Merge pull request #426 from archanavdev/fix/four-issues

Fix 4 issues: premium overflow (#382), trigger length check (#379), policy cache invalidation (#365), webhook per-user limit (#372)

Author: ChaoLing140

backend/src/config.py

@@ -61,6 +61,7 @@ class Settings(BaseSettings):
     webhook_secret_key: str = "webhook-secret-key-change-in-production"
     webhook_max_retries: int = 3
     webhook_delivery_timeout: int = 30
+    webhook_max_per_user: int = 10
 
     # Logging
     log_level: str = "INFO"

backend/src/routes/claims.py

@@ -22,6 +22,7 @@
 )
 from ..services.storage_service import storage_service
 from ..services.webhook_service import dispatch_webhook_event
+from ..cache import invalidate_policy_cache
 
 router = APIRouter(prefix="/claims", tags=["claims"])
 logger = logging.getLogger(__name__)
@@ -102,6 +103,8 @@ async def create_claim(
     db.commit()
     db.refresh(claim)
 
+    invalidate_policy_cache(current_user.id)
+
     background_tasks.add_task(
         dispatch_webhook_event,
         db=db,
@@ -174,6 +177,8 @@ async def create_claim_with_file(
     db.commit()
     db.refresh(claim)
 
+    invalidate_policy_cache(current_user.id)
+
     background_tasks.add_task(
         dispatch_webhook_event,
         db=db,

backend/src/routes/webhooks.py

@@ -6,6 +6,7 @@
 from fastapi import APIRouter, Depends, status, Query
 from sqlalchemy.orm import Session
 
+from ..config import get_settings
 from ..database import get_db
 from ..dependencies import get_current_active_user
 from ..errors import StellarInsureError
@@ -32,6 +33,11 @@ def __init__(self, detail: str = "An active webhook with this URL already exists
         super().__init__(status.HTTP_409_CONFLICT, detail, "WEBHOOK_002")
 
 
+class WebhookLimitExceededError(StellarInsureError):
+    def __init__(self, detail: str = "Webhook limit reached for this user"):
+        super().__init__(status.HTTP_429_TOO_MANY_REQUESTS, detail, "WEBHOOK_003")
+
+
 def _format_webhook(webhook: Webhook) -> WebhookResponse:
     return WebhookResponse(
         id=webhook.id,
@@ -60,6 +66,15 @@ async def create_webhook(
     current_user: User = Depends(get_current_active_user),
     db: Session = Depends(get_db),
 ):
+    settings = get_settings()
+    webhook_count = (
+        db.query(Webhook)
+        .filter(Webhook.user_id == current_user.id)
+        .count()
+    )
+    if webhook_count >= settings.webhook_max_per_user:
+        raise WebhookLimitExceededError()
+
     existing = (
         db.query(Webhook)
         .filter(Webhook.user_id == current_user.id, Webhook.url == body.url, Webhook.is_active == True)

