Merge pull request #154 from rohan911438/feat/auth-security-rate-limit

feat: implement auth security, replay protection and API rate limiting

Author: Jaydbrown

.env.example

@@ -24,6 +24,12 @@ PORT=3000
 # Valid values: development | production | test
 # Default: development
 NODE_ENV=development
+AUTH_CHALLENGE_LIMIT=10
+AUTH_CHALLENGE_WINDOW=60000
+PUBLIC_LIMIT=60
+PUBLIC_WINDOW=60000
+REFRESH_TOKEN_TTL=604800
+NONCE_TTL=900
 
 # -----------------------------------------------------------------------------
 # Authentication & Security

SECURITY.md

@@ -79,9 +79,12 @@ Never commit `.env` files. Use environment-specific secret management (Vault, AW
 
 ### API Security
 
-- **Rate limiting** on escrow, shipment, and auth endpoints
+- All API access (except public webhooks and SEP-10 challenge generation) requires a valid JWT.
+- JWTs are short-lived (1 hour) and signed using HMAC (HS256) with a secret rotation policy.
+- **Refresh Token Rotation**: Refresh tokens are issued alongside access tokens. Upon refresh, the old token is revoked and a new pair is issued. Reuse of a revoked refresh token immediately invalidates the entire token family to prevent hijacking.
+- **Replay Attack Prevention**: SEP-10 challenge transactions generate a cryptographically secure nonce stored in the database. Challenges are strictly single-use and expire within 15 minutes. Replay attempts with a previously used challenge transaction are rejected.
+- **Rate Limiting (Throttler)**: Public endpoints are protected against abuse and DDoS attacks. The SEP-10 challenge endpoint is limited to 10 requests per minute per IP. The Escrow query endpoints are limited to 60 requests per minute per IP.
 - **Input validation** via `class-validator` and Stellar SDK address checks
-- **SEP-10 authentication** with JWT (1-hour expiry) and challenge replay protection
 - **Security headers** via middleware: `X-Content-Type-Options`, `X-Frame-Options`, `X-XSS-Protection`, `Referrer-Policy`
 
 ### Operational Security

package.json

@@ -38,6 +38,7 @@
     "@nestjs/config": "^4.0.0",
     "@nestjs/core": "^11.0.1",
     "@nestjs/platform-express": "^11.0.1",
+    "@nestjs/throttler": "^6.3.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/auto-instrumentations-node": "^0.76.0",
     "@opentelemetry/core": "^2.7.1",

prisma/migrations/20260529000000_security_updates/migration.sql

@@ -0,0 +1,40 @@
+-- CreateTable
+CREATE TABLE "RefreshToken" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "parentTokenId" TEXT,
+    "revoked" BOOLEAN NOT NULL DEFAULT false,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RefreshToken_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Nonce" (
+    "id" TEXT NOT NULL,
+    "nonce" TEXT NOT NULL,
+    "walletAddress" TEXT NOT NULL,
+    "challenge" TEXT NOT NULL,
+    "used" BOOLEAN NOT NULL DEFAULT false,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "Nonce_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "RefreshToken_tokenHash_key" ON "RefreshToken"("tokenHash");
+
+-- CreateIndex
+CREATE INDEX "RefreshToken_userId_idx" ON "RefreshToken"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Nonce_nonce_key" ON "Nonce"("nonce");
+
+-- CreateIndex
+CREATE INDEX "Nonce_walletAddress_idx" ON "Nonce"("walletAddress");
+
+-- CreateIndex
+CREATE INDEX "Escrow_vendorAddress_state_idx" ON "Escrow"("vendorAddress", "state");

prisma/schema.prisma

@@ -40,6 +40,7 @@ model Escrow {
 
   @@index([vendorAddress])
   @@index([buyerAddress])
+  @@index([vendorAddress, state])
 }
 
 model Dispute {
@@ -164,3 +165,27 @@ model ProcessedWebhookEvent {
 
   @@index([processedAt])
 }
+
+model RefreshToken {
+  id            String   @id @default(cuid())
+  userId        String
+  tokenHash     String   @unique
+  parentTokenId String?
+  revoked       Boolean  @default(false)
+  expiresAt     DateTime
+  createdAt     DateTime @default(now())
+
+  @@index([userId])
+}
+
+model Nonce {
+  id            String   @id @default(cuid())
+  nonce         String   @unique
+  walletAddress String
+  challenge     String
+  used          Boolean  @default(false)
+  expiresAt     DateTime
+  createdAt     DateTime @default(now())
+
+  @@index([walletAddress])
+}

