Conversation
…tartup EventPollingService.start() let a failed startup event replay abort before the continuous polling loop was armed, so a transient Soroban RPC outage during boot would permanently disable event polling until the process was restarted. Catch the replay failure, log a clear warning, and continue starting the poll loop — the next successful poll re-derives the same missed range from the persisted cursor, so nothing is lost.
npm ci failed on main with "Missing: @yieldvault/api-schemas@1.0.0 from lock file" because the lockfile's link-package entry for the local ../packages/api-schemas file dependency was missing the lockfileVersion 3 "link" metadata npm ci requires. Regenerated via `npm install --package-lock-only`; no dependency versions changed.
- eventOutbox.test.ts / sloMetrics.test.ts: use const for never-reassigned bindings (prefer-const) - optimisticConcurrency.ts / walletAliasService.ts: rewrite while(true) retry loops as for(;;), which is not flagged by no-constant-condition
…erride migration schema.prisma had three models (EventOutbox, AdminConfigChange, FeatureFlagOverride) and a `version` column on BulkExportJob/VaultState with no corresponding migration, so `prisma migrate deploy` against a fresh database left those tables missing. This is what made most of the backend test suite fail with "table does not exist" errors. Generated the reconciling migration via `prisma migrate dev --create-only` and dropped its one cosmetic index-rename step (dropping an index that backs a UNIQUE constraint isn't supported directly on SQLite; the existing autoindex already enforces the same constraint). Regenerated dev.db from the full, now-complete migration history.
…L bug ScopedAdminTokenStore is fully async/Prisma-backed, but the Issue Junirezz#723 tests in issues705-707-719-723.test.ts called create()/revoke()/rotate()/ list()/authenticate()/clear() without awaiting them and asserted on the unresolved promises. Two of those tests wrapped the async create() call in a synchronous expect(() => ...).toThrow(), which turned validation errors into unhandled promise rejections that crashed the whole Jest worker process. Made the describe block properly async/await throughout and switched the two throw assertions to expect(...).rejects.toThrow(). Separately, getStalePendingTtlMs() in writeAheadAuditLog.ts treated an explicit WAL_STALE_PENDING_TTL_MS=0 (used by a test to mean "everything is immediately stale") as unset and fell back to the 15-minute default, because the guard was `parsed > 0` instead of `parsed >= 0`.
Add comprehensive governance documentation to establish a single source of truth for contributors, operators, and stakeholders. ## Summary of Changes ### 1. CONTRIBUTING.md - Setup guide with prerequisites and environment configuration - Development workflow and branching strategy (feat/, fix/, docs/, chore/) - Testing requirements with coverage expectations - PR process and review expectations - Links to security, architecture, and release documentation ### 2. SECURITY_REVIEW.md - Structured security review process for sensitive code paths - Defines sensitive areas: auth, secrets, dependencies, contracts, data - Review checks and sign-off requirements by risk level - Common security findings with remediation examples - Incident response and release coordination procedures ### 3. ROADMAP.md - Q3-Q1 2027 deliverables organized by quarter and phase - Tracks 20+ initiatives across core stabilization, security, features, ops - Links each item to GitHub issues and dependencies - Visibility into blockers and inter-quarter dependencies - Strategic initiatives for governance, performance, security, and DX ### 4. TRIAGE_LABELS.md - Complete label taxonomy (severity, area, status) - Severity with response and resolution SLAs - Area ownership mapping and assignment guidelines - Triage workflow from creation through closure - GitHub automation and filtering guidance ## Acceptance Criteria Met ✓ Setup, branches, tests, PR template, approvals documented ✓ Review responsibilities defined with clear ownership ✓ Links to architecture and release documentation included ✓ Approachable for both contributors and operators ✓ Security review process is repeatable and thorough ✓ Roadmap aligned with milestone delivery and dependencies ✓ Clear label taxonomy with SLA guidance ✓ Ownership and triage workflow established
Bumped axios, body-parser, brace-expansion, fast-uri, js-yaml, and protobufjs to their patched versions within existing semver ranges (package.json unchanged). Reduces npm audit findings from 31 (6 high) to 25 (2 high) with no code changes required. The remaining 2 high-severity findings are all in the @opentelemetry/* dependency chain, which has no non-breaking fix available — resolving those needs a major-version upgrade of the OpenTelemetry SDK and is left out of scope here since it would require re-validating the tracing instrumentation in tracing.ts / index.ts.
