Merge branch 'main' into fix/issue-5-oracle-secret-key-masking

Author: Smartdevs17

api/src/__tests__/validation.test.ts

@@ -1,52 +1,96 @@
 import request from 'supertest';
 import app from '../app';
 
+const VALID_ADDRESS = 'GDZZJ3UPZZCKY5DBH6ZGMPMRORRBG4ECIORASBUAXPPNCL4SYRHNLYU2';
+
 describe('Validation Middleware', () => {
   describe('Prepare Validation (GET /api/lending/prepare/:operation)', () => {
     it('should reject empty userAddress', async () => {
       const response = await request(app)
         .get('/api/lending/prepare/deposit')
-        .send({ amount: '1000000' });
+        .query({ amount: '1000000' });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error).toContain('User address is required');
+    });
+
+    it('should reject invalid Stellar public key', async () => {
+      const response = await request(app).get('/api/lending/prepare/deposit').query({
+        userAddress: 'invalid-address',
+        assetAddress: 'G...',
+        amount: '100',
+      });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error).toContain('Invalid Stellar address');
+    });
+
+    it('should reject Stellar address with wrong prefix', async () => {
+      const response = await request(app).get('/api/lending/prepare/deposit').query({
+        userAddress: 'S...', // Secret key prefix
+        assetAddress: 'G...',
+        amount: '100',
+      });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error).toContain('Invalid Stellar address');
+    });
+
+    it('should accept valid Stellar public key', async () => {
+      const response = await request(app).get('/api/lending/prepare/deposit').query({
+        userAddress: VALID_ADDRESS,
+        assetAddress: 'G...',
+        amount: '100',
+      });
+
+      expect(response.status).not.toBe(400);
+    });
+
+    it('should reject missing amount', async () => {
+      const response = await request(app).get('/api/lending/prepare/deposit').query({
+        userAddress: VALID_ADDRESS,
+        assetAddress: 'G...',
+      });
 
       expect(response.status).toBe(400);
+      expect(response.body.error).toContain('Amount is required');
     });
 
     it('should reject zero amount', async () => {
-      const response = await request(app).get('/api/lending/prepare/deposit').send({
-        userAddress: 'GXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
+      const response = await request(app).get('/api/lending/prepare/deposit').query({
+        userAddress: VALID_ADDRESS,
+        assetAddress: 'G...',
         amount: '0',
       });
 
       expect(response.status).toBe(400);
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error).toContain('Amount must be greater than 0');
     });
 
     it('should reject negative amount', async () => {
-      const response = await request(app).get('/api/lending/prepare/deposit').send({
-        userAddress: 'GXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
-        amount: '-1000',
+      const response = await request(app).get('/api/lending/prepare/deposit').query({
+        userAddress: VALID_ADDRESS,
+        assetAddress: 'G...',
+        amount: '-1',
       });
 
       expect(response.status).toBe(400);
+      expect(response.body.error).toBeDefined();
+      expect(response.body.error).toContain('Amount must be greater than 0');
     });
 
     it('should reject invalid operation', async () => {
-      const response = await request(app).get('/api/lending/prepare/invalid_op').send({
-        userAddress: 'GXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',
+      const response = await request(app).get('/api/lending/prepare/invalid_op').query({
+        userAddress: 'GDH7NBM22WUCYOLJJZ7ALN3QZ6W2G5YCHDP2YQWJZ76L2GZFPHSYZ4Y3',
         amount: '1000000',
       });
 
       expect(response.status).toBe(400);
     });
-
-    it('should not require userSecret', async () => {
-      // Sending userSecret should not cause a validation error (it's simply ignored)
-      // The route should still validate normally without it
-      const response = await request(app)
-        .get('/api/lending/prepare/deposit')
-        .send({ amount: '1000000' }); // missing userAddress — should still be 400
-
-      expect(response.status).toBe(400);
-    });
   });
 
   describe('Submit Validation (POST /api/lending/submit)', () => {

api/src/controllers/lending.controller.ts

@@ -6,7 +6,7 @@ import logger from '../utils/logger';
 export const prepare = async (req: Request, res: Response, next: NextFunction) => {
   try {
     const operation = req.params.operation as LendingOperation;
-    const { userAddress, assetAddress, amount } = req.body;
+    const { userAddress, assetAddress, amount } = { ...req.query, ...req.body } as any;
 
     logger.info('Preparing unsigned transaction', { operation, userAddress, amount });
 

api/src/middleware/validation.ts

@@ -1,6 +1,7 @@
-import { body, param, validationResult } from 'express-validator';
+import { body, param, validationResult, check } from 'express-validator';
 import { Request, Response, NextFunction } from 'express';
 import { ValidationError } from '../utils/errors';
+import { StrKey } from '@stellar/stellar-sdk';
 
 const VALID_OPERATIONS = ['deposit', 'borrow', 'repay', 'withdraw'];
 
@@ -16,23 +17,29 @@ export const validateRequest = (req: Request, res: Response, next: NextFunction)
   next();
 };
 
-const amountValidation = body('amount')
-  .isString()
-  .notEmpty()
-  .withMessage('Amount is required')
-  .custom((value) => {
-    const num = BigInt(value);
-    return num > 0n;
-  })
-  .withMessage('Amount must be greater than zero');
+export const amountValidation = [
+  check('amount')
+    .notEmpty()
+    .withMessage('Amount is required')
+    .isFloat({ min: 0.0000001 })
+    .withMessage('Amount must be greater than 0'),
+];
 
 export const prepareValidation = [
   param('operation')
     .isIn(VALID_OPERATIONS)
     .withMessage(`Operation must be one of: ${VALID_OPERATIONS.join(', ')}`),
-  body('userAddress').isString().notEmpty().withMessage('User address is required'),
-  amountValidation,
-  body('assetAddress').optional().isString(),
+  check('userAddress')
+    .notEmpty()
+    .withMessage('User address is required')
+    .custom((value) => {
+      if (!StrKey.isValidEd25519PublicKey(value)) {
+        throw new Error('Invalid Stellar address');
+      }
+      return true;
+    }),
+  ...amountValidation,
+  check('assetAddress').optional().isString().notEmpty().withMessage('Asset address is required'),
   validateRequest,
 ];
 

stellar-lend/contracts/hello-world/src/errors.rs

@@ -28,12 +28,12 @@ pub enum GovernanceError {
     ExecutionFailed = 122,
     InvalidMultisigConfig = 123,
     InsufficientApprovals = 124,
-    RecoveryInProgress = 125,
-    NoRecoveryInProgress = 126,
-    InvalidGuardianConfig = 127,
-    GuardianAlreadyExists = 128,
-    GuardianNotFound = 129,
-    MathOverflow = 130,
+    InvalidProposalType = 125,
+    GuardianAlreadyExists = 126,
+    GuardianNotFound = 127,
+    InvalidGuardianConfig = 128,
+    RecoveryInProgress = 129,
+    NoRecoveryInProgress = 130,
     Unauthorized = 131,
     AlreadyInitialized = 132,
     NotInitialized = 133,