Quality, readiness, docs, and image checks = success. I did not rerun the full test suite locally because this is a narrow route/query-validation change and the PR already reports the focused wallet tests, broader wallet/public/account tests, ruff, mypy, docs smoke, diff-check, and merge-tree validation. No wallet signing, nonce/replay, ledger mutation, transfer execution, custody, bridge, exchange, payout, or secret-handling path is touched.

[piaigmt]

APPROVE — verified the unsupported wallet-list filter guard on current head f13087225ded3b6fb326b3eb175ff6c64c57803c.

Evidence run locally with a Python 3.12 venv:

• python -m pytest tests/test_wallet_api.py::test_wallet_list_rejects_unsupported_filters tests/test_wallet_api.py::test_wallet_list_allows_supported_q_filter -q → 9 passed, 1 warning in 1.91s
• python -m pytest tests/test_wallet_api.py tests/test_public_routes.py tests/test_account_routes.py -q → 70 passed, 1 warning in 6.74s
• ruff check app/public_routes.py tests/test_wallet_api.py → All checks passed!
• ruff format --check app/public_routes.py tests/test_wallet_api.py → 2 files already formatted
• python -m mypy app/public_routes.py → Success: no issues found in 1 source file

Manual review notes:

• The new WALLET_LIST_UNSUPPORTED_FILTERS list covers adjacent filter names that would otherwise be silently ignored on /wallets.
• Supported q search stays allowed and is still protected by the existing control-character and repeated-param guards.
• The change is limited to public route query validation plus focused wallet API coverage; I did not see ledger mutation, wallet signing, custody, admin-token, or payout/off-ramp behavior changes.

This looks ready to merge.

[wangedmund77-cmyk]

Review for Bounty #1009 at head f13087225ded3b6fb326b3eb175ff6c64c57803c.

Verdict: no blocker from diff review.

Evidence checked:

• wallets_page still permits the supported q filter and now rejects unrelated public-list filters before rendering.
• The unsupported list covers cross-surface parameters that could otherwise imply activity/transaction filtering on the wallet directory.
• Tests cover representative unsupported fields plus the supported q path, including the rendered empty-search message.

Non-blocking suggestion: offset is in WALLET_LIST_UNSUPPORTED_FILTERS but not in the parametrized examples. Adding one offset=1 row would make the test mirror the full pagination-related guard set.

[yanyishuai]

Review packet (Bounty #933)

• Reviewed PR: #1195
• Head commit: f13087225ded3b6fb326b3eb175ff6c64c57803c
• Files inspected: app/public_routes.py, tests/test_wallet_api.py
• Verdict: Mirrors the activity-filter pattern for wallet list pages: unsupported filters rejected early with context=wallet list. Scoped change; CI green.
• Validation: Inspected WALLET_LIST_UNSUPPORTED_FILTERS in app/public_routes.py and new rejection tests in tests/test_wallet_api.py. Confirmed mergeable=clean and quality checks success on current head.

Bounty #933

[LarryHu0217]

Hi maintainers, this PR is ready for review and the current checks are passing. Please let me know if any changes or additional validation would help. Thank you.

[LarryHu0217]

This PR remains ready for review, and the current quality check is passing. Please let me know if any changes or additional validation would help. Thank you.