feat(stellar): Add real-time payment notifications (WebSocket) - #278
Open
Inspector222 wants to merge 26 commits into
Open
feat(stellar): Add real-time payment notifications (WebSocket)#278Inspector222 wants to merge 26 commits into
Inspector222 wants to merge 26 commits into
Conversation
Deen-Bridge#51) * stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests * test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController) * test: expect expectedHash at payment init (XDR pre-validation stores it there) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.
Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.
PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action.
…swords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99) * feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) - Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission. - Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage. - Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured). - Add User lockout fields and document new env vars in .env.example. * fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89) - loginUser: locked accounts now return the same generic 401 'Invalid credentials' as a nonexistent account (no enumeration); failed-login counter incremented atomically via findByIdAndUpdate \, lock persisted via updateOne - resetPassword: breached-password check moved to after successful OTP validation so unauthenticated callers cannot trigger HIBP lookups - authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback) - hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records - captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call; captcha rejection now returns the standard { success, message, data: null } shape - tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap; locked-account test expects 401; per-email limiter buckets reset between tests; outage test routed through mockHibp so the shared spy is cleaned up; added padding-record and cap coverage
* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93) * test: complement stellarService mock exports in idempotency test * test: refine idempotency middleware concurrency lock test (Deen-Bridge#93) * fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93) * fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
…n-Bridge#88) (Deen-Bridge#105) Add a centralized authorization layer that verifies the authenticated user owns the target resource (or is an admin) before any mutating handler runs, replacing the ad-hoc inline checks scattered across controllers. - add authorizeOwnership + authorizeReviewOwnership middleware (src/middlewares/authorize.js); on success the loaded doc is attached to req so handlers can reuse it - apply the guards to book delete, course update, space update/delete, and review update/delete on books and courses; review create stays purchase-gated - record ownership denials to the audit log (authz.ownership.denied) - remove the now-redundant inline ownership checks from the book, course, space, and review controllers - document the resource x action x role matrix (docs/authorization-matrix.md) and cover it with an integration test suite (test/ownershipAuthz.test.js) Closes Deen-Bridge#88 Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
…l bodies (Deen-Bridge#104) The NODE_ENV === "test" branch of sendMail logged the full rendered email body — including the password-reset OTP span and the verification link's token query param — and pino's redact config cannot censor values baked into interpolated strings, so the leak bypassed the app-wide redaction. Remove the body from every log statement (log only recipient, subject, and template id via structured fields), and give tests a sanctioned in-memory outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/ sendReceiptEmail now return the sendMail result so callers can capture it. Closes Deen-Bridge#95
…s and donations (Deen-Bridge#103) The Transaction collection used a blanket TTL index on expiresAt with a schema default that stamped a 30-minute expiry on every row regardless of status. Because confirm paths never cleared expiresAt, confirmed on-chain purchases and donations were permanently reaped ~30 minutes after creation, deleting the proof of payment and orphaning recorded earnings. Scope the TTL index to status: "pending" via partialFilterExpression, make the expiresAt default conditional on status, add a pre-save hook that clears expiresAt for any terminal state, explicitly unset expiresAt on every terminal transition (submit, donation, refund, dispute, cancel, job handler, reconciliation promotion), and add an idempotent migration that rescues legacy non-pending rows and rebuilds the index. Closes Deen-Bridge#94
…creation gating (Deen-Bridge#92) (Deen-Bridge#102) * feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) - Add EducatorVerification model with legal state-machine transitions (draft -> pending -> approved/rejected, resubmit from rejected) - Add verifiedEducator durable flag on User, set atomically on approval - Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT with metadata allowlist entries in auditService - requireVerifiedEducator middleware (403 for unverified, admin bypass) - Applicant API: submit/resubmit app, get own app, signed doc URLs, signed Cloudinary upload-signature for private credential uploads - Admin review queue: list+filter pending, view signed docs, approve/reject with notes (Mongo transaction for verifiedEducator grant) - Gate all content-creation routes: * POST /api/courses (courseRoutes.js) * POST /api/books (bookRoutes.js) * POST /api/spaces (spaceRoutes.js — live sessions per issue) - Wire routes: /api/educator-verification + /api/admin/educator-verification - Comprehensive test suite in test/educatorVerification.test.js (state-machine, middleware gating, submit/resubmit, approve/reject, content 403/2xx, both full lifecycles submit->pending->approve and reject->resubmit->approve, signed URL security, admin-only gating, audit log instrumentation) Verification Results: app.test.js: 22/22 PASS (CI boot + endpoint health) auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate) Closes