feat / Add Gateway proxy router

[fengtality]

Summary

• Adds a catch-all proxy router at /api/gateway-proxy/* that forwards requests to the Gateway server unchanged
• This allows the dashboard to access all Gateway endpoints through the API without needing each endpoint to be explicitly defined
• Protected by HTTP Basic Auth like all other routes

Examples

GET /api/gateway-proxy/wallet -> GET localhost:15888/wallet
POST /api/gateway-proxy/wallet/add -> POST localhost:15888/wallet/add
GET /api/gateway-proxy/config -> GET localhost:15888/config

Security Review

• ✅ Protected by authentication (same auth_user dependency as other routers)
• ✅ Fixed target host (Gateway URL from config, not user-controllable)
• ✅ No SSRF risk - forwards only to internal Gateway service

Test plan

• Verify authentication is required
• Test forwarding GET/POST requests to Gateway
• Test health check endpoint at /api/gateway-proxy

🤖 Generated with Claude Code

[rapcmia]

Commit 9f79733

• Tested on docker and build local image successfully on ubuntu24.04
• Setup hummingbot-api using make setup;make deploy ok
• Started gateway on hummingbot/gatewat:development image ok
• Tested with no credentials, responded with Not authenticated ✅
• Ran health check for /gateway-proxy ✅
• Tested gateway-proxy ❗
  • GET /gateway-proxy/ (health) ok
  • GET /gateway-proxy/config ok
  • GET /gateway-proxy/config/chains ok
  • POST /gateway-proxy/config/update
  • GET /gateway-proxy/wallet ok
  • POST /gateway-proxy/wallet/add ok
  • POST /gateway-proxy/wallet/create ok
  • POST /gateway-proxy/wallet/show-private-key ok
  • POST /gateway-proxy/wallet/send
  • DELETE /gateway-proxy/wallet/remove ❌
    • Got a Validation error on DELETE /wallet/remove: body must be object

    curl -sS --max-time 20 -u admin:admin -H 'Content-Type: application/json' -X DELETE http://localhost:8000/gateway-proxy/wallet/remove -d '{"chain":"solana","address":"Hj1nWhpMGgSeoBXDEUUbvBPMGouD8DqganvFAm4hutdc"}' | jq
    {
      "statusCode": 400,
      "error": "Validation Error",
      "message": "body must be object",
      "validation": [
        {
          "instancePath": "",
          "schemaPath": "#/type",
          "keyword": "type",
          "params": {
            "type": "object"
          },
          "message": "must be object"
        }
      ]
    }
    

  • POST /gateway-proxy/chains/solana/balances ok
  • GET /gateway-proxy/tokens ok
  • POST /gateway-proxy/tokens ok
  • DELETE /gateway-proxy/tokens ok

Test logs: 20012026.log

[fengtality]

@rapcmia thanks for detailed review and finding the delete issue. Last commit shd fix it.

[rapcmia]

• • Tested this PR with ubuntu24.04 on docker
  • Successfully build docker image
  • Successfully deploy gateway development
  • Tested gateway-proxy with no authentication, responded with Not authenticated ✅
  • Ran health check for /gateway-proxy ✅
  • Tested gateway-proxy
    • GET /gateway-proxy/ (health) ok
    • GET /gateway-proxy/config ok
    • GET /gateway-proxy/config/chains ok
    • POST /gateway-proxy/config/update
    • GET /gateway-proxy/wallet ok
    • POST /gateway-proxy/wallet/add ok
    • POST /gateway-proxy/wallet/create ok
    • POST /gateway-proxy/wallet/show-private-key ok
    • POST /gateway-proxy/wallet/send ok
    • DELETE /gateway-proxy/wallet/remove ok
    • POST /gateway-proxy/chains/solana/balances ok
    • GET /gateway-proxy/tokens ok
    • POST /gateway-proxy/tokens ok
    • DELETE /gateway-proxy/tokens ok
  • If gateway-proxy request expects a JSON body, User must include -d ‘{…}’ with Content-Type: application/json

      #### sample
      curl -s -u admin:admin -X DELETE \
        -H 'Content-Type: application/json' \
        -d '{"chain":"solana","address":"<wallet>"}' \
        http://localhost:8000/gateway-proxy/wallet/remove | jq
    

---

Test logs: 20012026.log, 22012026.log