Merge branch 'main' into dependabot/npm_and_yarn/client/testing-library/jest-dom-7.0.0

Author: Caleb

backend/.eslintrc.cjs

@@ -65,7 +65,14 @@ module.exports = {
       },
     },
     {
-      files: ["src/config/**/*.ts", "src/middleware/**/*.ts", "src/schemas/**/*.ts"],
+      // Critical paths: forbid new `any` usage (issue #1027)
+      files: [
+        "src/config/**/*.ts",
+        "src/middleware/**/*.ts",
+        "src/schemas/**/*.ts",
+        "src/routes/**/*.ts",
+        "src/services/webhook*.ts",
+      ],
       rules: {
         "@typescript-eslint/no-explicit-any": "error",
       },

backend/docs/DEPLOYMENT_PROBES.md

@@ -59,6 +59,16 @@ livenessProbe:
 - Determining if service can handle requests
 - Checking if critical dependencies are available
 
+**Critical vs. Optional Dependencies**:
+- **Critical** (readiness blocks): Database, Redis, RPC/Horizon, FX Provider
+- **Optional** (degraded allowed): Queue, Providers (external API keys), Scheduler
+
+**Behavior**:
+- ✅ Checks critical dependencies (database, Redis, RPC/Horizon, FX provider)
+- ✅ Returns 503 if any critical dep is unhealthy
+- ✅ Allows degraded state for non-critical services
+- ✅ RPC/Horizon and FX provider report `degraded` when not configured (no blocking)
+
 **Response (HTTP 200 if ready, 503 if not)**:
 ```json
 {
@@ -85,6 +95,16 @@ livenessProbe:
       "name": "providers",
       "status": "healthy",
       "latency_ms": 0
+    },
+    {
+      "name": "rpc_horizon",
+      "status": "healthy",
+      "latency_ms": 10
+    },
+    {
+      "name": "fx_provider",
+      "status": "healthy",
+      "latency_ms": 8
     }
   ]
 }
@@ -113,14 +133,14 @@ livenessProbe:
 ```
 
 **Critical vs. Optional Dependencies**:
-- **Critical** (readiness blocks): Database, Redis
-- **Optional** (degraded allowed): Queue, Providers
+- **Critical** (readiness blocks): Database, Redis, RPC/Horizon, FX Provider
+- **Optional** (degraded allowed): Queue, Providers (external API keys), Scheduler
 
 **Behavior**:
-- ✅ Checks critical dependencies (database, Redis)
-- ✅ Returns 503 if critical deps are unhealthy
+- ✅ Checks critical dependencies (database, Redis, RPC/Horizon, FX provider)
+- ✅ Returns 503 if any critical dep is unhealthy
 - ✅ Allows degraded state for non-critical services
-- ❌ Slightly higher latency than liveness probe
+- ✅ RPC/Horizon and FX provider report `degraded` when not configured (no blocking)
 
 **Deployment Use Case**:
 ```yaml
@@ -329,8 +349,9 @@ To add a new dependency check:
 
 1. Add a `check<Service>()` method to `DependencyHealthService`
 2. Include it in `checkAllDependencies()`
-3. Classify as critical or optional (only `database` and `redis` block readiness)
+3. Classify as critical or optional (critical deps: `database`, `redis`, `rpc_horizon`, `fx_provider`)
 4. Update this document with dependency details
+5. Add the check to both backend (`dependency-health-service.ts`) and client (`client/app/api/health/ready/route.ts`) readiness probes
 
 Example:
 ```typescript

backend/src/middleware/errorHandler.ts

@@ -69,14 +69,15 @@ export const errorHandler = (
   });
 
   // Don't leak internals in production
-  res.status(500).json({
-    type: 'https://syncro.app/errors/internal',
-    title: 'Internal Server Error',
-    status: 500,
-    detail: process.env.NODE_ENV === 'production' 
-      ? 'An unexpected error occurred.' 
-      : err.message,
-    instance,
-    requestId,
-  });
+  res
+    .status(500)
+    .type('application/problem+json')
+    .json({
+      type: 'https://syncro.app/errors/internal',
+      title: 'Internal Server Error',
+      status: 500,
+      detail: 'An unexpected error occurred.',
+      instance,
+      requestId,
+    });
 };

backend/src/routes/admin/privacy-metrics.ts

@@ -139,7 +139,7 @@ router.get('/privacy-metrics', async (_req: AuthenticatedRequest, res: Response)
  * Sanitizes a CSV cell to prevent formula injection.
  * Cells starting with =, +, -, @, tab, or carriage return are prefixed with a single quote.
  */
-function sanitizeCSVCell(value: any): string {
+function sanitizeCSVCell(value: unknown): string {
   if (value === null || value === undefined) return '';
 
