Merge pull request #2 from LabsCrypt/main

Merged

Author: Henrichy

backend/docs/DEPRECATION_POLICY.md

@@ -148,9 +148,10 @@ X-API-Migration-Path: /v1/streams
 - `/streams` → `/v1/streams`
 - `/events` → `/v1/events`
 
-**Status:** Deprecated (as of 2024-02-21)
+**Status:** Removed (deprecated 2024-02-21, sunset 2024-12-31, handlers deleted 2026-06-30)
 
-**Sunset Date:** 2024-12-31
+These routes no longer exist in the codebase. Clients still calling the unversioned
+paths will receive a 404. Update all callers to use the `/v1/` prefix.
 
 **Migration:**
 ```javascript

backend/src/app.ts

@@ -105,35 +105,6 @@ app.use((req: Request, res: Response, next: NextFunction) => {
     return next(); // Not versioned, continue to deprecated handlers
 });
 
-// Legacy routes (deprecated - redirect to v1)
-// These will be removed in a future version
-// Only match unversioned requests
-app.use('/streams', (req: Request, res: Response, next) => {
-    res.status(410).json({
-        error: 'Deprecated endpoint',
-        message: 'This endpoint has been deprecated. Please use /v1/streams instead.',
-        deprecated: true,
-        migration: {
-            old: '/streams',
-            new: '/v1/streams',
-        },
-        sunsetDate: '2024-12-31',
-    });
-});
-
-app.use('/events', (req: Request, res: Response, next) => {
-    res.status(410).json({
-        error: 'Deprecated endpoint',
-        message: 'This endpoint has been deprecated. Please use /v1/events instead.',
-        deprecated: true,
-        migration: {
-            old: '/events',
-            new: '/v1/events',
-        },
-        sunsetDate: '2024-12-31',
-    });
-});
-
 // Health check routes
 app.use('/health', healthRoutes);
 

backend/src/workers/soroban-event-worker.ts

@@ -1,5 +1,5 @@
 import { rpc, xdr, StrKey } from '@stellar/stellar-sdk';
-import { prisma } from '../lib/prisma.js';
+import { prisma, Prisma } from '../lib/prisma.js';
 import { INDEXER_STATE_ID } from '../lib/indexer-state.js';
 import { sseService } from '../services/sse.service.js';
 import logger from '../logger.js';
@@ -146,7 +146,7 @@ export class SorobanEventWorker {
     this.pollTimer = setTimeout(() => this.poll(), this.pollIntervalMs);
   }
 
-  private async ensureSystemStream(tx: any): Promise<void> {
+  private async ensureSystemStream(tx: Prisma.TransactionClient): Promise<void> {
     const systemUser = 'GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF';
     await tx.user.upsert({
       where: { publicKey: systemUser },
@@ -351,7 +351,7 @@ export class SorobanEventWorker {
     const newFeeRateBps = decodeU32(body['new_fee_rate_bps']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await this.ensureSystemStream(tx);
 
       await tx.streamEvent.upsert({
@@ -399,7 +399,7 @@ export class SorobanEventWorker {
     const newAdmin = decodeAddress(body['new_admin']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await this.ensureSystemStream(tx);
 
       await tx.streamEvent.upsert({
@@ -462,7 +462,7 @@ export class SorobanEventWorker {
         ? null
         : startTime + Number(BigInt(depositedAmount) / ratePerSecondBigInt);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.user.upsert({
         where: { publicKey: sender },
         create: { publicKey: sender },
@@ -551,7 +551,7 @@ export class SorobanEventWorker {
     const newDepositedAmount = decodeI128(body['new_deposited_amount']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       const stream = await tx.stream.findUniqueOrThrow({
         where: { streamId },
         select: { ratePerSecond: true, startTime: true, totalPausedDuration: true }
@@ -622,7 +622,7 @@ export class SorobanEventWorker {
     const amount = decodeI128(body['amount']);
     const timestamp = Number(decodeU64(body['timestamp']));
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       const stream = await tx.stream.findUniqueOrThrow({
         where: { streamId },
         select: { withdrawnAmount: true },
@@ -688,7 +688,7 @@ export class SorobanEventWorker {
     const refundedAmount = decodeI128(body['refunded_amount']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.stream.update({
         where: { streamId },
         data: {
@@ -746,7 +746,7 @@ export class SorobanEventWorker {
