status-im / open-bounty

Enable communities to distribute funds to push their cause forward.

Status Open Bounty

Allows you to set bounties for GitHub issues, paid out in Ether or any ERC-20 token.

More information: https://wiki.status.im/Status_Open_Bounty

Live production version: https://openbounty.status.im The master branch is automatically deployed here.

Live testnet (Ropsten) version: https://openbounty.status.im:444 The develop branch is automatically deployed here.

Table of contents

• Prerequisites
• Application config
• GitHub integration
• Contracts
• Running
• Testing
• More info

Prerequisites

You will need Leiningen 2.0 or above installed. Also, make sure that you have wkhtmltoimage available in your PATH. On macOS, it can be installed via brew cask install wkhtmltopdf.

PostgreSQL

Install PostgreSQL, and set it up properly:

psql postgres -c "CREATE USER commiteth WITH PASSWORD 'commiteth';"
psql postgres -c "CREATE DATABASE commiteth;"

Application config

Create /config-dev.edn, and populate it correctly, according to env/dev/resources/config.edn. The config fields are described below:

Key	Description
dev	Currently specifies whether Swagger UI endpoints should be added to routes
port	HTTP port for the Ring web app
dev-login	Local development only. Set it to the GitHub name of your dev user in order to log in to the system and to bypass OAuth. Following this, set server-address according to your localhost address.
nrepl-port	nREPL port for development
jdbc-database-url	PostgreSQL database URL; for instance, the URL to the local db would be jdbc:postgresql://localhost/commiteth?user=commiteth&password=commiteth
server-address	The URL and port of the local server that can be resolved from public internet. It will be used as a redirect URI during GitHub OAuth authorization process.
eth-account	Ethereum account ID for the bot. Make sure it has some test ether to cover the cost of gas for deploying contracts
eth-password	Ethereum account password for the bot
eth-rpc-url	RPC URL to the Ethereum node, e.g. Geth. Either local or remote
eth-wallet-file	Location of the wallet file. If Geth is run with the parameters specified below, it will reside under $HOME/.ropsten/keystore.
offline-signing	Specifies whether to sign transactions locally before sending. Default is true. Set to false when connecting to the local Geth node that unlocks accounts.
tokenreg-base-format	Should be set to :status
github-client-id	Related to OAuth. Copied from the GitHub account: Settings -> Developer settings -> OAuth Apps
github-client-secret	Related to OAuth. Copied from theGitHub account: Settings -> Developer settings -> OAuth Apps
github-user	GitHub username for a bot account. It is used for posting bounty comments.
github-password	GitHub password for a bot account.
webhook-secret	Secret string to be used when creating a GitHub App
user-whitelist	Set of GitHub user/org IDs to be whitelisted. E.g. #{"status-im" "your_org"}
testnet-token-data	Token data map; useful if there are Geth connectivity problems

GitHub integration

Open Bounty uses both OAuth App and GitHub App integration.

OAuth App

Follow the steps here. Specify the value of :server-address as "Homepage URL", and :server-address + /callback as "Authorization callback URL". Be sure to copy the Client ID and Client Secret values in the config file.

GitHub App

Follow the steps here. Be sure to specify :server-address + /webhook-app as "Webhook URL", and :webhook-secret as "Webhook Secret".

Contracts

All information related to development of OpenBounty smart contracts can be found in contracts/.

Running

Ethereum node

There are two options for connecting to an Ethereum node: either run a local node with an unlocked account, or connect to a remote Geth node or Infura. We will be connecting to Ropsten, which is an Ethereum network used for testing.

Local

To launch a local geth node with the bot account unlocked, issue the following command:

#!/bin/bash
geth --fast --testnet --cache=1024 --datadir=$HOME/.ropsten --verbosity 4 --port 50100 --ipcpath ~/.ropsten/geth.ipc --rpc --rpcaddr 127.0.0.1 --rpcport 8545 --rpcapi db,eth,net,web3,personal --rpccorsdomain "https://wallet.ethereum.org" --unlock "0xYOUR_ADDR" --password <(echo "YOUR_PASSPHRASE")

Remote

Register at Infura. You will receive an email with the provider's URLs. Paste a URL for the Ropsten network into config.edn under the :eth-rpc-url key, and set :offline-signing to true.

