api: memoize shared paid_blocks scan; explicit columns; normalized cache key

- getMinerBlockPayments: the 7-day paid_blocks list is identical for every miner,
  so memoize it briefly (bounded 64-entry map) instead of re-running the scan for
  each distinct address.
- transactions reads use an explicit column list (never SELECT *) so internal
  columns (payee address, payment_id) are never selected.
- /pool/coin_altblocks cache key uses the normalized integer port so equivalent
  spellings share one entry.

Author: MoneroOcean

lib/api/public.js

@@ -4,6 +4,11 @@ const workerHistory = require("../common/worker_history");
 const INVALID_POOL_TYPE = { error: "Invalid pool type" };
 const PAGE_LIMITS = [15, 50, 100];
 const MAX_PAGE = 1000;
+const PAID_BLOCKS_MEMO_TTL_MS = 10 * 1000;
+const PAID_BLOCKS_MEMO_MAX = 64;
+// Explicit column list (never SELECT *) so internal columns such as the payee
+// address and payment_id are not exposed even if a mapper later changes.
+const TRANSACTIONS_SELECT = "SELECT id, transaction_hash, mixin, fees, payees, xmr_amt, submitted_time FROM transactions";
 
 function defaultTsCompare(left, right) { return left.ts < right.ts ? 1 : left.ts > right.ts ? -1 : 0; }
 
@@ -44,7 +49,7 @@ function safeDecodeAddress(blockTemplate, address) {
 module.exports = function registerPublicRoutes(ctx) {
     const blockTemplate = ctx.blockTemplate || ctx.cnUtil;
     const { core, http, poolList } = ctx;
-    const { config, database, getCacheValue, query, support } = core;
+    const { config, database, getCacheValue, now, query, support } = core;
     const { registerCachedGet } = http;
 
     function getHashHistory(key) {
@@ -220,14 +225,14 @@ module.exports = function registerPublicRoutes(ctx) {
     }
 
     async function getPoolPayments(limit, page) {
-        const rows = await query("SELECT * FROM transactions ORDER BY id DESC LIMIT ? OFFSET ?", [limit, page * limit]);
+        const rows = await query(TRANSACTIONS_SELECT + " ORDER BY id DESC LIMIT ? OFFSET ?", [limit, page * limit]);
         if (rows.length === 0) return [];
 
         return sortMapped(rows, mapTransactionRow);
     }
 
     async function getRecentPayments(limit, page) {
-        const rows = await query("SELECT * FROM transactions ORDER BY id DESC LIMIT ? OFFSET ?", [limit, page * limit]);
+        const rows = await query(TRANSACTIONS_SELECT + " ORDER BY id DESC LIMIT ? OFFSET ?", [limit, page * limit]);
         if (rows.length === 0) return [];
 
         let poolTypes = {};
@@ -288,12 +293,36 @@ module.exports = function registerPublicRoutes(ctx) {
         return sortByTsDesc(response, support);
     }
 
-    async function getMinerBlockPayments(addressParam, limit, page) {
-        const parsed = parseAddress(addressParam);
-        const blocks = await query(
-            "SELECT * FROM paid_blocks WHERE paid_time > (NOW() - INTERVAL 7 DAY) ORDER BY id DESC LIMIT ? OFFSET ?",
+    // The recent-paid-blocks list is identical for every miner, so memoize it briefly:
+    // otherwise each distinct address re-runs the same 7-day paid_blocks scan. The cached
+    // rows are only read (never mutated) by callers, so sharing the array is safe.
+    const recentPaidBlocksMemo = new Map();
+    async function getRecentPaidBlocks(limit, page) {
+        const memoKey = limit + "|" + page;
+        const timeNow = typeof now === "function" ? now() : Date.now();
+        const cached = recentPaidBlocksMemo.get(memoKey);
+        if (cached && cached.expiresAt > timeNow) return cached.value;
+        const rows = await query(
+            "SELECT id, paid_time, found_time, port, hex, amount FROM paid_blocks WHERE paid_time > (NOW() - INTERVAL 7 DAY) ORDER BY id DESC LIMIT ? OFFSET ?",
             [limit, page * limit]
         );
+        recentPaidBlocksMemo.set(memoKey, { value: rows, expiresAt: timeNow + PAID_BLOCKS_MEMO_TTL_MS });
+        if (recentPaidBlocksMemo.size > PAID_BLOCKS_MEMO_MAX) {
+            for (const [key, entry] of recentPaidBlocksMemo) {
+                if (entry.expiresAt <= timeNow) recentPaidBlocksMemo.delete(key);
+            }
+            while (recentPaidBlocksMemo.size > PAID_BLOCKS_MEMO_MAX) {
+                const oldest = recentPaidBlocksMemo.keys().next();
+                if (oldest.done) break;
+                recentPaidBlocksMemo.delete(oldest.value);
+            }
+        }
+        return rows;
+    }
+
+    async function getMinerBlockPayments(addressParam, limit, page) {
+        const parsed = parseAddress(addressParam);
+        const blocks = await getRecentPaidBlocks(limit, page);
         if (blocks.length === 0) return [];
 