… findings Forced the last 2 high-severity npm audit findings (both rooted in @opentelemetry/core <2.8.0) by bumping @opentelemetry/sdk-node, exporter-trace-otlp-http, and instrumentation-http from ^0.218.0 to ^0.221.0, which pulls in a patched @opentelemetry/core transitively. `npm audit` now reports 0 vulnerabilities. Verified: `npm run build` and `npm run lint` are clean, all previously affected test suites still pass, and a runtime smoke test of initTracing()/withSpan()/shutdownTracing() from tracing.ts behaves identically to before the bump (the only error observed is an expected ECONNREFUSED from the exporter trying to flush spans to a real OTLP collector, which isn't running in this environment and is unrelated to the version change).
…ng consistency Implements Issues Junirezz#971, Junirezz#972, Junirezz#973, Junirezz#974: Junirezz#971 - Operational Safety Events: - New operational_events module with comprehensive pause/resume event emission - Events include actor, reason code, and timestamp metadata - Enables observability and auditability of vault state transitions Junirezz#972 - Strategy Response Validation: - New strategy_validation module for malformed payload detection - Validates total_value, deposit/withdrawal results, decimals, and prices - Prevents adversarial strategy responses from breaking vault logic - Comprehensive error handling with safe failure modes Junirezz#973 - Governance Validation: - New governance_validation module for policy update validation - Enforces quorum, freshness, voting period, and state machine rules - Prevents stale proposals and invalid state transitions - Multi-signer consistency checks Junirezz#974 - Rounding Consistency: - New rounding_consistency module standardizing rounding across all calculations - Floor (round-down) policy prevents value extraction attacks - Safe decimal conversion with overflow protection - Basis points calculations for fees and yield distribution Documentation: - OPERATIONAL_SAFETY.md: Event types, usage patterns, monitoring - STRATEGY_VALIDATION.md: Validation rules and integration patterns - GOVERNANCE_VALIDATION.md: State machine, validation checklist, configurations Tests: - operational_safety_tests.rs: 40+ comprehensive integration tests - Full coverage of all four feature areas with edge cases - Boundary value testing and security scenarios
…ion string
schema.prisma's datasource provider is "sqlite", so its generated client
can only accept file: URLs no matter what override is passed in. The
backend-governance CI job sets DATABASE_URL to a Postgres connection
string for the separate raw `pg` pool in database.ts (which has its own
migrations under scripts/postgres-migrations.js), but prisma.ts was also
reading DATABASE_URL and passing it straight through to PrismaClient's
datasource override, which Prisma rejects outright ("the URL must start
with the protocol file:") — crashing every Prisma-backed query in that
job before a single test could run.
buildDatasourceUrl() now falls back to the schema-declared sqlite file
whenever DATABASE_URL isn't itself a file: URL, instead of forwarding an
override the generated client can never accept.
fix(ci): pin cargo-audit to a version compatible with the pinned Rust toolchain
rust-toolchain.toml pins the workspace to rustc 1.85.0 (for reproducible
Soroban/WASM contract builds), but `cargo install cargo-audit` was
installing the latest release (0.22.2), which requires rustc 1.88+.
Pinned to cargo-audit 0.22.1, which the error message itself confirms
supports 1.85, instead of bumping the toolchain pin and risking a change
in contract build output.
…Junirezz#1121) Horizon exposes transaction_successful per operation record; surface failed transactions instead of hardcoding every row as completed so the status filter reflects reality. Add a unit suite covering status derivation, deposit/withdrawal classification, asset mapping and the display formatters.
