Merge branch 'main' of https://github.com/Samuel1505/flowfi into four

# Conflicts:
#	backend/src/controllers/sse.controller.ts
#	docs/ARCHITECTURE.md
#	docs/DEVELOPMENT.md
#	frontend/src/components/dashboard/dashboard-view.tsx
#	frontend/src/components/ui/Skeleton.tsx
#	package-lock.json

Author: Samuel1505

.github/workflows/ci.yml

@@ -31,6 +31,14 @@ jobs:
         run: npm run lint
         working-directory: frontend
 
+      - name: Install Rollup Native Binding
+        run: npm install @rollup/rollup-linux-x64-gnu --no-save
+        working-directory: frontend
+
+      - name: Run Frontend Tests
+        run: npm test
+        working-directory: frontend
+
       - name: Build
         run: npm run build
         working-directory: frontend
@@ -116,3 +124,30 @@ jobs:
       - name: Run Contract Tests
         run: cargo test
         working-directory: contracts
+
+      - name: Install Stellar CLI
+        run: |
+          curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh -s -- --install-deps
+        shell: bash
+
+      - name: Optimize WASM files
+        run: |
+          set -euo pipefail
+          WASMS=$(find contracts/target -type f -name "*.wasm" -print)
+          if [ -z "$WASMS" ]; then
+            echo "No wasm files found"
+            exit 1
+          fi
+          for w in $WASMS; do
+            out="${w%%.wasm}.optimized.wasm"
+            echo "Optimizing $w -> $out"
+            stellar contract optimize --wasm "$w" --wasm-out "$out"
+          done
+        shell: bash
+
+      - name: Upload optimized WASM artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: optimized-wasm
+          path: |
+            contracts/target/**/**/*.optimized.wasm

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "kiroAgent.configureMCP": "Disabled"
+}

README.md

@@ -37,6 +37,8 @@ FlowFi consists of three main components that work together:
 
 For a detailed explanation of how these components interact, where event indexing happens, and the overall system architecture, see the [Architecture Documentation](docs/ARCHITECTURE.md).
 
+For full local setup and contributor onboarding, see the [Development Guide](docs/DEVELOPMENT.md).
+
 ## Getting Started
 
 For full step-by-step instructions, see our [Development Guide](docs/DEVELOPMENT.md).
@@ -180,6 +182,8 @@ Contributions are welcome! Please see our [Contributing Guide](CONTRIBUTING.md)
 - Pull request process
 - Development scripts and CI workflows
 
+Before your first change, run through the [Development Guide](docs/DEVELOPMENT.md) and review [Architecture Documentation](docs/ARCHITECTURE.md).
+
 For architecture details, see [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
 
 ## Security

backend/.env.example

@@ -5,6 +5,8 @@ DATABASE_URL="postgresql://user:password@localhost:5432/flowfi?schema=public"
 PORT=3001
 NODE_ENV=development
 CORS_ALLOWED_ORIGINS="https://app.flowfi.xyz,https://flowfi.xyz"
+# Comma-separated list of allowed origins for CORS. In development, if unset,
+# defaults to http://localhost:3000
 
 # Stellar Network (Testnet/Mainnet)
 STELLAR_NETWORK=testnet

backend/src/app.ts

@@ -7,13 +7,21 @@ import { sandboxMiddleware } from './middleware/sandbox.middleware.js';
 import { globalRateLimiter } from './middleware/rate-limiter.middleware.js';
 import v1Routes from './routes/v1/index.js';
 
+import healthRoutes from './routes/health.routes.js';
+
 const app = express();
 const isProduction = process.env.NODE_ENV === 'production';
-const allowedOrigins = (process.env.CORS_ALLOWED_ORIGINS ?? '')
+const rawCors = process.env.CORS_ALLOWED_ORIGINS ?? '';
+const allowedOrigins = rawCors
     .split(',')
     .map((origin) => origin.trim())
     .filter(Boolean);
 
+// Default in development to only localhost:3000 (frontend dev server)
+if (!process.env.CORS_ALLOWED_ORIGINS && !isProduction) {
+    allowedOrigins.push('http://localhost:3000');
+}
+
 // Apply global rate limiter first
 app.use(globalRateLimiter);
 
@@ -35,11 +43,6 @@ app.use((req: Request, res: Response, next: NextFunction) => {
 
 app.use(cors({
     origin(origin, callback) {
-        if (!isProduction) {
-            callback(null, true);
-            return;
-        }
-
         // Allow non-browser clients (no Origin header)
         if (!origin) {
             callback(null, true);
@@ -51,10 +54,20 @@ app.use(cors({
             return;
         }
 
+        // Not allowed
         callback(new Error('CORS origin not allowed'));
     },
     credentials: true,
 }));
+
+// Convert CORS errors into 403 responses so callers get a clear status code
+app.use((err: any, req: Request, res: Response, next: NextFunction) => {
+    if (err && err.message === 'CORS origin not allowed') {
+        res.status(403).json({ error: 'CORS origin not allowed' });
+        return;
+    }
+    next(err);
+});
 app.use(express.json());
 
 // Sandbox mode detection (before versioning)
@@ -117,117 +130,25 @@ app.use('/events', (req: Request, res: Response, next) => {
     });
 });
 
+// Health check routes
+app.use('/health', healthRoutes);
+
 /**
  * @openapi
  * /:
  *   get:
  *     tags:
  *       - Health
- *     summary: Health check endpoint
+ *     summary: Simple health check
  *     description: Returns a simple message to verify the API is running
  *     responses:
  *       200:
  *         description: API is running successfully
- *         content:
- *           text/plain:
- *             schema:
- *               type: string
- *               example: FlowFi Backend is running
  */
 app.get('/', (req: Request, res: Response) => {
     res.send('FlowFi Backend is running');
 });
 