         const hexes = blocks.map(function map(row) { return row.hex; });
@@ -398,7 +427,7 @@ module.exports = function registerPublicRoutes(ctx) {
             })
         ),
         cachedRoute("/pool/coin_altblocks/:coin_port", 10 * 1000, "pool coin altblocks",
-            pagedCacheKey("pool-coin-altblocks", 15, undefined, function poolCoinAltBlockParts(req) { return [req.params.coin_port]; }),
+            pagedCacheKey("pool-coin-altblocks", 15, undefined, function poolCoinAltBlockParts(req) { return [normalizeInteger(req.params.coin_port, 0, 1)]; }),
             withPagination(15, undefined, function poolCoinAltBlocksRoute(req, pagination) {
                 const coinPort = normalizeInteger(req.params.coin_port, 0, 1);
                 if (coinPort === 0) return [];

tests/api/cache_and_payments.js

@@ -327,7 +327,7 @@ test.describe("api cache and payments", { concurrency: false }, () => {
         const config = createConfig();
         config.pplns.enable = false;
         const mysql = createMysql(async function handler(sql, params, calls) {
-            if (sql.startsWith("SELECT * FROM transactions ORDER BY id DESC")) {
+            if (sql.includes("FROM transactions ORDER BY id DESC")) {
                 return [
                     { id: 11, transaction_hash: "hash11", mixin: 12, payees: 1, fees: 2, xmr_amt: 3, submitted_time: "2024-01-02T00:00:00Z" },
                     { id: 10, transaction_hash: "hash10", mixin: 11, payees: 2, fees: 3, xmr_amt: 4, submitted_time: "2024-01-01T00:00:00Z" }
@@ -385,7 +385,7 @@ test.describe("api cache and payments", { concurrency: false }, () => {
 
     test("block payment lookups stay parameterized when the wallet path contains injection text", async () => {
         const mysql = createMysql(async function handler(sql) {
-            if (sql.startsWith("SELECT * FROM paid_blocks")) {
+            if (sql.includes("FROM paid_blocks WHERE")) {
                 return [
                     { id: 1, paid_time: "2024-01-02T00:00:00Z", found_time: "2024-01-01T00:00:00Z", port: 18081, hex: "hex1", amount: 1000 },
                     { id: 2, paid_time: "2024-01-03T00:00:00Z", found_time: "2024-01-02T00:00:00Z", port: 18081, hex: "hex2", amount: 2000 }
@@ -414,4 +414,82 @@ test.describe("api cache and payments", { concurrency: false }, () => {
         });
     });
 
