Merge branch 'main' into sorobanService_drop

Author: EbukaMoses

README.md

@@ -6,6 +6,8 @@
 
 _Programmable, real-time payment streams and recurring subscriptions._
 
+i just need to create a draft pr
+
 ## Overview
 
 FlowFi allows users to create continuous payment streams and recurring subscriptions using stablecoins on the Stellar network. By leveraging Soroban smart contracts, FlowFi enables autonomous accurate-to-the-second distribution of funds.

backend/.env.example

@@ -33,6 +33,9 @@ INDEXER_POLL_INTERVAL_MS=5000
 # Ledger sequence to start indexing from on first run (0 = latest)
 INDEXER_START_LEDGER=0
 
+# Max stream creation requests per wallet per minute (default: 10)
+STREAM_CREATE_RATE_LIMIT=10
+
 # Server-side Stellar secret key used to sign and submit on-chain transactions
 # (cancel_stream, top_up_stream). Must be funded on the target network.
 KEEPER_SECRET_KEY=

backend/package.json

@@ -23,38 +23,38 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "@prisma/adapter-pg": "^7.4.1",
-    "@stellar/stellar-sdk": "^14.5.0",
+    "@prisma/adapter-pg": "^7.8.0",
+    "@stellar/stellar-sdk": "^15.1.0",
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.2.1",
-    "ioredis": "^5.3.2",
-    "pg": "^8.18.0",
+    "express-rate-limit": "^8.5.2",
+    "ioredis": "^5.11.0",
+    "pg": "^8.21.0",
     "stellar-sdk": "^13.3.0",
-    "swagger-jsdoc": "^6.2.8",
+    "swagger-jsdoc": "^6.3.0",
     "swagger-ui-express": "^5.0.1",
     "winston": "^3.11.0",
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@prisma/client": "^7.4.1",
+    "@prisma/client": "^7.8.0",
     "@types/cors": "^2.8.19",
     "@types/eventsource": "^1.1.15",
     "@types/express": "^5.0.6",
     "@types/node": "^25.2.3",
-    "@types/pg": "^8.16.0",
+    "@types/pg": "^8.20.0",
     "@types/supertest": "^7.2.0",
     "@types/swagger-jsdoc": "^6.0.4",
     "@types/swagger-ui-express": "^4.1.6",
     "@vitest/coverage-v8": "^2.1.8",
     "eventsource": "^2.0.2",
     "nodemon": "^3.1.11",
-    "prisma": "^7.4.1",
-    "rollup": "^4.60.2",
+    "prisma": "^7.8.0",
+    "rollup": "^4.61.0",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2",
-    "tsx": "^4.19.2",
+    "tsx": "^4.22.4",
     "typescript": "^5.9.3",
     "vitest": "^2.1.8"
   }

backend/prisma/seed.ts

@@ -7,23 +7,29 @@ const pool = new pg.Pool({ connectionString });
 const adapter = new PrismaPg(pool);
 const prisma = new PrismaClient({ adapter });
 
+// Use stable, checksum-valid Stellar testnet/demo addresses so seeded rows
+// render correctly in the frontend and resolve against TOKEN_ADDRESSES.
+const DEMO_SENDER_PUBLIC_KEY = 'GCM5WPR4DDR24FSAX5LIEM4J7AI3KOWJYANSXEPKYXCSZOTAYXE75AFN';
+const DEMO_RECIPIENT_PUBLIC_KEY = 'GBJCHUKZMTFSLOMNC7P4TS4VJJBTCYL3XKSOLXAUJSD56C4LHND5TWUC';
+const DEMO_TOKEN_ADDRESS = 'CBIELTK6YBZJU5UP2WWQEUCYKLPU6AUNZ2BQ4WWFEIE3USCIHMXQDAMA';
+
 async function main() {
     console.log('Seeding database...');
 
