Merge branch 'LabsCrypt:main' into fix/stream-create-form-labels

T-kesh · web-flow · commit a37b121adb2b · 2026-07-01T12:32:07.000+01:00
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -2,6 +2,12 @@ version: 2
 
 updates:
   # ── npm: root workspace ────────────────────────────────────────────────────
+  # flowfi is a single npm workspace (frontend + backend hoisted into one root
+  # package-lock.json). Dependabot must update from the workspace root so the
+  # root lockfile CI runs `npm ci` against stays in sync. Per-directory entries
+  # for /frontend and /backend only touched their package.json without updating
+  # the root lockfile, so every PR they opened failed `npm ci` with
+  # "lock file's X does not satisfy Y". One root entry covers all workspaces.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -14,32 +20,6 @@ updates:
           - "minor"
           - "patch"
 
-  # ── npm: frontend ──────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/frontend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
-  # ── npm: backend ───────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/backend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
   # ── Cargo: contracts ───────────────────────────────────────────────────────
   - package-ecosystem: "cargo"
     directory: "/contracts"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -42,17 +42,6 @@ jobs:
         run: npm run test:coverage
         working-directory: frontend
 
-      - name: Upload frontend coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          files: frontend/coverage/lcov.info
-          flags: frontend
-          name: frontend-coverage
-          fail_ci_if_error: false
-          verbose: true
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
       - name: Build
         run: npm run build
         working-directory: frontend
diff --git a/backend/.env.example b/backend/.env.example
@@ -1,6 +1,16 @@
 # Database
 DATABASE_URL="postgresql://user:password@localhost:5433/flowfi?schema=public"
 
+# PostgreSQL pool settings
+# Maximum database connections per backend process (default: 10)
+PG_POOL_MAX=10
+# How long an idle connection stays open before being closed (milliseconds, default: 30000)
+PG_IDLE_TIMEOUT_MS=30000
+# How long to wait when establishing a new database connection (milliseconds, default: 5000)
+PG_CONNECTION_TIMEOUT_MS=5000
+# Maximum time a PostgreSQL statement may run before cancellation (milliseconds, default: 30000)
+PG_STATEMENT_TIMEOUT_MS=30000
+
 # Server
 PORT=3001
 NODE_ENV=development
diff --git a/backend/Dockerfile b/backend/Dockerfile
@@ -21,7 +21,13 @@ COPY package*.json ./
 RUN npm install --omit=dev
 
 COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/src/generated ./src/generated
+COPY --from=builder /app/src/generated ./dist/generated
+COPY --from=builder /app/prisma ./prisma
+# Prisma 7 reads the schema location and datasource url from prisma.config.ts,
+# and the schema's `datasource db {}` block has no inline url. The CI health
+# check runs `prisma db push` inside this image, so the config must be present
+# too (dotenv is a runtime dependency, so the config loads).
+COPY prisma.config.ts ./
 
 EXPOSE 3001
 
diff --git a/backend/package.json b/backend/package.json
@@ -32,7 +32,6 @@
     "express-rate-limit": "^8.5.2",
     "ioredis": "^5.11.1",
     "pg": "^8.21.0",
-    "stellar-sdk": "^13.3.0",
     "swagger-jsdoc": "^6.3.0",
     "swagger-ui-express": "^5.0.1",
     "winston": "^3.11.0",
diff --git a/backend/prisma/migrations/20260630000000_add_stream_token_address_index/migration.sql b/backend/prisma/migrations/20260630000000_add_stream_token_address_index/migration.sql
@@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Stream_tokenAddress_idx" ON "Stream"("tokenAddress");
diff --git a/backend/prisma/schema.prisma b/backend/prisma/schema.prisma
@@ -51,6 +51,7 @@ model Stream {
 
   @@index([sender])
   @@index([recipient])
+  @@index([tokenAddress])
   @@index([streamId])
   @@index([isActive])
   @@index([isPaused])
diff --git a/backend/prisma/seed.ts b/backend/prisma/seed.ts
@@ -1,9 +1,8 @@
-import pg from 'pg';
 import { PrismaPg } from '@prisma/adapter-pg';
 import { PrismaClient } from '../src/generated/prisma/index.js';
+import { createPgPool } from '../src/lib/pg-pool.js';
 
