fix(backend): add Zod validation, helmet, and rate limiting across all routes

backend/package.json

@@ -6,7 +6,9 @@
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "tsc",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@stellar/stellar-sdk": "14.2.0",
@@ -15,14 +17,20 @@
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
+    "express-rate-limit": "^7.5.0",
     "groq-sdk": "^0.12.0",
-    "multer": "^2.1.1"
+    "helmet": "^8.0.0",
+    "multer": "^2.1.1",
+    "zod": "^3.24.0"
   },
   "devDependencies": {
     "@types/cors": "^2.8.17",
     "@types/express": "^4.17.21",
     "@types/node": "^22.10.5",
+    "@types/supertest": "^6.0.2",
+    "supertest": "^7.0.0",
     "tsx": "^4.19.2",
-    "typescript": "^5.7.2"
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.0"
   }
 }

backend/src/__tests__/validation.test.ts

@@ -0,0 +1,264 @@
+import { describe, it, expect } from "vitest";
+import { postMessageBody, getConversationQuery, getInboxQuery } from "../schemas/messages.js";
+import {
+  getNotificationsQuery,
+  postNotificationBody,
+  patchNotificationReadParams,
+} from "../schemas/notifications.js";
+import { postMilestonesBody, postCoverLetterBody, postRewriteBody } from "../schemas/ai.js";
+import { postGaslessApplyBody } from "../schemas/gasless.js";
+import { uploadMilestoneBody } from "../schemas/upload.js";
+
+const VALID_ADDR_A = "G" + "A".repeat(55);
+const VALID_ADDR_B = "G" + "B".repeat(55);
+const VALID_UUID = "123e4567-e89b-12d3-a456-426614174000";
+
+// ── messages ─────────────────────────────────────────────────────────────────
+
+describe("postMessageBody", () => {
+  it("accepts valid payload", () => {
+    const result = postMessageBody.safeParse({
+      sender_address: VALID_ADDR_A,
+      recipient_address: VALID_ADDR_B,
+      content: "hello",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects missing content", () => {
+    const result = postMessageBody.safeParse({
+      sender_address: VALID_ADDR_A,
+      recipient_address: VALID_ADDR_B,
+      content: "",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects self-messaging", () => {
+    const result = postMessageBody.safeParse({
+      sender_address: VALID_ADDR_A,
+      recipient_address: VALID_ADDR_A,
+      content: "hi",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects invalid Stellar address format", () => {
+    const result = postMessageBody.safeParse({
+      sender_address: "notastellaraddress",
+      recipient_address: VALID_ADDR_B,
+      content: "hello",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects content exceeding 4000 chars", () => {
+    const result = postMessageBody.safeParse({
+      sender_address: VALID_ADDR_A,
+      recipient_address: VALID_ADDR_B,
+      content: "x".repeat(4001),
+    });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe("getConversationQuery", () => {
+  it("accepts valid a, b addresses", () => {
+    const result = getConversationQuery.safeParse({ a: VALID_ADDR_A, b: VALID_ADDR_B });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects invalid address for a", () => {
+    const result = getConversationQuery.safeParse({ a: "bad", b: VALID_ADDR_B });
+    expect(result.success).toBe(false);
+  });
+
+  it("accepts optional since as ISO datetime", () => {
+    const result = getConversationQuery.safeParse({
+      a: VALID_ADDR_A,
+      b: VALID_ADDR_B,
+      since: "2024-01-01T00:00:00.000Z",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects since as non-datetime string", () => {
+    const result = getConversationQuery.safeParse({
+      a: VALID_ADDR_A,
+      b: VALID_ADDR_B,
+      since: "not-a-date",
+    });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe("getInboxQuery", () => {
+  it("accepts valid wallet", () => {
+    expect(getInboxQuery.safeParse({ wallet: VALID_ADDR_A }).success).toBe(true);
+  });
+
+  it("rejects wallet starting with wrong character", () => {
+    expect(getInboxQuery.safeParse({ wallet: "XABC" + "D".repeat(52) }).success).toBe(false);
+  });
+
+  it("rejects missing wallet", () => {
+    expect(getInboxQuery.safeParse({}).success).toBe(false);
+  });
+});
+
+// ── notifications ─────────────────────────────────────────────────────────────
+
+describe("getNotificationsQuery", () => {
+  it("accepts valid 56-char G-address", () => {
+    expect(getNotificationsQuery.safeParse({ wallet: VALID_ADDR_A }).success).toBe(true);
+  });
+
+  it("rejects wallet that only starts with G but is too short", () => {
+    expect(getNotificationsQuery.safeParse({ wallet: "GABC" }).success).toBe(false);
+  });
+});
+
+describe("postNotificationBody", () => {
+  it("accepts valid payload", () => {
+    const result = postNotificationBody.safeParse({
+      wallet_address: VALID_ADDR_A,
+      type: "payment",
+      title: "Payment received",
+      message: "You received 100 XLM",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects missing type", () => {
+    const result = postNotificationBody.safeParse({
+      wallet_address: VALID_ADDR_A,
+      title: "hello",
+      message: "world",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects title exceeding 200 chars", () => {
+    const result = postNotificationBody.safeParse({
+      wallet_address: VALID_ADDR_A,
+      type: "t",
+      title: "x".repeat(201),
+      message: "msg",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects invalid action_url", () => {
+    const result = postNotificationBody.safeParse({
+      wallet_address: VALID_ADDR_A,
+      type: "t",
+      title: "t",
+      message: "m",
+      action_url: "not-a-url",
+    });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe("patchNotificationReadParams", () => {
+  it("accepts valid UUID", () => {
+    expect(patchNotificationReadParams.safeParse({ id: VALID_UUID }).success).toBe(true);
+  });
+
+  it("rejects non-UUID string", () => {
+    expect(patchNotificationReadParams.safeParse({ id: "not-a-uuid" }).success).toBe(false);
+  });
+});
+
+// ── AI ────────────────────────────────────────────────────────────────────────
+
+describe("postMilestonesBody", () => {
+  it("accepts valid payload with userPrompt", () => {
+    const result = postMilestonesBody.safeParse({ userPrompt: "build a login page" });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects missing userPrompt", () => {
+    expect(postMilestonesBody.safeParse({}).success).toBe(false);
+  });
+
+  it("rejects userPrompt over 2000 chars", () => {
+    expect(postMilestonesBody.safeParse({ userPrompt: "x".repeat(2001) }).success).toBe(false);
+  });
+
+  it("applies default empty strings for optional fields", () => {
+    const result = postMilestonesBody.safeParse({ userPrompt: "test" });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.projectTitle).toBe("");
+      expect(result.data.milestoneIndex).toBeNull();
+    }
+  });
+});
+
+describe("postCoverLetterBody", () => {
+  it("accepts valid payload", () => {
+    const result = postCoverLetterBody.safeParse({ jobDescription: "Build a REST API" });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects missing jobDescription", () => {
+    expect(postCoverLetterBody.safeParse({ jobTitle: "Dev" }).success).toBe(false);
+  });
+});
+
+describe("postRewriteBody", () => {
+  it("accepts valid text", () => {
+    expect(postRewriteBody.safeParse({ text: "Some project description" }).success).toBe(true);
+  });
+
+  it("rejects empty text", () => {
+    expect(postRewriteBody.safeParse({ text: "" }).success).toBe(false);
+  });
+
+  it("rejects text over 5000 chars", () => {
+    expect(postRewriteBody.safeParse({ text: "x".repeat(5001) }).success).toBe(false);
+  });
+});
+
+// ── gasless ───────────────────────────────────────────────────────────────────
+
+describe("postGaslessApplyBody", () => {
+  it("accepts valid XDR string", () => {
+    const result = postGaslessApplyBody.safeParse({ signedTxXdr: "A".repeat(100) });
+    expect(result.success).toBe(true);
+  });
+
+  it("rejects signedTxXdr shorter than 48 chars", () => {
+    expect(postGaslessApplyBody.safeParse({ signedTxXdr: "short" }).success).toBe(false);
+  });
+
+  it("rejects missing signedTxXdr", () => {
+    expect(postGaslessApplyBody.safeParse({}).success).toBe(false);
+  });
+});
+
+// ── upload ────────────────────────────────────────────────────────────────────
+
+describe("uploadMilestoneBody", () => {
+  it("accepts valid escrow_id and milestone_index", () => {
+    const result = uploadMilestoneBody.safeParse({ escrow_id: "esc-123", milestone_index: "2" });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.milestone_index).toBe(2);
+    }
+  });
+
+  it("applies defaults when fields are missing", () => {
+    const result = uploadMilestoneBody.safeParse({});
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.escrow_id).toBe("unknown");
+      expect(result.data.milestone_index).toBe(0);
+    }
+  });
+
+  it("rejects negative milestone_index", () => {
+    expect(uploadMilestoneBody.safeParse({ milestone_index: "-1" }).success).toBe(false);
+  });
+});

