Merge branch 'main' into fix/json-body-limit-and-jwt-exp-validation

Author: Litezy

.github/dependabot.yml

@@ -2,6 +2,12 @@ version: 2
 
 updates:
   # ── npm: root workspace ────────────────────────────────────────────────────
+  # flowfi is a single npm workspace (frontend + backend hoisted into one root
+  # package-lock.json). Dependabot must update from the workspace root so the
+  # root lockfile CI runs `npm ci` against stays in sync. Per-directory entries
+  # for /frontend and /backend only touched their package.json without updating
+  # the root lockfile, so every PR they opened failed `npm ci` with
+  # "lock file's X does not satisfy Y". One root entry covers all workspaces.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -14,32 +20,6 @@ updates:
           - "minor"
           - "patch"
 
-  # ── npm: frontend ──────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/frontend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
-  # ── npm: backend ───────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/backend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
   # ── Cargo: contracts ───────────────────────────────────────────────────────
   - package-ecosystem: "cargo"
     directory: "/contracts"

.github/workflows/ci.yml

@@ -42,17 +42,6 @@ jobs:
         run: npm run test:coverage
         working-directory: frontend
 
-      - name: Upload frontend coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          files: frontend/coverage/lcov.info
-          flags: frontend
-          name: frontend-coverage
-          fail_ci_if_error: false
-          verbose: true
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
       - name: Build
         run: npm run build
         working-directory: frontend

backend/.env.example

@@ -1,6 +1,16 @@
 # Database
 DATABASE_URL="postgresql://user:password@localhost:5433/flowfi?schema=public"
 
+# PostgreSQL pool settings
+# Maximum database connections per backend process (default: 10)
+PG_POOL_MAX=10
+# How long an idle connection stays open before being closed (milliseconds, default: 30000)
+PG_IDLE_TIMEOUT_MS=30000
+# How long to wait when establishing a new database connection (milliseconds, default: 5000)
+PG_CONNECTION_TIMEOUT_MS=5000
+# Maximum time a PostgreSQL statement may run before cancellation (milliseconds, default: 30000)
+PG_STATEMENT_TIMEOUT_MS=30000
+
 # Server
 PORT=3001
 NODE_ENV=development

backend/Dockerfile

@@ -21,7 +21,13 @@ COPY package*.json ./
 RUN npm install --omit=dev
 
 COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/src/generated ./src/generated
+COPY --from=builder /app/src/generated ./dist/generated
+COPY --from=builder /app/prisma ./prisma
+# Prisma 7 reads the schema location and datasource url from prisma.config.ts,
+# and the schema's `datasource db {}` block has no inline url. The CI health
+# check runs `prisma db push` inside this image, so the config must be present
+# too (dotenv is a runtime dependency, so the config loads).
+COPY prisma.config.ts ./
 
 EXPOSE 3001
 

backend/docs/DEPRECATION_POLICY.md

@@ -148,9 +148,10 @@ X-API-Migration-Path: /v1/streams
 - `/streams` → `/v1/streams`
 - `/events` → `/v1/events`
 
-**Status:** Deprecated (as of 2024-02-21)
+**Status:** Removed (deprecated 2024-02-21, sunset 2024-12-31, handlers deleted 2026-06-30)
 
-**Sunset Date:** 2024-12-31
+These routes no longer exist in the codebase. Clients still calling the unversioned
+paths will receive a 404. Update all callers to use the `/v1/` prefix.
 
 **Migration:**
 ```javascript

backend/package.json

@@ -32,7 +32,6 @@
     "express-rate-limit": "^8.5.2",
     "ioredis": "^5.11.1",
     "pg": "^8.21.0",
-    "stellar-sdk": "^13.3.0",
     "swagger-jsdoc": "^6.3.0",
     "swagger-ui-express": "^5.0.1",
     "winston": "^3.11.0",

backend/prisma/migrations/20260630000000_add_stream_token_address_index/migration.sql

@@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Stream_tokenAddress_idx" ON "Stream"("tokenAddress");

backend/prisma/schema.prisma

@@ -51,6 +51,7 @@ model Stream {
 
   @@index([sender])
   @@index([recipient])
+  @@index([tokenAddress])
   @@index([streamId])
   @@index([isActive])
   @@index([isPaused])

backend/prisma/seed.ts

@@ -1,9 +1,8 @@
-import pg from 'pg';
 import { PrismaPg } from '@prisma/adapter-pg';
 import { PrismaClient } from '../src/generated/prisma/index.js';
+import { createPgPool } from '../src/lib/pg-pool.js';
 
-const connectionString = process.env.DATABASE_URL;
-const pool = new pg.Pool({ connectionString });
+const pool = createPgPool();
 const adapter = new PrismaPg(pool);
 const prisma = new PrismaClient({ adapter });
 

backend/src/app.ts

@@ -32,14 +32,18 @@ app.use(requestIdMiddleware);
 app.disable('x-powered-by');
 
 // Helmet-equivalent core headers without external dependency.
+// Strict CSP applied globally; the /api-docs route overrides it below for Swagger UI.
 app.use((req: Request, res: Response, next: NextFunction) => {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('X-Frame-Options', 'DENY');
     res.setHeader('Referrer-Policy', 'no-referrer');
     res.setHeader('X-DNS-Prefetch-Control', 'off');
     res.setHeader('X-Download-Options', 'noopen');
     res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');
-    if (isProduction) {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
+    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+    if (process.env.NODE_ENV === 'production') {
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }
     next();
@@ -78,7 +82,11 @@ app.use(express.json({ limit: '1mb' }));
 app.use(sandboxMiddleware);
 
 // Swagger UI setup
-app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
+// Override CSP for /api-docs only: Swagger UI requires inline scripts/styles.
+app.use('/api-docs', (req: Request, res: Response, next: NextFunction) => {
+    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
+    next();
+}, swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
     customCss: '.swagger-ui .topbar { display: none }',
     customSiteTitle: 'FlowFi API Documentation',
 }));
@@ -105,35 +113,6 @@ app.use((req: Request, res: Response, next: NextFunction) => {
     return next(); // Not versioned, continue to deprecated handlers
 });
 
-// Legacy routes (deprecated - redirect to v1)
-// These will be removed in a future version
-// Only match unversioned requests
-app.use('/streams', (req: Request, res: Response, next) => {
-    res.status(410).json({
-        error: 'Deprecated endpoint',
-        message: 'This endpoint has been deprecated. Please use /v1/streams instead.',
-        deprecated: true,
-        migration: {
-            old: '/streams',
-            new: '/v1/streams',
-        },
-        sunsetDate: '2024-12-31',
-    });
-});
-
-app.use('/events', (req: Request, res: Response, next) => {
-    res.status(410).json({
-        error: 'Deprecated endpoint',
-        message: 'This endpoint has been deprecated. Please use /v1/events instead.',
-        deprecated: true,
-        migration: {
-            old: '/events',
-            new: '/v1/events',
-        },
-        sunsetDate: '2024-12-31',
-    });
-});
-
 // Health check routes
 app.use('/health', healthRoutes);