Merge pull request AgesEmpire#637 from charityagbenu12-cmd/issue-fixes/webhook-reserve-retry

Issue fixes/webhook reserve retry

Author: Mathews-25

src/assets/reserve-monitor/jobs/monitor-reserves.job.ts

@@ -0,0 +1,27 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ReserveMonitorService } from '../reserve-monitor.service';
+import { ConfigService } from '@nestjs/config';
+
+@Injectable()
+export class MonitorReservesJob {
+  private readonly logger = new Logger(MonitorReservesJob.name);
+  constructor(private readonly service: ReserveMonitorService, private readonly config: ConfigService) {}
+
+  async run(): Promise<void> {
+    const cfg = this.config.get<string>('RESERVE_ASSETS') || ''; // format: CODE:ISSUER:THRESHOLD,CSV
+    if (!cfg) return this.logger.debug('No RESERVE_ASSETS configured');
+    const entries = cfg.split(',').map((s) => s.trim()).filter(Boolean);
+    for (const e of entries) {
+      const parts = e.split(':');
+      const code = parts[0];
+      const issuer = parts[1];
+      const threshold = parseFloat(parts[2] || '0');
+      const res = await this.service.checkAssetReserve(code, issuer, threshold);
+      if (res.below) {
+        this.logger.warn(`Reserve alert for ${code}:${issuer} — current=${res.current} threshold=${threshold}`);
+      } else {
+        this.logger.log(`Reserve OK for ${code}:${issuer} — current=${res.current}`);
+      }
+    }
+  }
+}

src/assets/reserve-monitor/reserve-monitor.service.spec.ts

@@ -0,0 +1,14 @@
+import { ReserveMonitorService } from './reserve-monitor.service';
+import { ConfigService } from '@nestjs/config';
+
+describe('ReserveMonitorService', () => {
+  let service: ReserveMonitorService;
+  beforeEach(() => {
+    const cfg = { get: (k: string) => 'https://horizon-testnet.stellar.org' } as unknown as ConfigService;
+    service = new ReserveMonitorService(cfg);
+  });
+
+  it('evaluates threshold correctly', () => {
+    expect(service).toBeDefined();
+  });
+});

src/assets/reserve-monitor/reserve-monitor.service.ts

@@ -0,0 +1,34 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Server } from 'stellar-sdk';
+import { ConfigService } from '@nestjs/config';
+import { isBelowThreshold } from './utils/threshold-evaluator';
+
+@Injectable()
+export class ReserveMonitorService {
+  private readonly logger = new Logger(ReserveMonitorService.name);
+  private server: Server;
+
+  constructor(private readonly config: ConfigService) {
+    this.server = new Server(this.config.get<string>('HORIZON_URL') || 'https://horizon-testnet.stellar.org');
+  }
+
+  async checkAssetReserve(assetCode: string, issuer: string, threshold: number): Promise<{ below: boolean; current: number }> {
+    try {
+      const account = await this.server.loadAccount(issuer);
+      const bal = account.balances || [];
+      if (assetCode === 'XLM') {
+        const native = bal.find((b: any) => b.asset_type === 'native');
+        const current = parseFloat(native?.balance || '0');
+        return { below: isBelowThreshold(current, threshold), current };
+      }
+
+      const found = bal.find((b: any) => b.asset_code === assetCode && b.asset_issuer === issuer);
+      const current = parseFloat(found?.balance || '0');
+      return { below: isBelowThreshold(current, threshold), current };
+    } catch (err) {
+      this.logger.error(`Failed to fetch reserve for ${assetCode}:${issuer}`, err);
+      // On error consider it below to trigger alerting downstream
+      return { below: true, current: 0 };
+    }
+  }
+}

src/assets/reserve-monitor/utils/threshold-evaluator.ts

@@ -0,0 +1,3 @@
+export function isBelowThreshold(current: number, threshold: number): boolean {
+  return current < threshold;
+}

src/integrations/webhooks/utils/signature-validator.ts

@@ -0,0 +1,12 @@
+import * as crypto from 'crypto';
+
+export function verifyHmacSHA256(rawBody: string, signatureHeader: string, secret: string): boolean {
+  if (!signatureHeader || !secret) return false;
+  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
+  // header may be like "sha256=..." or raw hex
+  const received = signatureHeader.replace(/^sha256=/, '');
+  const rb = Buffer.from(received, 'hex');
+  const eb = Buffer.from(expected, 'hex');
+  if (rb.length !== eb.length) return false;
+  return crypto.timingSafeEqual(rb, eb);
+}

src/integrations/webhooks/webhook-verifier.service.spec.ts

@@ -0,0 +1,29 @@
+import { ConfigService } from '@nestjs/config';
+import { WebhookVerifierService } from './webhook-verifier.service';
+import * as crypto from 'crypto';
+
+describe('WebhookVerifierService', () => {
+  let service: WebhookVerifierService;
+  const secret = 'test-secret';
+  beforeEach(() => {
+    const config = { get: (k: string) => secret } as unknown as ConfigService;
+    service = new WebhookVerifierService(config);
+  });
+
+  it('validates correct signature', () => {
+    const body = JSON.stringify({ hello: 'world' });
+    const sig = 'sha256=' + crypto.createHmac('sha256', secret).update(body).digest('hex');
+    expect(service.validate(body, sig)).toBe(true);
+  });
+
+  it('rejects incorrect signature', () => {
+    const body = 'x';
+    const sig = 'sha256=' + crypto.createHmac('sha256', 'other').update(body).digest('hex');
+    try {
+      service.validate(body, sig);
+      throw new Error('should have thrown');
+    } catch (err) {
+      expect(err.status).toBe(401);
+    }
+  });
+});

