feat(social): add real-time direct messaging system (closes #214) by Xoft31 · Pull Request #315 · Deen-Bridge/dnb-backend

Xoft31 · 2026-08-25T18:08:21Z

Adds real-time direct messaging with Conversation/Message models, Socket.io events for live delivery, REST endpoints for history/pagination, read receipts, and typing indicators.

Closes #214.

* stellar: validate signed XDR contents before submit; store expectedHa… (Deen-Bridge#51) * stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests * test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController) * test: expect expectedHash at payment init (XDR pre-validation stores it there) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99) * feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) - Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission. - Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage. - Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured). - Add User lockout fields and document new env vars in .env.example. * fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89) - loginUser: locked accounts now return the same generic 401 'Invalid credentials' as a nonexistent account (no enumeration); failed-login counter incremented atomically via findByIdAndUpdate \, lock persisted via updateOne - resetPassword: breached-password check moved to after successful OTP validation so unauthenticated callers cannot trigger HIBP lookups - authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback) - hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records - captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call; captcha rejection now returns the standard { success, message, data: null } shape - tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap; locked-account test expects 401; per-email limiter buckets reset between tests; outage test routed through mockHibp so the shared spy is cleaned up; added padding-record and cap coverage * Feat/93 idempotency keys (Deen-Bridge#100) * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93) * test: complement stellarService mock exports in idempotency test * test: refine idempotency middleware concurrency lock test (Deen-Bridge#93) * fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93) * fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * feat(auth): enforce resource ownership across mutating endpoints (Deen-Bridge#88) (Deen-Bridge#105) Add a centralized authorization layer that verifies the authenticated user owns the target resource (or is an admin) before any mutating handler runs, replacing the ad-hoc inline checks scattered across controllers. - add authorizeOwnership + authorizeReviewOwnership middleware (src/middlewares/authorize.js); on success the loaded doc is attached to req so handlers can reuse it - apply the guards to book delete, course update, space update/delete, and review update/delete on books and courses; review create stays purchase-gated - record ownership denials to the audit log (authz.ownership.denied) - remove the now-redundant inline ownership checks from the book, course, space, and review controllers - document the resource x action x role matrix (docs/authorization-matrix.md) and cover it with an integration test suite (test/ownershipAuthz.test.js) Closes Deen-Bridge#88 Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com> * fix(security): stop logging OTP codes and verification tokens in email bodies (Deen-Bridge#104) The NODE_ENV === "test" branch of sendMail logged the full rendered email body — including the password-reset OTP span and the verification link's token query param — and pino's redact config cannot censor values baked into interpolated strings, so the leak bypassed the app-wide redaction. Remove the body from every log statement (log only recipient, subject, and template id via structured fields), and give tests a sanctioned in-memory outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/ sendReceiptEmail now return the sendMail result so callers can capture it. Closes Deen-Bridge#95 * fix(transactions): prevent TTL index from deleting confirmed purchases and donations (Deen-Bridge#103) The Transaction collection used a blanket TTL index on expiresAt with a schema default that stamped a 30-minute expiry on every row regardless of status. Because confirm paths never cleared expiresAt, confirmed on-chain purchases and donations were permanently reaped ~30 minutes after creation, deleting the proof of payment and orphaning recorded earnings. Scope the TTL index to status: "pending" via partialFilterExpression, make the expiresAt default conditional on status, add a pre-save hook that clears expiresAt for any terminal state, explicitly unset expiresAt on every terminal transition (submit, donation, refund, dispute, cancel, job handler, reconciliation promotion), and add an idempotent migration that rescues legacy non-pending rows and rebuilds the index. Closes Deen-Bridge#94 * feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) (Deen-Bridge#102) * feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) - Add EducatorVerification model with legal state-machine transitions (draft -> pending -> approved/rejected, resubmit from rejected) - Add verifiedEducator durable flag on User, set atomically on approval - Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT with metadata allowlist entries in auditService - requireVerifiedEducator middleware (403 for unverified, admin bypass) - Applicant API: submit/resubmit app, get own app, signed doc URLs, signed Cloudinary upload-signature for private credential uploads - Admin review queue: list+filter pending, view signed docs, approve/reject with notes (Mongo transaction for verifiedEducator grant) - Gate all content-creation routes: * POST /api/courses (courseRoutes.js) * POST /api/books (bookRoutes.js) * POST /api/spaces (spaceRoutes.js — live sessions per issue) - Wire routes: /api/educator-verification + /api/admin/educator-verification - Comprehensive test suite in test/educatorVerification.test.js (state-machine, middleware gating, submit/resubmit, approve/reject, content 403/2xx, both full lifecycles submit->pending->approve and reject->resubmit->approve, signed URL security, admin-only gating, audit log instrumentation) Verification Results: app.test.js: 22/22 PASS (CI boot + endpoint health) auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate) Closes Deen-Bridge#92 * fix(ci): resolve educator verification pipeline test failures - Remove redundant catchAsync double-wrap in educator-verification routes (controllers are already pre-wrapped; the outer wrap called .catch() on undefined, returning 500 for every new endpoint) - Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject MongoDB transaction can run (standalone MongoMemoryServer cannot) - Use AuditLog.collection.deleteMany in test cleanup to bypass append-only pre-hooks - Return recordAudit's promise so callers can await durability; await it in submitApplication and performReview to eliminate the fire-and-forget audit-race in tests - Fix testAuth.js password overwrite: destructure password out of the override spread so the hashed value is not clobbered by plaintext - Seed bookUpload test user as a verifiedEducator mentor so the new content gate lets it through --------- Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com> * feat(auth): signed service-to-service authentication for the AI service (Deen-Bridge#91) (Deen-Bridge#106) Give the backend a real machine-to-machine auth channel for the AI service (dnb-ai) — signed, scoped, rotatable keys instead of a single static shared secret. - add requireServiceAuth middleware (src/middlewares/serviceAuth.js): HMAC-SHA256 over a canonical method/path/timestamp/body-digest string, a ±300s replay window, constant-time signature comparison, per-key scope enforcement, and req.service on success - key store (src/config/serviceKeys.js): multiple active keys keyed by kid for zero-downtime rotation; resilient env parsing, never throws - mount a real internal route GET /api/internal/ai/whoami guarded by the guard (scope ai:read-content), plus raw-body capture in app.js - migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual - audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod (fail-fast), document the signing contract + rotation runbook - cover the full accept/reject matrix in test/serviceAuth.test.js Closes Deen-Bridge#91 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> * feat(webhooks): signed outbound webhook event system (Deen-Bridge#45) (Deen-Bridge#107) Add an outbound webhook/event system so external consumers can subscribe to payment and enrollment lifecycle events over HMAC-signed HTTP callbacks, with retries, dead-lettering, and redelivery. - models: WebhookEndpoint (encrypted secret at rest, subscribed events, auto-disable counters) and WebhookDelivery (all scheduling state in the doc: status, attemptCount, nextAttemptAt indexed) - webhookService.emitEvent: typed event catalog, per-event id for consumer idempotency, strict payload allowlist (no secrets/emails/user docs); persists a delivery per subscribed endpoint after the txn commits, never blocks or fails the request path, no-ops when the DB is unavailable - signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`) over the exact sent bytes; timing-safe verify + 5-min staleness window - deliveryWorker: atomic findOneAndUpdate claim (no double-send), exponential backoff + jitter, dead-letter after max attempts, endpoint auto-disable after sustained failures - management API (/api/webhooks, admin-gated): endpoint CRUD, rotate secret, list deliveries, redeliver (atomic $set), and ping - SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local - wire emitters into payment (initialized/confirmed/failed/expired), enrollment, and wallet connect/disconnect; migrate /admin/jobs to a timing-safe token compare - docs/webhooks.md consumer verifier + full offline test suite Closes Deen-Bridge#45 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> * feat(security): implement TOTP two-factor authentication for admins a… (Deen-Bridge#98) * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(security): implement TOTP two-factor authentication for admins and mentors - Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation - Add 10 single-use bcrypt-hashed recovery codes - Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window) - Update login controller to issue step-up mfaToken challenges when 2FA is enabled - Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions - Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage) - Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites * ci: update node version to 22 and sync package-lock.json * ci: pin mongo service to 6.0 and add wait-for-mongodb step * test: add 2FA enablement and 2FA verified token to admin in refund.test.js * fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility * fix(test): remove duplicate MongoMemoryServer import in refund.test.js * fix(test): add errorHandler middleware to refund.test.js app * fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js * fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks * fix(test): remove duplicate afterAll hooks and handle Multer 413 response status * test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js * test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims * fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * Add scholarship escrow contract foundation (Deen-Bridge#108) * Improve application test coverage (Deen-Bridge#110) * Add dependency health checks (Deen-Bridge#112) * Validate auth and Stellar requests (Deen-Bridge#109) * Validate auth and Stellar requests * Address validation review feedback * Secure book deletion authorization (Deen-Bridge#113) * Secure book deletion * Keep delete response consistent * feat(stellar): gift courses/books via claimable balances with expiry reclaim (Deen-Bridge#116) Adds a gift-a-course/book flow built on Stellar claimable balances so a buyer can send an item to another user — including one who has not finished wallet onboarding — without the recipient needing a USDC trustline. The sender creates an on-ledger USDC balance the recipient claims when ready, with a sender reclaim-after-expiry predicate so funds are never stranded. Includes a GiftClaim model (no document-deleting TTL, so the record survives expiry for reclaim), a claimableBalanceService (build create/claim transactions with complementary predicates, resolve the REAL balance id from the create result XDR — not the tx hash — with a Horizon forClaimant fallback, and validate the signed gift XDR before any state change), gift routes/controller at /api/stellar/gifts, and granting item access to the RECIPIENT (never the payer) on claim. Wires a `{ fallback: "claimable_balance" }` response into the purchase flow when a creator wallet/trustline is missing. Tests cover predicate decoding, trustline-free single-signature claiming, claim authorization before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR rejection, guards mirroring initializePayment, and the recipient access grant. * feat(stellar): add idempotency protection to the Stellar payment endpoints (Deen-Bridge#115) Makes /api/stellar/payment/initialize and /submit safe against double-clicks, client retries, and concurrent duplicates. Submit is naturally idempotent per transaction hash: the deterministic hash of the signed XDR is looked up against confirmed transactions before any processing, so a replayed submission returns the original success response without re-granting access, with the unique index on stellarTxHash as the database-level backstop (an E11000 on the confirm save is treated as already processed). Initialize no longer piles up duplicates: a pending checkout for the same user+item returns the existing record (with its persisted unsigned XDR) instead of creating a new document, and stale pending records are reaped by the existing pending-only TTL index. Adds a stricter per-user rate limiter (paymentLimiter) on the payment routes, keyed on the authenticated user id with an IPv6-aware IP fallback. Covers duplicate-submit, duplicate-initialize, the E11000 race, and limiter enforcement with tests. * feat(stellar): validate Stellar config at startup and document the mainnet switch (Deen-Bridge#114) Adds a single source of truth for the Stellar network configuration (src/config/stellar.js) that resolves the network name, network passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and validates the whole setup fail-fast at boot so a misconfigured deployment (bad network value, mainnet flag with testnet Horizon or issuer) fails with an error naming the exact problem instead of at request time. stellarService.js and horizonClient.js now consume this module. Adds docs/MAINNET.md covering the env changes, creator trustlines, and a first-mainnet-transaction smoke checklist, plus unit tests for resolution and validation across both networks. * feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (Deen-Bridge#111) Let the platform pay a user's Stellar network fee by wrapping the user-signed transaction in a fee-bump signed by a dedicated fee-source account, so a user holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per submit via `requestSponsorship: true`; off by default and byte-for-byte identical when disabled. Guard rails (server signs on the platform's behalf): - Structural whitelist (reject-by-default, allow-list of `payment` ops only): source, exact op count/order, destinations, amounts (stroops), asset, and memo must match the pending Transaction row exactly. Any foreign/extra operation — including unknown future types — is rejected. - Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee ceiling, per-day total, and per-user per-day count. - Sponsor float pre-check so an underfunded sponsor never marks the user's transaction failed. Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling (verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash alongside the inner hash. Sponsorship-specific failures return a distinct non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed. - Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when enabled with a missing/invalid secret); secret never logged or returned. - Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the sponsor public key, live float, caps, and today's spend. - Prometheus counters for approved/rejected sponsorship decisions. - Docs: docs/fee-sponsorship.md, README, and openapi.yaml. - Tests: feeSponsorService (whitelist adversarial matrix, fee correctness, inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist rejections that don't fail the row). Closes Deen-Bridge#30 * feat: add managed course categories (Deen-Bridge#118) * feat(courses): add managed category taxonomy * fix(categories): preserve legacy course creation * feat: add recurring sadaqah pledges (Deen-Bridge#119) * feat(donations): add recurring sadaqah pledges * fix(pledges): preserve donation test compatibility * fix(pledges): ignore non-persisted transactions --------- Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com> Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com> Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com> Co-authored-by: BountySpaghetti <zeemroyals@gmail.com> Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com> Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com> Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com> Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com> Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com> Co-authored-by: Mantissa <negativemantissa@gmail.com> Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* stellar: validate signed XDR contents before submit; store