CSS auto-compilation

Launch the following command in a separate shell:

lein less auto

Solidity compilation

Compile Solidity files into Java classes with:

cd contracts && ./build.sh

Clojure app without REPL

Launch the following commands, each in its own shell:

lein run
lein figwheel

Clojure app with REPL

You'll have to start a REPL on the backend and frontend.

lein repl

Now you can start a CLJS REPL:

(use 'figwheel-sidecar.repl-api)
(start-figwheel!)
(cljs-repl)

(Alternatively, if you use emacs and CIDER, you can run cider-jack-in. Details here)

Next, start the application from the clojure REPL with:

(reset)

Uberjar build

To create a standalone uberjar:

lein uberjar

This creates target/uberjar/commiteth.jar. You can run it with the following command from within the project's root:

java -Dconf=<path_to_config.edn> -jar target/uberjar/commiteth.jar

Testing

QA

Please refer to doc/testing.md.

Clojure tests

lein test

ClojureScript tests

lein with-profile test doo phantom test

Reagent component devcards

lein with-profile test figwheel devcards

Open http://localhost:3449/cards.html

CircleCI

We use CircleCI to run unit tests. For this to work, set the following env vars:

These env vars override the configuration parameters that are usually set using the config.edn file.

• ETH_ACCOUNT - as in config.edn
• ETH_PASSWORD - as in config.edn
• ETH_RPC_URL - as in config.edn
• ETH_WALLET_FILE - as in config.edn
• ETH_WALLET_JSON - contents of this will be written to ETH_WALLET_FILE

💡 Ideally, we'd create those parameters in a script. PR welcome.

Update landing page

Landing page is static and different CSS and JS due to time constraints.

• Build CSS with Gulp (see static_landing_page/README.md
• Make changes and ./build-landing-page.sh

This copies the necessary artifacts over to the resources dir.

More info

Detailed information on code structure, troubleshooting, and more can be found here.

License

Licensed under the Affero General Public License v3.0

open-bounty's Issues

Enabling repository fails

Description

Adding a repository is currently failing every time due to a 404 response when creating the webhook. This is a regression that was most likely introduced when progressive permissioning was implemented.

Injected web3 not usable with advanced cljs optimizations

All features using the web3 injected into the javascript context are currently not working in production. This happens only with :optimizations :advanced.

Find a way to fix this without resorting to :optimizations :whitespace

Indicate testnet usage on page header and issue comment

Add "(Testnet)" to page header and github comment.

Use ropsten revival chain

User Story

As a user, I expect Commit ETH to use the Ropsten revival chain.

Description

We indicate Testnet usage on the UI, but use a different Ropsten soft fork than eg. Metamask. Let's make geth use the ropsten revival chain.

https://github.com/ethereum/ropsten/blob/master/README.md

This may have an impact on existing bounties, but that should not be a huge proble since it's just test data.

Keep github oauth tokens on the client side

User Story

As a user, I expect commiteth to respect my privacy and not store my github oauth token on the server.

Description

Type: Enhancement

Summary: There should be no need to store github oauth tokens on the server.

Solution

• after successful redirect to commiteth.com, pass token to client-side and put it in localStorage on the client, avoiding the need to store the token on the server
• each commiteth HTTP API call that uses functionality in the github API requiring the user's token should be passed the token (we use ssl, so no security issue here)

first time sign-in, did not sign me in

first time signing in, retuned me to commiteth and i had to press sign in button again.

Layout looks broken on mobile browser and on status.im

Description

Layout looks broken on mobile browser and on status.im

Type: Bug

• Browser: Status.im

• Operating System: Status.im

Way to see outstanding bounties

User Story

As a user, I want to see a list of outstanding bounties so that I can know where to contribute and earn some sweet ETH.

Description

Type: Feature

Summary: Add ability to view a list of outstanding bounties.

Solution

I would expect that a new tab would be available labeled "Outstanding Bounties", next to "Activity". This would list all outstanding bounty and link to issues.

Filter for forks on Repositories view

User Story

As a user, I want to choose whether or not to show forked repositories in the Repositories view, because I have, like many other users, a large amount of forks, for which I am rarely interested in adding bounties.

