Merge branch 'fix/deprecation-cleanup' of https://github.com/markdavid000/Stellar-Dex-Chat into fix/deprecation-cleanup

Author: markdavid000

.gitignore

@@ -10,3 +10,5 @@ stellar-contracts/target/
 # Contract build artifacts
 *.wasm
 
+issue.md
+pr.md

dex_with_fiat_frontend/.env.example

@@ -12,7 +12,9 @@ NEXT_PUBLIC_XLM_SAC_CONTRACT=CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HH
 # Admin Stellar public key (G...)
 NEXT_PUBLIC_ADMIN_PUBLIC_KEY=GBLDNEYP3TGZJQG3QKQXQDQKQXQDQKQXQDQKQXQDQKQXQDQKQXQDQKQXQDQKQXQDQ
 
-# Google Gemini API key for the AI assistant.
 # SERVER-ONLY: Do NOT use the NEXT_PUBLIC_ prefix. This key is proxied via
 # /api/ai/chat and never sent to the browser.
 GEMINI_API_KEY=your_gemini_api_key_here
+
+# Admin secret for accessing reconciliation and audit log endpoints.
+ADMIN_SECRET=your_admin_secret_here

dex_with_fiat_frontend/src/app/api/admin/_utils/requireAdminAuth.ts

@@ -1,20 +1,16 @@
 import { env } from '@/lib/env';
 
 export function requireAdminAuth(request: Request): Response | null {
-  const configuredToken = env.ADMIN_API_TOKEN;
-
-  // Keep development ergonomics when no token is configured.
-  if (!configuredToken) {
-    return null;
-  }
+  const configuredSecret = env.ADMIN_SECRET;
 
   const headerToken = request.headers.get('x-admin-token');
   const authHeader = request.headers.get('authorization');
   const bearerToken = authHeader?.startsWith('Bearer ')
     ? authHeader.slice('Bearer '.length).trim()
     : null;
 
-  if (headerToken === configuredToken || bearerToken === configuredToken) {
+  // Basic check: match against secret (header is preferred)
+  if (configuredSecret && (headerToken === configuredSecret || bearerToken === configuredSecret)) {
     return null;
   }
 

dex_with_fiat_frontend/src/app/api/admin/reconciliation/reconciliation.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+
+const mockEnv = { ADMIN_SECRET: 'test-admin-secret' };
+vi.mock('@/lib/env', () => ({
+  get env() {
+    return mockEnv;
+  },
+}));
+
+import { GET } from './route';
+
+describe('GET /api/admin/reconciliation', () => {
+  beforeEach(() => {
+    mockEnv.ADMIN_SECRET = 'test-admin-secret';
+  });
+
+  it('returns 401 when no authentication is provided', async () => {
+    const req = new NextRequest('http://localhost/api/admin/reconciliation');
+    const res = await GET(req);
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toMatch(/Unauthorized/i);
+  });
+
+  it('returns 401 when invalid token is provided in x-admin-token', async () => {
+    const req = new NextRequest('http://localhost/api/admin/reconciliation', {
+      headers: { 'x-admin-token': 'wrong-secret' },
+    });
+    const res = await GET(req);
+    expect(res.status).toBe(401);
+  });
+
+  it('returns 200 when valid token is provided in x-admin-token', async () => {
+    const req = new NextRequest('http://localhost/api/admin/reconciliation', {
+      headers: { 'x-admin-token': 'test-admin-secret' },
+    });
+    const res = await GET(req);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(Array.isArray(body)).toBe(true);
+  });
+
+  it('returns 200 when valid bearer token is provided', async () => {
+    const req = new NextRequest('http://localhost/api/admin/reconciliation', {
+      headers: { authorization: 'Bearer test-admin-secret' },
+    });
+    const res = await GET(req);
+    expect(res.status).toBe(200);
+  });
+});

dex_with_fiat_frontend/src/app/api/webhook/webhook.test.ts

@@ -18,7 +18,7 @@ vi.mock('@/lib/env', () => ({ get env() { return mockEnv; } }));
 vi.mock('@/lib/telemetry', () => ({
   telemetry: {
     extractTraceFromHeaders: () => ({ traceId: 'trace1', spanId: 'span1' }),
-    createSpan: (_name: string, _spanId: string, _traceId: string) => ({ spanId: 'span1' }),
+    createSpan: () => ({ spanId: 'span1' }),
     addLog: vi.fn(),
     finishSpan: vi.fn(),
     setTraceHeaders: vi.fn(),