   const stringValue = String(value);

backend/src/routes/analytics.ts

@@ -144,7 +144,7 @@ router.get('/summary', async (req: AuthenticatedRequest, res: Response) => {
  */
 router.get('/budgets', async (req: AuthenticatedRequest, res: Response) => {
   try {
-    const { data: budgets, error } = await (analyticsService as any).getUserBudgets(req.user!.id);
+    const { data: budgets, error } = await analyticsService.getUserBudgets(req.user!.id);
     if (error) throw error;
     res.json({ success: true, data: budgets });
   } catch (error) {

backend/src/routes/api-keys.ts

@@ -6,7 +6,7 @@ import { requireRole } from '../middleware/rbac';
 import { validate } from '../middleware/validate';
 import logger from '../config/logger';
 import { createApiKeySchema } from '../schemas/api-key';
-import { NotFoundError } from '../errors';
+import { NotFoundError, BadRequestError } from '../errors';
 import { auditApiKeyEvent } from '../services/audit-service';
 import { createApiKeyLimiter } from '../middleware/rate-limit-factory';
 
@@ -66,7 +66,7 @@ router.post(
       return res.status(201).json({ success: true, key, scopes });
     } catch (error) {
       logger.error('Create API key error:', error);
-      return res.status(500).json({ error: String(error) || 'Internal server error' });
+      return res.status(500).json({ error: 'Internal server error' });
     }
   },
 );
@@ -139,4 +139,80 @@ router.get('/:id/usage', requireRole('owner', 'admin'), requireScope('subscripti
   res.json({ success: true, data });
 });
 
+/**
+ * POST /api/keys/:id/rotate
+ * Atomically revoke an existing key and issue a replacement with the same
+ * name and scopes. The old key stops working immediately; the new plaintext
+ * key is returned once and never stored.
+ */
+router.post(
+  '/:id/rotate',
+  requireRole('owner', 'admin'),
+  requireScope('subscriptions:write'),
+  async (req: AuthenticatedRequest, res: Response) => {
+    const { data: existing, error: fetchError } = await supabase
+      .from('api_keys')
+      .select('id, service_name, scopes, revoked')
+      .eq('id', req.params.id)
+      .eq('user_id', req.user!.id)
+      .maybeSingle();
+
+    if (fetchError || !existing) {
+      throw new NotFoundError('API key not found');
+    }
+
+    if (existing.revoked) {
+      throw new BadRequestError('Cannot rotate a revoked API key');
+    }
+
+    const { key: newKey, hash: newHash } = generateApiKey();
+
+    // Revoke the old key
+    const { error: revokeError } = await supabase
+      .from('api_keys')
+      .update({ revoked: true, updated_at: new Date().toISOString() })
+      .eq('id', req.params.id)
+      .eq('user_id', req.user!.id);
+
+    if (revokeError) {
+      logger.error('Failed to revoke old API key during rotation', { error: revokeError });
+      return res.status(500).json({ error: 'Internal server error' });
+    }
+
+    // Insert replacement key
+    const { error: insertError } = await supabase.from('api_keys').insert([
+      {
+        user_id: req.user!.id,
+        service_name: existing.service_name,
+        key_hash: newHash,
+        scopes: existing.scopes,
+        revoked: false,
+        last_used_at: null,
+        request_count: 0,
+      },
+    ]);
+
+    if (insertError) {
+      logger.error('Failed to insert replacement API key during rotation', { error: insertError });
+      // Attempt to un-revoke the original to avoid a total lockout
+      await supabase
+        .from('api_keys')
+        .update({ revoked: false, updated_at: new Date().toISOString() })
+        .eq('id', req.params.id)
+        .eq('user_id', req.user!.id);
+      return res.status(500).json({ error: 'Internal server error' });
+    }
+
+    await auditApiKeyEvent('api_key.rotated', req.user!.id, {
+      oldKeyId: req.params.id,
+      keyName: existing.service_name,
+      scopes: existing.scopes,
+      ipAddress: req.ip,
+      userAgent: req.headers['user-agent'],
+    });
+
+    return res.status(201).json({ success: true, key: newKey, scopes: existing.scopes });
+  },
+);
+
 export default router;

backend/src/routes/audit.ts

@@ -7,6 +7,9 @@ import { validate } from '../middleware/validate';
 import logger from '../config/logger';
 import { auditBatchSchema, auditQuerySchema, auditVerifyQuerySchema } from '../schemas/audit';
 import { PaginationError } from '../utils/pagination';
+import { z } from 'zod';
+
+type AuditQuery = z.infer<typeof auditQuerySchema>;
 
 const router: Router = Router();
 