src/integrations/webhooks/webhook-verifier.service.ts

@@ -0,0 +1,19 @@
+import { Injectable, UnauthorizedException, Logger } from '@nestjs/common';
+import { verifyHmacSHA256 } from './utils/signature-validator';
+import { ConfigService } from '@nestjs/config';
+
+@Injectable()
+export class WebhookVerifierService {
+  private readonly logger = new Logger(WebhookVerifierService.name);
+  constructor(private readonly config: ConfigService) {}
+
+  validate(rawBody: string, signatureHeader?: string, providerKeyName = 'WEBHOOK_SIGNING_KEY'): boolean {
+    const secret = this.config.get<string>(providerKeyName) || '';
+    const ok = verifyHmacSHA256(rawBody, signatureHeader || '', secret);
+    if (!ok) {
+      this.logger.warn('Invalid webhook signature');
+      throw new UnauthorizedException('Invalid webhook signature');
+    }
+    return true;
+  }
+}

src/stake-verification/stake-verification.service.spec.ts

@@ -0,0 +1,29 @@
+import { StakeVerificationService } from './stake-verification.service';
+import { ConfigService } from '@nestjs/config';
+
+const makeService = () => {
+  const cfg = { get: (k: string) => 'https://example.org' } as unknown as ConfigService;
+  const cache = { get: jest.fn(), set: jest.fn(), del: jest.fn() } as any;
+  const svc = new StakeVerificationService(cfg, cache);
+  // patch private query method
+  return { svc, cache };
+};
+
+describe('StakeVerificationService', () => {
+  it('verifies eligible provider', async () => {
+    const { svc } = makeService();
+    // @ts-ignore
+    svc.queryStakeFromSoroban = jest.fn(async () => '2000');
+    const res = await svc.verifyProviderStake({ publicKey: 'GABC' } as any);
+    expect(res.verified).toBe(true);
+    expect(res.stakeAmount).toBe('2000');
+  });
+
+  it('rejects ineligible provider', async () => {
+    const { svc } = makeService();
+    // @ts-ignore
+    svc.queryStakeFromSoroban = jest.fn(async () => '10');
+    const res = await svc.verifyProviderStake({ publicKey: 'GXYZ' } as any);
+    expect(res.verified).toBe(false);
+  });
+});

src/transactions/transaction-retry.service.spec.ts

@@ -0,0 +1,29 @@
+import { TransactionRetryService } from './transaction-retry.service';
+
+describe('TransactionRetryService', () => {
+  let service: TransactionRetryService;
+  beforeEach(() => (service = new TransactionRetryService()));
+
+  it('retries transient failures and succeeds', async () => {
+    let calls = 0;
+    const work = jest.fn(async () => {
+      calls += 1;
+      if (calls < 2) throw new Error('timeout');
+      return 'tx123';
+    });
+
+    const res = await service.runWithRetry(work, 3, 1);
+    expect(res.success).toBe(true);
+    expect(res.txId).toBe('tx123');
+    expect(res.attempts).toBe(2);
+  });
+
+  it('fails on permanent errors without retrying all attempts', async () => {
+    const work = jest.fn(async () => {
+      throw new Error('invalid signature');
+    });
+    const res = await service.runWithRetry(work, 3, 1);
+    expect(res.success).toBe(false);
+    expect(res.attempts).toBe(1);
+  });
+});

src/transactions/transaction-retry.service.ts

@@ -0,0 +1,33 @@
+import { Injectable, Logger } from '@nestjs/common';
+
+export type TxWork = () => Promise<string>; // returns tx id on success
+
+@Injectable()
+export class TransactionRetryService {
+  private readonly logger = new Logger(TransactionRetryService.name);
+
+  async runWithRetry(work: TxWork, attempts = 3, baseBackoff = 500): Promise<{ success: boolean; txId?: string; error?: string; attempts: number }> {
+    let attempt = 0;
+    while (attempt < attempts) {
+      attempt += 1;
+      try {
+        const txId = await work();
+        this.logger.log(`Transaction succeeded on attempt ${attempt}: ${txId}`);
+        return { success: true, txId, attempts: attempt };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        this.logger.warn(`Transaction attempt ${attempt} failed: ${msg}`);
+        // Simple heuristic: treat network/timeouts as transient if message contains certain words
+        const transient = /timeout|timed out|ECONNRESET|ETIMEDOUT|temporar/i.test(msg);
+        if (attempt >= attempts || !transient) {
+          this.logger.error(`Giving up after ${attempt} attempts: ${msg}`);
+          return { success: false, error: msg, attempts: attempt };
+        }
+        const delay = baseBackoff * Math.pow(2, attempt - 1);
+        this.logger.log(`Retrying in ${delay}ms...`);
+        await new Promise((r) => setTimeout(r, delay));
+      }
+    }
+    return { success: false, error: 'unknown', attempts };
+  }
+}