Rc/supernova

.github/workflows/deploy-docker.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
@@ -45,5 +45,7 @@ jobs:
           file: ./docker/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/pr-build.yml

@@ -12,14 +12,14 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.23.6
-        uses: actions/setup-go@v5
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.23.6
+          go-version: 1.26.2
         id: go
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get dependencies
         run: |

.github/workflows/pr-tests.yml

@@ -11,14 +11,14 @@ jobs:
     name: Unit
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.23.6
-        uses: actions/setup-go@v5
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.23.6
+          go-version: 1.26.2
         id: go
 
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Get dependencies
         run: |

README.md

@@ -56,6 +56,8 @@ For more details, go [here](https://docs.multiversx.com/sdk-and-tools/proxy/).
 - `/v1.0/network/direct-staked-info` (GET) --> returns the list of direct staked values
 - `/v1.0/network/delegated-info`     (GET) --> returns the list of delegated values
 - `/v1.0/network/enable-epochs`      (GET) --> returns the activation epochs metric
+- `/v1.0/network/enable-epochs-v2`   (GET) --> returns the newer version of activation epochs
+- `/v1.0/network/enable-rounds`      (GET) --> returns the activation rounds metric
 ### node
 
 - `/v1.0/node/heartbeatstatus`     (GET) --> returns the heartbeat data from an observer from any shard. Has a cache to avoid many requests

api/api.go

@@ -1,8 +1,11 @@
 package api
 
 import (
+	"bytes"
 	"encoding/hex"
+	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"reflect"
 	"time"
@@ -39,8 +42,12 @@ func CreateServer(
 	rateLimitTimeWindowInSeconds int,
 	isProfileModeActivated bool,
 	shouldStartSwaggerUI bool,
+	maxRequestBodySize int64,
 ) (*http.Server, error) {
 	ws := gin.Default()
+	if maxRequestBodySize > 0 {
+		ws.Use(maxRequestBodySizeMiddleware(maxRequestBodySize))
+	}
 	ws.Use(cors.Default())
 
 	err := registerValidators()
@@ -61,6 +68,40 @@ func CreateServer(
 	return httpServer, nil
 }
 
+func maxRequestBodySizeMiddleware(maxSize int64) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if c.Request.Body == nil {
+			c.Next()
+			return
+		}
+
+		bodyBytes, err := io.ReadAll(http.MaxBytesReader(c.Writer, c.Request.Body, maxSize))
+		if err != nil {
+			if maxBytesErr, ok := errors.AsType[*http.MaxBytesError](err); ok {
+				printMessage := fmt.Sprintf("request body exceeded the size limit of %d bytes", maxBytesErr.Limit)
+				log.Warn(printMessage, "path", c.Request.RequestURI)
+				c.AbortWithStatusJSON(http.StatusRequestEntityTooLarge, data.GenericAPIResponse{
+					Data:  nil,
+					Error: printMessage,
+					Code:  data.ReturnCodeRequestError,
+				})
+				return
+			}
+
+			log.Warn("error reading request body", "error", err, "path", c.Request.RequestURI)
+			c.AbortWithStatusJSON(http.StatusBadRequest, data.GenericAPIResponse{
+				Data:  nil,
+				Error: err.Error(),
+				Code:  data.ReturnCodeRequestError,
+			})
+			return
+		}
+
+		c.Request.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
+		c.Next()
+	}
+}
+
 func registerValidators() error {
 	validators := []validatorInput{
 		{Name: "skValidator", Validator: skValidator},

