Repository navigation
feat(node)!: send the erb token as a bearer header in get-and-observe-missing-vaas - #5092
Merged
jmgilman merged 6 commits intoNov 4, 2026
Merged
Conversation
…e-missing-vaas
GetAndObserveMissingVAAs now calls the missing-VAA endpoint the way erb's
POST /api/v1/stuck/reobserve expects:
- the admin RPC's api_key is sent as "Authorization: Bearer <api_key>"
instead of in the body;
- the body is {"guardian": "0x<address>"}, the node's own guardian address,
so the endpoint returns only the messages this guardian should observe.
The address is derived from the guardian signer and passed into
NewPrivService;
- a non-2xx response is returned as an error carrying the status and body,
instead of failing to unmarshal the error body.
The response format and the CLI arguments [URL] [API_KEY] are unchanged.
BREAKING CHANGE: the request no longer carries {"apiKey": ...} in the body,
so endpoints that authenticate that way, such as the wormhole-dashboard
reobserve-vaas Cloud Function, reject it.
Contributor
Author
|
Note this PR socializes this early. I am keeping it in draft until the |
…b-client # Conflicts: # node/pkg/adminrpc/adminserver_test.go
jmgilman
marked this pull request as ready for review
October 29, 2026 15:20
jmgilman
requested review from
SEJeff,
bemic,
djb15,
evan-gray,
johnsaigle,
kcsongor,
mdulin2,
panoel and
pleasew8t
as code owners
October 29, 2026 15:20
…serve-missing-vaas erb now works out the polling Guardian from the token's organization, so the request no longer names the Guardian and has no body.
jmgilman
changed the title
evan-gray
approved these changes
Nov 3, 2026
evan-gray
left a comment
evan-gray
left a comment
Contributor
There was a problem hiding this comment.
there are likely other fixes and improvements that could be made around this code, but these changes seem alright.
djb15
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This moves
guardiand admin get-and-observe-missing-vaasover to the Wormhole Foundation's new reobserve endpoint in erb. It replaces thereobserve-vaasCloud Function in the wormhole-dashboard GCP project, which is being shut down.The new endpoint works differently in two ways:
Authorizationheader instead of in the request body.The response format is unchanged.
Change
API_KEYargument is sent asAuthorization: Bearer <API_KEY>.get-and-observe-missing-vaas [URL] [API_KEY].This is a breaking change
Once a Guardian runs this version, the command no longer works against the old
reobserve-vaasfunction, because that function reads the key from the request body. Anyone using the command needs to switch to the erb URL and an erb token when they upgrade. Guardian operators create the token themselves in erb, as a service account under their Guardian's organization. The Foundation will coordinate the switch.Testing
httptestserver:go test ./pkg/adminrpc ./pkg/nodepasses.node/.