Merge remote-tracking branch 'upstream/main' into fix/issues-547

Author: wheval

.github/workflows/ci.yml

@@ -4,9 +4,9 @@ name: CI
 
 on:
   push:
-    branches: [ main, develop ]
+    branches: [main, develop]
   pull_request:
-    branches: [ main, develop ]
+    branches: [main, develop]
 
 jobs:
   frontend:
@@ -19,14 +19,13 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
 
-
       - name: Lint
         run: npm run lint
         working-directory: frontend
@@ -68,8 +67,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          cache: 'npm'
+          node-version: "20"
+          cache: "npm"
           cache-dependency-path: package-lock.json
 
       - name: Install dependencies
@@ -128,7 +127,7 @@ jobs:
       - name: Rust Cache
         uses: Swatinem/rust-cache@v2
         with:
-          workspaces: "contracts -> target"
+          workspace: "contracts -> target"
 
       - name: Check Formatting
         run: cargo fmt --all -- --check
@@ -167,19 +166,28 @@ jobs:
       - name: Install Stellar CLI
         run: |
           curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh -s -- --install-deps
+          echo "$HOME/.stellar-cli/bin" >> $GITHUB_PATH
         shell: bash
 
       - name: Optimize WASM files
         run: |
           set -euo pipefail
-          WASMS=$(find contracts/target -type f -name "*.wasm" -print)
+
+          # Target the precise release build directory
+          RELEASE_DIR="contracts/target/wasm32-unknown-unknown/release"
+
+          # Use your strict selection logic to target un-optimized raw binaries only
+          WASMS=$(find "$RELEASE_DIR" -maxdepth 1 -type f -name "*.wasm" ! -name "*.optimized.wasm")
+
           if [ -z "$WASMS" ]; then
-            echo "No wasm files found"
+            echo "Error: No raw WASM files found in $RELEASE_DIR"
             exit 1
           fi
+
           for w in $WASMS; do
-            out="${w%%.wasm}.optimized.wasm"
-            echo "Optimizing $w -> $out"
+            filename=$(basename "$w")
+            out="$RELEASE_DIR/${filename%.wasm}.optimized.wasm"
+            echo "Optimizing $filename -> $(basename "$out")"
             stellar contract optimize --wasm "$w" --wasm-out "$out"
           done
         shell: bash
@@ -188,5 +196,5 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: optimized-wasm
-          path: |
-            contracts/target/**/**/*.optimized.wasm
+          path: contracts/target/wasm32-unknown-unknown/release/*.optimized.wasm
+          if-no-files-found: error

README.md

@@ -6,6 +6,8 @@
 
 _Programmable, real-time payment streams and recurring subscriptions._
 
+i just need to create a draft pr
+
 ## Overview
 
 FlowFi allows users to create continuous payment streams and recurring subscriptions using stablecoins on the Stellar network. By leveraging Soroban smart contracts, FlowFi enables autonomous accurate-to-the-second distribution of funds.
@@ -269,11 +271,8 @@ If you discover a security vulnerability, please see our [Security Policy](SECUR
 
 ## Community & Support
 
-Have questions? Want to share ideas or projects? Join the conversation!
+Review the discussions guide before opening an issue or looking for community support.
 
-- **❓ [Ask Questions](https://github.com/flowfi/flowfi/discussions/categories/q-a)** - Get help in GitHub Discussions Q&A
-- **💡 [Share Ideas](https://github.com/flowfi/flowfi/discussions/categories/ideas)** - Propose features and discuss improvements
-- **🎪 [Show and Tell](https://github.com/flowfi/flowfi/discussions/categories/show-and-tell)** - Share projects and use cases built with FlowFi
 - **📖 [Discussions Guide](DISCUSSIONS.md)** - Learn when to use Discussions vs Issues.
 