     const totalWithdrawn = decodeI128(body['total_withdrawn']);
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.stream.update({
         where: { streamId },
         data: {
@@ -853,7 +853,7 @@ export class SorobanEventWorker {
     const pausedAt = Number(decodeU64(body['paused_at']));
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       await tx.stream.update({
         where: { streamId },
         data: {
@@ -910,7 +910,7 @@ export class SorobanEventWorker {
     const newEndTime = Number(decodeU64(body['new_end_time']));
     const timestamp = Math.floor(Date.now() / 1000);
 
-    await prisma.$transaction(async (tx: any) => {
+    await prisma.$transaction(async (tx: Prisma.TransactionClient) => {
       // Get current stream to calculate paused duration
       const currentStream = await tx.stream.findUniqueOrThrow({
         where: { streamId },

contracts/stream_contract/src/lib.rs

@@ -342,12 +342,12 @@ impl StreamContract {
 
         let elapsed = effective_now.saturating_sub(stream.last_update_time);
 
-        // Use checked_sub for deposited - withdrawn calculation
-        // Underflow (withdrawn > deposited) falls back to 0.
+        // Clamp to 0: withdrawn_amount should never exceed deposited_amount in
+        // normal flow, but guard defensively so the function never returns negative.
         let remaining = stream
             .deposited_amount
-            .checked_sub(stream.withdrawn_amount)
-            .unwrap_or_default();
+            .saturating_sub(stream.withdrawn_amount)
+            .max(0);
 
         // Use checked_mul to prevent overflow when multiplying rate * elapsed.
         // If overflow would occur, cap at the remaining balance.
@@ -602,11 +602,8 @@ impl StreamContract {
         let remaining = stream
             .deposited_amount
             .saturating_sub(stream.withdrawn_amount);
-        let new_end_time = if stream.rate_per_second > 0 {
-            now + (remaining / stream.rate_per_second) as u64
-        } else {
-            now
-        };
+        // rate_per_second is guaranteed >= 1 due to create_stream's InvalidRate guard
+        let new_end_time = now + (remaining / stream.rate_per_second) as u64;
 
         stream.paused = false;
         stream.paused_at = None;

contracts/stream_contract/src/test.rs

@@ -1042,6 +1042,36 @@ fn test_claimable_max_i128_rate_overflow() {
     assert_eq!(withdrawn, 1_000);
 }
 
+// ─── #795 calculate_claimable underflow guard ─────────────────────────────────
+
+#[test]
+fn test_calculate_claimable_underflow_returns_zero() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (token, _) = create_token(&env);
+    let sender = Address::generate(&env);
+    let recipient = Address::generate(&env);
+    mint(&env, &token, &sender, 1_000);
+
+    let client = create_contract(&env);
+    let stream_id = client.create_stream(&sender, &recipient, &token, &1_000, &1_000);
+
+    // Forcibly set withdrawn_amount > deposited_amount to exercise the underflow guard.
+    let mut stream = client.get_stream(&stream_id).unwrap();
+    stream.withdrawn_amount = stream.deposited_amount + 1;
+    env.as_contract(&client.address, || {
+        env.storage()
+            .persistent()
+            .set(&types::DataKey::Stream(stream_id), &stream);
+    });
+
+    // calculate_claimable uses checked_sub(...).unwrap_or_default(), so the
+    // underflow must return 0 rather than panicking or wrapping.
+    let claimable = client.get_claimable_amount(&stream_id).unwrap();
+    assert_eq!(claimable, 0);
+}
+
 // ─── #232 create_stream edge cases ───────────────────────────────────────────
 
 #[test]
@@ -1245,6 +1275,35 @@ fn test_withdraw_full_balance() {
     assert_eq!(s.status, StreamStatus::Completed);
 }
 
+#[test]
+fn test_withdraw_rejects_double_withdraw_after_completion() {
+    let env = Env::default();
+    env.mock_all_auths();
+    let (token, _) = create_token(&env);
+    let sender = Address::generate(&env);
+    let recipient = Address::generate(&env);
+    mint(&env, &token, &sender, 500);
+
+    let client = create_contract(&env);
+    let id = client.create_stream(&sender, &recipient, &token, &500, &100);
+
+    // Fully drain the stream via withdraw.
+    env.ledger().with_mut(|l| l.timestamp += 200);
