fix: issues 557, 558, 559, 560 (#564)

Co-authored-by: unrealtim-tech <jigah4thjuly@gmail.com>
Co-authored-by: Emmanuel Chukwunyere <emmanuelanalaba@gmail.com>

Author: 3 people

.env.example

@@ -2,6 +2,7 @@ NEXT_PUBLIC_STELLAR_NETWORK=testnet
 NEXT_PUBLIC_CONTRACT_ID=YOUR_CONTRACT_ID_HERE
 NEXT_PUBLIC_RPC_URL=https://soroban-testnet.stellar.org
 API_KEY_SIGNING_SECRET=replace-with-a-long-random-server-secret
+CSRF_SECRET=replace-with-a-long-random-server-secret
 
 # Generate with: npx web-push generate-vapid-keys
 NEXT_PUBLIC_VAPID_PUBLIC_KEY=replace-with-vapid-public-key

src/app/api/api-keys/route.ts

@@ -1,12 +1,16 @@
 import { NextRequest, NextResponse } from "next/server";
 import { type ApiKeyScope } from "@/lib/apiKeys";
 import { generateSignedApiKey } from "@/lib/signedApiKeys";
+import { assertCsrf } from "@/lib/middleware/csrfMiddleware";
 
 function isScope(value: unknown): value is ApiKeyScope {
   return value === "read" || value === "write";
 }
 
 export async function POST(request: NextRequest) {
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
   const body = await request.json().catch(() => null);
   const scope = body?.scope;
 

src/app/api/csrf/route.ts

@@ -0,0 +1,8 @@
+import { NextResponse } from "next/server";
+import { generateCsrfToken } from "@/lib/csrf";
+
+/** GET /api/csrf — issues a fresh CSRF token, valid for 60 minutes. */
+export async function GET() {
+  const { token, expiresAt } = await generateCsrfToken();
+  return NextResponse.json({ token, expiresAt });
+}

src/app/api/dev/faucet/route.ts

@@ -0,0 +1,72 @@
+import { NextRequest, NextResponse } from "next/server";
+import { StrKey } from "@stellar/stellar-sdk";
+import { assertCsrf } from "@/lib/middleware/csrfMiddleware";
+
+const HORIZON_URL =
+  process.env.NEXT_PUBLIC_HORIZON_URL ??
+  (process.env.NEXT_PUBLIC_STELLAR_NETWORK === "mainnet"
+    ? "https://horizon.stellar.org"
+    : "https://horizon-testnet.stellar.org");
+
+const FRIENDBOT_URL = "https://friendbot.stellar.org";
+
+/**
+ * Dev-only proxy for the Stellar testnet Friendbot. Never available in
+ * production — guarded both by NODE_ENV and by the app only rendering the
+ * widget that calls this route on testnet.
+ *
+ * POST /api/dev/faucet  { publicKey: string }
+ */
+export async function POST(request: NextRequest) {
+  if (process.env.NODE_ENV === "production" || process.env.NEXT_PUBLIC_STELLAR_NETWORK === "mainnet") {
+    return NextResponse.json({ error: "Faucet is not available in this environment" }, { status: 403 });
+  }
+
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
+  let publicKey: unknown;
+  try {
+    ({ publicKey } = await request.json());
+  } catch {
+    return NextResponse.json({ error: "Invalid request body" }, { status: 400 });
+  }
+
+  if (typeof publicKey !== "string" || !StrKey.isValidEd25519PublicKey(publicKey)) {
+    return NextResponse.json({ error: "A valid Stellar public key is required" }, { status: 400 });
+  }
+
+  const friendbotResponse = await fetch(`${FRIENDBOT_URL}?addr=${encodeURIComponent(publicKey)}`);
+
+  if (!friendbotResponse.ok) {
+    let detail: string | undefined;
+    try {
+      const body = await friendbotResponse.json();
+      detail = body?.detail;
+    } catch {
+      // Friendbot didn't return JSON — fall through with no detail.
+    }
+
+    if (friendbotResponse.status === 400) {
+      // Friendbot returns 400 when the account already exists / is already funded.
+      return NextResponse.json(
+        { alreadyFunded: true, message: detail ?? "This account is already funded." },
+        { status: 200 }
+      );
+    }
+
+    return NextResponse.json(
+      { error: detail ?? "Friendbot request failed" },
+      { status: 502 }
+    );
+  }
+
+  const account = await fetch(`${HORIZON_URL}/accounts/${publicKey}`).then((res) =>
+    res.ok ? res.json() : null
+  );
+
+  const nativeBalance = account?.balances?.find((b: any) => b.asset_type === "native");
+  const xlm = nativeBalance ? (parseFloat(nativeBalance.balance) || 0).toFixed(7) : null;
+
+  return NextResponse.json({ funded: true, xlm });
+}