-const connectionString = process.env.DATABASE_URL;
-const pool = new pg.Pool({ connectionString });
+const pool = createPgPool();
 const adapter = new PrismaPg(pool);
 const prisma = new PrismaClient({ adapter });
 
diff --git a/backend/src/controllers/stream.controller.ts b/backend/src/controllers/stream.controller.ts
@@ -316,7 +316,11 @@ export const getStreamEvents = async (req: Request, res: Response) => {
     const [events, total] = await Promise.all([
       prisma.streamEvent.findMany({
         where: whereClause,
-        orderBy: { timestamp: order },
+        // `timestamp` is not unique (events in the same block/ledger can
+        // share a timestamp), so it can't be the sole sort key for cursor
+        // pagination. Add `id` as a unique tiebreaker so ordering (and
+        // therefore cursor pagination) is stable across pages.
+        orderBy: [{ timestamp: order }, { id: order }],
         take: limit,
         ...(cursor
           ? { cursor: { id: cursor }, skip: 1 }
@@ -770,4 +774,4 @@ export const resumeStream = async (req: Request, res: Response) => {
     logger.error('Error resuming stream:', error);
     return res.status(500).json({ error: 'Internal server error' });
   }
-};
+};
diff --git a/backend/src/lib/pg-pool.ts b/backend/src/lib/pg-pool.ts
@@ -0,0 +1,21 @@
+import pg from 'pg';
+
+const parsePositiveIntegerEnv = (name: string, defaultValue: number): number => {
+  const rawValue = process.env[name];
+
+  if (!rawValue) return defaultValue;
+
+  const parsedValue = Number.parseInt(rawValue, 10);
+
+  return Number.isInteger(parsedValue) && parsedValue > 0 ? parsedValue : defaultValue;
+};
+
+export const createPgPoolConfig = (): pg.PoolConfig => ({
+  connectionString: process.env.DATABASE_URL,
+  max: parsePositiveIntegerEnv('PG_POOL_MAX', 10),
+  idleTimeoutMillis: parsePositiveIntegerEnv('PG_IDLE_TIMEOUT_MS', 30_000),
+  connectionTimeoutMillis: parsePositiveIntegerEnv('PG_CONNECTION_TIMEOUT_MS', 5_000),
+  statement_timeout: parsePositiveIntegerEnv('PG_STATEMENT_TIMEOUT_MS', 30_000),
+});
+
+export const createPgPool = () => new pg.Pool(createPgPoolConfig());
diff --git a/backend/src/lib/prisma.ts b/backend/src/lib/prisma.ts
@@ -1,16 +1,15 @@
 import pg from 'pg';
 import { PrismaPg } from '@prisma/adapter-pg';
 import { PrismaClient } from '../generated/prisma/index.js';
+import { createPgPool } from './pg-pool.js';
 
 const globalForPrisma = global as unknown as {
   prisma?: PrismaClient;
   pool?: pg.Pool;
 };
 
-const connectionString = process.env.DATABASE_URL;
-
 if (!globalForPrisma.pool) {
-  globalForPrisma.pool = new pg.Pool({ connectionString });
+  globalForPrisma.pool = createPgPool();
 }
 
 const adapter = new PrismaPg(globalForPrisma.pool);
diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
@@ -98,13 +98,31 @@ export function verifyJwt(token: string): { publicKey: string } | null {
   try {
     const [header, body, sig] = token.split('.');
     if (!header || !body || !sig) return null;
+
+    // Verify signature
     const expected = crypto
       .createHmac('sha256', JWT_SECRET)
       .update(`${header}.${body}`)
       .digest();
-    if (!crypto.timingSafeEqual(Buffer.from(sig, 'base64url'), expected)) return null;
+
+    let providedSig: Buffer;
+    try {
+      providedSig = Buffer.from(sig, 'base64url');
+    } catch {
+      return null;
+    }
+
+    // Use timingSafeEqual to prevent timing attacks
+    if (providedSig.length !== expected.length || !crypto.timingSafeEqual(providedSig, expected)) {
+      return null;
+    }
+
+    // Verify expiration
     const payload = JSON.parse(Buffer.from(body, 'base64url').toString());
-    if (payload.exp < Math.floor(Date.now() / 1000)) return null;
+    if (!payload.exp || payload.exp < Math.floor(Date.now() / 1000)) {
+      return null;
+    }
+
     return { publicKey: payload.sub };
   } catch {
     return null;
diff --git a/backend/src/routes/v1/admin.routes.ts b/backend/src/routes/v1/admin.routes.ts
@@ -222,7 +222,7 @@ router.post('/indexer/reset', async (req: Request, res: Response) => {
  * /v1/admin/indexer/replay:
  *   post:
  *     tags: [Admin]
- *     summary: Replay events from a given ledger (idempotent)
+ *     summary: Replay events from a given ledger (StreamEvent rows deduplicated; stream mutations not idempotent — see indexerService.ts JSDoc)
  *     security: [{ adminAuth: [] }]
  *     parameters:
  *       - in: query
diff --git a/backend/src/services/indexerService.ts b/backend/src/services/indexerService.ts
@@ -38,8 +38,13 @@ export async function resetIndexer(toLedger: number): Promise<void> {
 
 /**
  * Replay events from a given ledger by resetting state and triggering a poll.
- * Deduplication in the worker (transactionHash + eventType + ledger) ensures
- * no duplicate StreamEvent rows are created.
+ * The @@unique([transactionHash, eventType]) constraint on StreamEvent
+ * guarantees no duplicate StreamEvent rows are created on replay.
+ *
+ * CAVEAT: This dedup does NOT apply to stream state mutations.
+ * Stream.withdrawnAmount (handleTokensWithdrawn, soroban-event-worker.ts:635)
+ * is incremented unconditionally on every replay, so replay is NOT fully
+ * idempotent. See issue #808 for the withdrawnAmount idempotency fix.
  */
 export async function replayFromLedger(fromLedger: number): Promise<void> {
   await resetIndexer(fromLedger);
diff --git a/backend/src/services/sorobanService.ts b/backend/src/services/sorobanService.ts
@@ -4,9 +4,29 @@ import logger from '../logger.js';
 const RPC_URL = process.env.SOROBAN_RPC_URL ?? 'https://soroban-testnet.stellar.org';
 const CONTRACT_ID = process.env.STREAM_CONTRACT_ID ?? '';
 const KEEPER_SECRET = process.env.KEEPER_SECRET_KEY ?? '';
-/** DB data older than this is considered stale and triggers an RPC fallback. */
+/**
+ * DB data older than this is considered stale and triggers an RPC fallback.
+ * 30 s ≈ avg Stellar ledger close time (~5 s) × 6 ledgers — a reasonable
+ * window to tolerate indexer lag without hammering the RPC on every request.
+ */
 const STALE_THRESHOLD_MS = 30_000;
 
+/** Stroops charged on read-only simulation transactions (no real resource cost). */
+const SIMULATION_FEE = '100';
+
+/** Stroops charged on real contract-invocation transactions submitted to the network. */
+const SUBMIT_FEE = '1000';
+
+/** Transaction validity window in seconds (applied via setTimeout). */
+const TX_TIMEOUT_SECONDS = 30;
+
+/**
+ * Throw-away source account used when building simulation-only transactions.
+ * Any valid Ed25519 public key works here; the account never needs to exist on-chain
+ * because simulation transactions are never submitted.
+ */
+const SIMULATION_PLACEHOLDER_ACCOUNT = 'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN';
+
 const server = new rpc.Server(RPC_URL, { allowHttp: true });
 
 export interface ChainStream {
@@ -51,20 +71,17 @@ async function simulateContractCall(method: string, args: xdr.ScVal[]): Promise<
   const op = contract.call(method, ...args);
 
   const tx = new TransactionBuilder(
-    new Account(
-      'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN',
-      '0'
-    ),
+    new Account(SIMULATION_PLACEHOLDER_ACCOUNT, '0'),
     {
-      fee: '100',
+      fee: SIMULATION_FEE,
       networkPassphrase:
         process.env.STELLAR_NETWORK === 'mainnet'
           ? Networks.PUBLIC
           : Networks.TESTNET,
     }
   )
     .addOperation(op)
-    .setTimeout(30)
+    .setTimeout(TX_TIMEOUT_SECONDS)
     .build();
 