+    let claimed = client.withdraw(&recipient, &id);
+    assert_eq!(claimed, 500);
+
+    // Verify stream is now inactive and completed.
+    let s = client.get_stream(&id).unwrap();
+    assert!(!s.is_active);
+    assert_eq!(s.status, StreamStatus::Completed);
+
+    // Try to withdraw again — should return StreamInactive error.
+    assert_eq!(
+        client.try_withdraw(&recipient, &id),
+        Err(Ok(StreamError::StreamInactive))
+    );
+}
+
 #[test]
 fn test_top_up_extends_stream() {
     let env = Env::default();

frontend/eslint.config.mjs

@@ -13,6 +13,15 @@ const eslintConfig = defineConfig([
     "build/**",
     "next-env.d.ts",
   ]),
+  {
+    // Forbid raw console.* calls outside the logger module.
+    // Use src/lib/logger.ts instead.
+    files: ["src/**/*.{ts,tsx}"],
+    ignores: ["src/lib/logger.ts"],
+    rules: {
+      "no-console": "error",
+    },
+  },
 ]);
 
 export default eslintConfig;

frontend/src/app/activity/activity-content.tsx

@@ -8,11 +8,11 @@ import { Button } from "@/components/ui/Button";
 import { Loader2, Download } from "lucide-react";
 import { formatAmount } from "@/lib/amount";
 import { downloadCSV } from "@/utils/csvExport";
+import { getApiBaseUrl } from "@/lib/api/_shared";
+import { logger } from "@/lib/logger";
 
 const PAGE_SIZE = 10;
-const API_BASE_URL = (
-  process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:3001"
-).replace(/\/+$/, "");
+const API_BASE_URL = getApiBaseUrl();
 
 const TABS = [
   { id: "ALL", label: "All" },
@@ -62,7 +62,7 @@ export default function ActivityContent() {
         }
       } catch (error) {
         if (error instanceof DOMException && error.name === "AbortError") return;
-        console.error("Failed to fetch activity:", error);
+        logger.error("Failed to fetch activity:", error);
         if (!append) setEvents([]);
         setHasMore(false);
       } finally {

frontend/src/app/settings/settings-content.tsx

@@ -8,14 +8,15 @@ import { useRouter } from "next/navigation";
 import Link from "next/link";
 import { formatNetwork } from "@/lib/wallet";
 import toast from "react-hot-toast";
+import { getApiBaseUrl } from "@/lib/api/_shared";
 
 type DisplayCurrency = "USD" | "XLM" | "USDC";
 type AmountFormat = "full" | "compact";
 type DecimalPlaces = 2 | 4 | 7;
 
 const APP_VERSION = process.env.NEXT_PUBLIC_APP_VERSION || "1.0.0";
 const CONTRACT_ADDRESS = process.env.NEXT_PUBLIC_STREAMING_CONTRACT || "CDV4K...7ZQY";
-const INDEXER_URL = process.env.NEXT_PUBLIC_API_URL || "http://localhost:3001/v1";
+const INDEXER_URL = `${getApiBaseUrl()}/v1`;
 
 export default function SettingsContent() {
   const router = useRouter();

frontend/src/app/streams/[id]/stream-details-content.tsx

@@ -2,6 +2,8 @@
 
 import { useEffect, useState, useCallback, useMemo } from "react";
 import Link from "next/link";
+import { getApiBaseUrl } from "@/lib/api/_shared";
+import { logger } from "@/lib/logger";
 import { ArrowLeft, Pause, Play, X, Plus, Download, AlertTriangle } from "lucide-react";
 import { Button } from "@/components/ui/Button";
 import toast from "react-hot-toast";
@@ -42,7 +44,7 @@ interface StreamDetail {
   updatedAt: string;
 }
 
-const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || "http://localhost:3001/v1";
+const API_BASE_URL = `${getApiBaseUrl()}/v1`;
 const EVENTS_PER_PAGE = 10;
 
 const TOKEN_SYMBOLS: Record<string, string> = {
@@ -116,7 +118,7 @@ export default function StreamDetailsContent({ streamId }: { streamId: string })
       }
     } catch (err) {
       if (err instanceof Error && err.name === "AbortError") return;
-      console.error("Failed to fetch events:", err);
+      logger.error("Failed to fetch events:", err);
     }
   }, [streamId]);
 

frontend/src/app/streams/create/create-stream-content.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import React, { useState } from "react";
+import { logger } from "@/lib/logger";
 import {
   createStream,
   toBaseUnits,
@@ -67,7 +68,7 @@ export default function CreateStreamContent() {
         }, 2000);
       }
     } catch (error) {
-      console.error("Stream creation failed:", error);
+      logger.error("Stream creation failed:", error);
       toast.error(toSorobanErrorMessage(error));
     } finally {
       setLoading(false);