Merge pull request #39 from YASSERRMD/phase_2

refactor/fix: Phase 2 — code quality and safety

Author: YASSERRMD

cmd/siqlah/main.go

@@ -143,6 +143,9 @@ func main() {
 	reg := provider.NewRegistry()
 	srv := api.NewWithOptions(st, cpBuilder, operatorPub, operatorPriv, reg, version, *inferenceRegion)
 	srv.WithBackendInfo(*logBackend, *signingBackend)
+	if *rekorURL != "" {
+		srv.WithRekorURL(*rekorURL)
+	}
 	if *x402Recipient != "" {
 		srv.WithX402Recipient(*x402Recipient)
 	}

internal/api/checkpoint.go

@@ -128,7 +128,11 @@ func (s *Server) handleVerifyCheckpoint(w http.ResponseWriter, r *http.Request)
 	if cp.RekorLogIndex >= 0 {
 		resp.RekorAnchored = true
 		resp.RekorLogIndex = cp.RekorLogIndex
-		resp.RekorEntryURL = "https://rekor.sigstore.dev/api/v1/log/entries?logIndex=" +
+		rekorBase := s.rekorURL
+		if rekorBase == "" {
+			rekorBase = "https://rekor.sigstore.dev"
+		}
+		resp.RekorEntryURL = rekorBase + "/api/v1/log/entries?logIndex=" +
 			strconv.FormatInt(cp.RekorLogIndex, 10)
 	}
 	writeJSON(w, http.StatusOK, resp)

internal/api/ingest.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"strconv"
@@ -86,10 +87,16 @@ func (s *Server) handleIngestBatch(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "invalid JSON: "+err.Error())
 		return
 	}
+	const maxBatchItems = 500
 	if len(req.Items) == 0 {
 		writeError(w, http.StatusBadRequest, "items must not be empty")
 		return
 	}
+	if len(req.Items) > maxBatchItems {
+		writeError(w, http.StatusBadRequest,
+			fmt.Sprintf("batch exceeds maximum of %d items", maxBatchItems))
+		return
+	}
 	receipts := make([]*vur.Receipt, 0, len(req.Items))
 	for _, item := range req.Items {
 		if err := validateIngestRequest(item); err != nil {

internal/api/server.go

@@ -33,6 +33,7 @@ type Server struct {
 	logOrigin       string
 	logBackend      string
 	signerType      string
+	rekorURL        string
 	x402Bridge      *x402.Bridge
 	x402Recipient   string
 	modelReg        *model.Registry
@@ -71,10 +72,6 @@ func NewWithOptions(
 ) *Server {
 	s := NewWithOrigin(st, b, operatorPub, operatorPriv, reg, version, "")
 	s.inferenceRegion = inferenceRegion
-	if inferenceRegion != "" && s.energyEst == nil {
-		s.energyEst = energy.NewBenchmarkEstimator()
-		s.carbonLookup = energy.NewStaticCarbonLookup()
-	}
 	return s
 }
 
@@ -116,6 +113,13 @@ func (s *Server) WithX402Recipient(addr string) *Server {
 	return s
 }
 
+// WithRekorURL sets the Rekor transparency log base URL used when building
+// entry links in checkpoint verify responses. Defaults to the public Rekor instance.
+func (s *Server) WithRekorURL(url string) *Server {
+	s.rekorURL = url
+	return s
+}
+
 // WithBackendInfo sets the log backend and signer type strings surfaced by GET /v1/health.
 func (s *Server) WithBackendInfo(logBackend, signerType string) *Server {
 	s.logBackend = logBackend