Deen-Bridge#92 * fix(ci): resolve educator verification pipeline test failures - Remove redundant catchAsync double-wrap in educator-verification routes (controllers are already pre-wrapped; the outer wrap called .catch() on undefined, returning 500 for every new endpoint) - Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject MongoDB transaction can run (standalone MongoMemoryServer cannot) - Use AuditLog.collection.deleteMany in test cleanup to bypass append-only pre-hooks - Return recordAudit's promise so callers can await durability; await it in submitApplication and performReview to eliminate the fire-and-forget audit-race in tests - Fix testAuth.js password overwrite: destructure password out of the override spread so the hashed value is not clobbered by plaintext - Seed bookUpload test user as a verifiedEducator mentor so the new content gate lets it through --------- Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
…ce (Deen-Bridge#91) (Deen-Bridge#106) Give the backend a real machine-to-machine auth channel for the AI service (dnb-ai) — signed, scoped, rotatable keys instead of a single static shared secret. - add requireServiceAuth middleware (src/middlewares/serviceAuth.js): HMAC-SHA256 over a canonical method/path/timestamp/body-digest string, a ±300s replay window, constant-time signature comparison, per-key scope enforcement, and req.service on success - key store (src/config/serviceKeys.js): multiple active keys keyed by kid for zero-downtime rotation; resilient env parsing, never throws - mount a real internal route GET /api/internal/ai/whoami guarded by the guard (scope ai:read-content), plus raw-body capture in app.js - migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual - audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod (fail-fast), document the signing contract + rotation runbook - cover the full accept/reject matrix in test/serviceAuth.test.js Closes Deen-Bridge#91 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
…Deen-Bridge#107) Add an outbound webhook/event system so external consumers can subscribe to payment and enrollment lifecycle events over HMAC-signed HTTP callbacks, with retries, dead-lettering, and redelivery. - models: WebhookEndpoint (encrypted secret at rest, subscribed events, auto-disable counters) and WebhookDelivery (all scheduling state in the doc: status, attemptCount, nextAttemptAt indexed) - webhookService.emitEvent: typed event catalog, per-event id for consumer idempotency, strict payload allowlist (no secrets/emails/user docs); persists a delivery per subscribed endpoint after the txn commits, never blocks or fails the request path, no-ops when the DB is unavailable - signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`) over the exact sent bytes; timing-safe verify + 5-min staleness window - deliveryWorker: atomic findOneAndUpdate claim (no double-send), exponential backoff + jitter, dead-letter after max attempts, endpoint auto-disable after sustained failures - management API (/api/webhooks, admin-gated): endpoint CRUD, rotate secret, list deliveries, redeliver (atomic $set), and ping - SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local - wire emitters into payment (initialized/confirmed/failed/expired), enrollment, and wallet connect/disconnect; migrate /admin/jobs to a timing-safe token compare - docs/webhooks.md consumer verifier + full offline test suite Closes Deen-Bridge#45 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Deen-Bridge#98) * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(security): implement TOTP two-factor authentication for admins and mentors - Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation - Add 10 single-use bcrypt-hashed recovery codes - Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window) - Update login controller to issue step-up mfaToken challenges when 2FA is enabled - Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions - Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage) - Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites * ci: update node version to 22 and sync package-lock.json * ci: pin mongo service to 6.0 and add wait-for-mongodb step * test: add 2FA enablement and 2FA verified token to admin in refund.test.js * fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility * fix(test): remove duplicate MongoMemoryServer import in refund.test.js * fix(test): add errorHandler middleware to refund.test.js app * fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js * fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks * fix(test): remove duplicate afterAll hooks and handle Multer 413 response status * test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js * test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims * fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
* Validate auth and Stellar requests * Address validation review feedback
* Secure book deletion * Keep delete response consistent
…reclaim (Deen-Bridge#116) Adds a gift-a-course/book flow built on Stellar claimable balances so a buyer can send an item to another user — including one who has not finished wallet onboarding — without the recipient needing a USDC trustline. The sender creates an on-ledger USDC balance the recipient claims when ready, with a sender reclaim-after-expiry predicate so funds are never stranded. Includes a GiftClaim model (no document-deleting TTL, so the record survives expiry for reclaim), a claimableBalanceService (build create/claim transactions with complementary predicates, resolve the REAL balance id from the create result XDR — not the tx hash — with a Horizon forClaimant fallback, and validate the signed gift XDR before any state change), gift routes/controller at /api/stellar/gifts, and granting item access to the RECIPIENT (never the payer) on claim. Wires a `{ fallback: "claimable_balance" }` response into the purchase flow when a creator wallet/trustline is missing. Tests cover predicate decoding, trustline-free single-signature claiming, claim authorization before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR rejection, guards mirroring initializePayment, and the recipient access grant.