expectedHa… (Deen-Bridge#51) * stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests * test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController) * test: expect expectedHash at payment init (XDR pre-validation stores it there) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99) * feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) - Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission. - Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage. - Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured). - Add User lockout fields and document new env vars in .env.example. * fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89) - loginUser: locked accounts now return the same generic 401 'Invalid credentials' as a nonexistent account (no enumeration); failed-login counter incremented atomically via findByIdAndUpdate \, lock persisted via updateOne - resetPassword: breached-password check moved to after successful OTP validation so unauthenticated callers cannot trigger HIBP lookups - authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback) - hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records - captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call; captcha rejection now returns the standard { success, message, data: null } shape - tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap; locked-account test expects 401; per-email limiter buckets reset between tests; outage test routed through mockHibp so the shared spy is cleaned up; added padding-record and cap coverage * Feat/93 idempotency keys (Deen-Bridge#100) * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93) * test: complement stellarService mock exports in idempotency test * test: refine idempotency middleware concurrency lock test (Deen-Bridge#93) * fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93) * fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * feat(auth): enforce resource ownership across mutating endpoints (Deen-Bridge#88) (Deen-Bridge#105) Add a centralized authorization layer that verifies the authenticated user owns the target resource (or is an admin) before any mutating handler runs, replacing the ad-hoc inline checks scattered across controllers. - add authorizeOwnership + authorizeReviewOwnership middleware (src/middlewares/authorize.js); on success the loaded doc is attached to req so handlers can reuse it - apply the guards to book delete, course update, space update/delete, and review update/delete on books and courses; review create stays purchase-gated - record ownership denials to the audit log (authz.ownership.denied) - remove the now-redundant inline ownership checks from the book, course, space, and review controllers - document the resource x action x role matrix (docs/authorization-matrix.md) and cover it with an integration test suite (test/ownershipAuthz.test.js) Closes Deen-Bridge#88 Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com> * fix(security): stop logging OTP codes and verification tokens in email bodies (Deen-Bridge#104) The NODE_ENV === "test" branch of sendMail logged the full rendered email body — including the password-reset OTP span and the verification link's token query param — and pino's redact config cannot censor values baked into interpolated strings, so the leak bypassed the app-wide redaction. Remove the body from every log statement (log only recipient, subject, and template id via structured fields), and give tests a sanctioned in-memory outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/ sendReceiptEmail now return the sendMail result so callers can capture it. Closes Deen-Bridge#95 * fix(transactions): prevent TTL index from deleting confirmed purchases and donations (Deen-Bridge#103) The Transaction collection used a blanket TTL index on expiresAt with a schema default that stamped a 30-minute expiry on every row regardless of status. Because confirm paths never cleared expiresAt, confirmed on-chain purchases and donations were permanently reaped ~30 minutes after creation, deleting the proof of payment and orphaning recorded earnings. Scope the TTL index to status: "pending" via partialFilterExpression, make the expiresAt default conditional on status, add a pre-save hook that clears expiresAt for any terminal state, explicitly unset expiresAt on every terminal transition (submit, donation, refund, dispute, cancel, job handler, reconciliation promotion), and add an idempotent migration that rescues legacy non-pending rows and rebuilds the index. Closes Deen-Bridge#94 * feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) (Deen-Bridge#102) * feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) - Add EducatorVerification model with legal state-machine transitions (draft -> pending -> approved/rejected, resubmit from rejected) - Add verifiedEducator durable flag on User, set atomically on approval - Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT with metadata allowlist entries in auditService - requireVerifiedEducator middleware (403 for unverified, admin bypass) - Applicant API: submit/resubmit app, get own app, signed doc URLs, signed Cloudinary upload-signature for private credential uploads - Admin review queue: list+filter pending, view signed docs, approve/reject with notes (Mongo transaction for verifiedEducator grant) - Gate all content-creation routes: * POST /api/courses (courseRoutes.js) * POST /api/books (bookRoutes.js) * POST /api/spaces (spaceRoutes.js — live sessions per issue) - Wire routes: /api/educator-verification + /api/admin/educator-verification - Comprehensive test suite in test/educatorVerification.test.js (state-machine, middleware gating, submit/resubmit, approve/reject, content 403/2xx, both full lifecycles submit->pending->approve and reject->resubmit->approve, signed URL security, admin-only gating, audit log instrumentation) Verification Results: app.test.js: 22/22 PASS (CI boot + endpoint health) auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate) Closes Deen-Bridge#92 * fix(ci): resolve educator verification pipeline test failures - Remove redundant catchAsync double-wrap in educator-verification routes (controllers are already pre-wrapped; the outer wrap called .catch() on undefined, returning 500 for every new endpoint) - Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject MongoDB transaction can run (standalone MongoMemoryServer cannot) - Use AuditLog.collection.deleteMany in test cleanup to bypass append-only pre-hooks - Return recordAudit's promise so callers can await durability; await it in submitApplication and performReview to eliminate the fire-and-forget audit-race in tests - Fix testAuth.js password overwrite: destructure password out of the override spread so the hashed value is not clobbered by plaintext - Seed bookUpload test user as a verifiedEducator mentor so the new content gate lets it through --------- Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com> * feat(auth): signed service-to-service authentication for the AI service (Deen-Bridge#91) (Deen-Bridge#106) Give the backend a real machine-to-machine auth channel for the AI service (dnb-ai) — signed, scoped, rotatable keys instead of a single static shared secret. - add requireServiceAuth middleware (src/middlewares/serviceAuth.js): HMAC-SHA256 over a canonical method/path/timestamp/body-digest string, a ±300s replay window, constant-time signature comparison, per-key scope enforcement, and req.service on success - key store (src/config/serviceKeys.js): multiple active keys keyed by kid for zero-downtime rotation; resilient env parsing, never throws - mount a real internal route GET /api/internal/ai/whoami guarded by the guard (scope ai:read-content), plus raw-body capture in app.js - migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual - audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod (fail-fast), document the signing contract + rotation runbook - cover the full accept/reject matrix in test/serviceAuth.test.js Closes Deen-Bridge#91 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> * feat(webhooks): signed outbound webhook event system (Deen-Bridge#45) (Deen-Bridge#107) Add an outbound webhook/event system so external consumers can subscribe to payment and enrollment lifecycle events over HMAC-signed HTTP callbacks, with retries, dead-lettering, and redelivery. - models: WebhookEndpoint (encrypted secret at rest, subscribed events, auto-disable counters) and WebhookDelivery (all scheduling state in the doc: status, attemptCount, nextAttemptAt indexed) - webhookService.emitEvent: typed event catalog, per-event id for consumer idempotency, strict payload allowlist (no secrets/emails/user docs); persists a delivery per subscribed endpoint after the txn commits, never blocks or fails the request path, no-ops when the DB is unavailable - signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`) over the exact sent bytes; timing-safe