Merge branch 'main' into test/815-stream-post-negative-cases

Author: Emelie-Dev

backend/docs/DEPRECATION_POLICY.md

@@ -148,9 +148,10 @@ X-API-Migration-Path: /v1/streams
 - `/streams` → `/v1/streams`
 - `/events` → `/v1/events`
 
-**Status:** Deprecated (as of 2024-02-21)
+**Status:** Removed (deprecated 2024-02-21, sunset 2024-12-31, handlers deleted 2026-06-30)
 
-**Sunset Date:** 2024-12-31
+These routes no longer exist in the codebase. Clients still calling the unversioned
+paths will receive a 404. Update all callers to use the `/v1/` prefix.
 
 **Migration:**
 ```javascript

backend/src/app.ts

@@ -32,14 +32,18 @@ app.use(requestIdMiddleware);
 app.disable('x-powered-by');
 
 // Helmet-equivalent core headers without external dependency.
+// Strict CSP applied globally; the /api-docs route overrides it below for Swagger UI.
 app.use((req: Request, res: Response, next: NextFunction) => {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('X-Frame-Options', 'DENY');
     res.setHeader('Referrer-Policy', 'no-referrer');
     res.setHeader('X-DNS-Prefetch-Control', 'off');
     res.setHeader('X-Download-Options', 'noopen');
     res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');
-    if (isProduction) {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
+    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+    if (process.env.NODE_ENV === 'production') {
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }
     next();
@@ -78,7 +82,11 @@ app.use(express.json());
 app.use(sandboxMiddleware);
 
 // Swagger UI setup
-app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
+// Override CSP for /api-docs only: Swagger UI requires inline scripts/styles.
+app.use('/api-docs', (req: Request, res: Response, next: NextFunction) => {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
+    next();
+}, swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
     customCss: '.swagger-ui .topbar { display: none }',
     customSiteTitle: 'FlowFi API Documentation',
 }));
@@ -105,35 +113,6 @@ app.use((req: Request, res: Response, next: NextFunction) => {
     return next(); // Not versioned, continue to deprecated handlers
 });
 
-// Legacy routes (deprecated - redirect to v1)
-// These will be removed in a future version
-// Only match unversioned requests
-app.use('/streams', (req: Request, res: Response, next) => {
-    res.status(410).json({
-        error: 'Deprecated endpoint',
-        message: 'This endpoint has been deprecated. Please use /v1/streams instead.',
-        deprecated: true,
-        migration: {
-            old: '/streams',
-            new: '/v1/streams',
-        },
-        sunsetDate: '2024-12-31',
-    });
-});
-
-app.use('/events', (req: Request, res: Response, next) => {
-    res.status(410).json({
-        error: 'Deprecated endpoint',
-        message: 'This endpoint has been deprecated. Please use /v1/events instead.',
-        deprecated: true,
-        migration: {
-            old: '/events',
-            new: '/v1/events',
-        },
-        sunsetDate: '2024-12-31',
-    });
-});
-
 // Health check routes
 app.use('/health', healthRoutes);
 

backend/src/controllers/sse.controller.ts

@@ -44,6 +44,8 @@ export const subscribe = async (req: Request, res: Response) => {
     const { publicKey } = (req as AuthenticatedRequest).user;
     const { streams, users, all } = subscribeSchema.parse(req.query);
 
+    // Consistent with GET /v1/events/ (which requires requireAuth and is scoped to user's address),
+    // SSE subscriptions are also restricted to streams owned by the authenticated user.
     // Scope: only streams where the authenticated user is sender or recipient
     const ownedStreams = await prisma.stream.findMany({
       where: { OR: [{ sender: publicKey }, { recipient: publicKey }] },

backend/src/middleware/error.middleware.ts

@@ -14,6 +14,10 @@ export const errorHandler = (
 ) => {
     logger.error('Unhandled error:', err);
 
+    if (res.headersSent) {
+        return next(err);
+    }
+
     // Handle Zod Validation Errors
     if (err instanceof ZodError) {
         return res.status(400).json({

backend/src/routes/v1/events.routes.ts

@@ -3,6 +3,7 @@ import type { Request, Response, NextFunction } from 'express';
 import { subscribe } from '../../controllers/sse.controller.js';
 import { sseService } from '../../services/sse.service.js';
 import { requireAuth } from '../../middleware/auth.js';