backend/tests/test_cache.py

@@ -150,3 +150,73 @@ def test_create_policy_invalidates_cache(self, client, auth_user, auth_headers):
         list_response = client.get("/policies/", headers=auth_headers)
         assert list_response.status_code == 200
         assert list_response.json()["total"] >= 1
+
+
+class TestClaimCacheInvalidation:
+    """Test that claim submission invalidates policy cache."""
+
+    def test_create_claim_text_invalidates_policy_cache(
+        self, client, auth_user, auth_headers, policy_factory
+    ):
+        """Text claim creation should trigger policy cache invalidation."""
+        policy = policy_factory(auth_user, coverage_amount=1000.0)
+
+        import src.routes.claims as claims_module
+        from unittest.mock import patch
+
+        with patch.object(claims_module, "invalidate_policy_cache") as mock_invalidate:
+            response = client.post(
+                "/claims/",
+                headers=auth_headers,
+                json={
+                    "policy_id": policy.id,
+                    "claim_amount": 300.0,
+                    "proof": "Satellite weather evidence",
+                },
+            )
+
+            assert response.status_code == 201
+            mock_invalidate.assert_called_once_with(auth_user.id)
+
+    def test_create_claim_file_upload_invalidates_policy_cache(
+        self, client, auth_user, auth_headers, policy_factory
+    ):
+        """File upload claim creation should trigger policy cache invalidation."""
+        from io import BytesIO
+        policy = policy_factory(auth_user, coverage_amount=1000.0)
+
+        import src.routes.claims as claims_module
+        from unittest.mock import patch
+
+        with patch.object(claims_module, "invalidate_policy_cache") as mock_invalidate:
+            response = client.post(
+                "/claims/upload",
+                headers=auth_headers,
+                data={"policy_id": str(policy.id), "claim_amount": "275.0"},
+                files={"file": ("proof.png", BytesIO(b"png"), "image/png")},
+            )
+
+            assert response.status_code == 201
+            mock_invalidate.assert_called_once_with(auth_user.id)
+
+    def test_create_claim_failure_does_not_invalidate_cache(
+        self, client, auth_user, auth_headers
+    ):
+        """Failed claim creation should NOT trigger policy cache invalidation."""
+        import src.routes.claims as claims_module
+        from unittest.mock import patch
+
+        with patch.object(claims_module, "invalidate_policy_cache") as mock_invalidate:
+            # Non-existent policy
+            response = client.post(
+                "/claims/",
+                headers=auth_headers,
+                json={
+                    "policy_id": 99999,
+                    "claim_amount": 300.0,
+                    "proof": "Satellite weather evidence",
+                },
+            )
+
+            assert response.status_code == 404
+            mock_invalidate.assert_not_called()

smartcontract/src/error.rs

@@ -46,4 +46,6 @@ pub enum Error {
     OracleConditionNotMet = 32,
     ProofTooLong = 33,
     ClaimAmountOverflow = 34,
+    PremiumOverflow = 35,
+    TriggerConditionTooLong = 36,
 }

smartcontract/src/lib.rs

@@ -49,6 +49,7 @@ pub use types::*;
 pub struct StellarInsure;
 
 const MAX_POLICIES: u64 = 1_000_000;
+const MAX_TRIGGER_CONDITION_LEN: u32 = 256;
 
 #[contractimpl]
 impl StellarInsure {
@@ -142,6 +143,10 @@ impl StellarInsure {
             return Err(Error::InvalidDuration);
         }
 
+        if trigger_condition.len() > MAX_TRIGGER_CONDITION_LEN {
+            return Err(Error::TriggerConditionTooLong);
+        }
+
         let policy_id = storage::get_policy_counter(&env);
         let max_policies = storage::get_max_policies(&env);
         if policy_id >= max_policies {
@@ -228,7 +233,7 @@ impl StellarInsure {
         }
 
         let total_premium = storage::get_total_premium(&env);
-        storage::set_total_premium(&env, total_premium + amount);
+        storage::set_total_premium(&env, total_premium.checked_add(amount).ok_or(Error::PremiumOverflow)?);
 
         events::publish_premium_paid(
             &env,
@@ -659,7 +664,7 @@ impl StellarInsure {
         );
 
         let total_premium = storage::get_total_premium(&env);
-        storage::set_total_premium(&env, total_premium + additional_premium);
+        storage::set_total_premium(&env, total_premium.checked_add(additional_premium).ok_or(Error::PremiumOverflow)?);
 
         let old_coverage = policy.coverage_amount;
         policy.coverage_amount = new_coverage;
@@ -720,7 +725,7 @@ impl StellarInsure {
         );
 
         let total_premium = storage::get_total_premium(&env);
-        storage::set_total_premium(&env, total_premium + additional_premium);
+        storage::set_total_premium(&env, total_premium.checked_add(additional_premium).ok_or(Error::PremiumOverflow)?);
 
         let old_end_time = policy.end_time;
         policy.end_time = old_end_time + extra_seconds;
@@ -1128,7 +1133,7 @@ impl StellarInsure {
         );
 
         let total_premium = storage::get_total_premium(&env);
-        storage::set_total_premium(&env, total_premium + renewal_premium);
+        storage::set_total_premium(&env, total_premium.checked_add(renewal_premium).ok_or(Error::PremiumOverflow)?);
 
         policy.premium = renewal_premium;
         policy.end_time = new_end_time;

smartcontract/src/test.rs

@@ -1578,6 +1578,108 @@ fn test_partial_claim_exceeding_remaining_coverage_is_rejected() {
     client.submit_claim(&policy_id, &100_000, &String::from_str(&env, "proof2"));
 }
 
