feat(query): origin-aware pagination scan, limit, and offset caps

sei-cosmos/baseapp/abci.go

@@ -462,7 +462,7 @@ func (app *BaseApp) Query(ctx context.Context, req *abci.RequestQuery) (res *abc
 	// handle gRPC routes first rather than calling splitPath because '/' characters
 	// are used as part of gRPC paths
 	if grpcHandler := app.grpcQueryRouter.Route(req.Path); grpcHandler != nil {
-		resp := app.handleQueryGRPC(grpcHandler, *req)
+		resp := app.handleQueryGRPC(ctx, grpcHandler, *req)
 		return &resp, nil
 	}
 
@@ -623,15 +623,15 @@ func (app *BaseApp) ApplySnapshotChunk(context context.Context, req *abci.Reques
 	}
 }
 
-func (app *BaseApp) handleQueryGRPC(handler GRPCQueryHandler, req abci.RequestQuery) abci.ResponseQuery {
-	ctx, err := app.CreateQueryContext(req.Height, req.Prove)
+func (app *BaseApp) handleQueryGRPC(ctx context.Context, handler GRPCQueryHandler, req abci.RequestQuery) abci.ResponseQuery {
+	sdkCtx, err := app.CreateQueryContext(req.Height, req.Prove)
 	if err != nil {
 		return sdkerrors.QueryResultWithDebug(err, app.trace)
 	}
 
 	// Only Cosmos ABCI gRPC queries may use client-facing pagination semantics.
 	// Historical EVM RPC also calls CreateQueryContext and must remain unmarked.
-	res, err := handler(ctx.WithIsABCIQuery(true), req)
+	res, err := handler(app.enrichABCIQueryContext(ctx, sdkCtx), req)
 	if err != nil {
 		res = sdkerrors.QueryResultWithDebug(gRPCErrorToSDKError(err), app.trace)
 		res.Height = req.Height

sei-cosmos/baseapp/baseapp.go

@@ -184,6 +184,9 @@ type BaseApp struct {
 	concurrencyWorkers int
 	occEnabled         bool
 
+	queryConfig          config.QueryConfig
+	trustedOriginMatcher *trustedCIDRMatcher
+
 	deliverTxHooks []DeliverTxHook
 
 	execProcessProposalMs int64
@@ -320,6 +323,15 @@ func NewBaseApp(
 		app.concurrencyWorkers = config.DefaultConcurrencyWorkers
 	}
 
+	queryCfg, err := readQueryConfig(appOpts)
+	if err != nil {
+		panic(err)
+	}
+	warnQueryConfig(queryCfg)
+	matcher := newTrustedCIDRMatcher(queryCfg.TrustedCIDRs)
+	app.queryConfig = queryCfg
+	app.trustedOriginMatcher = matcher
+
 	return app
 }
 

