From 7e5c8b7a4b9aea34f1677d6466fda251ed1fbe11 Mon Sep 17 00:00:00 2001
From: lifofifo <lifofifo@thinkwares.com>
Date: Thu, 3 Oct 2024 20:19:32 -0500
Subject: [PATCH] Remove /runes/balances API endpoint

This endpoint returns every output containing any kind of a Rune. That doesn't seem very useful, and it's potentially a DDoS vector.
---
 src/subcommand/server.rs | 37 ---------------------
 tests/json_api.rs        | 70 ----------------------------------------
 2 files changed, 107 deletions(-)

diff --git a/src/subcommand/server.rs b/src/subcommand/server.rs
index 52dc058986..9701d26bcd 100644
--- a/src/subcommand/server.rs
+++ b/src/subcommand/server.rs
@@ -255,7 +255,6 @@ impl Server {
         .route("/rune/:rune", get(Self::rune))
         .route("/runes", get(Self::runes))
         .route("/runes/:page", get(Self::runes_paginated))
-        .route("/runes/balances", get(Self::runes_balances))
         .route("/sat/:sat", get(Self::sat))
         .route("/satpoint/:satpoint", get(Self::satpoint))
         .route("/search", get(Self::search_by_query))
@@ -767,34 +766,6 @@ impl Server {
     })
   }
 
-  async fn runes_balances(
-    Extension(index): Extension<Arc<Index>>,
-    AcceptJson(accept_json): AcceptJson,
-  ) -> ServerResult {
-    task::block_in_place(|| {
-      Ok(if accept_json {
-        Json(
-          index
-            .get_rune_balance_map()?
-            .into_iter()
-            .map(|(rune, balances)| {
-              (
-                rune,
-                balances
-                  .into_iter()
-                  .map(|(outpoint, pile)| (outpoint, pile.amount))
-                  .collect(),
-              )
-            })
-            .collect::<BTreeMap<SpacedRune, BTreeMap<OutPoint, u128>>>(),
-        )
-        .into_response()
-      } else {
-        StatusCode::NOT_FOUND.into_response()
-      })
-    })
-  }
-
   async fn home(
     Extension(server_config): Extension<Arc<ServerConfig>>,
     Extension(index): Extension<Arc<Index>>,
@@ -2921,14 +2892,6 @@ mod tests {
     );
   }
 
-  #[test]
-  fn html_runes_balances_not_found() {
-    TestServer::builder()
-      .chain(Chain::Regtest)
-      .build()
-      .assert_response("/runes/balances", StatusCode::NOT_FOUND, "");
-  }
-
   #[test]
   fn fallback() {
     let server = TestServer::new();
diff --git a/tests/json_api.rs b/tests/json_api.rs
index d5b9ff9720..928cd20d4d 100644
--- a/tests/json_api.rs
+++ b/tests/json_api.rs
@@ -643,76 +643,6 @@ fn get_runes() {
   );
 }
 
-#[test]
-fn get_runes_balances() {
-  let core = mockcore::builder().network(Network::Regtest).build();
-
-  let ord = TestServer::spawn_with_server_args(&core, &["--index-runes", "--regtest"], &[]);
-
-  create_wallet(&core, &ord);
-
-  core.mine_blocks(3);
-
-  let rune0 = Rune(RUNE);
-  let rune1 = Rune(RUNE + 1);
-  let rune2 = Rune(RUNE + 2);
-
-  let e0 = etch(&core, &ord, rune0);
-  let e1 = etch(&core, &ord, rune1);
-  let e2 = etch(&core, &ord, rune2);
-
-  core.mine_blocks(1);
-
-  let rune_balances: BTreeMap<Rune, BTreeMap<OutPoint, u128>> = vec![
-    (
-      rune0,
-      vec![(
-        OutPoint {
-          txid: e0.output.reveal,
-          vout: 1,
-        },
-        1000,
-      )]
-      .into_iter()
-      .collect(),
-    ),
-    (
-      rune1,
-      vec![(
-        OutPoint {
-          txid: e1.output.reveal,
-          vout: 1,
-        },
-        1000,
-      )]
-      .into_iter()
-      .collect(),
-    ),
-    (
-      rune2,
-      vec![(
-        OutPoint {
-          txid: e2.output.reveal,
-          vout: 1,
-        },
-        1000,
-      )]
-      .into_iter()
-      .collect(),
-    ),
-  ]
-  .into_iter()
-  .collect();
-
-  let response = ord.json_request("/runes/balances");
-  assert_eq!(response.status(), StatusCode::OK);
-
-  let runes_balance_json: BTreeMap<Rune, BTreeMap<OutPoint, u128>> =
-    serde_json::from_str(&response.text().unwrap()).unwrap();
-
-  pretty_assert_eq!(runes_balance_json, rune_balances);
-}
-
 #[test]
 fn get_decode_tx() {
   let core = mockcore::builder().network(Network::Regtest).build();