     // Create example users
     const user1 = await prisma.user.upsert({
-        where: { publicKey: 'GBRPYH6QC6WGLH473XI3CL4B3I754SFSULN5K3X7G3X4I6SGRH3V3U12' },
+        where: { publicKey: DEMO_SENDER_PUBLIC_KEY },
         update: {},
         create: {
-            publicKey: 'GBRPYH6QC6WGLH473XI3CL4B3I754SFSULN5K3X7G3X4I6SGRH3V3U12',
+            publicKey: DEMO_SENDER_PUBLIC_KEY,
         },
     });
 
     const user2 = await prisma.user.upsert({
-        where: { publicKey: 'GDRS6N3K7DQ6GKH47O6E5K5G7B7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V' },
+        where: { publicKey: DEMO_RECIPIENT_PUBLIC_KEY },
         update: {},
         create: {
-            publicKey: 'GDRS6N3K7DQ6GKH47O6E5K5G7B7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V',
+            publicKey: DEMO_RECIPIENT_PUBLIC_KEY,
         },
     });
 
@@ -37,7 +43,7 @@ async function main() {
             streamId: 101,
             sender: user1.publicKey,
             recipient: user2.publicKey,
-            tokenAddress: 'CBTM5D262F6VQY4A6E4F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0U1V2W3X',
+            tokenAddress: DEMO_TOKEN_ADDRESS,
             ratePerSecond: '100000000', // 10 XLM/sec if decimals=7
             depositedAmount: '1000000000000',
             withdrawnAmount: '0',

backend/src/app.ts

@@ -102,7 +102,7 @@ app.use((req: Request, res: Response, next: NextFunction) => {
         // This was a versioned request, route to v1 handlers
         return v1Routes(req, res, next);
     }
-    next(); // Not versioned, continue to deprecated handlers
+    return next(); // Not versioned, continue to deprecated handlers
 });
 
 // Legacy routes (deprecated - redirect to v1)

backend/src/controllers/sse.controller.ts

@@ -47,27 +47,33 @@ export const subscribe = async (req: Request, res: Response) => {
     // Scope: only streams where the authenticated user is sender or recipient
     const ownedStreams = await prisma.stream.findMany({
       where: { OR: [{ sender: publicKey }, { recipient: publicKey }] },
-      select: { streamId: true },
+      select: { streamId: true, sender: true, recipient: true },
     });
     const ownedIds = new Set(ownedStreams.map((s: { streamId: number }) => String(s.streamId)));
+    const allowedUserKeys = new Set<string>([publicKey]);
+    for (const stream of ownedStreams) {
+      allowedUserKeys.add(stream.sender);
+      allowedUserKeys.add(stream.recipient);
+    }
 
     let subscriptions: string[];
     if (all) {
       // "all" still scoped to the user's own streams
-      subscriptions = [...ownedIds] as string[];
+      subscriptions = [...ownedIds];
     } else if (streams.length > 0) {
       // Only allow subscribing to streams the user owns
       subscriptions = streams.filter((id) => ownedIds.has(id));
     } else {
-      subscriptions = [...ownedIds] as string[];
+      subscriptions = [...ownedIds];
     }
 
-    subscriptions.push(...users.map((userKey) => `user:${userKey}`));
-
-    // Always add user-scoped subscription key
-    subscriptions.push(`user:${publicKey}`);
+    const userSubscriptions = new Set<string>([`user:${publicKey}`]);
+    for (const key of users.filter((k) => allowedUserKeys.has(k))) {
+      userSubscriptions.add(`user:${key}`);
+    }
+    subscriptions.push(...userSubscriptions);
 
-    const clientId = `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+    const clientId = `${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
 
     res.writeHead(200, {
       'Content-Type': 'text/event-stream',
@@ -80,6 +86,7 @@ export const subscribe = async (req: Request, res: Response) => {
     res.write(`data: ${JSON.stringify({ type: 'connected', clientId, requestId })}\n\n`);
 
     sseService.addClient(clientId, res, subscriptions, sourceIp);
+    return;
   } catch (error: unknown) {
     if (error instanceof z.ZodError) {
       return res.status(400).json({

backend/src/controllers/stream.controller.ts

@@ -12,6 +12,10 @@ import {
   resumeStream as sorobanResumeStream,
 } from '../services/sorobanService.js';
 import type { AuthenticatedRequest } from '../types/auth.types.js';
+import { DEFAULT_EVENTS_PAGE_SIZE, MAX_EVENTS_PAGE_SIZE } from '../routes/v1/events.routes.js';
+
+const DEFAULT_STREAM_PAGE_SIZE = 20;
+const MAX_STREAM_PAGE_SIZE = 100;
 
 interface UserStreamSummary {
   address: string;
@@ -170,8 +174,8 @@ export const listStreams = async (req: Request, res: Response) => {
 