 ## Contributors

backend/.env.example

@@ -33,6 +33,10 @@ INDEXER_POLL_INTERVAL_MS=5000
 # Ledger sequence to start indexing from on first run (0 = latest)
 INDEXER_START_LEDGER=0
 
+# Server-side Stellar secret key used to sign and submit on-chain transactions
+# (cancel_stream, top_up_stream). Must be funded on the target network.
+KEEPER_SECRET_KEY=
+
 # ─── Auth ─────────────────────────────────────────────────────────────────────
 # Secret used to sign JWTs (generate with: openssl rand -hex 32)
 JWT_SECRET=
@@ -45,7 +49,9 @@ ADMIN_PUBLIC_KEY=
 # Leave empty to run in single-instance mode (no Redis required).
 REDIS_URL=
 
-# ─── Admin ───────────────────────────────────────────────────────────────────
-# Bearer token required for GET /v1/admin/metrics.
-# Leave empty to disable the admin endpoint entirely.
-ADMIN_SECRET=
+# ─── Caching (optional) ───────────────────────────────────────────────────────
+# Time in milliseconds between periodic sweeps to prune expired memory cache
+# entries (default: 60000)
+MEMORY_CACHE_SWEEP_MS=60000
+
+

backend/package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "main": "index.js",
   "scripts": {
+    "prebuild": "prisma generate",
     "test": "vitest run",
     "dev": "nodemon",
     "build": "tsc",
@@ -22,38 +23,38 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "@prisma/adapter-pg": "^7.4.1",
-    "@stellar/stellar-sdk": "^14.5.0",
+    "@prisma/adapter-pg": "^7.8.0",
+    "@stellar/stellar-sdk": "^15.1.0",
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.2.1",
-    "ioredis": "^5.3.2",
-    "pg": "^8.18.0",
+    "express-rate-limit": "^8.5.2",
+    "ioredis": "^5.11.0",
+    "pg": "^8.21.0",
     "stellar-sdk": "^13.3.0",
-    "swagger-jsdoc": "^6.2.8",
+    "swagger-jsdoc": "^6.3.0",
     "swagger-ui-express": "^5.0.1",
     "winston": "^3.11.0",
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@prisma/client": "^7.4.1",
+    "@prisma/client": "^7.8.0",
     "@types/cors": "^2.8.19",
     "@types/eventsource": "^1.1.15",
     "@types/express": "^5.0.6",
     "@types/node": "^25.2.3",
-    "@types/pg": "^8.16.0",
+    "@types/pg": "^8.20.0",
     "@types/supertest": "^7.2.0",
     "@types/swagger-jsdoc": "^6.0.4",
     "@types/swagger-ui-express": "^4.1.6",
     "@vitest/coverage-v8": "^2.1.8",
     "eventsource": "^2.0.2",
     "nodemon": "^3.1.11",
-    "prisma": "^7.4.1",
-    "rollup": "^4.60.2",
+    "prisma": "^7.8.0",
+    "rollup": "^4.61.0",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2",
-    "tsx": "^4.19.2",
+    "tsx": "^4.22.4",
     "typescript": "^5.9.3",
     "vitest": "^2.1.8"
   }

backend/prisma/seed.ts

@@ -7,23 +7,29 @@ const pool = new pg.Pool({ connectionString });
 const adapter = new PrismaPg(pool);
 const prisma = new PrismaClient({ adapter });
 
+// Use stable, checksum-valid Stellar testnet/demo addresses so seeded rows
+// render correctly in the frontend and resolve against TOKEN_ADDRESSES.
+const DEMO_SENDER_PUBLIC_KEY = 'GCM5WPR4DDR24FSAX5LIEM4J7AI3KOWJYANSXEPKYXCSZOTAYXE75AFN';
+const DEMO_RECIPIENT_PUBLIC_KEY = 'GBJCHUKZMTFSLOMNC7P4TS4VJJBTCYL3XKSOLXAUJSD56C4LHND5TWUC';
+const DEMO_TOKEN_ADDRESS = 'CBIELTK6YBZJU5UP2WWQEUCYKLPU6AUNZ2BQ4WWFEIE3USCIHMXQDAMA';
+
 async function main() {
     console.log('Seeding database...');
 
     // Create example users
     const user1 = await prisma.user.upsert({
-        where: { publicKey: 'GBRPYH6QC6WGLH473XI3CL4B3I754SFSULN5K3X7G3X4I6SGRH3V3U12' },
+        where: { publicKey: DEMO_SENDER_PUBLIC_KEY },
         update: {},
         create: {
-            publicKey: 'GBRPYH6QC6WGLH473XI3CL4B3I754SFSULN5K3X7G3X4I6SGRH3V3U12',
+            publicKey: DEMO_SENDER_PUBLIC_KEY,
         },
     });
 
     const user2 = await prisma.user.upsert({
-        where: { publicKey: 'GDRS6N3K7DQ6GKH47O6E5K5G7B7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V' },
+        where: { publicKey: DEMO_RECIPIENT_PUBLIC_KEY },
         update: {},
         create: {
-            publicKey: 'GDRS6N3K7DQ6GKH47O6E5K5G7B7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V',
+            publicKey: DEMO_RECIPIENT_PUBLIC_KEY,
         },
     });
 
@@ -37,7 +43,7 @@ async function main() {
             streamId: 101,
             sender: user1.publicKey,
             recipient: user2.publicKey,
-            tokenAddress: 'CBTM5D262F6VQY4A6E4F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0U1V2W3X',
+            tokenAddress: DEMO_TOKEN_ADDRESS,
             ratePerSecond: '100000000', // 10 XLM/sec if decimals=7
             depositedAmount: '1000000000000',
             withdrawnAmount: '0',

backend/src/app.ts

@@ -65,8 +65,8 @@ app.use(cors({
 }));
 
 // Convert CORS errors into 403 responses so callers get a clear status code
-app.use((err: any, req: Request, res: Response, next: NextFunction) => {
-    if (err && err.message === 'CORS origin not allowed') {
+app.use((err: unknown, req: Request, res: Response, next: NextFunction) => {
+    if (err instanceof Error && err.message === 'CORS origin not allowed') {
         res.status(403).json({ error: 'CORS origin not allowed' });
         return;
     }
@@ -102,7 +102,7 @@ app.use((req: Request, res: Response, next: NextFunction) => {
         // This was a versioned request, route to v1 handlers
         return v1Routes(req, res, next);
     }
-    next(); // Not versioned, continue to deprecated handlers
+    return next(); // Not versioned, continue to deprecated handlers
 });
 
 // Legacy routes (deprecated - redirect to v1)

backend/src/config/swagger.ts

@@ -76,6 +76,18 @@ See [Sandbox Mode Documentation](../docs/SANDBOX_MODE.md) for details.`,
           scheme: 'bearer',
           bearerFormat: 'JWT',
           description: 'JSON Web Token issued by /v1/auth/verify after completing the SEP-10 challenge flow.'
+        },
+        bearerAuth: {
+          type: 'http',
+          scheme: 'bearer',
+          bearerFormat: 'JWT',
+          description: 'Alias for BearerAuth — used by route-level security annotations.'
+        },
+        adminAuth: {
+          type: 'http',
+          scheme: 'bearer',
+          bearerFormat: 'JWT',
+          description: 'Admin JWT — the token subject must match ADMIN_PUBLIC_KEY.'
         }
       },
       schemas: {
@@ -165,6 +177,28 @@ See [Sandbox Mode Documentation](../docs/SANDBOX_MODE.md) for details.`,
               description: 'Stream active status',
               example: true,
             },
+            isPaused: {
+              type: 'boolean',
+              description: 'Whether the stream is currently paused',
+              example: false,
+            },
+            pausedAt: {
+              type: 'integer',
+              nullable: true,
+              description: 'Ledger timestamp when the stream was last paused (Unix), null if not paused',
+              example: null,
+            },
+            totalPausedDuration: {
+              type: 'integer',
+              description: 'Cumulative seconds the stream has spent paused',
+              example: 0,
+            },
+            endTime: {
+              type: 'integer',
+              nullable: true,
+              description: 'Ledger timestamp when the stream ended (Unix), null if still active',
+              example: null,
+            },
             createdAt: {
               type: 'string',
               format: 'date-time',
@@ -189,7 +223,7 @@ See [Sandbox Mode Documentation](../docs/SANDBOX_MODE.md) for details.`,
             },
             eventType: {
               type: 'string',
-              enum: ['CREATED', 'TOPPED_UP', 'WITHDRAWN', 'CANCELLED', 'COMPLETED'],
+              enum: ['CREATED', 'TOPPED_UP', 'WITHDRAWN', 'CANCELLED', 'COMPLETED', 'PAUSED', 'RESUMED', 'FEE_COLLECTED'],
               description: 'Type of stream event',
               example: 'TOPPED_UP',
             },