src/app.module.ts

@@ -1,5 +1,6 @@
 import { MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
 import { APP_FILTER, APP_GUARD } from '@nestjs/core';
+import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';
 import { AdminStatsModule } from './admin/stats/admin-stats.module';
 import { DisputeModule as AdminDisputeModule } from './admin/dispute/dispute.module';
 import { QueueDashboardModule } from './admin/queues/queue-dashboard.module';
@@ -10,7 +11,6 @@ import { AppController } from './app.controller';
 import { AppService } from './app.service';
 import { Sep10Module } from './auth/sep10/sep10.module';
 import { GlobalExceptionFilter } from './common/filters/global-exception.filter';
-import { RateLimitGuard } from './common/guards/rate-limit.guard';
 import { LoggerModule } from './common/logger/logger.module';
 import { LoggerMiddleware } from './common/middleware/logger.middleware';
 import { SecurityMiddleware } from './common/middleware/security.middleware';
@@ -54,6 +54,23 @@ import { CacheService } from './common/cache.service';
     // Webhook receivers
     WebhooksModule, // issue #76 – POST /webhooks/stellar
     StressTestModule,
+    
+    ThrottlerModule.forRootAsync({
+      imports: [ConfigModule],
+      inject: [ConfigService],
+      useFactory: (config: ConfigService) => [
+        {
+          name: 'auth',
+          ttl: config.get<number>('AUTH_CHALLENGE_WINDOW') || 60000,
+          limit: config.get<number>('AUTH_CHALLENGE_LIMIT') || 10,
+        },
+        {
+          name: 'public',
+          ttl: config.get<number>('PUBLIC_WINDOW') || 60000,
+          limit: config.get<number>('PUBLIC_LIMIT') || 60,
+        },
+      ],
+    }),
   ],
   controllers: [AppController],
   providers: [
@@ -65,7 +82,7 @@ import { CacheService } from './common/cache.service';
     },
     {
       provide: APP_GUARD,
-      useClass: RateLimitGuard,
+      useClass: ThrottlerGuard,
     },
   ],
 })

src/auth/sep10/sep10.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Get, HttpCode, HttpStatus, Post, Query } from '@nestjs/common';
 import { IsString, MinLength } from 'class-validator';
+import { SkipThrottle } from '@nestjs/throttler';
 import { IsStellarAddress } from '../../common/validators/stellar-address.validator';
 import { Sep10Service } from './sep10.service';
 
@@ -15,14 +16,20 @@ class VerifyChallengeDto {
   transaction!: string;
 }
 
+class RefreshTokenDto {
+  @IsString()
+  @MinLength(1)
+  refreshToken!: string;
+}
+
 @Controller('auth')
 export class Sep10Controller {
   constructor(private readonly sep10Service: Sep10Service) {}
 
   /** GET /auth?account=<G...> — issue a SEP-10 challenge (legacy) */
   @Get()
-  challengeGet(@Query('account') account: string) {
-    return { transaction: this.sep10Service.buildChallenge(account) };
+  async challengeGet(@Query('account') account: string) {
+    return { transaction: await this.sep10Service.buildChallenge(account) };
   }
 
   /**
@@ -32,17 +39,24 @@ export class Sep10Controller {
    */
   @Post('challenge')
   @HttpCode(HttpStatus.OK)
-  challengePost(@Body() dto: ChallengeRequestDto) {
+  @SkipThrottle({ public: true }) // Skip the public 60 req/min limit, only apply auth 10 req/min
+  async challengePost(@Body() dto: ChallengeRequestDto) {
     return {
-      transaction: this.sep10Service.buildChallenge(dto.publicKey, 900),
+      transaction: await this.sep10Service.buildChallenge(dto.publicKey, 900),
       network_passphrase: this.sep10Service.getNetworkPassphrase(),
     };
   }
 
   /** POST /auth { transaction: "<signed-base64-xdr>" } — verify and issue JWT */
   @Post()
-  verify(@Body() dto: VerifyChallengeDto) {
-    const token = this.sep10Service.verifyAndIssueToken(dto.transaction);
-    return { token };
+  async verify(@Body() dto: VerifyChallengeDto) {
+    return await this.sep10Service.verifyAndIssueToken(dto.transaction);
+  }
+
+  /** POST /auth/refresh { refreshToken } — rotate refresh token */
+  @Post('refresh')
+  @HttpCode(HttpStatus.OK)
+  async refresh(@Body() dto: RefreshTokenDto) {
+    return await this.sep10Service.rotateRefreshToken(dto.refreshToken);
   }
 }

src/auth/sep10/sep10.module.ts

@@ -1,8 +1,10 @@
 import { Module } from '@nestjs/common';
 import { Sep10Controller } from './sep10.controller';
 import { Sep10Service } from './sep10.service';
+import { PrismaModule } from '../../prisma/prisma.module';
 
 @Module({
+  imports: [PrismaModule],
   controllers: [Sep10Controller],
   providers: [Sep10Service],
   exports: [Sep10Service],