FIX: dyno crash on duplicate token insert + hardening from review

[GladosBlueWallet]

Summary

Fixes the production crash from Jul 21 (H13, unhandled ER_DUP_ENTRY on /getTokenConfiguration) plus the issues surfaced by a follow-up review of the surrounding code. Five commits, each self-contained:

• FIX: crash on duplicate insert — getTokenConfiguration hit a check-then-insert race on the (token, os) unique index; the rejected promise escaped the route wrapper and killed the dyno. Create path now catches ER_DUP_ENTRY and re-reads the row the concurrent request inserted (same guard in worker-sender). The express route wrapper also gained a .catch so any future rejected handler returns 500 instead of crashing the process.
• FIX: worker-sender crash-loop on malformed queue payload — payload validation ran after findOneBy, which throws on undefined criteria, and the poison record was never removed: one POST /enqueue with {} wedged the worker in a crash-restart loop. Validation now runs first and the record is removed.
• FIX: rate limiter was registered after routes so it never ran — express dispatches in registration order and route handlers don't call next(), so the limiter only ever throttled 404s. Now registered before routes. Note: this makes the existing 100 req/15 min/IP limit effective for the first time — worth watching for 429s from clients behind carrier-grade NAT after deploy.
• FIX: setTokenConfiguration dropped settings on create; stop swallowing real db errors — the create branch ignored all level_*/lang/redacted fields (first-ever call with redacted: true stored redacted: false and returned 200). Fields are now applied on create too, with the same duplicate-race guard. Blanket catch {} blocks in majorTomToGroundControl/unsubscribe/setTokenConfiguration now only swallow expected duplicates; real DB errors surface as 500 instead of a false success.
• FIX: blockprocessor retries failed block instead of silently skipping it — any processing error (except literal "socket hang up") used to advance LAST_PROCESSED_BLOCK, silently dropping every notification in that block; the error.message.includes check itself crashed on non-Error throws. Now it logs, sleeps 10s, and retries the block. Trade-off: a deterministically failing block retries forever (loudly) instead of being skipped silently.

Test plan

• 57/57 vitest tests pass (npx vitest run), including 8 new tests: duplicate-race handling for get/set, non-duplicate errors still propagate, settings applied on create, duplicate subscriptions treated as success, unsubscribe skips missing records
• tsc --noEmit clean, prettier clean
• After deploy: confirm no H13s on /getTokenConfiguration under load, watch 429 rates from the now-active rate limiter, confirm worker-sender drains the queue

Made with Cursor