verify + 5-min staleness window - deliveryWorker: atomic findOneAndUpdate claim (no double-send), exponential backoff + jitter, dead-letter after max attempts, endpoint auto-disable after sustained failures - management API (/api/webhooks, admin-gated): endpoint CRUD, rotate secret, list deliveries, redeliver (atomic $set), and ping - SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local - wire emitters into payment (initialized/confirmed/failed/expired), enrollment, and wallet connect/disconnect; migrate /admin/jobs to a timing-safe token compare - docs/webhooks.md consumer verifier + full offline test suite Closes Deen-Bridge#45 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> * feat(security): implement TOTP two-factor authentication for admins a… (Deen-Bridge#98) * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(security): implement TOTP two-factor authentication for admins and mentors - Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation - Add 10 single-use bcrypt-hashed recovery codes - Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window) - Update login controller to issue step-up mfaToken challenges when 2FA is enabled - Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions - Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage) - Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites * ci: update node version to 22 and sync package-lock.json * ci: pin mongo service to 6.0 and add wait-for-mongodb step * test: add 2FA enablement and 2FA verified token to admin in refund.test.js * fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility * fix(test): remove duplicate MongoMemoryServer import in refund.test.js * fix(test): add errorHandler middleware to refund.test.js app * fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js * fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks * fix(test): remove duplicate afterAll hooks and handle Multer 413 response status * test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js * test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims * fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * Add scholarship escrow contract foundation (Deen-Bridge#108) * Improve application test coverage (Deen-Bridge#110) * Add dependency health checks (Deen-Bridge#112) * Validate auth and Stellar requests (Deen-Bridge#109) * Validate auth and Stellar requests * Address validation review feedback * Secure book deletion authorization (Deen-Bridge#113) * Secure book deletion * Keep delete response consistent * feat(stellar): gift courses/books via claimable balances with expiry reclaim (Deen-Bridge#116) Adds a gift-a-course/book flow built on Stellar claimable balances so a buyer can send an item to another user — including one who has not finished wallet onboarding — without the recipient needing a USDC trustline. The sender creates an on-ledger USDC balance the recipient claims when ready, with a sender reclaim-after-expiry predicate so funds are never stranded. Includes a GiftClaim model (no document-deleting TTL, so the record survives expiry for reclaim), a claimableBalanceService (build create/claim transactions with complementary predicates, resolve the REAL balance id from the create result XDR — not the tx hash — with a Horizon forClaimant fallback, and validate the signed gift XDR before any state change), gift routes/controller at /api/stellar/gifts, and granting item access to the RECIPIENT (never the payer) on claim. Wires a `{ fallback: "claimable_balance" }` response into the purchase flow when a creator wallet/trustline is missing. Tests cover predicate decoding, trustline-free single-signature claiming, claim authorization before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR rejection, guards mirroring initializePayment, and the recipient access grant. * feat(stellar): add idempotency protection to the Stellar payment endpoints (Deen-Bridge#115) Makes /api/stellar/payment/initialize and /submit safe against double-clicks, client retries, and concurrent duplicates. Submit is naturally idempotent per transaction hash: the deterministic hash of the signed XDR is looked up against confirmed transactions before any processing, so a replayed submission returns the original success response without re-granting access, with the unique index on stellarTxHash as the database-level backstop (an E11000 on the confirm save is treated as already processed). Initialize no longer piles up duplicates: a pending checkout for the same user+item returns the existing record (with its persisted unsigned XDR) instead of creating a new document, and stale pending records are reaped by the existing pending-only TTL index. Adds a stricter per-user rate limiter (paymentLimiter) on the payment routes, keyed on the authenticated user id with an IPv6-aware IP fallback. Covers duplicate-submit, duplicate-initialize, the E11000 race, and limiter enforcement with tests. * feat(stellar): validate Stellar config at startup and document the mainnet switch (Deen-Bridge#114) Adds a single source of truth for the Stellar network configuration (src/config/stellar.js) that resolves the network name, network passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and validates the whole setup fail-fast at boot so a misconfigured deployment (bad network value, mainnet flag with testnet Horizon or issuer) fails with an error naming the exact problem instead of at request time. stellarService.js and horizonClient.js now consume this module. Adds docs/MAINNET.md covering the env changes, creator trustlines, and a first-mainnet-transaction smoke checklist, plus unit tests for resolution and validation across both networks. * feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (Deen-Bridge#111) Let the platform pay a user's Stellar network fee by wrapping the user-signed transaction in a fee-bump signed by a dedicated fee-source account, so a user holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per submit via `requestSponsorship: true`; off by default and byte-for-byte identical when disabled. Guard rails (server signs on the platform's behalf): - Structural whitelist (reject-by-default, allow-list of `payment` ops only): source, exact op count/order, destinations, amounts (stroops), asset, and memo must match the pending Transaction row exactly. Any foreign/extra operation — including unknown future types — is rejected. - Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee ceiling, per-day total, and per-user per-day count. - Sponsor float pre-check so an underfunded sponsor never marks the user's transaction failed. Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling (verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash alongside the inner hash. Sponsorship-specific failures return a distinct non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed. - Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when enabled with a missing/invalid secret); secret never logged or returned. - Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the sponsor public key, live float, caps, and today's spend. - Prometheus counters for approved/rejected sponsorship decisions. - Docs: docs/fee-sponsorship.md, README, and openapi.yaml. - Tests: feeSponsorService (whitelist adversarial matrix, fee correctness, inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist rejections that don't fail the row). Closes Deen-Bridge#30 * feat: add managed course categories (Deen-Bridge#118) * feat(courses): add managed category taxonomy * fix(categories): preserve legacy course creation * feat: add recurring sadaqah pledges (Deen-Bridge#119) * feat(donations): add recurring sadaqah pledges * fix(pledges): preserve donation test compatibility * fix(pledges): ignore non-persisted transactions * refactor(db): scaffold /mongo data-layer structure (closes Deen-Bridge#167) --------- Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com> Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com> Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com> Co-authored-by: BountySpaghetti <zeemroyals@gmail.com> Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com> Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com> Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com> Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com> Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com> Co-authored-by: Mantissa <negativemantissa@gmail.com> Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* stellar: validate signed XDR contents before submit; store expectedHa… (Deen-Bridge#51) * stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests * test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController) * test: expect expectedHash at payment init (XDR pre-validation stores it there) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99) * feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) - Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission. - Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage. - Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured). - Add User lockout fields and document new env vars in .env.example. * fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89) - loginUser: locked accounts now return the same generic 401 'Invalid credentials' as a nonexistent account (no enumeration); failed-login counter incremented atomically via findByIdAndUpdate \, lock persisted via updateOne - resetPassword: breached-password check moved to after successful OTP validation so unauthenticated callers cannot trigger HIBP lookups - authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback) - hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records - captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call; captcha rejection now returns the standard { success, message, data: null } shape - tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap; locked-account test expects 401; per-email limiter buckets reset between tests; outage test routed through mockHibp so the shared spy is cleaned up; added padding-record and cap coverage * Feat/93 idempotency keys (Deen-Bridge#100) * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93) * test: complement stellarService mock exports in idempotency test * test: refine idempotency middleware concurrency lock test (Deen-Bridge#93) * fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93) * fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93) --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * feat(auth): enforce resource ownership across mutating endpoints (Deen-Bridge#88) (Deen-Bridge#105) Add a centralized authorization layer that verifies the authenticated user owns the target resource (or is an admin) before any mutating handler runs, replacing the ad-hoc inline checks scattered across controllers. - add authorizeOwnership + authorizeReviewOwnership middleware (src/middlewares/authorize.js); on success the loaded doc is attached to req so handlers can reuse it - apply the guards to book delete, course update, space update/delete, and review update/delete on books and courses; review create stays purchase-gated - record ownership denials to the audit log (authz.ownership.denied) - remove the now-redundant inline ownership checks from the book, course, space, and review controllers - document the resource x action x role matrix (docs/authorization-matrix.md) and cover it with an integration test suite (test/ownershipAuthz.test.js) Closes Deen-Bridge#88 Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com> * fix(security): stop logging OTP codes and verification tokens in email bodies (Deen-Bridge#104) The NODE_ENV === "test" branch of sendMail logged the full rendered email body — including the password-reset OTP span and the verification link's token query param — and pino's redact config cannot censor values baked into interpolated strings, so the leak bypassed the app-wide redaction. Remove the body from every log statement (log only recipient, subject, and template id via structured fields), and give tests a sanctioned in-memory outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/ sendReceiptEmail now return the sendMail result so callers can capture it. Closes Deen-Bridge#95 * fix(transactions): prevent TTL index from deleting confirmed purchases and donations (Deen-Bridge#103) The Transaction collection used a blanket TTL index on expiresAt with a schema default that stamped a 30-minute expiry on every row regardless of status. Because confirm paths never cleared expiresAt, confirmed on-chain purchases and donations were permanently reaped ~30 minutes after creation, deleting the proof of payment and orphaning recorded earnings. Scope the TTL index to status: "pending" via partialFilterExpression, make the expiresAt default conditional on status, add a pre-save hook that clears expiresAt for any terminal state, explicitly unset expiresAt on every terminal transition (submit, donation, refund, dispute, cancel, job handler, reconciliation promotion), and add an idempotent migration that rescues legacy non-pending rows and rebuilds the index. Closes Deen-Bridge#94 * feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) (Deen-Bridge#102) * feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) - Add EducatorVerification model with legal state-machine transitions (draft -> pending -> approved/rejected, resubmit from rejected) - Add verifiedEducator durable flag on User, set atomically on approval - Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT with metadata allowlist entries in auditService - requireVerifiedEducator middleware (403 for unverified, admin bypass) - Applicant API: submit/resubmit app, get own app, signed doc URLs, signed Cloudinary upload-signature for private credential uploads - Admin review queue: list+filter pending, view signed docs, approve/reject with notes (Mongo transaction for verifiedEducator grant) - Gate all content-creation routes: * POST /api/courses (courseRoutes.js) * POST /api/books (bookRoutes.js) * POST /api/spaces (spaceRoutes.js — live sessions per issue) - Wire routes: /api/educator-verification + /api/admin/educator-verification - Comprehensive test suite in test/educatorVerification.test.js (state-machine, middleware gating, submit/resubmit, approve/reject, content 403/2xx, both full lifecycles submit->pending->approve and reject->resubmit->approve, signed URL security, admin-only gating, audit log instrumentation) Verification Results: app.test.js: 22/22 PASS (CI boot + endpoint health) auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate) Closes Deen-Bridge#92 * fix(ci): resolve educator verification pipeline test failures - Remove redundant catchAsync double-wrap in educator-verification routes (controllers are already pre-wrapped; the outer wrap called .catch() on undefined, returning 500 for every new endpoint) - Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject MongoDB transaction can run (standalone MongoMemoryServer cannot) - Use AuditLog.collection.deleteMany in test cleanup to bypass append-only pre-hooks - Return recordAudit's promise so callers can await durability; await it in submitApplication and performReview to eliminate the fire-and-forget audit-race in tests - Fix testAuth.js password overwrite: destructure password out of the override spread so the hashed value is not clobbered by plaintext - Seed bookUpload test user as a verifiedEducator mentor so the new content gate lets it through --------- Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com> * feat(auth): signed service-to-service authentication for the AI service (Deen-Bridge#91) (Deen-Bridge#106) Give the backend a real machine-to-machine auth channel for the AI service (dnb-ai) — signed, scoped, rotatable keys instead of a single static shared secret. - add requireServiceAuth middleware (src/middlewares/serviceAuth.js): HMAC-SHA256 over a canonical method/path/timestamp/body-digest string, a ±300s replay window, constant-time signature comparison, per-key scope enforcement, and req.service on success - key store (src/config/serviceKeys.js): multiple active keys keyed by kid for zero-downtime rotation; resilient env parsing, never throws - mount a real internal route GET /api/internal/ai/whoami guarded by the guard (scope ai:read-content), plus raw-body capture in app.js - migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual - audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod (fail-fast), document the signing contract + rotation runbook - cover the full accept/reject matrix in test/serviceAuth.test.js Closes Deen-Bridge#91 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> * feat(webhooks): signed outbound webhook event system (Deen-Bridge#45) (Deen-Bridge#107) Add an outbound webhook/event system so external consumers can subscribe to payment and enrollment lifecycle events over HMAC-signed HTTP callbacks, with retries, dead-lettering, and redelivery. - models: WebhookEndpoint (encrypted secret at rest, subscribed events, auto-disable counters) and WebhookDelivery (all scheduling state in the doc: status, attemptCount, nextAttemptAt indexed) - webhookService.emitEvent: typed event catalog, per-event id for consumer idempotency, strict payload allowlist (no secrets/emails/user docs); persists a delivery per subscribed endpoint after the txn commits, never blocks or fails the request path, no-ops when the DB is unavailable - signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`) over the exact sent bytes; timing-safe verify + 5-min staleness window - deliveryWorker: atomic findOneAndUpdate claim (no double-send), exponential backoff + jitter, dead-letter after max attempts, endpoint auto-disable after sustained failures - management API (/api/webhooks, admin-gated): endpoint CRUD, rotate secret, list