fix(dapi): bound path element queries

[QuantumExplorer]

Issue being fixed or feature implemented

Keeps public Platform queries within explicit request and diagnostic-work budgets. Covers internal review items 118, 311, 312, and 313.

What was done?

• Applied a tighter Platform request decode ceiling while preserving the Core stream ceiling.
• Validated path/key counts and byte budgets before DAPI cache serialization.
• Repeated the checks before Drive diagnostic work and at query execution.
• Removed full request-body rendering from the shared Drive query logger.
• Added count, component-size, aggregate-size, proof, and fetch regression coverage.

How Has This Been Tested?

• Full rs-dapi unit and documentation suite: 286 tests.
• Focused Drive ABCI path-query and service-boundary tests.
• Strict Clippy for rs-dapi and drive-abci across all targets.
• Workspace formatting check.

Breaking Changes

None for valid Platform requests.

Checklist:

• I have performed a self-review of my own code.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have run formatting and strict lint checks for the affected Rust crates.

Summary by CodeRabbit

• New Features

  • Added validation for path-element queries, including request version, path depth, key count, and size limits.
  • Applied service-specific request size limits for Platform and Core APIs.

• Bug Fixes

  • Invalid or oversized path queries are now rejected early with clear errors.
  • Improved protection against excessive query payloads, helping maintain service reliability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fbd89778-6a46-405e-a48c-724facc71870

📥 Commits

Reviewing files that changed from the base of the PR and between fc05d62 and 3b1e739.

📒 Files selected for processing (4)

• packages/rs-dapi/src/server/grpc.rs
• packages/rs-dapi/src/services/platform_service/mod.rs
• packages/rs-drive-abci/src/query/service.rs
• packages/rs-drive-abci/src/query/system/path_elements/v0/mod.rs

---

📝 Walkthrough

Walkthrough

Path-elements validation is added at the gRPC and query layers, covering request versions, path/key counts, and byte budgets. The Platform method retains cached Drive dispatch through a custom implementation. Platform and Core gRPC decoding limits are separated.

Changes

Path Elements Guardrails

Layer / File(s)	Summary
Query-layer path validation packages/rs-drive-abci/src/query/service.rs, packages/rs-drive-abci/src/query/system/path_elements/v0/mod.rs	Validates path-elements versions, counts, component sizes, and aggregate byte budgets before query execution, with validation tests and reduced request logging requirements.
Platform request validation and cached dispatch packages/rs-dapi/src/services/platform_service/mod.rs	Adds gRPC request validation and replaces macro-generated dispatch with a custom method that preserves cache and Drive-call behavior, with unit coverage.
Service-specific gRPC decoding limits packages/rs-dapi/src/server/grpc.rs	Applies separate decoding limits to Platform and Core services while retaining the existing encoding limit.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: pastapastapasta, shumkov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding bounds to path element queries.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-path-element-bounds

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch codex/fix-path-element-bounds

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🕓 Ready for review — 31 ahead in queue (commit ad46a85)
Queue position: 32/72 · 2 reviews active
ETA: start ~03:08 UTC · complete ~03:37 UTC (median 28m across 30 recent reviews; 2 slots)
Queued 21h 30m ago · Last checked: 2026-07-22 19:40 UTC

[codecov]

Codecov Report

❌ Patch coverage is 97.36842% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.46%. Comparing base (5b8dbf4) to head (ad46a85).
⚠️ Report is 1 commits behind head on v4.1-dev.

Files with missing lines	Patch %	Lines
...rive-abci/src/query/system/path_elements/v0/mod.rs	97.36%	2 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##           v4.1-dev    #4153       +/-   ##
=============================================
+ Coverage     65.42%   87.46%   +22.03%     
=============================================
  Files            26     2651     +2625     
  Lines          2707   334731   +332024     
=============================================
+ Hits           1771   292756   +290985     
- Misses          936    41975    +41039     

Components	Coverage Δ
dpp	88.44% <ø> (∅)
drive	86.13% <ø> (∅)
drive-abci	89.58% <97.36%> (∅)
sdk	∅ <ø> (∅)
dapi-client	∅ <ø> (∅)
platform-version	∅ <ø> (∅)
platform-value	92.90% <ø> (∅)
platform-wallet	∅ <ø> (∅)
drive-proof-verifier	49.66% <ø> (∅)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.