Description

Type: Feature

Solution

Add a toggle switch with caption "Show forked repositories" to the view. Default should be off. The filtering should be done client-side.

Allow setting bounties for forked repositories

User Story

As a user, I may want to set a bounty to a forked repository.

Description

Currently, the admin view for repositories lists non-fork repositories where the user has admin access to webhooks. We should show also forks.

Solution

Don't filter out forked repositories.

Github webhook security impovements

We should set a secret key in the config when creating Github webhooks and verify the received webhook POST payloads' integrity.

https://developer.github.com/webhooks/securing/

Post comment immediately after bounty label added

Currenty we post the QR image as a comment to the Github issue only after the contract has been mined and we know the contract address.

To provide better UX, let's initially post this image:

and update it with the QR image once the contract has been mined.

Add existing bounty tagged issues when enabling a repository

Currently, bounties are created only for new issues added after the repository is enabled by the maintainer. It should work so that when a repository is enabled, we immediately add bounties for existing issues with the "bounty" label.

Cache invalidation for app.js

Currently users' browsers are caching the application's javascript, causing the site to sometimes appear broken until a forced refresh is performed. Let's find a way to invalidate caches when a new version is deployed. Optimus seems like a good tool for this.

README.md downloads on site

User Story

As a user of commiteth.com I went to commiteth.com/README.md and a README downloaded.

Description

Bug

Expected behavior

A 404 page would be served

Actual behavior

A file downloaded

Reproduction

• Go to commiteth.com/README.md

Solution

Summary:

Additional Information

I was using chrome.

Built by Status
version d6aaa2d

ETH Address

0x4f22Fc7990F1a99133e5FAa40C4CD1De23a8e3C5

overflow-y: scroll; causes double scrollbars

Don't add overflow-y: scroll; to <html>

Setup Yellerapp

http://yellerapp.com/

list isn't populated with bounties & more

Contract may not get deployed in a high concurrency situation

Description

Type: Bug

Summary: If we receive many issue-labeled webhook events triggering bounty contract deployments within a very short time, all contracts may not get deployed successfully.

Expected behavior

Commiteth should be robust enough to have all the contracts deployed successfully.

Actual behavior

For the failed contract deployments, we get the following error response from geth's json-rpc:
{:code -32000, :message known transaction: 8af7cb488c7b60eea519e2086215e50f0616df5a6d0009891995556fde8f7cc0}

Reproduction

Add the bounty label to ~5 issues within ~15 seconds.

Estimate gas instead of hard-coding

Currently eth.core/send-transaction (used for contract deployments and multisig wallet operations) uses a hard-coded value for gas. We should make the gas value dynamic by using eth_estimateGas.

Show organization thumbnail and repository name for bounty-added and bounty-balance-updated activity feed items

User Story

As a user I am more interested in seeing the project name than the repository's admin's name on the activity feed for items related to new bounties and bounty balance updates.

Description

Type: Enhancement

Solution

Currently bounty-balance-updated (and bounty-created more or less) items look like this:

Let's change

• picture to be organization profile image in case the repository is owned by an organization, or profile image of repo owner
• title to repository name instead of repo admin name

Toggle checkbox for a repository needs to be atomic

Currently, the checkbox for enabling/disabling a repository immediately switches it's state upon clicking, regardless of what happens to the AJAX request. This causes UI state corruption, when for example you quickly click the checkbox several times.

The checkbox should only change it's checked state after the operation has been completed and not allow clicks during the operation.

Optional deadline for bounties

User Story

As a user who sets bounties on issues, I would like to be able to (optionally) set a deadline for the claim.

Description

Type: Feature

(This feature was suggested by rolandkin the #commiteth slack channel)

Add ability to set a deadline for a bounty. If no PR is accepted before the deadline passes, the funds are automatically returned to the repo admin.

Details TBD

Datetetimes on front end use wrong time-zone

We store all timestamps in UTC time in the DB, but for some reason the datetimes delivered to the front end are off by 8 hours. Something is converting these datetimes from UTC -> SGT.

This means eg. activity feed will show 8 hours ago for an event that just happened.

Do not allow users with no Ethereum account configured to enable repositories

Users should not be allowed to enable repositories before they have provided a valid Ethereum address. Currently it is possible and it leads to a crash in case a user enables a repo and adds bounty issues.

