Merge branch 'main' into docs/backend-env-example-completeness

Author: ogazboiz

backend/prisma/schema.prisma

@@ -87,5 +87,4 @@ model StreamEvent {
   @@index([transactionHash])
   @@index([createdAt])
   @@index([streamId, timestamp])
-  @@unique([transactionHash, eventType])
 }

backend/src/lib/indexer-state.ts

@@ -1,15 +1,10 @@
 import { prisma } from './prisma.js';
+import type { IndexerState } from '../generated/prisma/index.js';
 import logger from '../logger.js';
 
 export const INDEXER_STATE_ID = 'singleton';
 
-export interface IndexerStateRow {
-  id: string;
-  lastLedger: number;
-  lastCursor: string | null;
-  createdAt: Date;
-  updatedAt: Date;
-}
+export type IndexerStateRow = IndexerState;
 
 /**
  * Ensure the singleton indexer_state row exists.

backend/src/middleware/admin-rate-limiter.middleware.ts

@@ -15,7 +15,7 @@ export const adminRateLimiter = rateLimit({
     // Use x-forwarded-for or remote address as key
     const forwarded = req.headers['x-forwarded-for'];
     if (typeof forwarded === 'string') {
-      return forwarded.split(',')[0].trim();
+      return forwarded.split(',')[0]?.trim() ?? 'unknown';
     }
     return req.ip ?? 'unknown';
   },

backend/src/middleware/auth.ts

@@ -31,6 +31,9 @@ if (isProduction) {
 
 const JWT_EXPIRY_SECONDS = 3600; // 1 hour max per spec
 
+const JWT_ISSUER = process.env.JWT_ISSUER || 'flowfi-api';
+const JWT_AUDIENCE = process.env.JWT_AUDIENCE || 'flowfi-api';
+
 const STELLAR_NETWORK =
   process.env.STELLAR_NETWORK === 'mainnet'
     ? StellarSdk.Networks.PUBLIC
@@ -130,6 +133,11 @@ export function verifyJwt(token: string): { publicKey: string } | null {
       return null;
     }
 
+    // Verify issuer and audience
+    if (payload.iss !== JWT_ISSUER || payload.aud !== JWT_AUDIENCE) {
+      return null;
+    }
+
     return { publicKey: payload.sub };
   } catch {
     return null;
@@ -205,7 +213,7 @@ export function verifyChallenge(req: Request, res: Response): void {
     challenges.delete(publicKey);
 
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: publicKey, iat: now, exp: now + JWT_EXPIRY_SECONDS });
+    const token = signJwt({ sub: publicKey, iat: now, exp: now + JWT_EXPIRY_SECONDS, iss: JWT_ISSUER, aud: JWT_AUDIENCE });
     res.json({ token, expiresIn: JWT_EXPIRY_SECONDS });
   } catch (err) {
     logger.error('[Auth] verifyChallenge error:', err);

backend/src/routes/health.routes.ts

@@ -1,6 +1,8 @@
 import { Router, type Request, type Response } from 'express';
 import { prisma } from '../lib/prisma.js';
 import { INDEXER_STATE_ID } from '../lib/indexer-state.js';
+import { isRedisAvailable } from '../lib/redis.js';
+import { checkRpcHealth } from '../services/sorobanService.js';
 import { sorobanEventWorker } from '../workers/soroban-event-worker.js';
 
 const router = Router();
@@ -161,7 +163,7 @@ router.get('/', async (_req: Request, res: Response) => {
         status: dbStatus === 'connected' ? 'ok' : 'down',
       },
       indexer: {
-        status: !indexerEnabled ? 'disabled' : indexerDegraded ? 'degraded' : 'ok',
+        status: !indexerEnabled ? 'disabled' : indexerFailureDegraded ? 'degraded' : 'ok',
         enabled: indexerEnabled,
         lagSeconds: indexerLag === -1 ? null : indexerLag,
       },

backend/src/services/soroban-indexer.service.ts

@@ -184,9 +184,8 @@ export class SorobanIndexerService {
       const tokenAddress = this.readString(value, 'token_address', 'tokenAddress');
       const ratePerSecond = this.readString(value, 'rate_per_second', 'ratePerSecond');
       const depositedAmount = this.readString(value, 'deposited_amount', 'depositedAmount');
-      const startTimeRaw = value.start_time ?? value.startTime ?? timestamp;
-      const startTime = BigInt(startTimeRaw ?? timestamp);
-      const timestampBigInt = BigInt(timestamp);
+      const startTimeStr = this.readString(value, 'start_time', 'startTime') ?? String(timestamp);
+      const startTime = BigInt(startTimeStr);
 
       if (!sender || !recipient || !tokenAddress || !ratePerSecond || !depositedAmount) return;
 

