Merge pull request #1318 from Emmanuelchukwunonso/feat/issues-1275-1273-635-497

feat: add request validation/rate limiting, error boundary, and ARIA labels

Author: leojay-net

Dechat/dex_with_fiat_frontend/src/app/api/events/route.test.ts

@@ -0,0 +1,78 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { NextRequest } from 'next/server';
+
+const applyRateLimitMock = vi.fn(() => null);
+
+vi.mock('@/lib/rateLimit', () => ({
+  applyRateLimit: (...args: unknown[]) => applyRateLimitMock(...args),
+  getClientIp: vi.fn(() => '127.0.0.1'),
+}));
+
+vi.mock('fs', () => ({
+  default: {
+    existsSync: vi.fn(() => false),
+    readFileSync: vi.fn(),
+  },
+}));
+
+const { GET } = await import('./route');
+
+function makeRequest(query: string) {
+  return new NextRequest(new Request(`http://localhost/api/events${query}`));
+}
+
+describe('GET /api/events', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    applyRateLimitMock.mockReturnValue(null);
+  });
+
+  it('returns 400 for a non-numeric limit', async () => {
+    const req = makeRequest('?limit=not-a-number');
+    const res = await GET(req);
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.success).toBe(false);
+  });
+
+  it('returns 400 for a negative offset', async () => {
+    const req = makeRequest('?offset=-1');
+    const res = await GET(req);
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.success).toBe(false);
+  });
+
+  it('returns 400 when limit exceeds the maximum', async () => {
+    const req = makeRequest('?limit=1000');
+    const res = await GET(req);
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.success).toBe(false);
+  });
+
+  it('defaults limit and offset when omitted', async () => {
+    const req = makeRequest('');
+    const res = await GET(req);
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.events).toEqual([]);
+  });
+
+  it('returns 429 when the rate limit is exceeded', async () => {
+    applyRateLimitMock.mockReturnValueOnce(
+      new Response(JSON.stringify({ success: false, retryAfter: 60 }), {
+        status: 429,
+      }) as never,
+    );
+
+    const req = makeRequest('');
+    const res = await GET(req);
+
+    expect(res.status).toBe(429);
+  });
+});

Dechat/dex_with_fiat_frontend/src/app/api/events/route.ts

@@ -2,15 +2,38 @@ import { NextRequest, NextResponse } from 'next/server';
 import fs from 'fs';
 import path from 'path';
 import { ContractEvent } from '../../../types/events';
+import { applyRateLimit, getClientIp } from '@/lib/rateLimit';
+import { eventsQuerySchema } from '@/lib/apiSchemas';
 
 const DATA_DIR = path.join(process.cwd(), 'data');
 const EVENTS_FILE = path.join(DATA_DIR, 'contract-events.json');
+const RATE_LIMIT = { maxRequests: 30, windowMs: 60_000 };
 
 export async function GET(request: NextRequest) {
+  const ip = getClientIp(request);
+  const limited = applyRateLimit(ip, '/api/events', RATE_LIMIT);
+  if (limited) return limited;
+
   try {
     const { searchParams } = new URL(request.url);
-    const limit = parseInt(searchParams.get('limit') || '20', 10);
-    const offset = parseInt(searchParams.get('offset') || '0', 10);
+
+    const validationResult = eventsQuerySchema.safeParse({
+      limit: searchParams.get('limit') ?? undefined,
+      offset: searchParams.get('offset') ?? undefined,
+    });
+
+    if (!validationResult.success) {
+      return NextResponse.json(
+        {
+          success: false,
+          message: 'Validation failed',
+          errors: validationResult.error.issues,
+        },
+        { status: 400 },
+      );
+    }
+
+    const { limit, offset } = validationResult.data;
 
     if (!fs.existsSync(EVENTS_FILE)) {
       return NextResponse.json({ events: [], total: 0 });