It would probably make sense for the UI to indicate somehow that using the system is not possible before configuring your address. Maybe force it as first step after signing up.

All tabs show "no data" in both logged-in & logged-out states

Description

Type: Bug

Expected behavior

comment: # Expect to see a feed of Activity, repos, etc.

Actual behavior

comment: # No feeds are shown. The site appears broken.

Reproduction

comment: # Visit https://commiteth.com/

Additional Information

• Browser: Tried Safari and Chrome (Mac OS Sierra) No JS errors seen.

• Operating System: Mac OS Sierra

Update comment when pull request merged

User Story

As a user, I want to know that I should not send ETH to a bounty contract that already has a claim chosen as the winner.

Description

Type: Enhancement

Summary: No QR image and more informative comment for bounties with a merged referencing PR.

Currently, a github issue that has a merged referencing PR (winning claim) still has the QR image and contract address shown until the maintainer signs off the payout. After the winning claim is chosen, commieth self-signs the contract and it is not possible (to my understanding) to send more ETH to it.

Solution

Update the comment to not include QR image and the text to read

Balance: <balance>
Contract address: <addr>
Network: <network>
Winner: <winner-username>

commiteth.com should use HTTPS

The production server should use HTTPS. We can get a free SSL certificate from letsencrypt.org and set up automated renewal.

Not possible to switch github accounts

Currently it is not possible to switch github accounts on the commiteth web UI.

Reproducing:

• sign in with a github account A
• sign out
• press sign in again
  -> commiteth signs you in with account A automatically

The only way to sign in with another github account at this point is to revoke access to the oauth application on github's settings view for account A.

There should be some means of switching accounts.

Minimize required Github permission set

User Story

As a user, I only want to grant the commiteth bot permissions that make sense.

Description

Type: Bug

Currently, the following permissions are requested from users when signing up.

There are most likely some permissions that are not actually needed.

Update comment image for signed off bounty

User Story

As a user, I want the comment image generated by commieth to clearly indicate that the bounty has been signed off, so no one will send ETH to the contract.

Type: Feature

Summary: Currently, the comment image for a bounty issue is not updated after the bounty has been signed off to the winner.

Solution

Update the comment and image indicating the bounty has been signed off. The image should not contain a QR code and the comment should not contain the contract address.

Broken link on manage bounties view

Description

Type: Bug

Summary: Bounties view link to Github issue is missing the repo owner in the URL.

Expected behavior

The URL should contain https://github.com/<owner>/<repo>/issues/<issue-number>

Actual behavior

URL contains https://github.com//<repo>/issues/<issue-number>

Crash in pull request webhook handler

Description

Type: Bug

There is a crash when receiving a webhook payload for pull_request opened event for an issue that has a bounty.

Reproduction

• Enable a repo
• Add bounty label to an issue
• Create a PR referencing the bounty issue
  -> webhook POST for pull_request opened will now cause a 500 internal server error

Twitter Bounty Alerts

User Story

As a user, I want to get updated via twitter every time there is a new bounty available

Solution

Every time a new bounty is posted, post to twitter account using twitter API. Store twitter credentials in secure way. Don't check in any credentials, instead provide example config for users deploying the app to set their twitter token. Provide instructions on how to obtain a twitter token.

Organisations are not listed.

User Story

As a user, I want to add a repository from my organisation so that I can use commieth.

Description

Type: Bug

Summary: I want to add my organisation repository, like I used to.

Expected behavior

After signing in I want to goto repositories tab and

Actual behavior

Nothing, I can only see personal.

Reproduction

• Open Commiteth
• Sign-in
• Navigate to Repositories Tab
• See absolutely no organisation repositories

Balance not updated to QR image

After a bounty issue is created and some ether is deposited onto the bounty contract, the commiteth bot should update the ETH balance to the the bounty comment on the Github issue.

It currently updates the text "Current balance: N.00000000 ETH" in the beginning of the comment, but leaves the QR image unmodified, showing the old balance.

Indicate confirming bounties not possible without connected wallet

User Story

As a user, I want to have a clear indication that confirming bounty payouts is not possible unless I have an Ethereum wallet connected to the app.

Description

Type: Improvement

Summary: Currently the manage bounties view shows a greyed out "Confirm" button for bounties pending payout if the signed in used has no Ethereum wallet connected.

