• Add POST /debug/reset-scores endpoint to clear optimizer scores
• Implement handler in both RPCConsumer and RPCSmartRouter packages
• Returns JSON with reset status and chain count
• Add comprehensive unit tests for new endpoint

Add reset-scores debug endpoint to RPCConsumer

• Add POST /debug/reset-scores handler to buildDebugMux function
• Validate POST method only, reject other HTTP methods
• Iterate through all optimizers and call ResetState on each
• Return JSON response with reset status and chain count
• Update function documentation to mention new endpoint

protocol/rpcconsumer/rpcconsumer.go

Add unit tests for reset-scores endpoint

• Add postResetScores helper function for test requests
• Add TestDebugResetScores_ReturnsJSON to verify successful response
• Add TestDebugResetScores_MethodNotAllowed to verify POST-only enforcement
• Add TestDebugResetScores_DoesNotChangeOffset to verify offset preservation

protocol/rpcconsumer/debug_server_test.go

Add reset-scores debug endpoint to RPCSmartRouter

• Add POST /debug/reset-scores handler to buildDebugMux function
• Validate POST method only, reject other HTTP methods
• Iterate through all optimizers and call ResetState on each
• Return JSON response with reset status and chain count
• Update function documentation to mention new endpoint

protocol/rpcsmartrouter/rpcsmartrouter.go

Description

The new POST /debug/reset-scores handler mutates optimizer state but accepts an empty POST with no
Content-Type/body/token validation, so it can be triggered by cross-origin browser requests (e.g., a
simple HTML form) whenever the debug server is enabled. This is a meaningful security footgun
compared to /debug/time-warp, which effectively requires JSON parsing and therefore is harder to
invoke without preflight-triggering headers.

Code

protocol/rpcconsumer/rpcconsumer.go[R402-417]

+	// POST /debug/reset-scores — clears optimizer score state without changing
+	// current time offset or NowFunc.
+	mux.HandleFunc("/debug/reset-scores", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			http.Error(w, "POST only", http.StatusMethodNotAllowed)
+			return
+		}
+		count := 0
+		optimizers.Range(func(chainID string, opt *provideroptimizer.ProviderOptimizer) bool {
+			opt.ResetState()
+			count++
+			return true
+		})
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"reset":true,"chains_reset":%d}`, count)
+	})

Evidence

In both buildDebugMux copies, /debug/reset-scores only checks the HTTP method and then immediately
calls ResetState() across optimizers; there is no check for a required header/token or JSON body,
which makes it trivially invokable by "simple" cross-origin POSTs. The new tests explicitly
demonstrate that a nil-body POST with no headers succeeds (200), confirming the endpoint is designed
to be callable this way.

protocol/rpcconsumer/rpcconsumer.go[402-417]
protocol/rpcsmartrouter/rpcsmartrouter.go[417-432]
protocol/rpcconsumer/debug_server_test.go[31-37]
protocol/rpcconsumer/debug_server_test.go[186-194]
protocol/rpcconsumer/rpcconsumer.go[266-283]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`POST /debug/reset-scores` is state-changing but currently accepts an empty POST with no header/body validation. This makes it easy to trigger from untrusted browser contexts (CSRF-style) whenever the debug server is enabled.

### Issue Context
Unlike `/debug/time-warp`, this endpoint does not require JSON decoding, so it can be invoked by a "simple" cross-origin POST (e.g., HTML form) without any special headers.

### Fix Focus Areas
- Add a required header token (e.g., `X-Debug-Token`) configured via flag/env, and return 401 if missing/invalid; **and/or**
- Require `Content-Type: application/json` and decode a trivial body (e.g., `{}`) so "simple" form POSTs fail.

- protocol/rpcconsumer/rpcconsumer.go[402-417]
- protocol/rpcsmartrouter/rpcsmartrouter.go[417-432]
- protocol/rpcconsumer/debug_server_test.go[31-37]
- protocol/rpcsmartrouter/debug_server_test.go[27-32]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.