Merge branch 'main' into fix-issues-1182-1186-1190-1192

Author: leojay-net

.github/workflows/auto-merge.yml

@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Evaluate and merge
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/changelog.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -46,7 +46,7 @@ jobs:
         run: git-cliff --config cliff.toml --output CHANGELOG.md
 
       - name: Commit and push CHANGELOG.md
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
         with:
           file_pattern: CHANGELOG.md
           commit_message: "chore(changelog): update changelog [skip ci]"

.github/workflows/contract-tests.yml

@@ -19,16 +19,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust stable toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
         with:
           components: clippy
           targets: wasm32-unknown-unknown
 
       - name: Cache Cargo dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
         with:
           workspaces: Dechat/stellar-contracts -> target
 

.github/workflows/contracts.yml

@@ -25,17 +25,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
         with:
           toolchain: stable
           components: clippy
           targets: wasm32-unknown-unknown
 
       - name: Cache Cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry

.github/workflows/deploy-futurenet.yml

@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
         with:
           toolchain: stable
           targets: wasm32-unknown-unknown
@@ -38,7 +38,7 @@ jobs:
           soroban --version
 
       - name: Cache Cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry
@@ -68,15 +68,15 @@ jobs:
 
       - name: Upload contract ID artifact
         if: success()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: contract-deployment-${{ github.sha }}
           path: Dechat/stellar-contracts/contract_id_futurenet.txt
           retention-days: 90
 
       - name: Create deployment status
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const status = '${{ job.status }}' === 'success' ? 'success' : 'failure';

.github/workflows/frontend-build.yml

@@ -18,15 +18,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
         with:
           version: 8
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: "pnpm"

.github/workflows/frontend.yml

@@ -25,15 +25,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
         with:
           version: 8
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: "pnpm"
@@ -96,15 +96,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
         with:
           version: 8
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: "pnpm"
@@ -136,7 +136,7 @@ jobs:
           NEXT_PUBLIC_STELLAR_NETWORK: ${{ secrets.NEXT_PUBLIC_STELLAR_NETWORK || 'TESTNET' }}
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: playwright-report

Dechat/dex_with_fiat_frontend/src/app/api/banks/route.test.ts

@@ -0,0 +1,49 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { NextRequest } from 'next/server';
+
+vi.mock('@/lib/telemetry', () => ({
+  telemetry: {
+    extractTraceFromHeaders: () => ({ traceId: 'trace', spanId: 'parent' }),
+    createSpan: () => ({ spanId: 'span' }),
+    addLog: vi.fn(),
+    finishSpan: vi.fn(),
+    setTraceHeaders: vi.fn(),
+  },
+}));
+
+const { GET } = await import('./route');
+
+function request(query = '', ip = '198.51.100.100') {
+  return new NextRequest(`http://localhost/api/banks${query}`, {
+    headers: { 'x-forwarded-for': ip },
+  });
+}
+
+describe('GET /api/banks', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('returns a machine-readable 400 response for unsupported query parameters', async () => {
+    const response = await GET(request('?country=ghana'));
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      success: false,
+      error: { code: 'INVALID_REQUEST' },
+    });
+  });
+
+  it('rejects requests after the shared rate-limit quota is exhausted', async () => {
+    const ip = '198.51.100.101';
+
+    for (let attempt = 0; attempt < 30; attempt += 1) {
+      expect((await GET(request('', ip))).status).toBe(200);
+    }
+
+    const response = await GET(request('', ip));
+    expect(response.status).toBe(429);
+    await expect(response.json()).resolves.toMatchObject({ success: false });
+    expect(response.headers.get('Retry-After')).toBe('60');
+  });
+});

Dechat/dex_with_fiat_frontend/src/app/api/banks/route.ts

@@ -1,11 +1,17 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import axios from 'axios';
 import { telemetry } from '@/lib/telemetry';
 import { env } from '@/lib/env';
+import { banksQuerySchema } from '@/lib/apiSchemas';
+import { applyRateLimit, getClientIp } from '@/lib/rateLimit';
 
 const PAYSTACK_SECRET_KEY = env.PAYSTACK_SECRET_KEY;
+const RATE_LIMIT = { maxRequests: 30, windowMs: 60_000 };
+
+export async function GET(request: NextRequest) {
+  const limited = applyRateLimit(getClientIp(request), '/api/banks', RATE_LIMIT);
+  if (limited) return limited;
 
-export async function GET(request: Request) {
   const traceContext = telemetry.extractTraceFromHeaders(
     request.headers as Headers,
   );
@@ -20,6 +26,30 @@ export async function GET(request: Request) {
       endpoint: '/api/banks',
     });
 
+    const query = Object.fromEntries(request.nextUrl.searchParams.entries());
+    const validationResult = banksQuerySchema.safeParse(query);
+    if (!validationResult.success) {
+      telemetry.addLog(span.spanId, 'warn', 'Banks query validation failed', {
+        errors: validationResult.error.issues,
+      });
+      telemetry.finishSpan(span.spanId, { success: false, error: 'Invalid request' });
+
+      const response = NextResponse.json(
+        {
+          success: false,
+          error: {
+            code: 'INVALID_REQUEST',
+            issues: validationResult.error.issues,
+          },
+        },
+        { status: 400 },
+      );
+      telemetry.setTraceHeaders(response.headers as Headers, traceContext);
+      return response;
+    }
+
+    const { country } = validationResult.data;
+
     if (!PAYSTACK_SECRET_KEY) {
       telemetry.addLog(
         span.spanId,
@@ -104,11 +134,11 @@ export async function GET(request: Request) {
     // Call real Paystack API to get Nigerian banks
     telemetry.addLog(span.spanId, 'info', 'Calling Paystack API', {
       endpoint: 'https://api.paystack.co/bank',
-      country: 'nigeria',
+      country,
     });
 
     const response = await axios.get(
-      'https://api.paystack.co/bank?country=nigeria',
+      `https://api.paystack.co/bank?country=${country}`,
       {
         headers: {
           Authorization: `Bearer ${PAYSTACK_SECRET_KEY}`,

Dechat/dex_with_fiat_frontend/src/components/ChatMessages.tsx

@@ -23,6 +23,11 @@ interface ChatMessagesProps {
     actionType: string,
     data?: Record<string, unknown>,
   ) => void;
+  /**
+   * Resend a message that failed to send. Receives the failed message's id and
+   * its original content, ready to be submitted again as-is.
+   */
+  onRetry?: (messageId: string, content: string) => void | Promise<void>;
   isLoading?: boolean;
   searchQuery?: string;
 }
@@ -108,6 +113,7 @@ function HelpCard({
 export default function ChatMessages({
   messages: allMessages,
   onActionClick,
+  onRetry,
   isLoading = false,
   searchQuery = '',
 }: ChatMessagesProps) {
@@ -460,6 +466,7 @@ export default function ChatMessages({
               key={message.id}
               message={message}
               onActionClick={onActionClick}
+              onRetry={onRetry}
               shouldAnimate={isReadyToAnimate && !isLoadingMore && !seenMessageIds.current.has(message.id)}
             />
           ))}