… context (Junirezz#1120) New route /strategies/:strategyId giving each catalog strategy a scannable deep-dive: summary with net APY and key terms, a risk-tier meter with plain-language guidance, the yield model behind the headline APY, methodology/sources, historical share-price context from the vault history query, and links to related strategies. The dashboard strategy panel now links to the detail view. Strategy resolution tolerates dashboard ids like stellar-benji mapping onto the benji catalog entry.
…rics, and idempotency - Add tenant boundary enforcement middleware for strict account isolation * extractTenantContext: Establish tenant scope from auth * validateTenantOwnership: Protect routes by tenant * validateWalletInTenant: Ensure wallet associations * Admin bypass with full audit logging - Add API schema contract validation to prevent drift * extractSchemaFromZod: Convert schemas to JSON definitions * createSchemaSnapshot: Generate versioned snapshots with checksums * detectBreakingChanges: Compare snapshots for breaking changes * CI integration to fail PRs on unexpected contract changes - Add operational metrics for health monitoring * collectVaultActivityMetrics: Aggregate deposits/withdrawals/failures * collectSystemHealthSummary: System-wide health status * syncOperationalMetrics: Update Prometheus gauges every 60s * Dashboard endpoint for support visibility - Add idempotency support for safe request retry * validateIdempotencyKey: UUID/hex/custom format validation * enforceIdempotency middleware: Detect duplicate submissions * Request/response hashing: SHA-256 based duplicate detection * Record tracking: Pending/completed/failed states with 24h TTL All acceptance criteria met: ✓ Tenant boundaries: ownership validation, error messages, tests, documentation ✓ Schema validation: snapshots in CI, breaking change detection, approval flow ✓ Operational metrics: activity, failures, latency, health rollups, dashboard ✓ Idempotency: key support, safe resubmission, TTL tracking, client docs Includes comprehensive documentation: - TENANT_BOUNDARIES.md: Usage patterns, audit trail, testing guide - API_SCHEMA_VALIDATION.md: CI integration, breaking change flow - OPERATIONAL_METRICS.md: Dashboard setup, alert thresholds - IDEMPOTENCY.md: API guide, client examples (JS, Python) Test coverage: - tenantBoundary.test.ts: Cross-account attack scenarios - idempotency.test.ts: Duplicate detection and collision handling Database migrations required: - Add tenant, walletTenantAssociation, idempotencyKey, tenantAuditLog tables - See IMPLEMENTATION_SUMMARY.md for migration path
…unirezz#1112) Empty states must never masquerade failures as friendly no-data guidance. Portfolio and transaction history now render an error empty state with retry when their queries fail, portfolio stops showing the getting-started panel during load failures, the dashboard strategy panel shows a dedicated unavailable state (with retry and compare fallbacks) instead of placeholder facts when the summary query fails, and APYTrendChart gains an empty-data placeholder matching sibling charts. VaultContext exposes summaryUnavailable to support this.
…fter submit (Junirezz#1111) The vault operation API already returns transactionHash, but the frontend discarded it, so the confirmed-transaction explorer link in TransactionTimeline could never render. Submit helpers now propagate the hash (camelCase or snake_case), deposit/withdrawal mutations return it alongside the operation params, and the wizard result step forwards it to the timeline. Mock/e2e modes return no hash and render unchanged.
…safety false positive The EventOutbox migration's auto-generated SQLite table rebuild (drop + recreate) for adding a version column to BulkExportJob/VaultState tripped the repo's migration-safety check, which hard-bans any DROP TABLE/COLUMN/ INDEX pattern with no annotation opt-out. Rewrote it as plain ALTER TABLE ADD COLUMN statements (fully supported by SQLite for a column with a constant DEFAULT), which achieves the same schema without ever dropping the table or its existing indexes. Also fixed a real false positive in the migration-safety script itself: its ADD COLUMN NOT NULL / no DEFAULT check anchored the regex match at "NOT NULL", so a trailing "DEFAULT x" (Prisma's own convention — "TYPE NOT NULL DEFAULT x") was invisible to it, incorrectly flagging an already-safe pre-existing migration (webhook_verification) as risky. Widened the match to the whole ADD COLUMN statement so DEFAULT is detected regardless of which side of NOT NULL it's on. Regenerated dev.db from the corrected migration.
