Release: audit remediation + Workstream A access system

.env.example

@@ -87,8 +87,35 @@ API_HMAC_PEPPER=
 # Closed-beta allowlist — comma-separated Stellar G... addresses permitted to
 # mint API keys via /v1/keys. Unset = key issuance open to anyone (dev only).
 # REQUIRED in production: the API refuses to boot when this is unset/empty.
+# Workstream A transition: wallets APPROVED in access_grants pass the gate
+# too (union) — this env var retires once the DB migration is verified.
 API_KEY_ALLOWLIST=
 
+# ── Workstream A access system (waitlist + admin approvals) ──
+
+# Cloudflare Turnstile SERVER secret for POST /v1/waitlist. Unset = the join
+# endpoint answers 503 (fail loud, never silently bot-open). Cloudflare's
+# always-pass test secret for local dev: 1x0000000000000000000000000000000AA
+TURNSTILE_SECRET=
+
+# Azure Communication Services — approval notification email. Both unset =
+# approvals simply never email (admin panel shows unsent; resend later).
+# Connection string: az communication list-key; sender: the MailFrom address
+# of the provisioned email domain (DoNotReply@<id>.azurecomm.net for the
+# Azure-managed domain).
+ACS_CONNECTION_STRING=
+ACS_SENDER=
+
+# Wallets allowed into /v1/admin/* (comma-separated G... addresses — the
+# founders' PERSONAL wallets, never the contract admin key). Empty = every
+# admin route fails closed with 403.
+ADMIN_WALLETS=
+
+# Cloudflare Turnstile SITE key, inlined into the web build for the waitlist
+# widget on /audit. Dev fallback (unset outside production) is Cloudflare's
+# always-pass test sitekey.
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=
+
 # CORS — comma-separated origins, or "*" for dev.
 # REQUIRED in production: the API refuses to boot with the "*" wildcard;
 # set the real frontend origin(s), e.g. https://noether.exchange

api/package.json

@@ -15,6 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
+    "@azure/communication-email": "^1.1.0",
     "@fastify/cors": "^10.0.1",
     "@fastify/swagger": "^9.4.0",
     "@fastify/swagger-ui": "^5.2.0",

api/src/config.ts

@@ -24,6 +24,25 @@ export interface ApiConfig {
    * requirement.
    */
   keeperHeartbeatSecret?: string;
+  /**
+   * Cloudflare Turnstile server secret for POST /v1/waitlist. Optional:
+   * unset makes the join endpoint 503 (fail loud, never silently
+   * bot-open). Cloudflare's always-pass test secret works for dev.
+   */
+  turnstileSecret?: string;
+  /**
+   * Azure Communication Services connection string + verified sender for
+   * the approval email. Optional: unset means approvals simply never
+   * email (email_sent_at stays null; admin can resend later).
+   */
+  acsConnectionString?: string;
+  acsSender?: string;
+  /**
+   * Wallets allowed into the /v1/admin/* surface (comma-separated env
+   * ADMIN_WALLETS — the founders' PERSONAL wallets, never the contract
+   * admin key). Empty = every admin route fails closed with 403.
+   */
+  adminWallets: string[];
 }
 
 /** WebSocket abuse controls (audit A-5). All overridable via env. */
@@ -76,6 +95,13 @@ export function loadConfig(): ApiConfig {
     sourceAccount: process.env.API_SOURCE_ACCOUNT ?? contracts.admin,
     databaseUrl,
     keeperHeartbeatSecret: process.env.KEEPER_HEARTBEAT_SECRET || undefined,
+    turnstileSecret: process.env.TURNSTILE_SECRET || undefined,
+    acsConnectionString: process.env.ACS_CONNECTION_STRING || undefined,
+    acsSender: process.env.ACS_SENDER || undefined,
+    adminWallets: (process.env.ADMIN_WALLETS ?? '')
+      .split(',')
+      .map((s) => s.trim())
+      .filter((s) => s.length === 56 && s.startsWith('G')),
     contracts,
     ws: {
       maxConnections: Number(process.env.WS_MAX_CONNECTIONS ?? 1000),

api/src/plugins/rateLimit.ts

@@ -47,7 +47,29 @@ async function rateLimitPluginImpl(app: FastifyInstance, opts: RateLimitPluginOp
       reply.header('Retry-After', String(decision.retryAfterSec));
       return reply.code(429).send({ error: 'rate_limited', retry_after_sec: decision.retryAfterSec });
     }
+
+    // Workstream A: the public waitlist join gets a much tighter per-IP
+    // budget than the generic 60/min — a signup is a once-per-human action,
+    // and each join costs a Turnstile verification round-trip.
+    if (
+      request.method === 'POST' &&
+      request.url.startsWith('/v1/waitlist') &&
+      !request.user
+    ) {
+      const join = await opts.limiter.checkAndConsume(
+        `join:ip:${request.ip}`,
+        'public',
+        WAITLIST_JOIN_PER_MINUTE,
+      );
+      if (!join.allowed) {
+        reply.header('Retry-After', String(join.retryAfterSec));
+        return reply.code(429).send({ error: 'rate_limited', retry_after_sec: join.retryAfterSec });
+      }
+    }
   });
 }
 
+/** Per-IP joins per minute — far below the public tier's 60. */
+const WAITLIST_JOIN_PER_MINUTE = 5;
+
 export const rateLimitPlugin = fp(rateLimitPluginImpl, { name: 'noether-rate-limit' });