api/api_test.go

@@ -0,0 +1,118 @@
+package api
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/multiversx/mx-chain-proxy-go/api/middleware"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMaxRequestBodySizeMiddleware_OversizedBodyShouldErr(t *testing.T) {
+	t.Parallel()
+
+	ws := gin.New()
+	ws.Use(maxRequestBodySizeMiddleware(1 << 20))
+	ws.POST("/test", func(c *gin.Context) {
+		_, err := io.ReadAll(c.Request.Body)
+		if err != nil {
+			c.Status(http.StatusRequestEntityTooLarge)
+			return
+		}
+		c.Status(http.StatusOK)
+	})
+
+	hugeBody := make([]byte, 2*1024*1024)
+	for i := range hugeBody {
+		hugeBody[i] = 'a'
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/test", bytes.NewReader(hugeBody))
+	resp := httptest.NewRecorder()
+	ws.ServeHTTP(resp, req)
+
+	require.Equal(t, http.StatusRequestEntityTooLarge, resp.Code)
+}
+
+func TestMaxRequestBodySizeMiddleware_NormalBodyShouldPass(t *testing.T) {
+	t.Parallel()
+
+	ws := gin.New()
+	ws.Use(maxRequestBodySizeMiddleware(1 << 20))
+	ws.POST("/test", func(c *gin.Context) {
+		body, err := io.ReadAll(c.Request.Body)
+		if err != nil {
+			c.Status(http.StatusInternalServerError)
+			return
+		}
+		if string(body) != `{"key":"value"}` {
+			c.Status(http.StatusBadRequest)
+			return
+		}
+		c.Status(http.StatusOK)
+	})
+
+	body := []byte(`{"key":"value"}`)
+	req := httptest.NewRequest(http.MethodPost, "/test", bytes.NewReader(body))
+	resp := httptest.NewRecorder()
+	ws.ServeHTTP(resp, req)
+
+	require.Equal(t, http.StatusOK, resp.Code)
+}
+
+func TestMaxRequestBodySizeMiddleware_LoggingDisabled_ValidJSONWithExcessWhitespaceShouldBeRejected(t *testing.T) {
+	t.Parallel()
+
+	validJSON := `{"valid":"request"}`
+	limit := int64(len(validJSON))
+
+	ws := gin.New()
+	ws.Use(maxRequestBodySizeMiddleware(limit))
+	ws.POST("/test", func(c *gin.Context) {
+		var payload map[string]string
+		if err := c.ShouldBindJSON(&payload); err != nil {
+			c.Status(http.StatusBadRequest)
+			return
+		}
+		c.Status(http.StatusOK)
+	})
+
+	body := validJSON + strings.Repeat(" ", 10)
+	req := httptest.NewRequest(http.MethodPost, "/test", strings.NewReader(body))
+	resp := httptest.NewRecorder()
+	ws.ServeHTTP(resp, req)
+
+	require.Equal(t, http.StatusRequestEntityTooLarge, resp.Code)
+}
+
+func TestMaxRequestBodySizeMiddleware_LoggingEnabled_ValidJSONWithExcessWhitespaceShouldBeRejected(t *testing.T) {
+	t.Parallel()
+
+	validJSON := `{"valid":"request"}`
+	limit := int64(len(validJSON))
+
+	ws := gin.New()
+	ws.Use(maxRequestBodySizeMiddleware(limit))
+	ws.Use(middleware.NewResponseLoggerMiddleware(10 * time.Second).MiddlewareHandlerFunc())
+	ws.POST("/test", func(c *gin.Context) {
+		var payload map[string]string
+		if err := c.ShouldBindJSON(&payload); err != nil {
+			c.Status(http.StatusBadRequest)
+			return
+		}
+		c.Status(http.StatusOK)
+	})
+
+	body := validJSON + strings.Repeat(" ", 10)
+	req := httptest.NewRequest(http.MethodPost, "/test", strings.NewReader(body))
+	resp := httptest.NewRecorder()
+	ws.ServeHTTP(resp, req)
+
+	require.Equal(t, http.StatusRequestEntityTooLarge, resp.Code)
+}

api/groups/baseNetworkGroup.go

@@ -37,6 +37,8 @@ func NewNetworkGroup(facadeHandler data.FacadeHandler) (*networkGroup, error) {
 		{Path: "/esdt/non-fungible-tokens", Handler: ng.getEsdtHandlerFunc(data.NonFungibleTokens), Method: http.MethodGet},
 		{Path: "/esdt/supply/:token", Handler: ng.getESDTSupply, Method: http.MethodGet},
 		{Path: "/enable-epochs", Handler: ng.getEnableEpochs, Method: http.MethodGet},
+		{Path: "/enable-epochs-v2", Handler: ng.getEnableEpochsV2, Method: http.MethodGet},
+		{Path: "/enable-rounds", Handler: ng.getEnableRounds, Method: http.MethodGet},
 		{Path: "/direct-staked-info", Handler: ng.getDirectStakedInfo, Method: http.MethodGet},
 		{Path: "/delegated-info", Handler: ng.getDelegatedInfo, Method: http.MethodGet},
 		{Path: "/ratings", Handler: ng.getRatingsConfig, Method: http.MethodGet},
@@ -144,6 +146,26 @@ func (group *networkGroup) getEnableEpochs(c *gin.Context) {
 	c.JSON(http.StatusOK, enableEpochsMetrics)
 }
 
+func (group *networkGroup) getEnableEpochsV2(c *gin.Context) {
+	enableEpochsMetrics, err := group.facade.GetEnableEpochsMetricsV2()
+	if err != nil {
+		shared.RespondWith(c, http.StatusInternalServerError, nil, err.Error(), data.ReturnCodeInternalError)
+		return
+	}
+
+	c.JSON(http.StatusOK, enableEpochsMetrics)
+}
+
+func (group *networkGroup) getEnableRounds(c *gin.Context) {
+	enableRoundsMetrics, err := group.facade.GetEnableRoundsMetrics()
+	if err != nil {
+		shared.RespondWith(c, http.StatusInternalServerError, nil, err.Error(), data.ReturnCodeInternalError)
+		return
+	}
+
+	c.JSON(http.StatusOK, enableRoundsMetrics)
+}
+
 func (group *networkGroup) getESDTSupply(c *gin.Context) {
 	tokenIdentifier := c.Param("token")
 	if tokenIdentifier == "" {