deliveries, redeliver (atomic $set), and ping - SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local - wire emitters into payment (initialized/confirmed/failed/expired), enrollment, and wallet connect/disconnect; migrate /admin/jobs to a timing-safe token compare - docs/webhooks.md consumer verifier + full offline test suite Closes Deen-Bridge#45 Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> * feat(security): implement TOTP two-factor authentication for admins a… (Deen-Bridge#98) * feat(stellar): publish Soroban giving-escrow contract id in stellar.toml Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage. * fix(stellar): resolve Horizon endpoints lazily + network-aware default Horizon client was constructed at import time with a hardcoded testnet fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins. * feat(auth): authenticated change-password endpoint PUT /api/auth/change-password (protected): verifies current password, enforces the password policy, updates the hash, and signs out all other sessions. Adds the auth.password_change audit action. * feat(security): implement TOTP two-factor authentication for admins and mentors - Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation - Add 10 single-use bcrypt-hashed recovery codes - Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window) - Update login controller to issue step-up mfaToken challenges when 2FA is enabled - Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions - Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage) - Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites * ci: update node version to 22 and sync package-lock.json * ci: pin mongo service to 6.0 and add wait-for-mongodb step * test: add 2FA enablement and 2FA verified token to admin in refund.test.js * fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility * fix(test): remove duplicate MongoMemoryServer import in refund.test.js * fix(test): add errorHandler middleware to refund.test.js app * fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js * fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks * fix(test): remove duplicate afterAll hooks and handle Multer 413 response status * test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js * test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims * fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests --------- Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> * Add scholarship escrow contract foundation (Deen-Bridge#108) * Improve application test coverage (Deen-Bridge#110) * Add dependency health checks (Deen-Bridge#112) * Validate auth and Stellar requests (Deen-Bridge#109) * Validate auth and Stellar requests * Address validation review feedback * Secure book deletion authorization (Deen-Bridge#113) * Secure book deletion * Keep delete response consistent * feat(stellar): gift courses/books via claimable balances with expiry reclaim (Deen-Bridge#116) Adds a gift-a-course/book flow built on Stellar claimable balances so a buyer can send an item to another user — including one who has not finished wallet onboarding — without the recipient needing a USDC trustline. The sender creates an on-ledger USDC balance the recipient claims when ready, with a sender reclaim-after-expiry predicate so funds are never stranded. Includes a GiftClaim model (no document-deleting TTL, so the record survives expiry for reclaim), a claimableBalanceService (build create/claim transactions with complementary predicates, resolve the REAL balance id from the create result XDR — not the tx hash — with a Horizon forClaimant fallback, and validate the signed gift XDR before any state change), gift routes/controller at /api/stellar/gifts, and granting item access to the RECIPIENT (never the payer) on claim. Wires a `{ fallback: "claimable_balance" }` response into the purchase flow when a creator wallet/trustline is missing. Tests cover predicate decoding, trustline-free single-signature claiming, claim authorization before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR rejection, guards mirroring initializePayment, and the recipient access grant. * feat(stellar): add idempotency protection to the Stellar payment endpoints (Deen-Bridge#115) Makes /api/stellar/payment/initialize and /submit safe against double-clicks, client retries, and concurrent duplicates. Submit is naturally idempotent per transaction hash: the deterministic hash of the signed XDR is looked up against confirmed transactions before any processing, so a replayed submission returns the original success response without re-granting access, with the unique index on stellarTxHash as the database-level backstop (an E11000 on the confirm save is treated as already processed). Initialize no longer piles up duplicates: a pending checkout for the same user+item returns the existing record (with its persisted unsigned XDR) instead of creating a new document, and stale pending records are reaped by the existing pending-only TTL index. Adds a stricter per-user rate limiter (paymentLimiter) on the payment routes, keyed on the authenticated user id with an IPv6-aware IP fallback. Covers duplicate-submit, duplicate-initialize, the E11000 race, and limiter enforcement with tests. * feat(stellar): validate Stellar config at startup and document the mainnet switch (Deen-Bridge#114) Adds a single source of truth for the Stellar network configuration (src/config/stellar.js) that resolves the network name, network passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and validates the whole setup fail-fast at boot so a misconfigured deployment (bad network value, mainnet flag with testnet Horizon or issuer) fails with an error naming the exact problem instead of at request time. stellarService.js and horizonClient.js now consume this module. Adds docs/MAINNET.md covering the env changes, creator trustlines, and a first-mainnet-transaction smoke checklist, plus unit tests for resolution and validation across both networks. * feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (Deen-Bridge#111) Let the platform pay a user's Stellar network fee by wrapping the user-signed transaction in a fee-bump signed by a dedicated fee-source account, so a user holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per submit via `requestSponsorship: true`; off by default and byte-for-byte identical when disabled. Guard rails (server signs on the platform's behalf): - Structural whitelist (reject-by-default, allow-list of `payment` ops only): source, exact op count/order, destinations, amounts (stroops), asset, and memo must match the pending Transaction row exactly. Any foreign/extra operation — including unknown future types — is rejected. - Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee ceiling, per-day total, and per-user per-day count. - Sponsor float pre-check so an underfunded sponsor never marks the user's transaction failed. Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling (verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash alongside the inner hash. Sponsorship-specific failures return a distinct non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed. - Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when enabled with a missing/invalid secret); secret never logged or returned. - Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the sponsor public key, live float, caps, and today's spend. - Prometheus counters for approved/rejected sponsorship decisions. - Docs: docs/fee-sponsorship.md, README, and openapi.yaml. - Tests: feeSponsorService (whitelist adversarial matrix, fee correctness, inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist rejections that don't fail the row). Closes Deen-Bridge#30 * feat: add managed course categories (Deen-Bridge#118) * feat(courses): add managed category taxonomy * fix(categories): preserve legacy course creation * feat: add recurring sadaqah pledges (Deen-Bridge#119) * feat(donations): add recurring sadaqah pledges * fix(pledges): preserve donation test compatibility * fix(pledges): ignore non-persisted transactions * feat(stellar): add loyalty points Soroban contract and service (closes Deen-Bridge#161) --------- Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com> Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com> Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com> Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com> Co-authored-by: BountySpaghetti <zeemroyals@gmail.com> Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com> Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com> Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com> Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com> Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com> Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com> Co-authored-by: Mantissa <negativemantissa@gmail.com> Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