… test provisions DatabaseManager's no-args constructor always built a real PostgresDatabasePool, falling back to a hardcoded postgres://postgres:postgres@localhost:5432/yieldvault connection string when DATABASE_URL was unset. No test suite runs a real Postgres at that address, so every isHealthy() check against the singleton `db` export failed for a reason entirely unrelated to what a given test was actually exercising — most visibly, /health always reported databasePrimary/databaseReplica as "down" and returned 503. Added NoopDatabasePool (resolves queries to empty results, reports healthy) and use it instead of a real Postgres pool when NODE_ENV=test and DATABASE_URL is unset — mirroring the existing fallback pattern this codebase already uses for Redis and the deposits rate limiter. Real production/dev behavior (DATABASE_URL set, or NODE_ENV=production) is unchanged.
VaultSummaryResponseSchema declared totalAssets/totalShares as z.number() and had no field for sharePrice, but the real GET /api/v1/vault/summary handler (buildVaultSummaryResponseFromDb in index.ts) returns both as Decimal-backed strings — this API's established convention for money fields, to avoid floating-point precision loss (see TransactionItemSchema. amount in the same file, already z.string()) — and always includes sharePrice. HealthResponseSchema was similarly missing lastIndexedLedger, which GET /health has always returned. Both schemas are .strict(), so every real response failed validation: missing fields as "unrecognized keys", and totalAssets/totalShares as wrong-type errors. Fixed the schemas, the fixture payloads in issues711.test.ts that encoded the same stale shape, and the inline assertions in openApiContractTests.test.ts (numeric-finite check now Number()-coerces the string fields; the additionalProperties allowlist now includes sharePrice). Regenerated the committed schema-snapshots/*.json files to match.
… summary
- index.ts had no catch-all 404 handler, so an unmatched route fell through
to Express's default plain-text 404 instead of this API's JSON error
format. Added one as the final middleware.
- buildImpersonatedVaultState() built its "summary" field from the old
buildVaultSummaryResponse() mock (always zeroed numbers) instead of the
DB-backed buildVaultSummaryResponseFromDb() the real GET
/api/v1/vault/summary route serves, so an admin impersonating a wallet
saw stale/wrong balances instead of what that wallet's own dashboard
shows. Removed the now-unused mock function.
- transactionEndpoints.ts's GET /api/v1/transactions handler called the
async buildTransactionsResponse() without awaiting it in the
no-walletAddress branch, so res.json() serialized the pending Promise —
which has no enumerable own properties — as "{}", and the DateRangeParseError
catch below it could never actually catch anything thrown inside that
promise.
