Merge branch 'LabsCrypt:main' into issue-832

Author: chiscookeke11

.github/dependabot.yml

@@ -2,6 +2,12 @@ version: 2
 
 updates:
   # ── npm: root workspace ────────────────────────────────────────────────────
+  # flowfi is a single npm workspace (frontend + backend hoisted into one root
+  # package-lock.json). Dependabot must update from the workspace root so the
+  # root lockfile CI runs `npm ci` against stays in sync. Per-directory entries
+  # for /frontend and /backend only touched their package.json without updating
+  # the root lockfile, so every PR they opened failed `npm ci` with
+  # "lock file's X does not satisfy Y". One root entry covers all workspaces.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -14,32 +20,6 @@ updates:
           - "minor"
           - "patch"
 
-  # ── npm: frontend ──────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/frontend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
-  # ── npm: backend ───────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/backend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
   # ── Cargo: contracts ───────────────────────────────────────────────────────
   - package-ecosystem: "cargo"
     directory: "/contracts"

.github/workflows/ci.yml

@@ -42,17 +42,6 @@ jobs:
         run: npm run test:coverage
         working-directory: frontend
 
-      - name: Upload frontend coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          files: frontend/coverage/lcov.info
-          flags: frontend
-          name: frontend-coverage
-          fail_ci_if_error: false
-          verbose: true
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
       - name: Build
         run: npm run build
         working-directory: frontend

backend/Dockerfile

@@ -21,7 +21,13 @@ COPY package*.json ./
 RUN npm install --omit=dev
 
 COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/src/generated ./src/generated
+COPY --from=builder /app/src/generated ./dist/generated
+COPY --from=builder /app/prisma ./prisma
+# Prisma 7 reads the schema location and datasource url from prisma.config.ts,
+# and the schema's `datasource db {}` block has no inline url. The CI health
+# check runs `prisma db push` inside this image, so the config must be present
+# too (dotenv is a runtime dependency, so the config loads).
+COPY prisma.config.ts ./
 
 EXPOSE 3001
 

backend/src/app.ts

@@ -32,14 +32,18 @@ app.use(requestIdMiddleware);
 app.disable('x-powered-by');
 
 // Helmet-equivalent core headers without external dependency.
+// Strict CSP applied globally; the /api-docs route overrides it below for Swagger UI.
 app.use((req: Request, res: Response, next: NextFunction) => {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('X-Frame-Options', 'DENY');
     res.setHeader('Referrer-Policy', 'no-referrer');
     res.setHeader('X-DNS-Prefetch-Control', 'off');
     res.setHeader('X-Download-Options', 'noopen');
     res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');
-    if (isProduction) {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
+    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+    if (process.env.NODE_ENV === 'production') {
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }
     next();
@@ -78,7 +82,11 @@ app.use(express.json());
 app.use(sandboxMiddleware);
 
 // Swagger UI setup
-app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
+// Override CSP for /api-docs only: Swagger UI requires inline scripts/styles.
+app.use('/api-docs', (req: Request, res: Response, next: NextFunction) => {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
+    next();
+}, swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
     customCss: '.swagger-ui .topbar { display: none }',
     customSiteTitle: 'FlowFi API Documentation',
 }));

backend/src/controllers/sse.controller.ts

@@ -44,6 +44,8 @@ export const subscribe = async (req: Request, res: Response) => {
     const { publicKey } = (req as AuthenticatedRequest).user;
     const { streams, users, all } = subscribeSchema.parse(req.query);
 
+    // Consistent with GET /v1/events/ (which requires requireAuth and is scoped to user's address),
+    // SSE subscriptions are also restricted to streams owned by the authenticated user.
     // Scope: only streams where the authenticated user is sender or recipient
     const ownedStreams = await prisma.stream.findMany({
       where: { OR: [{ sender: publicKey }, { recipient: publicKey }] },