…een-Bridge#287)

… (Deen-Bridge#286) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

…ge#284) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

…ridge#295)

…Deen-Bridge#293) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

Closes Deen-Bridge#185 - Add mongo/utils/textSearch.js: reusable utility wrapping MongoDB \ search operations with score-based ranking, filters, and pagination - Add mongo/mixins/Searchable.js: mixin that gives any model a consistent .search() interface built on top of textSearch.js - Add docs/full-text-search.md: comprehensive guide for configuring text indexes and using the search abstraction - Add tests for both textSearch utility (25 tests) and Searchable mixin (23 tests) covering score ranking, filters, pagination, empty results, and multi-model reuse Co-authored-by: glorious21-coder <glorious21-coder@users.noreply.github.com>

…Deen-Bridge#299) Adds mongo/utils/aggregation.js — pure, dependency-free ESM helpers that build common aggregation stages/pipelines (callers run Model.aggregate()), matching the existing mongo/utils house style (textSearch.js, cursorPagination.js). - Group builders: groupBy, sumBy, countBy, averageBy (single-field or whole-collection grouping). - Stage builders: matchStage, sortStage, limitStage, skipStage, paginate. - Date aggregations: dateGroup(dateField, "daily"|"weekly"|"monthly", tz) and timeSeries(...) — date-bucketed group→sort pipelines (keys formatted so lexical order == chronological order). - buildPipeline({match, group, sort, skip, limit}) composes stages in canonical order, omitting empty parts. Defensive validation throws clear errors. Adds mongo/utils/__tests__/aggregation.test.js (MongoMemoryServer, 44 cases).

…n-Bridge#300) Learners must complete prerequisite courses before enrolling in an advanced course. Additive and backward compatible; implemented in the real JS layout (the issue's .ts paths don't exist in this repo). - src/models/Course.js: add prerequisites: [ObjectId ref Course] (default []). - src/controllers/courses/courseController.js: normalizePrerequisites() validates each id and rejects self-reference; createCourse/updateCourse accept + persist prerequisites (update stays PATCH-like); getCourseById populates prerequisites (title, thumbnail). - enrollInCourse: before enrolling, verifies the user has COMPLETED every prerequisite (CourseProgress completedAt set or percentComplete >= 100); otherwise 400 "Complete these prerequisites first: <titles>" and no enroll. - src/validators/requestValidators.js: prerequisitesValidation (express-validator — optional array of ObjectIds, no self-reference); wired into POST / and PUT /:id in src/routes/courses/courseRoutes.js. Adds test/coursePrerequisites.test.js (MongoMemoryServer): blocks when unmet, allows when completed, and detail returns populated prerequisites. Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

…ridge#306) Create TransactionRepository extending BaseRepository with methods for transaction queries and analytics including findByUser, findByStatus, findByDateRange, getVolumeStats, getDailyVolume, and getCreatorEarnings aggregations. Follows established repository pattern conventions. Fixes Deen-Bridge#170 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

…Bridge#303) Users can create response videos ("duets" and "stitches") linked to an original reel: - Reel model: add originalReelId (ref Reel, nullable), duetType enum (duet|stitch), stitchClip {start,end} for the stitched portion, a composition descriptor, and duetCount/stitchCount surfaced on the original. Add an originalReelId+createdAt index for browsing. - utils/videoCompositor.js: dependency-free compositing abstraction that records intent/metadata (side-by-side for duet, prepend-clip for stitch) and returns a composition descriptor. Actual frame compositing is delegated to the media pipeline (no ffmpeg / no new deps). - services/reelDuetService.js: create a derivative reel linked to the original and atomically increment the original's counter; list derivatives for a reel (paginated, optional type filter). - reelController + reelsRoutes: POST /api/reels/:id/duet (create) and GET /api/reels/:id/duets (browse), with express-validator validation. Counts are surfaced on the reel response envelope. - test/reelDuet.test.js: ESM Jest + mongodb-memory-server covering duet linkage/count, stitch clip range, validation, and listing. Implemented in JavaScript to match the repo (no TypeScript tooling) and adds no new npm dependencies.

Create SpaceRepository extending BaseRepository with specialized queries for space management including findByOwner, findByMember, findPublic, getMembers, addMember, removeMember, and isMember operations. Follows established repository pattern conventions. Fixes Deen-Bridge#175 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Create a QueryBuilder class that provides a fluent interface for building Mongoose queries with chainable methods for where, select, sort, limit, skip, populate, paginate, and lean operations. Includes comprehensive test suite covering all query methods, pagination helpers, and edge cases. Fixes Deen-Bridge#180 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

… (Deen-Bridge#302) Add EducatorBalanceRepository extending BaseRepository with: - findByEducator, getAvailableBalance, getPendingAmount - getTransactionHistory with pagination (queries LedgerEntry collection) - reconcileBalance to detect stored vs computed balance mismatches - Atomic balance mutations using + aggregation pipeline updates - deductOwedBalance, creditOwedBalance, settleOwedToSettled Includes BaseRepository from merged PR Deen-Bridge#276 and 47 tests covering all methods including concurrent withdrawal atomicity testing. Co-authored-by: glorious21-coder <glorious21-coder@users.noreply.github.com> Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

…een-Bridge#298) - Add BaseRepository from dev branch (Deen-Bridge#168) to mongo/base/ - Update mongo/index.js to export BaseRepository from the base namespace - Create NotificationRepository extending BaseRepository with: - findByUser: query notifications by recipient with pagination support - findUnread: query unread notifications for a user - findByType: filter notifications by type enum - findByPriority: filter notifications by priority enum - markAsRead: mark a single notification as read - markAllAsRead: bulk mark all unread notifications as read - markManyAsRead: mark multiple specific notifications as read - deleteOlderThan: hard delete old notifications (TTL-style cleanup) - softDeleteOlderThan: soft delete old notifications (archival) - Add comprehensive tests (49 tests) covering all methods - Note: Notification schema has no MongoDB TTL index; cleanup is manual via deleteOlderThan/softDeleteOlderThan Co-authored-by: glorious21-coder <glorious21-coder@users.noreply.github.com> Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