     // Validate and parse pagination parameters
     const parsedLimit = Math.min(
-      typeof limit === 'string' ? (Number.parseInt(limit, 10) || 20) : 20,
-      100
+      typeof limit === 'string' ? (Number.parseInt(limit, 10) || DEFAULT_STREAM_PAGE_SIZE) : DEFAULT_STREAM_PAGE_SIZE,
+      MAX_STREAM_PAGE_SIZE
     );
     const parsedOffset = typeof offset === 'string' ? (Number.parseInt(offset, 10) || 0) : 0;
 
@@ -280,13 +284,12 @@ export const getStreamEvents = async (req: Request, res: Response) => {
     const rawOffset = req.query['offset'];
     const rawPage = req.query['page'];
     const cursor = typeof req.query['cursor'] === 'string' ? req.query['cursor'] : undefined;
-    const direction = req.query['direction'] === 'asc' ? 'asc' as const : 'desc' as const;
     const order = req.query['order'] === 'asc' ? 'asc' as const : 'desc' as const;
     const eventType = typeof req.query['eventType'] === 'string' ? req.query['eventType'] : undefined;
 
     const limit = Math.min(
-      rawLimit && typeof rawLimit === 'string' ? (Number.parseInt(rawLimit, 10) || 50) : 50,
-      500,
+      rawLimit && typeof rawLimit === 'string' ? (Number.parseInt(rawLimit, 10) || DEFAULT_EVENTS_PAGE_SIZE) : DEFAULT_EVENTS_PAGE_SIZE,
+      MAX_EVENTS_PAGE_SIZE,
     );
 
     let offset = 0;

backend/src/controllers/user.controller.ts

@@ -3,6 +3,7 @@ import { prisma } from '../lib/prisma.js';
 import logger from '../logger.js';
 import { registerUserSchema } from '../validators/user.validator.js';
 import type { AuthenticatedRequest } from '../types/auth.types.js';
+import { DEFAULT_EVENTS_PAGE_SIZE, MAX_EVENTS_PAGE_SIZE } from '../routes/v1/events.routes.js';
 
 /**
  * Register a new wallet public key
@@ -29,7 +30,7 @@ export const registerUser = async (req: Request, res: Response, next: NextFuncti
         logger.info(`User registered: ${publicKey}`);
         return res.status(201).json(user);
     } catch (error) {
-        next(error);
+        return next(error);
     }
 };
 
@@ -60,7 +61,7 @@ export const getUser = async (req: Request, res: Response, next: NextFunction) =
 
         return res.status(200).json(user);
     } catch (error) {
-        next(error);
+        return next(error);
     }
 };
 
@@ -81,8 +82,8 @@ export const getUserEvents = async (req: Request, res: Response, next: NextFunct
         const rawOffset = req.query['offset'];
 
         const limit = Math.min(
-            rawLimit && typeof rawLimit === 'string' ? (Number.parseInt(rawLimit, 10) || 50) : 50,
-            200
+            rawLimit && typeof rawLimit === 'string' ? (Number.parseInt(rawLimit, 10) || DEFAULT_EVENTS_PAGE_SIZE) : DEFAULT_EVENTS_PAGE_SIZE,
+            MAX_EVENTS_PAGE_SIZE
         );
         const offset = rawOffset && typeof rawOffset === 'string' ? (Number.parseInt(rawOffset, 10) || 0) : 0;
 