+    test("block payment lookups reuse the address-independent paid_blocks scan across miners", async () => {
+        let paidBlocksCalls = 0;
+        let balanceCalls = 0;
+        const mysql = createMysql(async function handler(sql) {
+            if (sql.includes("FROM paid_blocks WHERE")) {
+                paidBlocksCalls += 1;
+                assert.doesNotMatch(sql, /SELECT \*/);
+                return [{ id: 1, paid_time: "2024-01-02T00:00:00Z", found_time: "2024-01-01T00:00:00Z", port: 18081, hex: "hex1", amount: 1000 }];
+            }
+            if (sql.startsWith("SELECT hex, amount FROM block_balance")) {
+                balanceCalls += 1;
+                return [{ hex: "hex1", amount: 0.5 }];
+            }
+            throw new Error("Unexpected SQL: " + sql);
+        });
+
+        await withRuntime({
+            blockTemplate: createBlockTemplate(),
+            config: createConfig(),
+            database: createDatabase({ caches: {} }),
+            mysql: mysql,
+            support: createSupport()
+        }, async (port) => {
+            const a = await request(port, { path: "/miner/walletA/block_payments?limit=15&page=0" });
+            const b = await request(port, { path: "/miner/walletB/block_payments?limit=15&page=0" });
+            assert.equal(a.statusCode, 200);
+            assert.equal(b.statusCode, 200);
+            // The 7-day paid_blocks scan is identical for every miner, so it runs once;
+            // only the per-miner block_balance lookup repeats.
+            assert.equal(paidBlocksCalls, 1);
+            assert.equal(balanceCalls, 2);
+        });
+    });
+
+    test("pool payments select explicit transaction columns, never SELECT *", async () => {
+        const seen = [];
+        const mysql = createMysql(async function handler(sql) {
+            seen.push(sql);
+            if (sql.includes("FROM transactions ORDER BY id DESC")) {
+                return [{ id: 1, transaction_hash: "h1", mixin: 7, payees: 1, fees: 2, xmr_amt: 3, submitted_time: "2024-01-02T00:00:00Z" }];
+            }
+            throw new Error("Unexpected SQL: " + sql);
+        });
+
+        await withRuntime({
+            blockTemplate: createBlockTemplate(),
+            config: createConfig(),
+            database: createDatabase({ caches: {} }),
+            mysql: mysql,
+            support: createSupport()
+        }, async (port) => {
+            const res = await request(port, { path: "/pool/payments/pplns?limit=15&page=0" });
+            assert.equal(res.statusCode, 200);
+            const txnSql = seen.find((sql) => sql.includes("FROM transactions ORDER BY id DESC"));
+            assert.ok(txnSql, "transactions query ran");
+            assert.doesNotMatch(txnSql, /SELECT \*/);
+            assert.doesNotMatch(txnSql, /\baddress\b/);
+            assert.doesNotMatch(txnSql, /payment_id/);
+        });
+    });
+
+    test("coin altblocks cache key normalizes the port so equivalent spellings share one entry", async () => {
+        const database = createDatabase({ caches: {} });
+        await withRuntime({
+            blockTemplate: createBlockTemplate(),
+            config: createConfig(),
+            database: database,
+            mysql: createMysql(async () => []),
+            support: createSupport()
+        }, async (port) => {
+            await request(port, { path: "/pool/coin_altblocks/18081?page=0" });
+            await request(port, { path: "/pool/coin_altblocks/018081?page=0" });
+            // Both spellings normalize to port 18081 -> one cache entry -> one DB call.
+            assert.equal(database.state.altBlockListCalls.length, 1);
+            assert.equal(database.state.altBlockListCalls[0].coinPort, 18081);
+        });
+    });
+
 });

tests/api/public_and_auth.js

@@ -516,7 +516,7 @@ test.describe("api public and auth", { concurrency: false }, () => {
 
     test("GUI-facing public routes keep nested stats, field names, and timestamp units", async () => {
         const mysql = createMysql(async function handler(sql, params) {
-            if (sql.startsWith("SELECT * FROM transactions ORDER BY id DESC")) {
+            if (sql.includes("FROM transactions ORDER BY id DESC")) {
                 return [
                     { id: 44, transaction_hash: "pool-tx", mixin: 11, payees: 3, fees: 15, xmr_amt: 345, submitted_time: "2024-01-02T03:04:05Z" }
                 ];
@@ -531,7 +531,7 @@ test.describe("api public and auth", { concurrency: false }, () => {
                     { id: 55, transaction_hash: "miner-tx", mixin: 7 }
                 ];
             }
-            if (sql.startsWith("SELECT * FROM paid_blocks")) {
+            if (sql.includes("FROM paid_blocks WHERE")) {
                 return [
                     { id: 8, paid_time: "2024-01-03T00:00:00Z", found_time: "2024-01-02T00:00:00Z", port: 18081, hex: "block-hex", amount: 400 }
                 ];