…idge#301) - Add BaseRepository from dev branch (Deen-Bridge#168) to mongo/base/ - Update mongo/index.js to export BaseRepository and ReelRepository - Create ReelRepository extending BaseRepository with: - findByCreator: query reels by creator with pagination support - findBySpace: placeholder for future schema changes (Reel model has no spaceId yet) - findTrending: reels ranked by engagement (views + likes*2 + loves*3 + comments*4) - Engagement tracking: incrementViewCount, addLike, removeLike, addLove, removeLove, addComment, removeComment, incrementShareCount - filter: flexible multi-criterion filtering with sorting and pagination - Add comprehensive tests (62 tests) covering all methods - Note: Reel schema has no spaceId field; findBySpace returns empty results until schema is updated Co-authored-by: glorious21-coder <glorious21-coder@users.noreply.github.com> Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

…ation queue, and reading groups (Deen-Bridge#307) - Implement live session polls (Deen-Bridge#210) - Add text highlights and notes feature for books (Deen-Bridge#204) - Add content moderation queue and workflow for reels (Deen-Bridge#213) - Implement book clubs and reading groups (Deen-Bridge#205)

…etion badges (Deen-Bridge#308) - Deen-Bridge#184: Implement course bundles model, service, controller, and routes with discount calculation and bulk enrollment purchase endpoint - Deen-Bridge#186: Add PDF certificate generation using pdfkit, certificate schema, service, template, and download endpoint - Deen-Bridge#194: Add database health check endpoint /health/database with MongoDB ping, response time, connection status and timeout handling - Deen-Bridge#187: Implement course completion milestone badges schema, criteria definitions, awarding service, and user profile badge integration

…Bridge#310) Adds per-user per-book reading progress so readers can resume from their last position and see completion percentages on their library. - ReadingProgress model keyed by { user, book } with a unique compound index, storing page/percentage (0-100)/lastPosition, a monotonic version and timestamps. - Service upserts progress (one record per user+book), exposes a resume getter and augments the library listing with progress %. - Controller + routes mounted at /api/books: PUT /api/books/:bookId/progress (update/upsert) GET /api/books/:bookId/progress (resume) GET /api/books/library/progress (library with progress %) Inputs validated with express-validator (percentage 0-100, page >= 0). Real-time sync: socket.io is a dependency but no io server is wired in this repo, so REST is the reliable sync path and clients can poll the version/updatedAt fields to detect cross-device changes. A reading-progress socket namespace + emitProgress() seam (mirroring space-poll.socket.js) is provided so live push activates automatically once a socket.io server is attached, with zero import-time side effects. Implemented in the repo's real JavaScript ESM layout (the issue's .ts paths do not apply; this project has no TypeScript tooling). No new dependencies. Adds a Jest suite covering upsert uniqueness, overwrite + version/updatedAt bump, resume, percentage bounds validation and the library listing.

…e#192) (Deen-Bridge#309) Add a MongoDB connection-pool metrics collector and a Prometheus-compatible metrics endpoint at GET /metrics/database. - mongo/monitoring/poolMetrics.js: hand-rolled collector that subscribes to the MongoDB driver CMAP pool events (connectionCreated/Closed, checkedOut/In, checkOutStarted/Failed, pool created/ready/cleared) plus connection errors, and derives open/in-use/available/wait-queue gauges and readyState. No import-time side effects; degrades gracefully when the DB is not connected. - src/routes/metrics/database.js (+ routes/metrics/database.js re-export shim): renders the metrics in Prometheus text exposition format (# HELP / # TYPE / labelled samples). Mounted in app.js. - src/config/db.js: attaches the collector to the live connection after mongoose.connect (best-effort). - docs/connection-pool-metrics.md: Prometheus scrape config, Grafana panel JSON examples, and suggested alert rules. - Jest unit test drives synthetic pool events, no live DB required. Pure JavaScript ESM. No new npm dependencies (Prometheus format hand-rolled).

…ge#214)

coderabbitai · 2026-08-25T18:08:30Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6db2c3e6-fc17-4919-a5df-91f35b64e84f

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

zeemscript · 2026-08-27T19:24:56Z

Strict review blocker: this branch conflicts with the base branch. Please rebase and resolve conflicts before requesting merge.

zeemscript · 2026-08-27T19:26:22Z

Strict review blocker: this branch conflicts with the base branch. Please rebase and resolve conflicts before requesting merge.

zeemscript · 2026-08-27T19:28:05Z

Strict review blocker: this branch conflicts with the base branch. Please rebase and resolve conflicts before requesting merge.

zeemscript · 2026-08-30T12:28:30Z

@Xoft31 this PR has merge conflicts with the main branch. Please resolve the conflicts (merge main in or rebase) and push the fix so it can be merged. Thanks!

zeemscript and others added 24 commits August 24, 2026 17:19

feat(courses): add course analytics for creators (Deen-Bridge#193) (D…

83a1f28

…een-Bridge#287)

feat(db): implement cursor-based pagination utilities (Deen-Bridge#188)…

dbc8dd1

… (Deen-Bridge#286) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

feat(db): implement read replica support (Deen-Bridge#190) (Deen-Brid…

fa29916

…ge#284) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

refactor(db): create BookRepository (Deen-Bridge#172) (Deen-Bridge#285)

746b529

Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

feat(stellar): add fiat on-ramp integration (Deen-Bridge#166) (Deen-B…

2fb4e4b

…ridge#295)

feat(stellar): add payment analytics dashboard data (Deen-Bridge#162) (…

f9f9eed

…Deen-Bridge#293) Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>

feat(social): add real-time direct messaging system (closes Deen-Brid…

2b88d8b

…ge#214)

Navigation Menu

Uh oh!

feat(social): add real-time direct messaging system (closes #214) - #315

feat(social): add real-time direct messaging system (closes #214)#315
Xoft31 wants to merge 24 commits into
Deen-Bridge:devfrom
Xoft31:fix/issue-214

Xoft31 commented Aug 25, 2026

Uh oh!

coderabbitai Bot commented Aug 25, 2026

Uh oh!

zeemscript commented Aug 27, 2026

Uh oh!

zeemscript commented Aug 27, 2026

Uh oh!

zeemscript commented Aug 27, 2026

Uh oh!

zeemscript commented Aug 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants