Remove retired EMMA collection keyword search

[GelatoGenesis]

Issue and fix

Backend stage of #69. The compatible EMMA frontend in 6529-Collections/6529seize-frontend#3929 is already deployed to production and uses five fixed 6529 shortcuts plus manual contract entry.

Remove POST /other/search-contract-metadata, its request DTO, the OtherService and Alchemy service/client search methods, and the search-only Alchemy V2 response type. The retired route returns 404 and is absent from generated OpenAPI.

Compatibility

• Preserve exact-address V3 getContractMetadata, canonical collection fallbacks, seasons, token IDs, block prediction, and historical owner snapshots.
• Keep the shared SearchContractMetadataResponseApiModel schema name and payload for the retained exact-address and ecosystem-collection endpoints.
• Keep the V2 base URL because historical getOwnersForCollection still uses it.
• No database migrations, dependency changes, or additional frontend changes.

Validation and review

• 86 tests across 13 suites pass. All four overall coverage metrics exceed main: statements 25.16% to 27.16%, lines 24.67% to 26.73%, branches 37.25% to 37.34%, functions 19.51% to 20.24%.
• Lint, build, both dependency audit gates, Sentry source-map injection, Lambda packaging, and artifact verification pass. The audits retain one existing moderate csv-parse advisory and no high or critical findings.
• HTTP tests exercise the real controller, service, and Alchemy client with mocked transport: retired-route 404 without upstream calls, retained OpenAPI schemas, arbitrary-contract metadata, and five shortcuts despite empty or failed upstream metadata. Retry/error and verification-status tests now exercise exact-address metadata.
• 6529bot: Good to merge; no security, i18n, or WCAG findings. All five GitHub checks pass on 53e76dc86ed4 (CI). CodeRabbit skipped automatic review for this repository; its check is green.
• Latest frontend main and staging contain no EMMA/Distribution Plan keyword caller. Runtime source and built handlers contain no searchContractMetadata operation.

Deployment and live checks

• Staging deployment passed on bcb75ede1aba9db425eda23737da10bb4b680f31.
• Production deployment passed on merged main c4ec257fd5511991c5ef067d8668799ddc93aa6e.
• Both release trees match the reviewed feature. Each workflow deployed token-pool downloader, allowlist worker, then API sequentially. All six deployed functions are active, match the verified artifact, and passed cold-start smoke tests.
• All eight HTTP checks passed in each environment: OpenAPI cleanup, old-route 404, all five collections, arbitrary-contract metadata, 16 Memes seasons, exactly unchanged 20 Intern token IDs, latest block, and future-block prediction.
• Production browser checks before and after backend deployment verified collection shortcuts, keyboard season selection, Intern token-ID precision, and manual exact-address name autofill. No new snapshots were submitted.
• Validated API Gateway telemetry recorded 90 production requests and 12 staging requests over approximately 19 minutes, with zero legacy-client keyword calls and zero server errors. The deliberate retired-route probes each returned 404 and were excluded from client-call counts.
• Temporary gateway logging supplied request evidence because application HTTP completion logs were unavailable. Original gateway logging settings were restored in both environments; diagnostic logs have seven-day retention.

Rollback

Redeploy the previous backend main revision fc2d228fc8c82b28163a48675ed1ea7a0543873a to restore the endpoint. It remains compatible with the deployed frontend.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[6529bot]

6529bot general PR review - 53e76dc

Verdict: Good to merge

The PR cleanly removes the retired POST /other/search-contract-metadata route and its supporting client/service methods, request model, and tests. The removal is consistent across all layers:

• searchContractMetadata removed from client (alchemy-api.client.ts), service (alchemy-api.service.ts), and OtherService (other.service.ts).
• Controller endpoint and unused import removed (other.controller.ts).
• Request model deleted; the response model is deliberately retained with an explanatory comment because it is shared by the two remaining endpoints (search-contract-metadata-response-api.model.ts:4).
• New HTTP-level tests (other.controller.spec.ts) verify the 404 for the retired route, its absence from OpenAPI (including the removed request schema), and that the retained metadata/collections schemas still resolve — good coverage for the behavioral contract.

No correctness, security, or data-integrity regressions found. The RawV2ContractMetadata interface and the v2 comment were correctly pruned, and the v2 base URL is still needed for getOwnersForCollection, so leaving it in place is correct.

Minor observations (not blocking, and pre-existing rather than introduced here):

• other.controller.ts:49 uses type: SearchContractMetadataResponseApiModel || null, which evaluates to just the model — the || null is a no-op. This predates the PR and is outside its scope, so no action required here.

[6529bot]

6529bot i18n analysis - 53e76dc

Verdict: No i18n findings

This is a backend-only change to the allowlist-api repository. It removes a retired keyword-search API route and its associated NestJS service/client code, updates tests, and adds README documentation. There is no user-facing React UI, no locale-sensitive formatting, and no changes to translatable copy within the scope of the 6529 progressive i18n standard. Swagger description/summary strings and README text are developer-facing API documentation, which is out of scope for the frontend locale requirements.

No changes are required from an i18n perspective.

[6529bot]

6529bot WCAG 2.2 AA analysis - 53e76dc

Verdict: No WCAG findings

This is a backend-only change to the allowlist-api repository. It removes a retired API route, associated Alchemy client method, request model, and adds test coverage plus README documentation. There is no user interface code (no React components, templates, or markup) in the changed files, so WCAG 2.2 AA success criteria do not apply here.

No accessibility review is warranted for this PR.

[6529bot]

6529bot crypto security analysis - 53e76dc

Verdict: No security findings

This PR cleanly removes the retired POST /other/search-contract-metadata route, its request model, and the associated searchContractMetadata client/service methods. The change is a pure attack-surface reduction with no new wallet, auth, signature, or crypto behavior introduced.

Notes reviewed and cleared:

• The retained getContractMetadata path continues to use encodeURIComponent on the API key and passes the contract address as a query param (src/alchemy-api/alchemy-api.client.ts:116-132), so no new injection or key-leak vector is added.
• Both retained endpoints remain @PublicEndpoint() as before; no auth regression is introduced by this diff.
• Removing the route returns 404 without contacting Alchemy (src/api/other/other.controller.spec.ts:59-66), avoiding any confused-deputy proxying through the now-removed keyword search.

No blocking or important issues found in the changed code.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 199972ff-e225-48c0-ae47-cbf0f939134c

---

_{Comment @coderabbitai help to get the list of available commands.}