backend/src/middleware/auth.ts

@@ -98,13 +98,31 @@ export function verifyJwt(token: string): { publicKey: string } | null {
   try {
     const [header, body, sig] = token.split('.');
     if (!header || !body || !sig) return null;
+
+    // Verify signature
     const expected = crypto
       .createHmac('sha256', JWT_SECRET)
       .update(`${header}.${body}`)
       .digest();
-    if (!crypto.timingSafeEqual(Buffer.from(sig, 'base64url'), expected)) return null;
+
+    let providedSig: Buffer;
+    try {
+      providedSig = Buffer.from(sig, 'base64url');
+    } catch {
+      return null;
+    }
+
+    // Use timingSafeEqual to prevent timing attacks
+    if (providedSig.length !== expected.length || !crypto.timingSafeEqual(providedSig, expected)) {
+      return null;
+    }
+
+    // Verify expiration
     const payload = JSON.parse(Buffer.from(body, 'base64url').toString());
-    if (payload.exp < Math.floor(Date.now() / 1000)) return null;
+    if (!payload.exp || payload.exp < Math.floor(Date.now() / 1000)) {
+      return null;
+    }
+
     return { publicKey: payload.sub };
   } catch {
     return null;

backend/src/middleware/error.middleware.ts

@@ -14,6 +14,10 @@ export const errorHandler = (
 ) => {
     logger.error('Unhandled error:', err);
 
+    if (res.headersSent) {
+        return next(err);
+    }
+
     // Handle Zod Validation Errors
     if (err instanceof ZodError) {
         return res.status(400).json({

backend/src/routes/v1/admin.routes.ts

@@ -222,7 +222,7 @@ router.post('/indexer/reset', async (req: Request, res: Response) => {
  * /v1/admin/indexer/replay:
  *   post:
  *     tags: [Admin]
- *     summary: Replay events from a given ledger (idempotent)
+ *     summary: Replay events from a given ledger (StreamEvent rows deduplicated; stream mutations not idempotent — see indexerService.ts JSDoc)
  *     security: [{ adminAuth: [] }]
  *     parameters:
  *       - in: query

backend/src/routes/v1/events.routes.ts

@@ -3,6 +3,7 @@ import type { Request, Response, NextFunction } from 'express';
 import { subscribe } from '../../controllers/sse.controller.js';
 import { sseService } from '../../services/sse.service.js';
 import { requireAuth } from '../../middleware/auth.js';
+import type { AuthenticatedRequest } from '../../types/auth.types.js';
 import { prisma } from '../../lib/prisma.js';
 import logger from '../../logger.js';
 
@@ -65,14 +66,21 @@ export const DEFAULT_EVENTS_PAGE_SIZE = 50;
  *       200:
  *         description: Paginated event list
  */
-router.get('/', async (req: Request, res: Response, next: NextFunction) => {
+router.get('/', requireAuth, async (req: Request, res: Response, next: NextFunction) => {
   try {
+    const { publicKey } = (req as AuthenticatedRequest).user;
     const address = typeof req.query.address === 'string' ? req.query.address.trim() : '';
     if (!address) {
       res.status(400).json({ error: 'address query parameter is required' });
       return;
     }
 
+    // Aligned with SSE security: history queries require authentication and are scoped to the caller.
+    if (address !== publicKey) {
+      res.status(403).json({ error: 'Forbidden', message: 'You can only view your own event history' });
+      return;
+    }
+
     const rawType = typeof req.query.type === 'string' ? req.query.type : '';
     const requested = rawType
       .split(',')

backend/src/services/indexerService.ts

@@ -38,8 +38,13 @@ export async function resetIndexer(toLedger: number): Promise<void> {
 
 /**
  * Replay events from a given ledger by resetting state and triggering a poll.
- * Deduplication in the worker (transactionHash + eventType + ledger) ensures
- * no duplicate StreamEvent rows are created.
+ * The @@unique([transactionHash, eventType]) constraint on StreamEvent
+ * guarantees no duplicate StreamEvent rows are created on replay.
+ *
+ * CAVEAT: This dedup does NOT apply to stream state mutations.
+ * Stream.withdrawnAmount (handleTokensWithdrawn, soroban-event-worker.ts:635)
+ * is incremented unconditionally on every replay, so replay is NOT fully
+ * idempotent. See issue #808 for the withdrawnAmount idempotency fix.
  */
 export async function replayFromLedger(fromLedger: number): Promise<void> {
   await resetIndexer(fromLedger);