@@ -71,7 +74,8 @@ router.get(
   validate(auditQuerySchema, 'query'),
   async (req: Request, res: Response) => {
     try {
-      const { action, resourceType, userId, limit, offset, startDate, endDate } = req.query as any;
+      const { action, resourceType, userId, limit, offset, startDate, endDate } =
+        req.query as AuditQuery;
 
       const logs = await auditService.getAllLogs({
         action,
@@ -99,12 +103,12 @@ router.get(
           hasMore: offset + limit < total,
         },
       });
-    } catch (error: any) {
-      if (error.name === 'PaginationError') {
+    } catch (error: unknown) {
+      if (error instanceof Error && error.name === 'PaginationError') {
         res.status(400).json({
           success: false,
           error: error.message,
-          code: error.code,
+          code: (error as { code?: string }).code,
         });
         return;
       }

backend/src/routes/compliance.ts

@@ -24,7 +24,10 @@ const exportRateLimit = RateLimiterFactory.createCustomLimiter({
   windowMs: 60 * 60 * 1000,
   max: 1,
   message: { error: 'Export rate limit exceeded. Try again in 1 hour.' },
-  keyGenerator: (req: any) => req.user?.id || req.ip,
+  keyGenerator: (req: Request) => {
+    const authReq = req as AuthenticatedRequest;
+    return authReq.user?.id || req.ip || 'anonymous';
+  },
   endpointType: 'data-export',
 });
 
@@ -70,8 +73,8 @@ async function resolveUserFromTokenOrSession(
   let sessionToken: string | null = null;
   if (authHeader?.startsWith('Bearer ')) {
     sessionToken = authHeader.substring(7);
-  } else if ((req as any).cookies?.authToken) {
-    sessionToken = (req as any).cookies.authToken;
+  } else if (req.cookies?.authToken) {
+    sessionToken = req.cookies.authToken;
   }
   if (!sessionToken) return null;
 

backend/src/routes/gift-card-ledger.ts

@@ -35,8 +35,8 @@ router.get('/history', async (req: AuthenticatedRequest, res: Response) => {
     const limit = validateLimit(req.query.limit, 100, 50);
     const history = await giftCardLedgerService.getHistory(req.user!.id, limit);
     res.json({ success: true, data: history });
-  } catch (error: any) {
-    if (error.name === 'PaginationError') {
+  } catch (error: unknown) {
+    if (error instanceof Error && error.name === 'PaginationError') {
       throw new BadRequestError(error.message);
     }
     throw error;
@@ -49,7 +49,7 @@ router.post('/top-up', validate(topUpSchema), async (req: AuthenticatedRequest,
     const { amount, description } = req.body;
     const entry = await giftCardLedgerService.topUp(req.user!.id, amount, description);
     res.status(201).json({ success: true, data: entry });
-  } catch (err: any) {
+  } catch (err: unknown) {
     const appError = parseDbError(err);
     if (appError) {
       return res.status(appError.status).json({ success: false, error: appError.message, field: appError.field });
@@ -64,8 +64,8 @@ router.post('/deduct', validate(deductSchema), async (req: AuthenticatedRequest,
   try {
     const entry = await giftCardLedgerService.deduct(req.user!.id, subscriptionId, amount, description);
     res.status(201).json({ success: true, data: entry });
-  } catch (err: any) {
-    if (err.message?.startsWith('Insufficient balance')) {
+  } catch (err: unknown) {
+    if (err instanceof Error && err.message?.startsWith('Insufficient balance')) {
       throw new BadRequestError(err.message);
     }
     throw err;

backend/src/routes/merchants.ts

@@ -6,6 +6,9 @@ import { adminAuth } from '../middleware/admin';
 import { createMerchantSchema, updateMerchantSchema, merchantQuerySchema } from '../schemas/merchant';
 import { validateRequest } from '../utils/validation';
 import { PaginationError } from '../utils/pagination';
+import { z } from 'zod';
+
+type MerchantQuery = z.infer<typeof merchantQuerySchema>;
 
 const router: Router = Router();
 
@@ -18,7 +21,7 @@ router.get(
   validate(merchantQuerySchema, 'query'),
   async (req: Request, res: Response) => {
     try {
-      const { limit, offset, category } = req.query as any;
+      const { limit, offset, category } = req.query as MerchantQuery;
 
       const result = await merchantService.listMerchants({
         category,
@@ -31,12 +34,12 @@ router.get(
         data: result.merchants,
         pagination: { total: result.total, limit, offset },
       });
-    } catch (error: any) {
-      if (error.name === 'PaginationError') {
+    } catch (error: unknown) {
+      if (error instanceof Error && error.name === 'PaginationError') {
         res.status(400).json({
           success: false,
           error: error.message,
-          code: error.code,
+          code: (error as { code?: string }).code,
         });
         return;
       }