+// ── Issue #379 — Trigger condition length check ───────────────────────────────
+
+#[test]
+fn test_create_policy_accepts_max_length_trigger_condition() {
+    let (env, contract_id, _admin, policyholder, _token) = setup_insurance_contract();
+    let client = StellarInsureClient::new(&env, &contract_id);
+
+    let sac = soroban_sdk::token::StellarAssetClient::new(&env, &_token);
+    sac.mint(&policyholder, &1_000_000);
+
+    // Exactly 256 characters (the limit)
+    let long_condition = "X".repeat(256);
+    let premium = client.calculate_premium(&PolicyType::Weather, &1_000_000, &2_592_000);
+    let policy_id = client.create_policy(
+        &policyholder,
+        &PolicyType::Weather,
+        &1_000_000,
+        &premium,
+        &2_592_000,
+        &String::from_str(&env, &long_condition),
+    );
+    assert_eq!(policy_id, 0);
+}
+
+#[test]
+#[should_panic(expected = "#36")]
+fn test_create_policy_rejects_oversized_trigger_condition() {
+    let (env, contract_id, _admin, policyholder, _token) = setup_insurance_contract();
+    let client = StellarInsureClient::new(&env, &contract_id);
+
+    let sac = soroban_sdk::token::StellarAssetClient::new(&env, &_token);
+    sac.mint(&policyholder, &1_000_000);
+
+    // 257 characters — exceeds the limit
+    let long_condition = "X".repeat(257);
+    let premium = client.calculate_premium(&PolicyType::Weather, &1_000_000, &2_592_000);
+    client.create_policy(
+        &policyholder,
+        &PolicyType::Weather,
+        &1_000_000,
+        &premium,
+        &2_592_000,
+        &String::from_str(&env, &long_condition),
+    );
+}
+
+// ── Issue #382 — Checked addition for total premium ────────────────────────────
+
+#[test]
+fn test_pay_premium_updates_total_premium() {
+    let (env, contract_id, _admin, policyholder, _token) = setup_insurance_contract();
+    let client = StellarInsureClient::new(&env, &contract_id);
+
+    let premium = client.calculate_premium(&PolicyType::Weather, &1_000_000, &2_592_000);
+    // Mint enough tokens for premium
+    let sac = soroban_sdk::token::StellarAssetClient::new(&env, &_token);
+    sac.mint(&policyholder, &premium);
+
+    let policy_id = client.create_policy(
+        &policyholder,
+        &PolicyType::Weather,
+        &1_000_000,
+        &premium,
+        &2_592_000,
+        &String::from_str(&env, "temperature < 0"),
+    );
+    client.pay_premium(&policy_id, &premium);
+
+    let stats = client.get_treasury_stats();
+    assert_eq!(stats.total_premium_collected, premium);
+}
+
+#[test]
+fn test_pay_premium_updates_total_premium_correctly() {
+    let (env, contract_id, _admin, policyholder, _token) = setup_insurance_contract();
+    let client = StellarInsureClient::new(&env, &contract_id);
+
+    let premium = client.calculate_premium(&PolicyType::Weather, &1_000_000, &2_592_000);
+    let two_premiums = premium.checked_mul(2).unwrap();
+    let sac = soroban_sdk::token::StellarAssetClient::new(&env, &_token);
+    sac.mint(&policyholder, &two_premiums);
+
+    let policy_id = client.create_policy(
+        &policyholder,
+        &PolicyType::Weather,
+        &1_000_000,
+        &premium,
+        &2_592_000,
+        &String::from_str(&env, "temperature < 0"),
+    );
+    client.pay_premium(&policy_id, &premium);
+
+    let stats = client.get_treasury_stats();
+    assert_eq!(stats.total_premium_collected, premium);
+
+    // A second premium payment on the same policy also increases the total
+    client.pay_premium(&policy_id, &premium);
+
+    let stats = client.get_treasury_stats();
+    assert_eq!(stats.total_premium_collected, two_premiums);
+}
+
 // ── Issue #381 — Checked arithmetic ───────────────────────────────────────────
 
 #[test]