sei-cosmos/baseapp/config_fuzz_test.go

@@ -584,3 +584,61 @@
 	fn()
 	return true
 }
+
+// queryKeys covers the [query] keys readQueryConfig reads during BaseApp construction.
+//
+// Spelled as literals rather than through FlagQueryTrustedCIDRs so a constant rename fails
+// CheckKeyNames rather than moving the row with the reader. Both reads are guarded and checked,
+// matching ParseQueryConfig in sei-cosmos/server/config, but this manifest describes this reader.
+var queryKeys = []configtest.KeySpec{
+	{
+		Key: "query.trusted-cidrs", Path: "TrustedCIDRs", Cast: configtest.CastStringSlice, Checked: true,
+		Why: "CIDR allowlist for relaxed query scan limits; empty means fail closed",
+	},
+	{
+		Key: "query.trusted-scan-limit", Path: "TrustedScanLimit", Cast: configtest.CastUint64, Checked: true,
+		Why: "max store entries a trusted-origin paginator may scan",
+	},
+}
+
+func readBaseAppQuery(opts configtest.AppOpts) (any, error) {
+	return readQueryConfig(opts)
+}
+
+func FuzzBaseAppQueryConfig(f *testing.F) {
+	seeds := configtest.NewSeeds(f, fuzzing.ConfigValue)
+	for i := range len(queryKeys) {
+		seeds.AddRow(uint(i), fuzzing.KindNil, "", int64(0), false)
+		seeds.AddRow(uint(i), fuzzing.KindString, "not-a-value", int64(0), false)
+		seeds.AddRow(uint(i), fuzzing.KindMap, "", int64(0), false)
+	}
+	seeds.AddRow(uint(0), fuzzing.KindStringSlice, "127.0.0.1/32", int64(0), false)
+	seeds.AddRow(uint(1), fuzzing.KindInt64, "", int64(250_000), false)
+
+	configtest.CheckEveryRowHasADiscriminatingSeed(f, "query", readBaseAppQuery, queryKeys, seeds)
+
+	f.Fuzz(func(t *testing.T, keyIdx uint, kind uint8, s string, n int64, b bool) {
+		spec := configtest.Pick(queryKeys, keyIdx)
+		configtest.CheckRow(t, "query", readBaseAppQuery, spec, fuzzing.ConfigValue(kind, s, n, b))
+	})
+}
+
+func TestBaseAppQueryAbsentKeysKeepDefaults(t *testing.T) {
+	configtest.CheckAbsent(t, "query", readBaseAppQuery, config.DefaultQueryConfig())
+}
+
+func TestBaseAppQueryDefaultsMatchTheRecordedValues(t *testing.T) {
+	configtest.CheckDefaults(t, "query", config.DefaultQueryConfig())
+}
+
+func TestBaseAppQueryKeyNamesMatchTheRecordedNames(t *testing.T) {
+	configtest.CheckKeyNames(t, "query", queryKeys)
+}
+
+func TestBaseAppQueryManifestNamesEveryField(t *testing.T) {
+	configtest.CheckManifestCoversEveryField(t, "query", config.DefaultQueryConfig(), queryKeys)
+}
+
+func TestWiringMatchesTheRecord(t *testing.T) {
+	configtest.CheckWiring(t)
+}

sei-cosmos/baseapp/grpcserver.go

@@ -59,7 +59,7 @@ func (app *BaseApp) RegisterGRPCServer(server gogogrpc.Server) {
 
 		// Direct Cosmos gRPC queries may use client-facing pagination semantics.
 		// Other CreateQueryContext consumers remain v6.6-compatible by default.
-		sdkCtx = sdkCtx.WithIsABCIQuery(true)
+		sdkCtx = app.enrichABCIQueryContext(grpcCtx, sdkCtx)
 		grpcCtx = context.WithValue(grpcCtx, sdk.SdkContextKey, sdkCtx)
 
 		md = metadata.Pairs(grpctypes.GRPCBlockHeightHeader, strconv.FormatInt(height, 10))