+import type { AuthenticatedRequest } from '../../types/auth.types.js';
 import { prisma } from '../../lib/prisma.js';
 import logger from '../../logger.js';
 
@@ -65,14 +66,21 @@ export const DEFAULT_EVENTS_PAGE_SIZE = 50;
  *       200:
  *         description: Paginated event list
  */
-router.get('/', async (req: Request, res: Response, next: NextFunction) => {
+router.get('/', requireAuth, async (req: Request, res: Response, next: NextFunction) => {
   try {
+    const { publicKey } = (req as AuthenticatedRequest).user;
     const address = typeof req.query.address === 'string' ? req.query.address.trim() : '';
     if (!address) {
       res.status(400).json({ error: 'address query parameter is required' });
       return;
     }
 
+    // Aligned with SSE security: history queries require authentication and are scoped to the caller.
+    if (address !== publicKey) {
+      res.status(403).json({ error: 'Forbidden', message: 'You can only view your own event history' });
+      return;
+    }
+
     const rawType = typeof req.query.type === 'string' ? req.query.type : '';
     const requested = rawType
       .split(',')

backend/src/workers/soroban-event-worker.ts

@@ -1,5 +1,5 @@
 import { rpc, xdr, StrKey } from '@stellar/stellar-sdk';
-import { prisma } from '../lib/prisma.js';
+import { prisma, Prisma } from '../lib/prisma.js';
 import { INDEXER_STATE_ID } from '../lib/indexer-state.js';
 import { sseService } from '../services/sse.service.js';
 import logger from '../logger.js';
@@ -146,7 +146,7 @@ export class SorobanEventWorker {
     this.pollTimer = setTimeout(() => this.poll(), this.pollIntervalMs);
   }
 
-  private async ensureSystemStream(tx: any): Promise<void> {
+  private async ensureSystemStream(tx: Prisma.TransactionClient): Promise<void> {
     const systemUser = 'GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF';
     await tx.user.upsert({
       where: { publicKey: systemUser },
@@ -351,7 +351,7 @@ export class SorobanEventWorker {
     const newFeeRateBps = decodeU32(body['new_fee_rate_bps']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await this.ensureSystemStream(tx);
 
       await tx.streamEvent.upsert({
@@ -399,7 +399,7 @@ export class SorobanEventWorker {
     const newAdmin = decodeAddress(body['new_admin']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await this.ensureSystemStream(tx);
 
       await tx.streamEvent.upsert({
@@ -462,7 +462,7 @@ export class SorobanEventWorker {
         ? null
         : startTime + Number(BigInt(depositedAmount) / ratePerSecondBigInt);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.user.upsert({
         where: { publicKey: sender },
         create: { publicKey: sender },
@@ -551,7 +551,7 @@ export class SorobanEventWorker {
     const newDepositedAmount = decodeI128(body['new_deposited_amount']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       const stream = await tx.stream.findUniqueOrThrow({
         where: { streamId },
         select: { ratePerSecond: true, startTime: true, totalPausedDuration: true }
@@ -622,7 +622,7 @@ export class SorobanEventWorker {
     const amount = decodeI128(body['amount']);
     const timestamp = Number(decodeU64(body['timestamp']));
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       const stream = await tx.stream.findUniqueOrThrow({
         where: { streamId },
         select: { withdrawnAmount: true },
@@ -688,7 +688,7 @@ export class SorobanEventWorker {
     const refundedAmount = decodeI128(body['refunded_amount']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.stream.update({
         where: { streamId },
         data: {
@@ -746,7 +746,7 @@ export class SorobanEventWorker {
     const totalWithdrawn = decodeI128(body['total_withdrawn']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.stream.update({
         where: { streamId },
         data: {
@@ -853,7 +853,7 @@ export class SorobanEventWorker {
     const pausedAt = Number(decodeU64(body['paused_at']));
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.stream.update({
         where: { streamId },
         data: {
@@ -910,7 +910,7 @@ export class SorobanEventWorker {
     const newEndTime = Number(decodeU64(body['new_end_time']));
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       // Get current stream to calculate paused duration
       const currentStream = await tx.stream.findUniqueOrThrow({
         where: { streamId },