ido: key txchain tx lookup by txid; gate debug endpoints behind config

Change get_txchain_tx to take the public txid (a unique field) instead of
the non-public internal txchain item id, and promote it to a production
endpoint. Mount the two remaining debug endpoints (list_ido_txchain,
list_txchain_tracker_map) only when `debug = true` in the config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/db/ido/mod.rs

@@ -2588,10 +2588,10 @@ pub async fn list_ido_txchain(
 
 pub async fn get_txchain_tx_hex(
     pool: &SqlitePool,
-    txchain_item_id: i64,
+    txid: &[u8],
 ) -> Result<Option<String>> {
-    let row = sqlx::query("SELECT tx FROM ido_txchain WHERE id = ?")
+    let row = sqlx::query("SELECT tx FROM ido_txchain WHERE txid = ?")
-        .bind(txchain_item_id)
+        .bind(txid)
         .fetch_optional(pool)
         .await?;
     Ok(row.map(|r| {

src/main.rs

@@ -380,6 +380,9 @@ async fn launch() -> _ {
         config
     };
 
+    // Debug-only RPC endpoints (e.g. txchain inspection) are gated behind this flag.
+    let debug_endpoints = config.debug;
+
     let (
         dbpool,
         bcmrdownloader,

src/rpc/ido.rs

@@ -102,6 +102,30 @@ pub async fn list_ido_entries(
     Ok(cached_ok(serde_json::to_value(items).unwrap(), CACHE_NONE))
 }
 
+/// Get the raw transaction hex for a txchain item by its txid.
+/// Returns `{"tx": "<hex>"}` or `{"tx": null}` if not found.
+#[get("/txchain/<txid>/tx")]
+pub async fn get_txchain_tx(
+    txid: &str,
+    db: &State<DB>,
+) -> CachedApiResult<Value> {
+    let txid_blob = display_hex_to_blob::<Txid>(txid).map_err(|e| {
+        bad_request(
+            ApiErrorCode::InvalidParameters,
+            &format!("Invalid txid hex: {e}"),
+        )
+    })?;
+
+    let tx_hex = crate::db::ido::get_txchain_tx_hex(&db.ido_r, &txid_blob)
+        .await
+        .map_err(db_error)?;
+
+    Ok(cached_ok(
+        serde_json::json!({ "tx": tx_hex }),
+        CACHE_NONE,
+    ))
+}
+
 /// [Debug] List the txchain for an IDO, sorted oldest-first (head is last).
 ///
 /// - `id`: the IDO's public id (preinit txid, 64-char hex)
@@ -148,23 +172,6 @@ async fn resolve_ido(
     Ok((internal_id, preinit_txid_hex))
 }
 
-/// [Debug] Get the raw transaction hex for a txchain item by its ID.
-/// Returns `{"tx": "<hex>"}` or `{"tx": null}` if not found.
-#[get("/txchain/<txchain_item_id>/tx")]
-pub async fn get_txchain_tx(
-    txchain_item_id: i64,
-    db: &State<DB>,
-) -> CachedApiResult<Value> {
-    let tx_hex = crate::db::ido::get_txchain_tx_hex(&db.ido_r, txchain_item_id)
-        .await
-        .map_err(db_error)?;
-
-    Ok(cached_ok(
-        serde_json::json!({ "tx": tx_hex }),
-        CACHE_NONE,
-    ))
-}
-
 /// [Debug] List all entries in the txchain tracker map.
 ///
 /// Pagination: `offset` (default 0), `limit` (default 100, max 10000)