backend/src/index.ts

@@ -1,7 +1,9 @@
 import "dotenv/config";
 import cors from "cors";
 import express from "express";
+import helmet from "helmet";
 import { requireApiSecret } from "./middleware/auth.js";
+import { rateLimiter } from "./middleware/rateLimiter.js";
 import { aiRouter } from "./routes/ai.js";
 import { notificationsRouter } from "./routes/notifications.js";
 import { uploadRouter } from "./routes/upload.js";
@@ -12,6 +14,8 @@ const app = express();
 const port = Number(process.env.PORT) || 8787;
 const apiSecret = process.env.API_SECRET;
 
+app.use(helmet());
+app.use(rateLimiter);
 app.use(
   cors({
     origin: true,

backend/src/lib/errors.ts

@@ -0,0 +1,9 @@
+import type { Response } from "express";
+
+export function internalError(res: Response): void {
+  res.status(500).json({ error: "An internal error occurred" });
+}
+
+export function serviceUnavailable(res: Response, service: string): void {
+  res.status(503).json({ error: `${service} is not configured` });
+}

backend/src/middleware/rateLimiter.ts

@@ -0,0 +1,9 @@
+import rateLimit from "express-rate-limit";
+
+export const rateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  limit: 100,
+  standardHeaders: "draft-7",
+  legacyHeaders: false,
+  message: { error: "Too many requests, please try again later" },
+});

backend/src/middleware/validate.ts

@@ -0,0 +1,35 @@
+import type { Request, Response, NextFunction } from "express";
+import { type ZodSchema } from "zod";
+
+function formatError(errors: { path: (string | number)[]; message: string }[]) {
+  return {
+    error: "Validation failed",
+    details: errors.map((e) => ({
+      field: e.path.join(".") || "root",
+      message: e.message,
+    })),
+  };
+}
+
+export function validateBody(schema: ZodSchema) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const result = schema.safeParse(req.body);
+    if (!result.success) {
+      res.status(400).json(formatError(result.error.errors));
+      return;
+    }
+    req.body = result.data;
+    next();
+  };
+}
+
+export function validateQuery(schema: ZodSchema) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const result = schema.safeParse(req.query);
+    if (!result.success) {
+      res.status(400).json(formatError(result.error.errors));
+      return;
+    }
+    next();
+  };
+}