src/app/api/invoices/[id]/address-change-requests/[requestId]/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import type { AddressChangeRequestStatus } from '@/types/addressChangeRequest';
+import { assertCsrf } from '@/lib/middleware/csrfMiddleware';
 
 // Import the store (in real implementation, would use database)
 // For now using a simple in-memory approach (would be shared across routes)
@@ -9,6 +10,9 @@ export async function PATCH(
   request: NextRequest,
   { params }: { params: { id: string; requestId: string } }
 ) {
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
   try {
     const { id: invoiceId, requestId } = params;
     const body = await request.json();

src/app/api/invoices/[id]/address-change-requests/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import type { AddressChangeRequest, AddressChangeRequestStatus } from '@/types/addressChangeRequest';
+import { assertCsrf } from '@/lib/middleware/csrfMiddleware';
 
 // In-memory store for address change requests
 // In production, this would use a database
@@ -41,6 +42,9 @@ export async function POST(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
   try {
     const invoiceId = params.id;
     const body = await request.json();

src/app/api/invoices/[id]/comments/[commentId]/reactions/route.ts

@@ -1,10 +1,14 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getComment, isAllowedEmoji, toggleReaction, ALLOWED_EMOJIS } from "@/lib/commentStore";
+import { assertCsrf } from "@/lib/middleware/csrfMiddleware";
 
 export async function POST(
   request: NextRequest,
   { params }: { params: { id: string; commentId: string } }
 ) {
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
   const body = await request.json().catch(() => null);
   const emoji = body?.emoji;
   const reactorId = body?.reactorId;

src/app/api/invoices/[id]/comments/[commentId]/route.ts

@@ -1,11 +1,15 @@
 import { NextRequest, NextResponse } from "next/server";
 import { deleteComment, getComment } from "@/lib/commentStore";
 import { getSplitClient } from "@/lib/stellar";
+import { assertCsrf } from "@/lib/middleware/csrfMiddleware";
 
 export async function DELETE(
   request: NextRequest,
   { params }: { params: { id: string; commentId: string } }
 ) {
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
   const body = await request.json().catch(() => null);
   const requesterAddress = body?.requesterAddress;
   const coCreatorWritePermission = body?.coCreatorWritePermission === true;

src/app/api/invoices/[id]/comments/route.ts

@@ -6,6 +6,7 @@ import {
   reactorEmojis,
   type StoredComment,
 } from "@/lib/commentStore";
+import { assertCsrf } from "@/lib/middleware/csrfMiddleware";
 
 function serialise(comment: StoredComment, reactorId: string | null) {
   return {
@@ -32,6 +33,9 @@ export async function GET(request: NextRequest, { params }: { params: { id: stri
 }
 
 export async function POST(request: NextRequest, { params }: { params: { id: string } }) {
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
   const body = await request.json().catch(() => null);
   const authorAddress = body?.authorAddress;
   const text = typeof body?.text === "string" ? body.text.trim() : "";

src/app/api/invoices/[id]/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { splitClient } from "@/lib/stellar";
 import { safeParseSplitMeta, type SplitMetaInput } from "@/lib/splitMetaSchema";
+import { assertCsrf } from "@/lib/middleware/csrfMiddleware";
 
 interface SplitMetaStore {
   [invoiceId: string]: SplitMetaInput;
@@ -12,6 +13,9 @@ export async function PATCH(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  const csrfError = await assertCsrf(request);
+  if (csrfError) return csrfError;
+
   try {
     const invoiceId = params.id;
     const walletPublicKey = request.headers.get("x-wallet-public-key");