fix rewards admin hmac import

Author: keon0711

node/rewards_implementation_rip200.py

@@ -12,6 +12,7 @@
 import sqlite3
 import time
 import os
+import hmac
 try:
     from flask import request, jsonify
 except ImportError:
@@ -286,7 +287,6 @@ def register_rewards_rip200(app, DB_PATH):
     @app.route('/rewards/settle', methods=['POST'])
     def settle_rewards():
         # ── Authentication: settlement is a privileged operation ──────
-        import hmac
         settle_key = os.environ.get("RC_SETTLE_KEY", "")
         if not settle_key:
             return jsonify({"error": "RC_SETTLE_KEY not configured — settle endpoint disabled"}), 503

tests/test_rewards_admin_hmac_import.py

@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: MIT
+
+import sqlite3
+import sys
+
+from flask import Flask
+
+
+rewards = sys.modules["rewards_mod"]
+ADMIN_KEY = "abcdefghijklmnopqrstuvwxyz123456"
+
+
+def _app_with_balances(tmp_path, monkeypatch):
+    db_path = tmp_path / "rewards.db"
+    with sqlite3.connect(db_path) as db:
+        db.execute("CREATE TABLE balances (miner_id TEXT PRIMARY KEY, amount_i64 INTEGER)")
+        db.execute("INSERT INTO balances VALUES (?, ?)", ("alice", 1_000_000))
+
+    monkeypatch.setenv("RC_ADMIN_KEY", ADMIN_KEY)
+    app = Flask(__name__)
+    app.config["TESTING"] = True
+    rewards.register_rewards_rip200(app, str(db_path))
+    return app
+
+
+def test_wallet_balance_admin_guard_uses_module_hmac(tmp_path, monkeypatch):
+    app = _app_with_balances(tmp_path, monkeypatch)
+
+    response = app.test_client().get(
+        "/wallet/balance?miner_id=alice",
+        headers={"X-Admin-Key": ADMIN_KEY},
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["amount_i64"] == 1_000_000
+
+
+def test_wallet_balance_rejects_wrong_admin_key_without_500(tmp_path, monkeypatch):
+    app = _app_with_balances(tmp_path, monkeypatch)
+
+    response = app.test_client().get(
+        "/wallet/balance?miner_id=alice",
+        headers={"X-Admin-Key": "wrong"},
+    )
+
+    assert response.status_code == 401
+    assert response.get_json()["error"].startswith("Unauthorized")
+
+
+def test_all_balances_admin_guard_uses_module_hmac(tmp_path, monkeypatch):
+    app = _app_with_balances(tmp_path, monkeypatch)
+
+    response = app.test_client().get(
+        "/wallet/balances/all",
+        headers={"X-Admin-Key": ADMIN_KEY},
+    )
+
+    assert response.status_code == 200
+    assert response.get_json()["total_urtc"] == 1_000_000