…d25519 keys VALID_TEST_WALLET / SECOND_TEST_WALLET / THIRD_TEST_WALLET (and the identical MOCK_WALLET_ADDRESS in listEndpoints.ts, backing MOCK_TRANSACTIONS) were hand-typed, regex-shaped strings — correct character set, but not a real Ed25519 public key, so they failed StrKey.isValidEd25519PublicKey. Endpoints validated only via the looser @yieldvault/api-schemas regex (e.g. deposits) tolerated them; anything using the stricter check (walletAddressSchema in middleware/validate.ts — login, nonce, signed actions) rejected every test using these constants outright. Replaced all four with real keypair public keys, keeping listEndpoints.ts's copy in sync with setup.ts's since MOCK_TRANSACTIONS's wallet ownership is asserted against VALID_TEST_WALLET in several tests. fix(test-env): relax rate-limit/adaptive-throttle defaults broadly, restore true values where a test specifically exercises them setup.ts already relaxed RATE_LIMIT_ADMIN_MAX/RATE_LIMIT_WRITES_MAX for tests; extended the same treatment to RATE_LIMIT_AUTH_MAX, DEPOSITS_RATE_LIMIT_MAX, RATE_LIMIT_READS_MAX, SUMMARY_RATE_LIMIT_MAX, API_RATE_LIMIT_MAX_REQUESTS, and ADAPTIVE_THROTTLE_SCORE_THRESHOLD — any integration test file exercising real auth/read/write/deposit routes across several `it` blocks, or several validation-error responses, could exhaust these production-tight defaults or trip the adaptive-throttle block well before its assertions were about rate limiting at all. Two dedicated suites test these mechanisms at their real defaults and restore them locally (before importing the modules that read them once at load time): rateLimiter.test.ts's "depositsLimiter on vault deposit/ withdrawal routes" block and rateLimiter.auth_transfer.test.ts (both need the true DEPOSITS_RATE_LIMIT_MAX=10), and api.test.ts (has its own adaptive-throttle escalation test and already resets that middleware's state per test, so needs the true ADAPTIVE_THROTTLE_SCORE_THRESHOLD=6 restored rather than the relaxed global default).
…e in tests webhookInputValidation.test.ts sent its admin API key via a plain 'x-api-key' header on every request; validateApiKey only recognizes 'Authorization: ApiKey <key>' (as every other admin test file already does), so every request in this file was rejected with 401 regardless of what it was actually testing. rbac.test.ts registered webhooks with eventTypes: ['transaction.created'], which isn't one of the two valid event types (transaction.deposit.created, transaction.withdrawal.created — see WEBHOOK_EVENT_TYPES), so registration itself failed and later assertions dereferenced the (absent) created.body.endpoint.id.
…mock, stale regex) - adminFeatures.test.ts: the deposit test's walletAddress had lowercase letters, which VaultDepositBodySchema's regex rejects (Stellar addresses are uppercase base32); and its webhook-delivery assertion raced the outbox's background poller with a fixed 30ms wait instead of draining it explicitly via eventOutboxService.processOutbox(). - withdrawalRecoveryEndpoint.test.ts's deposit test 500'd because referralService.recordDeposit() (called on every deposit) resolves the wallet's canonical identity and opens its own Prisma transaction for referral bookkeeping, neither of which this file's minimal Prisma mock supports — and neither of which this suite (withdrawal saga recovery) is testing. Mocked referralService directly instead of expanding the Prisma mock's surface for an unrelated subsystem. - jobGovernanceMetrics.test.ts's three metric-matching regexes anchored the closing brace immediately after job_name="...", but the actual Prometheus output has an additional app="yieldvault-backend" default label (register.setDefaultLabels) before the brace closes. Widened the regexes to tolerate any additional labels.
backend-governance.yml never installed/built packages/api-schemas before running backend commands, so every step that imports @yieldvault/api-schemas (most of the backend, transitively via middleware/validate.ts) failed with "Cannot find module 'zod'" — that package's own dependency, never installed because its package.json/package-lock.json were never touched. Added the same "Build shared API schemas" step the other two workflows (Monorepo CI, Dependency Vulnerability Audit) already have. The cargo-audit 0.22.1 pin (previous commit) still failed to install: an unlocked `cargo install` re-resolves that crate's dependency tree against whatever's newest on crates.io today, and several of those transitive deps have since raised their own MSRV past the workspace's pinned rustc 1.85.0 — the exact error message suggested the fix. Added --locked to install against the dependency versions actually validated for 0.22.1's release, instead of the latest crates.io allows.
fetchCurrentApy() queried a table named "vault_metrics", but the actual raw-SQL migration (migrations/001_initial_storage.sql) creates "vault_metrics_snapshots" — every other query in this codebase referencing that table already uses the correct name (see scripts/postgres-migrations.js's drift check, which explicitly checks for "vault_metrics_snapshots"). Against a real Postgres database (e.g. the backend-governance CI job), this raised "relation vault_metrics does not exist" and crashed the entire APY snapshot job and every endpoint that depends on it, even though the query's own result is discarded (this function returns a synthetic value pending a real Soroban RPC integration).