-/**
- * @openapi
- * /health:
- *   get:
- *     tags:
- *       - Health
- *     summary: Detailed health check
- *     description: Returns detailed health information about the API
- *     responses:
- *       200:
- *         description: Health check details
- *         content:
- *           application/json:
- *             schema:
- *               type: object
- *               properties:
- *                 status:
- *                   type: string
- *                   example: healthy
- *                 timestamp:
- *                   type: string
- *                   format: date-time
- *                   example: 2024-02-21T14:30:00.000Z
- *                 uptime:
- *                   type: number
- *                   description: Server uptime in seconds
- *                   example: 3600
- *                 version:
- *                   type: string
- *                   example: 1.0.0
- *                 apiVersions:
- *                   type: object
- *                   properties:
- *                     supported:
- *                       type: array
- *                       items:
- *                         type: string
- *                       example: ["v1"]
- *                     default:
- *                       type: string
- *                       example: "v1"
- */
-app.get('/health', async (req: Request, res: Response) => {
-    const { getSandboxConfig } = await import('./config/sandbox.js');
-    const { prisma } = await import('./lib/prisma.js');
-    const sandboxConfig = getSandboxConfig();
-
-    let dbStatus = 'healthy';
-    try {
-        await prisma.$queryRaw`SELECT 1`;
-    } catch {
-        dbStatus = 'unhealthy';
-    }
-
-    let indexerStatus = 'unknown';
-    let indexerLastLedger: number | null = null;
-    try {
-        const state = await prisma.indexerState.findUnique({ where: { id: 'singleton' } });
-        if (state) {
-            indexerLastLedger = state.lastLedger;
-            indexerStatus = 'running';
-        } else {
-            indexerStatus = 'not_started';
-        }
-    } catch {
-        indexerStatus = 'error';
-    }
-
-    const status = dbStatus === 'healthy' ? 'healthy' : 'unhealthy';
-    res.status(status === 'healthy' ? 200 : 503).json({
-        status,
-        db: dbStatus,
-        indexer: { status: indexerStatus, lastLedger: indexerLastLedger },
-        uptime: process.uptime(),
-        timestamp: new Date().toISOString(),
-        version: '1.0.0',
-        apiVersions: {
-            supported: ['v1'],
-            default: 'v1',
-        },
-        services: {
-            database: dbStatus,
-        },
-        sandbox: {
-            enabled: sandboxConfig.enabled,
-            available: sandboxConfig.enabled,
-        },
-    });
-});
-
 import { errorHandler } from './middleware/error.middleware.js';
 
 app.use(errorHandler);

backend/src/controllers/sse.controller.ts

@@ -9,12 +9,36 @@ const subscribeSchema = z.object({
   all: z.boolean().optional().default(false),
 });
 
+
+function getClientIp(req: Request): string {
+  const forwarded = req.headers['x-forwarded-for'];
+  if (typeof forwarded === 'string' && forwarded.trim().length > 0) {
+    return forwarded.split(',')[0]?.trim() || 'unknown';
+  }
+
+  if (Array.isArray(forwarded) && forwarded.length > 0) {
+    return forwarded[0] ?? 'unknown';
+  }
+
+  return req.ip || req.socket.remoteAddress || 'unknown';
+}
 export const subscribe = async (req: Request, res: Response) => {
   if (sseService.isShuttingDown()) {
     return res.status(503).json({ message: 'Server is shutting down, please reconnect shortly.' });
   }
 
   try {
+    const sourceIp = getClientIp(req);
+    const capacity = sseService.checkCapacity(sourceIp);
+    if (!capacity.allowed) {
+      if (capacity.retryAfterSeconds) {
+        res.setHeader('Retry-After', String(capacity.retryAfterSeconds));
+      }
+      return res.status(capacity.status ?? 503).json({
+        message: capacity.message ?? 'SSE connection rejected',
+      });
+    }
+
     const { publicKey } = (req as AuthenticatedRequest).user;
     const { streams, all } = subscribeSchema.parse(req.query);
 
@@ -23,17 +47,17 @@ export const subscribe = async (req: Request, res: Response) => {
       where: { OR: [{ sender: publicKey }, { recipient: publicKey }] },
       select: { streamId: true },
     });
-    const ownedIds = new Set(ownedStreams.map((s) => String(s.streamId)));
+    const ownedIds = new Set(ownedStreams.map((s: any) => String(s.streamId)));
 
     let subscriptions: string[];
     if (all) {
       // "all" still scoped to the user's own streams
-      subscriptions = [...ownedIds];
+      subscriptions = [...ownedIds] as string[];
     } else if (streams.length > 0) {
       // Only allow subscribing to streams the user owns
       subscriptions = streams.filter((id) => ownedIds.has(id));
     } else {
-      subscriptions = [...ownedIds];
+      subscriptions = [...ownedIds] as string[];
     }
 
     // Always add user-scoped subscription key
@@ -50,7 +74,7 @@ export const subscribe = async (req: Request, res: Response) => {
 
     res.write(`data: ${JSON.stringify({ type: 'connected', clientId })}\n\n`);
 
-    sseService.addClient(clientId, res, subscriptions);
+    sseService.addClient(clientId, res, subscriptions, sourceIp);
   } catch (error: any) {
     if (error.name === 'ZodError') {
       return res.status(400).json({