From d24c10ca9c2b7a6591f6dd0cdcce0d0ea9510e81 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Thu, 26 Feb 2026 15:40:09 +0700
Subject: [PATCH] Debug-log every API request and response

Add debugFetch wrapper in log.js that logs method, URL, and body on
request, and status code on response. Replace all fetch() calls
across balances, transactions, tokens, background RPC proxy, and
settings validation with debugFetch.
---
 src/background/index.js     |  3 ++-
 src/popup/views/settings.js |  6 +++---
 src/shared/balances.js      |  4 ++--
 src/shared/log.js           | 12 +++++++++++-
 src/shared/tokens.js        |  4 +++-
 src/shared/transactions.js  |  6 +++---
 6 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/src/background/index.js b/src/background/index.js
index 503d378..fcb22f3 100644
--- a/src/background/index.js
+++ b/src/background/index.js
@@ -8,6 +8,7 @@ const {
 } = require("../shared/constants");
 const { state, loadState, saveState } = require("../shared/state");
 const { refreshBalances } = require("../shared/balances");
+const { debugFetch } = require("../shared/log");
 
 const storageApi =
     typeof browser !== "undefined"
@@ -67,7 +68,7 @@ function extractHostname(origin) {
 // Proxy an RPC call to the Ethereum node
 async function proxyRpc(method, params) {
     const rpcUrl = await getRpcUrl();
-    const resp = await fetch(rpcUrl, {
+    const resp = await debugFetch(rpcUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
diff --git a/src/popup/views/settings.js b/src/popup/views/settings.js
index f892967..7c7fb27 100644
--- a/src/popup/views/settings.js
+++ b/src/popup/views/settings.js
@@ -1,7 +1,7 @@
 const { $, showView, showFlash } = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { ETHEREUM_MAINNET_CHAIN_ID } = require("../../shared/constants");
-const { log } = require("../../shared/log");
+const { log, debugFetch } = require("../../shared/log");
 
 const runtime =
     typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
@@ -56,7 +56,7 @@ function init(ctx) {
         }
         showFlash("Testing endpoint...");
         try {
-            const resp = await fetch(url, {
+            const resp = await debugFetch(url, {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({
@@ -98,7 +98,7 @@ function init(ctx) {
         }
         showFlash("Testing endpoint...");
         try {
-            const resp = await fetch(url + "/stats");
+            const resp = await debugFetch(url + "/stats");
             if (!resp.ok) {
                 showFlash("Endpoint returned HTTP " + resp.status + ".");
                 return;
diff --git a/src/shared/balances.js b/src/shared/balances.js
index 363432d..1dfe9a9 100644
--- a/src/shared/balances.js
+++ b/src/shared/balances.js
@@ -9,7 +9,7 @@ const {
     formatUnits,
 } = require("ethers");
 const { ERC20_ABI } = require("./constants");
-const { log } = require("./log");
+const { log, debugFetch } = require("./log");
 const { deriveAddressFromXpub } = require("./wallet");
 
 // Use a static network to skip auto-detection (which can fail and cause
@@ -40,7 +40,7 @@ function formatTokenBalance(raw, decimals) {
 // Returns [{ address, symbol, decimals, balance }].
 async function fetchTokenBalances(address, blockscoutUrl) {
     try {
-        const resp = await fetch(
+        const resp = await debugFetch(
             blockscoutUrl + "/addresses/" + address + "/token-balances",
         );
         if (!resp.ok) {
diff --git a/src/shared/log.js b/src/shared/log.js
index ee3c47e..b4a63f9 100644
--- a/src/shared/log.js
+++ b/src/shared/log.js
@@ -27,4 +27,14 @@ const log = {
     },
 };
 
-module.exports = { log };
+// Fetch wrapper that debug-logs every request and response.
+async function debugFetch(url, opts) {
+    const method = (opts && opts.method) || "GET";
+    const body = opts && opts.body;
+    log.debugf("fetch →", method, url, body || "");
+    const resp = await fetch(url, opts);
+    log.debugf("fetch ←", resp.status, url);
+    return resp;
+}
+
+module.exports = { log, debugFetch };
diff --git a/src/shared/tokens.js b/src/shared/tokens.js
index 5b90119..ea69439 100644
--- a/src/shared/tokens.js
+++ b/src/shared/tokens.js
@@ -5,6 +5,8 @@
 // Source: Etherscan, CoinGecko, CoinMarketCap as of 2026-02-25.
 // Ordered by approximate market cap descending.
 
+const { debugFetch } = require("./log");
+
 const COINDESK_API = "https://data-api.coindesk.com/index/cc/v1/latest/tick";
 
 const DEFAULT_TOKENS = [
@@ -818,7 +820,7 @@ async function getTopTokenPrices(n) {
         "?market=cadli&instruments=" +
         instruments +
         "&apply_mapping=true";
-    const resp = await fetch(url);
+    const resp = await debugFetch(url);
     const json = await resp.json();
     const prices = {};
     for (const [instrument, data] of Object.entries(json.Data || {})) {
diff --git a/src/shared/transactions.js b/src/shared/transactions.js
index b3d6b62..88bb9ef 100644
--- a/src/shared/transactions.js
+++ b/src/shared/transactions.js
@@ -7,7 +7,7 @@
 // a pure function that applies anti-poisoning heuristics.
 
 const { formatEther, formatUnits } = require("ethers");
-const { log } = require("./log");
+const { log, debugFetch } = require("./log");
 const { KNOWN_SYMBOLS } = require("./tokens");
 
 function formatTxValue(val) {
@@ -67,8 +67,8 @@ async function fetchRecentTransactions(address, blockscoutUrl, count = 25) {
     const addrLower = address.toLowerCase();
 
     const [txResp, ttResp] = await Promise.all([
-        fetch(blockscoutUrl + "/addresses/" + address + "/transactions"),
-        fetch(
+        debugFetch(blockscoutUrl + "/addresses/" + address + "/transactions"),
+        debugFetch(
             blockscoutUrl +
                 "/addresses/" +
                 address +