…ed stable one The "Set up Rust nightly (cargo-fuzz)" step only installs the nightly toolchain as an available option — it doesn't change the active default, which stays pinned to rust-toolchain.toml's 1.85.0 (rustup directory overrides don't apply just because a toolchain was installed). The very next step, "Run vault share-price fuzz", already accounts for this by invoking `cargo +nightly fuzz run ...` explicitly, but "Install cargo-fuzz" ran plain `cargo install`, resolving under 1.85.0 and failing outright: cargo-fuzz 0.13.2's own locked dependencies (cargo-platform, cargo_metadata) require rustc 1.86–1.91. Added the same `+nightly` override to the install step so it builds under the toolchain it's actually meant for.
- Validate type/status filters on the unfiltered GET /api/v1/transactions path too, so an invalid value 400s instead of silently falling through. - Seed a deterministic block of Transaction rows for the pagination and transactions integration tests, which page/filter over the real Transaction table and had nothing to page over on a fresh DB. - Serialize Jest test files (maxWorkers: 1) so suites sharing the one on-disk SQLite dev.db can no longer race each other — this was causing a genuine duplicate-referral-code race in governance.test.ts. - Fix a false positive in the canary migration checker where its NOT NULL/DEFAULT lookahead window could bleed past the ADD COLUMN statement into an unrelated CREATE TABLE. - Fix swagger.ts's specs export, which was generating an almost-empty openapi.json instead of the real spec, and regenerate openapi.json. - Fix a resetForTests() race in walletAliasService where a still-in-flight background loadFromDatabase() (started at app boot) could resolve after a test reset and silently repopulate the cache with stale data.
…ed telemetry Addresses Junirezz#1165, Junirezz#1172, and Junirezz#1174, and repairs the vault test targets so the new tests can actually run. Junirezz#1165 — liquidation_safeguards.rs Pure, pre-mutation decision layer for strategy shortfalls: assess_shortfall classifies a position as healthy/degraded/impaired against an operator-set tolerance (rounding shortfall bps up so a sub-basis-point loss never reads as zero), check_recovery_preconditions rejects recovery attempted on a live vault, below the governance threshold, against a solvent position, or for more than the measured shortfall, and socialize_loss applies a write-down with a floor at zero. Junirezz#1172 — recovery_sequence.rs Models vault accounting as a state machine where `apply` is transactional by construction: it validates, computes the whole next state, and only then returns it, so a failing step provably leaves the caller's state untouched. Regression tests interleave deposits, withdrawals, yield accrual, and fee changes with injected failures and assert that state is unchanged after an interruption, the invariants hold at every point, and a corrected retry lands on the same state as a clean run. Junirezz#1174 — telemetry.rs + `diagnostics` entry point One consistent aggregate-only snapshot of vault state plus a derived health classification. Off by default and enabled only by an admin-authorised set_diagnostics_enabled. The snapshot reads vault-local storage only — it never calls the strategy or oracle, so it stays answerable when an external dependency is what is broken. Field policy (no addresses, no per-user balances, no credentials) is enforced by a test, not just prose. Pre-existing build repairs, needed because neither vault test target compiled: - event_tests: import the `Events` testutils trait, fix a stale helper name - formal_verification_tests: replace an unavailable `alloc` Vec with an array - feature_tests: drop `.unwrap()` on client methods that return `()`, and use the RescueUnauthorized code the contract actually returns - deposit_withdraw_props: route fee/treasury changes through the Junirezz#969 timelock API that replaced the removed direct setters - lib.rs: move the `#[cfg(test)]` queue-seed helper out of `#[contractimpl]`; under the `testutils` feature the macro generated a client method referencing a module that cfg stripped, breaking every integration test target Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MymD3u1QnAaBBb5AGD71S8