@@ -118,7 +119,7 @@ export const getUserEvents = async (req: Request, res: Response, next: NextFunct
             offset
         });
     } catch (error) {
-        next(error);
+        return next(error);
     }
 };
 
@@ -159,6 +160,6 @@ export const getCurrentUser = async (req: Request, res: Response, next: NextFunc
 
         return res.status(200).json(user);
     } catch (error) {
-        next(error);
+        return next(error);
     }
 };

backend/src/lib/prisma-sandbox.ts

@@ -1,32 +1,10 @@
 import { PrismaClient } from '../generated/prisma/index.js';
-import { getSandboxConfig } from '../config/sandbox.js';
-
-/**
- * Sandbox Prisma Client
- * 
- * Uses a separate database connection for sandbox mode to ensure
- * complete isolation from production data.
- */
 
 const globalForSandboxPrisma = globalThis as unknown as {
   sandboxPrisma: PrismaClient | undefined;
 };
 
-/**
- * Get sandbox Prisma client instance
- * 
- * If SANDBOX_DATABASE_URL is set, uses that database.
- * Otherwise, uses the default DATABASE_URL with a sandbox suffix.
- */
 export function getSandboxPrisma(): PrismaClient {
-  const config = getSandboxConfig();
-  
-  // Use sandbox-specific database URL if provided
-  const databaseUrl = config.databaseUrl || 
-    (process.env.DATABASE_URL 
-      ? `${process.env.DATABASE_URL}_sandbox` 
-      : 'file:./sandbox.db');
-
   if (globalForSandboxPrisma.sandboxPrisma) {
     return globalForSandboxPrisma.sandboxPrisma;
   }

backend/src/middleware/error.middleware.ts

@@ -1,13 +1,13 @@
 import type { Request, Response, NextFunction } from 'express';
 import { Prisma } from '../generated/prisma/index.js';
-import { ZodError } from 'zod';
+import { ZodError, type ZodIssue } from 'zod';
 import logger from '../logger.js';
 
 /**
  * Global error handler middleware
  */
 export const errorHandler = (
-    err: any,
+    err: unknown,
     req: Request,
     res: Response,
     next: NextFunction
@@ -18,7 +18,7 @@ export const errorHandler = (
     if (err instanceof ZodError) {
         return res.status(400).json({
             error: 'Validation Error',
-            details: err.issues.map((e: any) => ({
+            details: err.issues.map((e: ZodIssue) => ({
                 path: e.path.join('.'),
                 message: e.message
             }))
@@ -28,28 +28,28 @@ export const errorHandler = (
     // Handle Prisma Errors
     if (err instanceof Prisma.PrismaClientKnownRequestError) {
         // Unique constraint violation
-        if (err.code === 'P2002') {
-            const target = (err.meta?.target as string[])?.join(', ') || 'field';
+        if ((err as Prisma.PrismaClientKnownRequestError).code === 'P2002') {
+            const target = ((err as Prisma.PrismaClientKnownRequestError).meta?.target as string[])?.join(', ') || 'field';
             return res.status(409).json({
                 error: 'Conflict Error',
                 message: `Record with this ${target} already exists.`
             });
         }
 
         // Record not found
-        if (err.code === 'P2025') {
+        if ((err as Prisma.PrismaClientKnownRequestError).code === 'P2025') {
             return res.status(404).json({
                 error: 'Not Found',
-                message: err.message || 'The requested record was not found.'
+                message: (err as Prisma.PrismaClientKnownRequestError).message || 'The requested record was not found.'
             });
         }
     }
 
     // Default Error
-    const statusCode = err.status || err.statusCode || 500;
-    const message = err.message || 'Internal Server Error';
+    const statusCode = (err instanceof Error && (err as any).status) || (err instanceof Error && (err as any).statusCode) || 500;
+    const message = err instanceof Error ? err.message : 'Internal Server Error';
 
-    res.status(statusCode).json({
+    return res.status(statusCode).json({
         error: statusCode === 500 ? 'Internal Server Error' : 'Error',
         message: statusCode === 500 ? 'A technical error occurred. Please try again later.' : message
     });