fix(security): GET /reputation/me unreachable due to route order and missing JwtAuthGuard

[Josue19-08]

🔖 Title

Fix `GET /reputation/me` — unreachable route and missing auth guard

---

📄 Description

`GET /reputation/me` in `reputation.controller.ts` is permanently unreachable and would not work even if it were reachable. Two distinct bugs:

Bug 1 — Route ordering: `@Get(':wallet')` is declared before `@Get('me')`. NestJS/Fastify matches routes in declaration order, so `/reputation/me` is captured by the `:wallet` handler first. The wallet param regex rejects the string `"me"` and returns a 400 — the `/me` endpoint is dead code that can never execute.

Bug 2 — Missing auth guard: `GET /reputation/me` has no `@UseGuards(JwtAuthGuard)` decorator. The handler reads `req.user?.wallet` directly; without Passport processing the request, `req.user` is always `undefined`, causing the endpoint to throw `UnauthorizedException` for every call — even if the routing bug were fixed.

---

✅ Tasks to complete

• Move `@Get('me')` above `@Get(':wallet')` in `reputation.controller.ts`
• Add `@UseGuards(JwtAuthGuard)` to `GET /reputation/me`
• Replace raw `@Request() req` with `@CurrentUser() user` decorator (already exists in `src/common/decorators/`)
• Ensure `JwtModule` and `PassportModule` are imported in `reputation.module.ts`
• Add unit tests in `reputation.controller.spec.ts` covering: authenticated call returns score, unauthenticated call returns 401, route precedence (me is not matched by :wallet)
• Add E2E test `test/e2e/modules/reputation/reputation.e2e-spec.ts`: valid JWT → 200 with score; no token → 401

---

📚 Documentation/context for AI

(This link never should removed)
https://github.com/TrustUp-app/TrustUp-API/tree/main/docs

Relevant files:

• `src/modules/reputation/reputation.controller.ts`
• `src/modules/reputation/reputation.module.ts`
• `src/common/decorators/current-user.decorator.ts`
• `src/modules/auth/guards/jwt-auth.guard.ts`

---

🗒️ Additional notes

• Follow the same auth pattern as `GET /users/me` (`users.controller.ts`) — it correctly uses `@UseGuards(JwtAuthGuard)` + `@CurrentUser()`
• The `:wallet` route should remain below `/me` in the final file
• This is a security issue: the `/me` endpoint currently exposes unintended behavior (always 400 or always 401 depending on call path)

[Achievers-sketch]

I’d like to fix the route ordering, secure the endpoint with JWT authentication, use @currentuser, and add comprehensive tests.

[BrayanMQ]

Hi! I’d be happy to work on this issue. I have experience contributing to collaborative projects and have also acted as a maintainer, which has given me strong skills in understanding requirements, managing issues, and delivering reliable, well-scoped solutions.

I’m a Computer Science Engineer and full-stack developer with solid experience implementing solutions across both backend and frontend, including designing and integrating APIs. I mainly work with React, TypeScript, Node.js, and C#, and I enjoy building scalable features and collaborating closely with other contributors to deliver high-quality results.

[grantfox-oss]

🦊 GrantFox — @BrayanMQ has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #115)
2. Your PR will be reviewed by the TrustUp-app maintainers

Good luck! Track your progress on GrantFox.