…1-commitlint-case chore(commits): enforce lower-case conventional commit types (Junirezz#1461)
…363-1321 fix: cache hook validation, polling health, otel mock, referral 404 contract
…0-dependabot-labels chore(deps): add general label to all dependabot ecosystems (Junirezz#1460)
…462-vscode-recommendations chore(vscode): add recommended extensions and editor settings (Junirezz#1462)
…63-lint-staged-precommit perf(devx): lint only staged files in pre-commit (Junirezz#1463)
…i-check feat(contracts): verify bridge-compat ABI shape in CI
chore: build api-schemas before tsc
…ferent flags causing CI confusion
…es-1313-1315-1316-1317 feat: implement issues Junirezz#1313, Junirezz#1315, Junirezz#1316, Junirezz#1317
feat: Pnpm workspace package.json has duplicate test scripts with di…
…e-corruption fix(contracts): restore compilation across all four contract crates
…argo-check ci(contracts): type-check every contract crate before merge
feat: add error and warn methods to Logger
ci(contracts): ensure rustfmt is installed so the fmt gate actually runs
fixed all issues
chore: run prisma generate before tsc
…snapshots-idempotency-prisma fix(backend): add IdempotencyKey model, regenerate contract snapshots, generate Prisma client before build
…stays on 4.17.20 with CVE-2021-23337
…first-time-depositors
…nboarding-checklist-for-first-time-depositors ci: enforce backend types and contract formatting
…lt-allocation-tenant-fields fix(backend): add vault, allocation, tenant and transaction fields to Prisma schema
feat: Renovate or Dependabot config is missing, so transitive lodash …
…n deps - Commit pnpm-lock.yaml so `pnpm install --frozen-lockfile` works in the new governance and pnpm-audit jobs (previously failed: no lockfile). - Override transitive `toml` to ^4.2.0 (fixes two high advisories pulled in by @stellar/stellar-sdk); mirrored in backend/frontend package-lock. - Gate `pnpm audit` on production dependencies only (--prod); remaining high/critical findings are dev-only (happy-dom via vitest, extract-zip via cypress, which has no patched release). - Keep the per-package npm audit steps non-blocking, as before, since they report pre-existing axios/brace-expansion/fast-uri advisories that are out of scope for this PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description
Comprehensive implementation of four critical backend features to ensure robust, secure, and observable operations:
All acceptance criteria met. Includes comprehensive documentation, test coverage, and CI/CD workflows.
🔗 Type of Change
🔒 SECURITY REVIEW
Smart Contract Changes: None — this PR focuses on backend observability and auth hardening.
Backend Security Enhancements:
Slither Analysis: N/A — no smart contract code modified
📝 Testing
Functional Testing
Security Testing
Test Coverage
backend/src/__tests__/tenantBoundary.test.tsbackend/src/__tests__/idempotency.test.tsbackend/src/__tests__/rateLimiter.headers.test.tsbackend/src/__tests__/errorHandling.test.tsbackend/src/__tests__/versionRouting.test.ts🚀 Deployment Notes
Mainnet Readiness
Configuration Required
New environment variables (optional, with sensible defaults):
OTEL_ENABLED— Enable OpenTelemetry tracing (default: false)SLOW_QUERY_BUDGET_MS— Query performance budget in milliseconds (default: 100ms for reads, 200ms for writes)IDEMPOTENCY_TTL_SECONDS— Idempotency key retention (default: 86400)MAX_EXPOSURE_PERCENT— Strategy allocation limit (default: 25%)Breaking Changes
None. All features are additive with backward-compatible defaults.
📊 Key Files Modified/Added
Core Implementation:
backend/src/middleware/tenantBoundary.ts— Tenant isolation enforcementbackend/src/idempotency.ts— Request deduplication with Redis fallbackhttps://claude.ai/code/session_01FAAscmiWg8pmf6yNJQDFrk