   const result = await server.simulateTransaction(tx);
@@ -87,14 +104,14 @@ async function submitContractCall(method: string, args: xdr.ScVal[], senderSecre
   const op = contract.call(method, ...args);
 
   const tx = new TransactionBuilder(account, {
-    fee: '1000',
+    fee: SUBMIT_FEE,
     networkPassphrase:
       process.env.STELLAR_NETWORK === 'mainnet'
         ? Networks.PUBLIC
         : Networks.TESTNET,
   })
     .addOperation(op)
-    .setTimeout(30)
+    .setTimeout(TX_TIMEOUT_SECONDS)
     .build();
 
   // Simulate first to get foot print and resource info
diff --git a/backend/src/workers/soroban-event-worker.ts b/backend/src/workers/soroban-event-worker.ts
@@ -1,5 +1,6 @@
 import { rpc, xdr, StrKey } from '@stellar/stellar-sdk';
-import { prisma, Prisma } from '../lib/prisma.js';
+import { prisma } from '../lib/prisma.js';
+import type { Prisma } from '../generated/prisma/index.js';
 import { INDEXER_STATE_ID } from '../lib/indexer-state.js';
 import { sseService } from '../services/sse.service.js';
 import logger from '../logger.js';
diff --git a/backend/tests/auth.test.ts b/backend/tests/auth.test.ts
@@ -3,6 +3,7 @@ import request from 'supertest';
 import * as crypto from 'crypto';
 import * as StellarSdk from '@stellar/stellar-sdk';
 import express from 'express';
+import { rateLimit } from 'express-rate-limit';
 import app from '../src/app.js';
 import { __authChallengeTestUtils, requireAdmin, signJwt } from '../src/middleware/auth.js';
 
@@ -287,6 +288,14 @@ describe('Authentication & Middleware Tests', () => {
     beforeEach(() => {
       adminApp = express();
       adminApp.use(express.json());
+      const adminLimiter = rateLimit({
+        windowMs: 60_000,
+        max: 100,
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: { error: 'Too many requests' },
+      });
+      adminApp.use('/test-admin', adminLimiter);
       adminApp.get('/test-admin', requireAdmin, (_req: any, res: any) => {
         res.status(200).json({ success: true });
       });
diff --git a/backend/tests/deprecated.test.ts b/backend/tests/deprecated.test.ts
diff --git a/contracts/stream_contract/src/errors.rs b/contracts/stream_contract/src/errors.rs
@@ -29,4 +29,6 @@ pub enum StreamError {
     InvalidTokenAddress = 10,
     /// `amount / duration` rounds to zero — the stream would lock tokens but never accrue.
     InvalidRate = 11,
+    /// Operation requires an active stream, but the stream is currently paused.
+    StreamPaused = 12,
 }
diff --git a/contracts/stream_contract/src/lib.rs b/contracts/stream_contract/src/lib.rs
@@ -431,7 +431,7 @@ impl StreamContract {
         // Validate stream is active and not paused
         Self::validate_stream_active(&stream)?;
         if stream.paused {
-            return Err(StreamError::StreamInactive);
+            return Err(StreamError::StreamPaused);
         }
 
         let now = env.ledger().timestamp();
diff --git a/contracts/stream_contract/src/test.rs b/contracts/stream_contract/src/test.rs
diff --git a/frontend/src/components/dashboard/dashboard-view.tsx b/frontend/src/components/dashboard/dashboard-view.tsx
diff --git a/frontend/src/components/stream-creation/StreamCreationWizard.tsx b/frontend/src/components/stream-creation/StreamCreationWizard.tsx
diff --git a/frontend/src/hooks/useIncomingStreams.ts b/frontend/src/hooks/useIncomingStreams.ts
diff --git a/frontend/src/lib/dashboard.ts b/frontend/src/lib/dashboard.ts
diff --git a/frontend/vitest.config.mts b/frontend/vitest.config.mts
diff --git a/package-lock.json b/package-lock.json

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+-- CreateIndex`
	`2`	`+CREATE INDEX IF NOT EXISTS "Stream_tokenAddress_idx" ON "Stream"("tokenAddress");`