Dechat/dex_with_fiat_frontend/src/app/api/transfer-status/route.test.ts

@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { NextRequest } from 'next/server';
+
+const applyRateLimitMock = vi.fn(() => null);
+
+vi.mock('@/lib/rateLimit', () => ({
+  applyRateLimit: (...args: unknown[]) => applyRateLimitMock(...args),
+  getClientIp: vi.fn(() => '127.0.0.1'),
+}));
+
+vi.mock('@/lib/payout/providers/registry', () => ({
+  getPayoutProvider: () => ({
+    checkTransferStatus: vi.fn().mockResolvedValue({ reference: 'ref-123', status: 'success' }),
+  }),
+}));
+
+const { POST } = await import('./route');
+
+function makeRequest(body: unknown) {
+  return new NextRequest(
+    new Request('http://localhost/api/transfer-status', {
+      method: 'POST',
+      body: JSON.stringify(body),
+      headers: { 'content-type': 'application/json' },
+    }),
+  );
+}
+
+describe('POST /api/transfer-status', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    applyRateLimitMock.mockReturnValue(null);
+  });
+
+  it('returns 400 for malformed JSON body', async () => {
+    const badReq = new NextRequest(
+      new Request('http://localhost/api/transfer-status', {
+        method: 'POST',
+        body: 'not json{{{',
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+
+    const res = await POST(badReq);
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.success).toBe(false);
+  });
+
+  it('returns 400 for validation failures', async () => {
+    const req = makeRequest({ reference: '' });
+    const res = await POST(req);
+    const body = await res.json();
+
+    expect(res.status).toBe(400);
+    expect(body.success).toBe(false);
+  });
+
+  it('returns 200 for a valid request', async () => {
+    const req = makeRequest({ reference: 'ref-123' });
+    const res = await POST(req);
+    const body = await res.json();
+
+    expect(res.status).toBe(200);
+    expect(body.success).toBe(true);
+  });
+
+  it('returns 429 when the rate limit is exceeded', async () => {
+    applyRateLimitMock.mockReturnValueOnce(
+      new Response(JSON.stringify({ success: false, retryAfter: 60 }), {
+        status: 429,
+      }) as never,
+    );
+
+    const req = makeRequest({ reference: 'ref-123' });
+    const res = await POST(req);
+
+    expect(res.status).toBe(429);
+  });
+});

Dechat/dex_with_fiat_frontend/src/app/api/transfer-status/route.ts

@@ -1,18 +1,41 @@
 import { NextRequest, NextResponse } from 'next/server';
 
 import { getPayoutProvider } from '@/lib/payout/providers/registry';
+import { applyRateLimit, getClientIp } from '@/lib/rateLimit';
+import { transferStatusSchema } from '@/lib/apiSchemas';
+
+const RATE_LIMIT = { maxRequests: 10, windowMs: 60_000 };
 
 export async function POST(request: NextRequest) {
+  const ip = getClientIp(request);
+  const limited = applyRateLimit(ip, '/api/transfer-status', RATE_LIMIT);
+  if (limited) return limited;
+
   try {
-    const { reference } = await request.json();
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return NextResponse.json(
+        { success: false, message: 'Request body must be valid JSON' },
+        { status: 400 },
+      );
+    }
 
-    if (!reference) {
+    const validationResult = transferStatusSchema.safeParse(body);
+    if (!validationResult.success) {
       return NextResponse.json(
-        { success: false, message: 'Reference is required' },
+        {
+          success: false,
+          message: 'Validation failed',
+          errors: validationResult.error.issues,
+        },
         { status: 400 },
       );
     }
 
+    const { reference } = validationResult.data;
+
     const provider = getPayoutProvider();
     const data = await provider.checkTransferStatus({ reference });
 

Dechat/dex_with_fiat_frontend/src/components/ChatHistorySidebar.tsx

@@ -876,7 +876,17 @@ export default function ChatHistorySidebar({
         <div
           className={`theme-border border-t p-4 ${isCollapsed ? 'flex flex-col items-center' : ''}`}
         >
-          <PriceTicker symbols={['XLM', 'ETH', 'BTC']} currency="usd" />
+          <ErrorBoundary
+            fallback={
+              <div className="theme-surface-muted rounded-lg border theme-border p-3">
+                <p className="theme-text-secondary text-sm text-center py-2">
+                  Prices unavailable
+                </p>
+              </div>
+            }
+          >
+            <PriceTicker symbols={['XLM', 'ETH', 'BTC']} currency="usd" />
+          </ErrorBoundary>
 
           <div
             className={`theme-border border-t p-4 ${isCollapsed ? 'flex flex-col items-center' : ''}`}