Solution

Let's add a warning style message (something like http://semantic-ui.com/collections/message.html#warning) to top of the view with the text "To sign claims, please view Commiteth in Status, Mist or Metamask".

Permissions

These permissions are quite intrusive:

And I think most of them are not needed right? As far as I understand only issue read/write is used ..

Ability to tweet bounties automatically.

User Story

As a user/developer, I want to have my bounties broadcasted to Twitter so more people will know about it.

Description

Type: Feature

Summary: When a new bounty gets added to CommitETH, a bot will broadcast that bounty to Twitter. This can be used via the CommitETH Twitter account or a fresh one made for this purpose.

Also consider:

• Tweeting made optional, user needs to enable the function via CommitETH page.
• Add the ability for a user/developer to add hashtags to engage a more specific and/or broad audience on Twitter.

Homepage listings

The homepage should list

Activity (new bounty, changes in balance, awarded)
Top Bounty Hunters (and their earnings)
A list of most popular repositories

Similar to https://www.bountysource.com/

Maintainer list does not include Organisation repositories

Support ERC20 using DSMultsig, DSAuth & DSAuthority

This is the Multisig contract used by Maker

https://github.com/nexusdev/ds-multisig
https://github.com/nexusdev/ds-auth/blob/master/src/DSAuthority50.sol
https://github.com/nexusdev/ds-auth/blob/master/src/auth.sol

you will want to learn the DSAuthority pattern, which is what allows an ERC20 contract to have restricted access to only a multisig

if you make your ERC20 contract inherit from DSAuth, then you can control it with a DSAuthority which is in turn owned by your multisig.

Include contract address in comment text

Currently the bot's comment includes the QR image and a "current balance" text. The image has a the contract address as text, but since it's an image copying it to the clipboard is impossible. Let's include the address in the comment text.

Users and repositories DB tables use incorrect datatype for datetimes

Both users.created and repositories.updated use SQL time datatype. We want to store full datetimes instead of time of day, so those should be changed to timestamp.

Store bounty comment image for all balances

Currently we store one comment PNG image in the db per bounty issue. This works correctly for the issue page on Github, but email notifications (and Slack integration) will show the latest image for all comments of an issue, showing a different balance on the image and comment.

Let's change it to store an image for all balances.

Bounty contract does not get deployed if bot account runs out of gas

Description

Type: Bug

If the bot account runs out of gas and a bounty label is added to an issue of an enabled repository, we try to deploy the contract and save the transaction ID in DB, but nothing gets written to the blockchain. This leads to the scheduler waiting indefinetely for the contract to get mined, even after some more ETH has been added to the bot account.

Solution

Periodically look for bounties where we have a transaction ID, but no address and if get-transaction-receipt returns nil for them, re-deploy the contract. This should be enough to have CommitETH recover from balance going to 0.

Spinner shown forever on manage bounties view after confirming payout

Description

Type: Bug

Summary: After clicking on the Confirm button for bounty pending payout on manage bounties view, the button is meant go into an in progress state until the transaction is approved in the connected wallet.

Expected behavior

Button spinner not shown after transaction approved. Bounty issue shown in "Old claims" list with greyed out "Signed off" button.

Actual behavior

Button spinner shown even after transaction approved. Payout succeeds, so this is just a UI glitch.

Reproduction

• Pre-conditions:
  • user with admin access to a repo with bounties signed in
  • a bounty issue with a merged pull-request exists

• open "Bounties" page
• click on "Confirm"

Additional Information

• Observed with MetaMask. Most likely happens with all wallets.

Progressive permissioning

User Story

As a user, I only want to grant commiteth permissions that are needed.

Description

Type: Feature

Summary: Require only basic permissions when signing up and ask for more permissions when needed.

Solution

• require only user:email when signing up
• require additionally admin:repo_hook, repo and admin:org_hook in case the user wants to use the Manage repositories feature (to be a repo admin). This can work so that if the user does not already have the full permission set, there is a button on the "Repositories" tab for granting access.

Automatically add the "bounty" label to a repository

'bounty' label doesn't exist by default. Let's add it automatically.

Design similar to BountySource

We need a stripped down web design similar to https://www.bountysource.com/

Let's discuss