backend/src/controllers/sse.controller.ts

@@ -7,6 +7,7 @@ import { z } from 'zod';
 
 const subscribeSchema = z.object({
   streams: z.array(z.string()).optional().default([]),
+  users: z.array(z.string()).optional().default([]),
   all: z.boolean().optional().default(false),
 });
 
@@ -41,30 +42,38 @@ export const subscribe = async (req: Request, res: Response) => {
     }
 
     const { publicKey } = (req as AuthenticatedRequest).user;
-    const { streams, all } = subscribeSchema.parse(req.query);
+    const { streams, users, all } = subscribeSchema.parse(req.query);
 
     // Scope: only streams where the authenticated user is sender or recipient
     const ownedStreams = await prisma.stream.findMany({
       where: { OR: [{ sender: publicKey }, { recipient: publicKey }] },
-      select: { streamId: true },
+      select: { streamId: true, sender: true, recipient: true },
     });
-    const ownedIds = new Set(ownedStreams.map((s: any) => String(s.streamId)));
+    const ownedIds = new Set(ownedStreams.map((s: { streamId: number }) => String(s.streamId)));
+    const allowedUserKeys = new Set<string>([publicKey]);
+    for (const stream of ownedStreams) {
+      allowedUserKeys.add(stream.sender);
+      allowedUserKeys.add(stream.recipient);
+    }
 
     let subscriptions: string[];
     if (all) {
       // "all" still scoped to the user's own streams
-      subscriptions = [...ownedIds] as string[];
+      subscriptions = [...ownedIds];
     } else if (streams.length > 0) {
       // Only allow subscribing to streams the user owns
       subscriptions = streams.filter((id) => ownedIds.has(id));
     } else {
-      subscriptions = [...ownedIds] as string[];
+      subscriptions = [...ownedIds];
     }
 
-    // Always add user-scoped subscription key
-    subscriptions.push(`user:${publicKey}`);
+    const userSubscriptions = new Set<string>([`user:${publicKey}`]);
+    for (const key of users.filter((k) => allowedUserKeys.has(k))) {
+      userSubscriptions.add(`user:${key}`);
+    }
+    subscriptions.push(...userSubscriptions);
 
-    const clientId = `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+    const clientId = `${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
 
     res.writeHead(200, {
       'Content-Type': 'text/event-stream',
@@ -77,11 +86,12 @@ export const subscribe = async (req: Request, res: Response) => {
     res.write(`data: ${JSON.stringify({ type: 'connected', clientId, requestId })}\n\n`);
 
     sseService.addClient(clientId, res, subscriptions, sourceIp);
-  } catch (error: any) {
-    if (error.name === 'ZodError') {
+    return;
+  } catch (error: unknown) {
+    if (error instanceof z.ZodError) {
       return res.status(400).json({
         message: 'Invalid subscription parameters',
-        errors: error.errors,
+        errors: error.issues,
       });
     }
     return res.status(500).json({ message: 'Internal server error' });