backend/src/types/auth.types.ts

@@ -30,4 +30,6 @@ export interface SEP10TokenPayload {
   sub: string; // Stellar public key
   iat: number; // Issued at
   exp: number; // Expiration
+  iss: string; // Issuer
+  aud: string; // Audience
 }

backend/src/workers/soroban-event-worker.ts

@@ -1,9 +1,8 @@
-import { randomUUID } from "crypto";
 import { rpc, xdr, StrKey } from "@stellar/stellar-sdk";
 import { prisma } from "../lib/prisma.js";
 import { INDEXER_STATE_ID, ensureIndexerState } from "../lib/indexer-state.js";
 import { sseService } from "../services/sse.service.js";
-import logger, { requestContext } from "../logger.js";
+import logger from "../logger.js";
 import { Prisma } from "../generated/prisma/index.js";
 import "../lib/stream-id.js";
 
@@ -113,13 +112,6 @@ export class SorobanEventWorker {
   /** Recent attempt outcomes for sliding-window spike detection. */
   private recentOutcomes: { ok: boolean; at: number }[] = [];
 
-  /**
-   * Stable id attached to every log line emitted by the background poll
-   * loop, since these callbacks fire outside of any HTTP request and would
-   * otherwise have no requestContext (and thus no correlation id) at all.
-   */
-  private readonly workerId = `soroban-worker:${randomUUID()}`;
-
   constructor() {
     const rpcUrl =
       process.env.SOROBAN_RPC_URL ?? "https://soroban-testnet.stellar.org";
@@ -1125,11 +1117,9 @@ export class SorobanEventWorker {
         select: { pausedAt: true, totalPausedDuration: true },
       });
 
-      // Calculate the duration of this pause interval
-      let additionalPausedDuration = 0;
-      if (currentStream.pausedAt) {
-        additionalPausedDuration = timestamp - currentStream.pausedAt;
-      }
+      const additionalPausedDuration = currentStream.pausedAt
+        ? timestamp - Number(currentStream.pausedAt)
+        : 0;
 
       const newTotalPausedDuration =
         currentStream.totalPausedDuration + additionalPausedDuration;

backend/tests/auth-jwt.test.ts

@@ -16,14 +16,14 @@ describe('JWT helpers', () => {
 
   it('round-trips through verifyJwt', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
 
     expect(verifyJwt(token)).toEqual({ publicKey: 'GTESTPUBLICKEY123' });
   });
 
   it('returns null for a tampered header', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
     const parts = token.split('.') as [string, string, string];
     parts[0] = parts[0].slice(0, -1) + (parts[0].slice(-1) === 'A' ? 'B' : 'A');
 
@@ -32,7 +32,7 @@ describe('JWT helpers', () => {
 
   it('returns null for a tampered body', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
     const parts = token.split('.') as [string, string, string];
     parts[1] = parts[1].slice(0, -1) + (parts[1].slice(-1) === 'A' ? 'B' : 'A');
 
@@ -41,7 +41,7 @@ describe('JWT helpers', () => {
 
   it('returns null for a tampered signature', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
     const parts = token.split('.') as [string, string, string];
     // Replace the signature with invalid data to ensure verification fails
     parts[2] = 'invalid-signature-data-1234567890abcdef';
@@ -51,7 +51,21 @@ describe('JWT helpers', () => {
 
   it('returns null for an expired token', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now - 3600, exp: now - 1 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now - 3600, exp: now - 1, iss: 'flowfi-api', aud: 'flowfi-api' });
+
+    expect(verifyJwt(token)).toBeNull();
+  });
+
+  it('returns null for a token with wrong audience', async () => {
+    const now = Math.floor(Date.now() / 1000);
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'wrong-audience' });
+
+    expect(verifyJwt(token)).toBeNull();
+  });
+
+  it('returns null for a token with wrong issuer', async () => {
+    const now = Math.floor(Date.now() / 1000);
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'wrong-issuer', aud: 'flowfi-api' });
 
     expect(verifyJwt(token)).toBeNull();
   });

backend/tests/auth.test.ts

@@ -307,9 +307,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_admin_middleware_rejects_non_admin_token', async () => {
       const nonAdminKeypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: nonAdminKeypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       // Set admin key to something else
@@ -326,9 +330,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_admin_middleware_accepts_admin_token', async () => {
       const adminKeypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: adminKeypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       process.env.ADMIN_PUBLIC_KEY = adminKeypair.publicKey();
@@ -343,9 +351,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_admin_middleware_fails_closed_when_key_unset', async () => {
       const keypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: keypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       // Unset the admin key
@@ -371,9 +383,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_events_endpoint_allows_authenticated_matching_address', async () => {
       const keypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: keypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       const res = await request(app)
@@ -388,9 +404,13 @@ describe('Authentication & Middleware Tests', () => {
     it('test_events_endpoint_rejects_authenticated_mismatched_address', async () => {
       const keypair = makeKeypair();
       const otherKeypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: keypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       const res = await request(app)