Fix/security and correctness issues

backend/src/modules/prescriptions/prescriptions.controller.ts

@@ -58,6 +58,7 @@ export class PrescriptionsController {
   @Get('pet/:petId/expiring-soon')
   getExpiringSoon(@Param('petId') petId: string, @Query('days') days?: number) {
     return this.prescriptionsService.getExpiringPrescriptions(
+      petId,
       days ? +days : 30,
     );
   }

backend/src/modules/prescriptions/prescriptions.service.ts

@@ -388,6 +388,7 @@ export class PrescriptionsService {
    * Get prescriptions expiring soon
    */
   async getExpiringPrescriptions(
+    petId: string,
     daysWindow: number = 30,
   ): Promise<Prescription[]> {
     const today = new Date();
@@ -396,6 +397,7 @@ export class PrescriptionsService {
 
     return await this.prescriptionRepository.find({
       where: {
+        petId,
         status: PrescriptionStatus.ACTIVE,
         endDate: Between(today, windowEnd),
       },

backend/src/modules/wallets/wallets.service.ts

@@ -198,6 +198,12 @@ export class WalletsService {
   }> {
     const wallet = await this.findOneForUser(walletId, userId);
 
+    if (dto.network !== wallet.network) {
+      throw new BadRequestException(
+        `Network mismatch: request specifies '${dto.network}' but wallet is configured for '${wallet.network}'`,
+      );
+    }
+
     const network = this.stellarCfg.networks[dto.network];
     const horizonUrl = dto.horizonUrl || network.horizonUrl;
 

backend/src/modules/zkp/zkp.service.ts

@@ -136,7 +136,13 @@ export class ZkpService {
     publicInputs: Record<string, unknown>,
     privateWitness: Record<string, unknown>,
   ): { proof: string; commitment: string } {
-    const secret = process.env.ZKP_SECRET ?? 'zkp-dev-secret';
+    const secret = process.env.ZKP_SECRET;
+    if (!secret) {
+      throw new Error(
+        'ZKP_SECRET environment variable is not configured. ' +
+          'Set ZKP_SECRET to a strong random value before starting the application.',
+      );
+    }
     const commitment = crypto
       .createHmac('sha256', secret)
       .update(JSON.stringify(privateWitness))