Merge branch 'staging' into somzilla_Issues

Author: Jambox11

.env.example

@@ -4,6 +4,9 @@
 # Never commit .env to version control.
 # ============================================================
 
+# Stellar Configuration
+STELLAR_HORIZON_TESTNET_URL=https://horizon-testnet.stellar.org
+STELLAR_HORIZON_MAINNET_URL=https://horizon.stellar.org
 # ------------------------------------------------------------
 # Database
 # Required: PostgreSQL connection string (Prisma)

prisma/schema.prisma

@@ -130,6 +130,9 @@ model User {
   /// Relation to user's spending limits
   spendingLimits SpendingLimit[]
 
+  /// Relation to user's refresh tokens
+  refreshTokens RefreshToken[]
+
   @@index([authId])
   @@index([authProvider])
   @@index([deletedAt])
@@ -736,6 +739,58 @@ model KeyRotationAuditLog {
   @@index([expiresAt])
 }
 
+/// Refresh token status lifecycle
+enum RefreshTokenStatus {
+  ACTIVE
+  ROTATED
+  REVOKED
+  EXPIRED
+}
+
+/// Refresh token management with automatic rotation on use
+model RefreshToken {
+  id String @id @default(uuid())
+
+  /// User reference
+  userId String
+  user   User   @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  /// Refresh token hash (never store plaintext)
+  tokenHash String @unique
+
+  /// Rotation chain - previous token in rotation sequence
+  previousTokenId String?
+  previousToken   RefreshToken?  @relation("TokenRotation", fields: [previousTokenId], references: [id])
+  nextToken       RefreshToken[] @relation("TokenRotation")
+
+  /// Token status
+  status RefreshTokenStatus @default(ACTIVE)
+
+  /// Expiration timestamp
+  expiresAt DateTime
+
+  /// Usage tracking
+  lastUsedAt DateTime?
+  usageCount Int @default(0)
+
+  /// Rotation tracking
+  rotatedAt DateTime?
+  rotatedReason String?
+
+  /// Revocation details
+  revokedAt DateTime?
+  revokeReason String?
+
+  /// Metadata
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([userId, status])
+  @@index([tokenHash])
+  @@index([expiresAt])
+  @@index([previousTokenId])
+}
+
 /// Transaction lifecycle states
 enum TransactionStatus {
   PENDING    // Transaction created but not yet submitted to network

src/auth/auth-orchestrator.controller.ts

@@ -41,7 +41,10 @@ import {
 @FeatureFlag('auth_api')
 @UseGuards(FeatureFlagGuard)
 export class AuthOrchestratorController {
-  constructor(private readonly authOrchestrator: AuthOrchestrator) {}
+  constructor(
+    private readonly authOrchestrator: AuthOrchestrator,
+    private readonly refreshTokenService: RefreshTokenService,
+  ) {}
 
   /**
    * Main authentication endpoint - handles both first-time and returning users.
@@ -306,6 +309,7 @@ export class AuthOrchestratorController {
     },
   })
   @Get('validate/:authId')
+  @UseGuards(AuthRateLimitGuard)
   async validateAuthentication(@Param('authId') authId: string) {
     const isValid = await this.authOrchestrator.validateAuthentication(authId);
     return { valid: isValid };

src/auth/auth-rate-limit.service.spec.ts

@@ -0,0 +1,178 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { ConfigService } from '@nestjs/config';
+import { AuthRateLimitService } from './auth-rate-limit.service';
+import { PrismaClient } from '../generated/prisma/client';
+
+// Mock Prisma
+jest.mock('../generated/prisma/client', () => {
+  return {
+    PrismaClient: jest.fn(),
+  };
+});
+
+describe('AuthRateLimitService', () => {
+  let service: AuthRateLimitService;
+  let configService: jest.Mocked<ConfigService>;
+  let prismaMock: any;
+
+  beforeEach(async () => {
+    // Setup Prisma mock
+    prismaMock = {
+      rateLimitRecord: {
+        findUnique: jest.fn(),
+        deleteMany: jest.fn(),
+        create: jest.fn(),
+        update: jest.fn(),
+      },
+    };
+
+    (PrismaClient as jest.Mock).mockImplementation(() => prismaMock);
+
+    // Setup ConfigService mock
+    configService = {
+      get: jest.fn((key: string, defaultValue: string) => {
+        const config: Record<string, string> = {
+          AUTH_RATE_LIMIT_MAX: '10',
+          AUTH_RATE_LIMIT_WINDOW_MS: '60000',
+        };
+        return config[key] || defaultValue;
+      }),
+    } as any;
+
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        AuthRateLimitService,
+        {
+          provide: ConfigService,
+          useValue: configService,
+        },
+      ],
+    }).compile();
+
+    service = module.get<AuthRateLimitService>(AuthRateLimitService);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('checkRateLimit', () => {
+    it('should allow request when within limit', async () => {
+      const ipAddress = '192.168.1.1';
+
+      prismaMock.rateLimitRecord.findUnique.mockResolvedValue(null);
+      prismaMock.rateLimitRecord.create.mockResolvedValue({
+        id: 'record-1',
+        apiKeyId: `auth-rate-limit:${ipAddress}`,
+        endpoint: 'POST /auth/authenticate',
+        windowStart: new Date(),
+        requestCount: 1,
+      });
+
+      const result = await service.checkRateLimit(ipAddress);
+
+      expect(result.allowed).toBe(true);
+      expect(result.remaining).toBe(9);
+      expect(result.limit).toBe(10);
+    });
+
+    it('should reject request when limit exceeded', async () => {
+      const ipAddress = '192.168.1.1';
+      const now = new Date();
+      const windowStart = new Date(
+        Math.floor(now.getTime() / 60000) * 60000,
+      );
+
+      prismaMock.rateLimitRecord.findUnique.mockResolvedValue({
+        id: 'record-1',
+        apiKeyId: `auth-rate-limit:${ipAddress}`,
+        endpoint: 'POST /auth/authenticate',
+        windowStart,
+        requestCount: 10, // Already at limit
+      });
+
+      const result = await service.checkRateLimit(ipAddress);
+
+      expect(result.allowed).toBe(false);
+      expect(result.remaining).toBe(0);
+      expect(result.limit).toBe(10);
+      expect(result.retryAfterSeconds).toBeGreaterThan(0);
+    });
+
+    it('should increment request count for existing record', async () => {
+      const ipAddress = '192.168.1.1';
+      const now = new Date();
+      const windowStart = new Date(
+        Math.floor(now.getTime() / 60000) * 60000,
+      );
+
+      prismaMock.rateLimitRecord.findUnique.mockResolvedValue({
+        id: 'record-1',
+        apiKeyId: `auth-rate-limit:${ipAddress}`,
+        endpoint: 'POST /auth/authenticate',
+        windowStart,
+        requestCount: 5,
+      });
+
+      prismaMock.rateLimitRecord.update.mockResolvedValue({
+        id: 'record-1',
+        apiKeyId: `auth-rate-limit:${ipAddress}`,
+        endpoint: 'POST /auth/authenticate',
+        windowStart,
+        requestCount: 6,
+      });
+
+      const result = await service.checkRateLimit(ipAddress);
+
+      expect(result.allowed).toBe(true);
+      expect(result.remaining).toBe(4);
+    });
+
+    it('should clean up old records for same IP', async () => {
+      const ipAddress = '192.168.1.1';
+      const now = new Date();
+      const windowStart = new Date(
+        Math.floor(now.getTime() / 60000) * 60000,
+      );
+
+      prismaMock.rateLimitRecord.findUnique.mockResolvedValue(null);
+      prismaMock.rateLimitRecord.deleteMany.mockResolvedValue({ count: 3 });
+      prismaMock.rateLimitRecord.create.mockResolvedValue({
+        id: 'record-new',
+        apiKeyId: `auth-rate-limit:${ipAddress}`,
+        endpoint: 'POST /auth/authenticate',
+        windowStart,
+        requestCount: 1,
+      });
+
+      await service.checkRateLimit(ipAddress);
+
+      expect(prismaMock.rateLimitRecord.deleteMany).toHaveBeenCalled();
+      expect(prismaMock.rateLimitRecord.create).toHaveBeenCalled();
+    });
+
+    it('should handle database errors gracefully', async () => {
+      const ipAddress = '192.168.1.1';
+
+      prismaMock.rateLimitRecord.findUnique.mockRejectedValue(
+        new Error('Database error'),
+      );
+
+      const result = await service.checkRateLimit(ipAddress);
+
+      // Should fail open on error
+      expect(result.allowed).toBe(true);
+      expect(result.limit).toBe(10);
+      expect(result.remaining).toBe(10);
+    });
+  });
+
+  describe('getConfig', () => {
+    it('should return rate limit configuration', () => {
+      const config = service.getConfig();
+
+      expect(config.maxRequests).toBe(10);
+      expect(config.windowMs).toBe(60000);
+    });
+  });
+});

src/auth/auth.module.ts

@@ -18,6 +18,7 @@ import { FeatureFlagGuard } from '../common/feature-flags/feature-flag.guard';
   controllers: [AuthOrchestratorController, AuthMetricsController],
   providers: [
     AuthOrchestrator,
+    RefreshTokenService,
     IdempotencyService,
     AuthRateLimitService,
     AuthRateLimitGuard,
@@ -27,6 +28,7 @@ import { FeatureFlagGuard } from '../common/feature-flags/feature-flag.guard';
   ],
   exports: [
     AuthOrchestrator,
+    RefreshTokenService,
     IdempotencyService,
     AuthRateLimitService,
     AuthRateLimitGuard,