sei-cosmos/baseapp/query_trust.go

@@ -0,0 +1,131 @@
+package baseapp
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strings"
+
+	srvconfig "github.com/sei-protocol/sei-chain/sei-cosmos/server/config"
+	servertypes "github.com/sei-protocol/sei-chain/sei-cosmos/server/types"
+	sdk "github.com/sei-protocol/sei-chain/sei-cosmos/types"
+	"github.com/sei-protocol/sei-chain/sei-cosmos/types/query"
+	rpctypes "github.com/sei-protocol/sei-chain/sei-tendermint/rpc/jsonrpc/types"
+	"github.com/spf13/cast"
+	"google.golang.org/grpc/peer"
+)
+
+const (
+	FlagQueryTrustedCIDRs     = "query.trusted-cidrs"
+	FlagQueryTrustedScanLimit = "query.trusted-scan-limit"
+)
+
+type trustedCIDRMatcher struct {
+	networks []*net.IPNet
+}
+
+// newTrustedCIDRMatcher returns a matcher for parseable entries in cidrs, skipping the rest.
+// warnQueryConfig should run before this so skipped entries are logged.
+func newTrustedCIDRMatcher(cidrs []string) *trustedCIDRMatcher {
+	networks := make([]*net.IPNet, 0, len(cidrs))
+	for _, cidr := range cidrs {
+		_, network, err := net.ParseCIDR(cidr)
+		if err != nil {
+			continue
+		}
+		networks = append(networks, network)
+	}
+	return &trustedCIDRMatcher{networks: networks}
+}
+
+func (m *trustedCIDRMatcher) contains(ipStr string) bool {
+	if m == nil {
+		return false
+	}
+	ip := net.ParseIP(stripHostPort(ipStr))
+	if ip == nil {
+		return false
+	}
+	for _, network := range m.networks {
+		if network.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+func readQueryConfig(appOpts servertypes.AppOptions) (srvconfig.QueryConfig, error) {
+	cfg := srvconfig.DefaultQueryConfig()
+	var err error
+
+	if v := appOpts.Get(FlagQueryTrustedCIDRs); v != nil {
+		if cfg.TrustedCIDRs, err = cast.ToStringSliceE(v); err != nil {
+			return cfg, fmt.Errorf("invalid %s: %w", FlagQueryTrustedCIDRs, err)
+		}
+	}
+	if v := appOpts.Get(FlagQueryTrustedScanLimit); v != nil {
+		if cfg.TrustedScanLimit, err = cast.ToUint64E(v); err != nil {
+			return cfg, fmt.Errorf("invalid %s: %w", FlagQueryTrustedScanLimit, err)
+		}
+	}
+	return cfg, nil
+}
+
+func warnQueryConfig(cfg srvconfig.QueryConfig) {
+	for _, warning := range srvconfig.ValidateQueryConfig(cfg) {
+		logger.Warn(warning)
+	}
+}
+
+func (app *BaseApp) enrichABCIQueryContext(ctx context.Context, sdkCtx sdk.Context) sdk.Context {
+	sdkCtx = sdkCtx.WithIsABCIQuery(true)
+	originIP := queryOriginIP(ctx)
+	trusted := app.trustedOriginMatcher != nil && app.trustedOriginMatcher.contains(originIP)
+	sdkCtx = sdkCtx.WithIsTrustedQueryOrigin(trusted)
+
+	if trusted {
+		if app.queryConfig.TrustedScanLimit == 0 {
+			sdkCtx = sdkCtx.WithQueryScanLimit(false, 0)
+		} else {
+			sdkCtx = sdkCtx.WithQueryScanLimit(true, app.queryConfig.TrustedScanLimit)
+		}
+		logger.Debug(
+			"query pagination using trusted scan limit",
+			"origin", originIP,
+			"limit", app.queryConfig.TrustedScanLimit,
+		)
+		return sdkCtx
+	}
+
+	return sdkCtx.WithQueryScanLimit(true, query.MaxScanLimit)
+}
+
+func queryOriginIP(ctx context.Context) string {
+	if callInfo := rpctypes.GetCallInfo(ctx); callInfo != nil {
+		if addr := callInfo.RemoteAddr(); addr != "" {
+			return addr
+		}
+	}
+	if p, ok := peer.FromContext(ctx); ok && p.Addr != nil {
+		return p.Addr.String()
+	}
+	return ""
+}
+
+func stripHostPort(addr string) string {
+	if addr == "" {
+		return ""
+	}
+	if strings.HasPrefix(addr, "[") {
+		host, _, err := net.SplitHostPort(addr)
+		if err != nil {
+			return strings.Trim(addr, "[]")
+		}
+		return host
+	}
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return addr
+	}
+	return host
+}

sei-cosmos/baseapp/query_trust_test.go

@@ -0,0 +1,43 @@
+package baseapp
+
+import (
+	"net"
+	"testing"
+
+	srvconfig "github.com/sei-protocol/sei-chain/sei-cosmos/server/config"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/peer"
+)
+
+func TestTrustedCIDRMatcher(t *testing.T) {
+	matcher := newTrustedCIDRMatcher([]string{"127.0.0.1/32", "10.0.0.0/8"})
+	require.True(t, matcher.contains("127.0.0.1:54321"))
+	require.True(t, matcher.contains("10.1.2.3"))
+	require.False(t, matcher.contains("203.0.113.1"))
+}
+
+func TestTrustedCIDRMatcherSkipsInvalidEntries(t *testing.T) {
+	matcher := newTrustedCIDRMatcher([]string{"not-a-cidr", "127.0.0.1/32"})
+	require.True(t, matcher.contains("127.0.0.1"))
+	require.False(t, matcher.contains("203.0.113.1"))
+}
+
+func TestQueryOriginIPFromGRPCPeer(t *testing.T) {
+	addr, err := net.ResolveTCPAddr("tcp", "192.0.2.1:9090")
+	require.NoError(t, err)
+	ctx := peer.NewContext(t.Context(), &peer.Peer{Addr: addr})
+	require.Equal(t, "192.0.2.1:9090", queryOriginIP(ctx))
+}
+
+func TestValidateQueryConfigWarnsOnBroadCIDR(t *testing.T) {
+	warnings := srvconfig.ValidateQueryConfig(srvconfig.QueryConfig{
+		TrustedCIDRs: []string{"0.0.0.0/0"},
+	})
+	require.Len(t, warnings, 1)
+	require.Contains(t, warnings[0], "overly broad")
+}
+
+func TestStripHostPort(t *testing.T) {
+	require.Equal(t, "127.0.0.1", stripHostPort("127.0.0.1:9090"))
+	require.Equal(t, "2001:db8::1", stripHostPort("[2001:db8::1]:9090"))
+}

sei-cosmos/baseapp/testdata/query.golden

@@ -0,0 +1,2 @@
+TrustedCIDRs = <nil-slice>
+TrustedScanLimit = uint64(100000)

sei-cosmos/baseapp/testdata/query.keys.golden

@@ -0,0 +1,3 @@
+"query.trusted-cidrs"
+"query.trusted-scan-limit"
+# keys with a target of their own

sei-cosmos/baseapp/testdata/wiring_coverage.txt

@@ -0,0 +1,14 @@
+# Code generated by TestWiringMatchesTheRecord. DO NOT EDIT.
+# The coverage record. Which checks cover each configuration section in this package, one
+# tab-separated (section, check) pair per line, read from this package's own test files.
+# Compared exactly, the way go.sum is. A line that disappears is a check that was deleted,
+# which is the one edit the remaining checks cannot report. Repeat calls collapse to one line,
+# so this records which checks cover a section rather than how many times.
+# Regenerate with `go test ./<pkg>/ -run TestWiringMatchesTheRecord -update` and read the diff.
+
+query	CheckAbsent
+query	CheckDefaults
+query	CheckEveryRowHasADiscriminatingSeed
+query	CheckKeyNames
+query	CheckManifestCoversEveryField
+query	CheckRow

sei-cosmos/server/config/config.go

@@ -312,6 +312,7 @@ type Config struct {
 	StateCommit config.StateCommitConfig `mapstructure:"state-commit"`
 	StateStore  config.StateStoreConfig  `mapstructure:"state-store"`
 	Genesis     GenesisConfig            `mapstructure:"genesis"`
+	Query       QueryConfig              `mapstructure:"query"`
 }
 
 // SetMinGasPrices sets the validator's minimum gas prices.
@@ -409,6 +410,7 @@ func DefaultConfig() *Config {
 			StreamImport:      false,
 			GenesisStreamFile: "",
 		},
+		Query: DefaultQueryConfig(),
 	}
 }
 
@@ -569,7 +571,7 @@ func GetConfig(v *viper.Viper) (Config, error) {
 	grpcMaxConnectionAge := clampNonNegativeDuration(v.GetDuration("grpc.max-connection-age"), DefaultGRPCMaxConnectionAge)
 	grpcMaxConnectionAgeGrace := clampNonNegativeDuration(v.GetDuration("grpc.max-connection-age-grace"), DefaultGRPCMaxConnectionAgeGrace)
 
-	return Config{
+	cfg := Config{
 		BaseConfig: BaseConfig{
 			MinGasPrices:       v.GetString("minimum-gas-prices"),
 			InterBlockCache:    v.GetBool("inter-block-cache"),
@@ -664,7 +666,15 @@ func GetConfig(v *viper.Viper) (Config, error) {
 			StreamImport:      v.GetBool("genesis.stream-import"),
 			GenesisStreamFile: v.GetString("genesis.genesis-stream-file"),
 		},
-	}, nil
+	}
+
+	queryCfg, err := ParseQueryConfig(v)
+	if err != nil {
+		return Config{}, err
+	}
+	cfg.Query = queryCfg
+
+	return cfg, nil
 }
 
 // ValidateBasic validates the server configuration.