Merge branch 'main' into Resolved

Author: BrightHeart23

IMPLEMENTATION_COMPLETE.md

@@ -0,0 +1,44 @@
+# Add Secure Admin-Controlled Contract Upgrade (Safe Upgrade Pattern)
+
+## Summary
+
+This PR implements a secure, admin-controlled contract upgrade pattern ("Safe Upgrade" / Admin Proxy) for the VaultixEscrow Soroban contract. It allows protocol maintainers to fix bugs or add features without migrating all state and users to a new contract address.
+
+## Key Changes
+
+- **Upgrade Functionality:**  
+  - Added `upgrade(env, new_wasm_hash: [u8; 32])` to the contract, callable only by the admin.
+  - Emits a `ContractUpgraded` event before performing the upgrade.
+  - Enforces strict access control (admin-only).
+  - Documents storage compatibility requirements for future upgrades.
+
+- **Testing:**  
+  - Integration test verifies:
+    - State is preserved across upgrades.
+    - Unauthorized users cannot trigger upgrades.
+    - New contract logic is accessible after upgrade.
+
+## Motivation
+
+Soroban allows contract upgrades via `env.deployer().update_current_contract_wasm`. This PR wraps that capability in a secure, admin-controlled function to ensure only authorized upgrades, protecting user funds and protocol integrity.
+
+## Acceptance Criteria
+
+- [x] `upgrade` function exists and is admin-protected.
+- [x] Emits upgrade event.
+- [x] Storage compatibility is documented.
+- [x] Integration test proves code can be swapped while keeping escrow storage intact.
+- [x] Unauthorized users cannot trigger an upgrade.
+
+## Non-Goals
+
+- DAO-voting based upgrades (admin-only for now).
+
+---
+
+**Reviewer Notes:**  
+- Please review the storage compatibility comment for future upgrade safety.
+- All tests pass (`cargo test`).
+- No breaking changes to existing escrow logic.
+
+---

IMPLEMENTATION_SUMMARY.md

@@ -1,15 +1,20 @@
 # Database Configuration
 DATABASE_PATH=./data/vaultix.db
 
-# JWT Configuration
-JWT_SECRET=your-super-secret-jwt-key-change-in-production
+# JWT Configuration (Required at startup, minimum 32 characters long)
+JWT_SECRET=your-32-character-minimum-super-secret-key-here
 JWT_EXPIRES_IN=15m
 
 # Environment
 NODE_ENV=development
 
 # Server Configuration
 PORT=3000
+ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001
+
+# Health Check Configuration
+# Max time (ms) each dependency probe may take before being reported as down
+HEALTH_CHECK_TIMEOUT_MS=5000
 
 # Stellar Configuration
 STELLAR_NETWORK=testnet
@@ -24,6 +29,23 @@ SMTP_PORT=587
 SMTP_USER=your-smtp-user
 SMTP_PASS=your-smtp-password
 EMAIL_FROM=no-reply@vaultix.io
+EMAIL_MAX_ATTEMPTS=5
+EMAIL_RETRY_BASE_DELAY_MS=60000
+
+# Webhook Delivery Configuration
+# Max delivery attempts before a webhook moves to the dead letter queue
+WEBHOOK_MAX_ATTEMPTS=6
+# Backoff schedule in ms (1m, 5m, 30m, 2h, 12h, 24h)
+WEBHOOK_RETRY_SCHEDULE_MS=60000,300000,1800000,7200000,43200000,86400000
+# Outbound request timeout in ms
+WEBHOOK_REQUEST_TIMEOUT_MS=30000
+# Alert when failure rate (%) in the window exceeds this threshold
+WEBHOOK_ALERT_FAILURE_RATE_THRESHOLD=25
+WEBHOOK_ALERT_MIN_DELIVERIES=10
+WEBHOOK_ALERT_WINDOW_MINUTES=60
+# Base URL used to build email verification links (defaults to API_BASE_URL + /auth/profile/verify-email)
+API_BASE_URL=http://localhost:3000
+#EMAIL_VERIFICATION_BASE_URL=https://app.vaultix.io/verify-email
 
 # App Version Gating
 APP_MIN_SUPPORTED_VERSION=1.0.0

PR_MESSAGE.md

@@ -0,0 +1 @@
+import 'reflect-metadata';