…oints (Deen-Bridge#115) Makes /api/stellar/payment/initialize and /submit safe against double-clicks, client retries, and concurrent duplicates. Submit is naturally idempotent per transaction hash: the deterministic hash of the signed XDR is looked up against confirmed transactions before any processing, so a replayed submission returns the original success response without re-granting access, with the unique index on stellarTxHash as the database-level backstop (an E11000 on the confirm save is treated as already processed). Initialize no longer piles up duplicates: a pending checkout for the same user+item returns the existing record (with its persisted unsigned XDR) instead of creating a new document, and stale pending records are reaped by the existing pending-only TTL index. Adds a stricter per-user rate limiter (paymentLimiter) on the payment routes, keyed on the authenticated user id with an IPv6-aware IP fallback. Covers duplicate-submit, duplicate-initialize, the E11000 race, and limiter enforcement with tests.
…innet switch (Deen-Bridge#114) Adds a single source of truth for the Stellar network configuration (src/config/stellar.js) that resolves the network name, network passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and validates the whole setup fail-fast at boot so a misconfigured deployment (bad network value, mainnet flag with testnet Horizon or issuer) fails with an error naming the exact problem instead of at request time. stellarService.js and horizonClient.js now consume this module. Adds docs/MAINNET.md covering the env changes, creator trustlines, and a first-mainnet-transaction smoke checklist, plus unit tests for resolution and validation across both networks.
…nd caps (Deen-Bridge#111) Let the platform pay a user's Stellar network fee by wrapping the user-signed transaction in a fee-bump signed by a dedicated fee-source account, so a user holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per submit via `requestSponsorship: true`; off by default and byte-for-byte identical when disabled. Guard rails (server signs on the platform's behalf): - Structural whitelist (reject-by-default, allow-list of `payment` ops only): source, exact op count/order, destinations, amounts (stroops), asset, and memo must match the pending Transaction row exactly. Any foreign/extra operation — including unknown future types — is rejected. - Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee ceiling, per-day total, and per-user per-day count. - Sponsor float pre-check so an underfunded sponsor never marks the user's transaction failed. Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling (verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash alongside the inner hash. Sponsorship-specific failures return a distinct non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed. - Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when enabled with a missing/invalid secret); secret never logged or returned. - Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the sponsor public key, live float, caps, and today's spend. - Prometheus counters for approved/rejected sponsorship decisions. - Docs: docs/fee-sponsorship.md, README, and openapi.yaml. - Tests: feeSponsorService (whitelist adversarial matrix, fee correctness, inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist rejections that don't fail the row). Closes Deen-Bridge#30
Resolved conflicts: - src/controllers/authController.js: Keep 2FA controllers from dev - src/models/AuditLog.js: Keep 2FA audit actions from dev - src/services/stellar/horizonClient.js: Keep centralized stellar config from dev 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(courses): add managed category taxonomy * fix(categories): preserve legacy course creation
* feat(donations): add recurring sadaqah pledges * fix(pledges): preserve donation test compatibility * fix(pledges): ignore non-persisted transactions
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
|
Strict review blocker: this branch conflicts with the base branch, and plus are failing. Please rebase, resolve conflicts, and fix the checks. |
Collaborator
|
Strict review blocker: this branch conflicts with the base branch, and |
Collaborator
|
Strict review blocker: required checks are failing. Please fix the failures before requesting merge. |
Collaborator
|
@Inspector222 this PR has merge conflicts with the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #164