Merge branch 'main' into oracle-price-sanity-check

Author: pixels26

backend/src/api/debug.routes.ts

@@ -51,11 +51,10 @@ debugRouter.post('/debug/notifications/test', blockDebugInProduction, requireAdm
     }
 })
 
-debugRouter.get('/debug/coingecko-test', blockDebugInProduction, async (req: Request, res: Response) => {
+debugRouter.get('/debug/coingecko-test', blockDebugInProduction, requireAdmin, async (req: Request, res: Response) => {
     try {
         const apiKey = process.env.COINGECKO_API_KEY
 
-        // Test direct API call
         const testUrl = apiKey ?
             'https://pro-api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd' :
             'https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd'
@@ -75,20 +74,16 @@ debugRouter.get('/debug/coingecko-test', blockDebugInProduction, async (req: Req
         const data = await fetchResponse.json()
 
         const response = {
-            apiKeySet: !!apiKey,
-            testUrl,
             responseStatus: fetchResponse.status,
             responseData: data
         }
         return ok(res, redactObject(response))
     } catch (error) {
-        return fail(res, 500, 'INTERNAL_ERROR', getErrorMessage(error), {
-            stack: error instanceof Error ? error.stack : String(error)
-        })
+        return fail(res, 500, 'INTERNAL_ERROR', getErrorMessage(error))
     }
 })
 
-debugRouter.get('/debug/force-fresh-prices', blockDebugInProduction, async (req: Request, res: Response) => {
+debugRouter.get('/debug/force-fresh-prices', blockDebugInProduction, requireAdmin, async (req: Request, res: Response) => {
     try {
         logger.info('[DEBUG] Clearing cache and forcing fresh prices...')
 
@@ -112,7 +107,7 @@ debugRouter.get('/debug/force-fresh-prices', blockDebugInProduction, async (req:
     }
 })
 
-debugRouter.get('/debug/reflector-test', blockDebugInProduction, async (req: Request, res: Response) => {
+debugRouter.get('/debug/reflector-test', blockDebugInProduction, requireAdmin, async (req: Request, res: Response) => {
     try {
         logger.info('[DEBUG] Testing reflector service...')
 
@@ -133,23 +128,20 @@ debugRouter.get('/debug/reflector-test', blockDebugInProduction, async (req: Req
     }
 })
 
-debugRouter.get('/debug/env', blockDebugInProduction, async (req: Request, res: Response) => {
+debugRouter.get('/debug/env', blockDebugInProduction, requireAdmin, async (req: Request, res: Response) => {
     try {
         const response = {
             environment: global.process.env.NODE_ENV,
-            apiKeySet: !!global.process.env.COINGECKO_API_KEY,
             autoRebalancerEnabled: !!autoRebalancer,
-            autoRebalancerRunning: autoRebalancer ? autoRebalancer.getStatus().isRunning : false,
-            enableAutoRebalancer: global.process.env.ENABLE_AUTO_REBALANCER,
-            port: global.process.env.PORT
+            autoRebalancerRunning: autoRebalancer ? autoRebalancer.getStatus().isRunning : false
         }
         return ok(res, redactObject(response))
     } catch (error) {
         return fail(res, 500, 'INTERNAL_ERROR', getErrorMessage(error))
     }
 })
 
-debugRouter.get('/debug/auto-rebalancer-test', blockDebugInProduction, async (req: Request, res: Response) => {
+debugRouter.get('/debug/auto-rebalancer-test', blockDebugInProduction, requireAdmin, async (req: Request, res: Response) => {
     try {
         if (!autoRebalancer) {
             return fail(res, 500, 'INTERNAL_ERROR', 'Auto-rebalancer not initialized', {

backend/src/api/portfolios.routes.ts

@@ -46,8 +46,9 @@ portfoliosRouter.get('/portfolios', async (req: Request, res: Response) => {
         const search = req.query.search as string || ''
         const limit = parseInt(req.query.limit as string) || 20
         const offset = parseInt(req.query.offset as string) || 0
+        const includeArchived = req.query.include_archived === 'true'
 
-        const portfolios = await portfolioStorage.searchPortfolios(search, limit, offset)
+        const portfolios = await portfolioStorage.searchPortfolios(search, limit, offset, includeArchived)
         return ok(res, { portfolios, limit, offset })
     } catch (error) {
         logger.error('[ERROR] Search portfolios failed', { error: getErrorObject(error) })
@@ -343,6 +344,66 @@ portfoliosRouter.get('/portfolio/:id/share', async (req: Request, res: Response)
     }
 })
 
+// ================================
+// ARCHIVE / RESTORE ROUTES
+// ================================
+
+portfoliosRouter.delete('/portfolio/:id', ...protectedWriteLimiter, async (req: Request, res: Response) => {
+    try {
+        const portfolioId = req.params.id
+        if (!portfolioId) return fail(res, 400, 'VALIDATION_ERROR', 'Portfolio ID required')
+
+        const portfolio = await portfolioStorage.getPortfolio(portfolioId)
+        if (!portfolio) return fail(res, 404, 'NOT_FOUND', 'Portfolio not found')
+
+        const authConfig = getAuthConfig()
+        if (authConfig.enabled && (!req.user || portfolio.userAddress !== req.user.address)) {
+            return fail(res, 403, 'FORBIDDEN', 'You can only archive your own portfolio')
+        }
+
+        if (portfolio.archivedAt) {
+            return fail(res, 400, 'ALREADY_ARCHIVED', 'Portfolio is already archived')
+        }
+
+        const archived = await portfolioStorage.archivePortfolio(portfolioId)
+        if (!archived) return fail(res, 500, 'INTERNAL_ERROR', 'Failed to archive portfolio')
+
+        logger.info('[ARCHIVE] Portfolio archived', { portfolioId })
+        return ok(res, { portfolioId, status: 'archived', archivedAt: new Date().toISOString() })
+    } catch (error) {
+        logger.error('[ERROR] Archive portfolio failed', { error: getErrorObject(error) })
+        return fail(res, 500, 'INTERNAL_ERROR', getErrorMessage(error))
+    }
+})
+
+portfoliosRouter.post('/portfolio/:id/restore', ...protectedWriteLimiter, async (req: Request, res: Response) => {
+    try {
+        const portfolioId = req.params.id
+        if (!portfolioId) return fail(res, 400, 'VALIDATION_ERROR', 'Portfolio ID required')
+
+        const portfolio = await portfolioStorage.getPortfolio(portfolioId)
+        if (!portfolio) return fail(res, 404, 'NOT_FOUND', 'Portfolio not found')
+
+        const authConfig = getAuthConfig()
+        if (authConfig.enabled && (!req.user || portfolio.userAddress !== req.user.address)) {
+            return fail(res, 403, 'FORBIDDEN', 'You can only restore your own portfolio')
+        }
+
+        if (!portfolio.archivedAt) {
+            return fail(res, 400, 'NOT_ARCHIVED', 'Portfolio is not archived')
+        }
+
+        const restored = await portfolioStorage.restorePortfolio(portfolioId)
+        if (!restored) return fail(res, 500, 'INTERNAL_ERROR', 'Failed to restore portfolio')
+
+        logger.info('[RESTORE] Portfolio restored', { portfolioId })
+        return ok(res, { portfolioId, status: 'restored' })
+    } catch (error) {
+        logger.error('[ERROR] Restore portfolio failed', { error: getErrorObject(error) })
+        return fail(res, 500, 'INTERNAL_ERROR', getErrorMessage(error))
+    }
+})
+
 // ================================
 // DRAFT PORTFOLIO ROUTES
 // ================================
@@ -559,7 +620,8 @@ portfoliosRouter.get('/user/:address/portfolios', async (req: Request, res: Resp
             }
         }
 
-        const list = await portfolioStorage.getUserPortfolios(address)
+        const includeArchived = req.query.include_archived === 'true'
+        const list = await portfolioStorage.getUserPortfolios(address, includeArchived)
 
         return ok(res, { portfolios: list })
     } catch (error) {

backend/src/db/migrations/014_portfolio_archiving.down.sql

@@ -0,0 +1,6 @@
+-- Migration: 014_portfolio_archiving (down)
+-- Description: Rollback for portfolio archiving changes.
+-- Rollback for: 014_portfolio_archiving.up.sql
+
+DROP INDEX IF EXISTS idx_portfolios_archived_at;
+ALTER TABLE portfolios DROP COLUMN IF EXISTS archived_at;

backend/src/db/migrations/014_portfolio_archiving.up.sql

@@ -0,0 +1,8 @@
+-- Migration: 014_portfolio_archiving (up)
+-- Description: Add soft-delete / archive support to portfolios.
+-- Rollback: See 014_portfolio_archiving.down.sql
+
+ALTER TABLE portfolios ADD COLUMN archived_at TIMESTAMPTZ;
+
+CREATE INDEX idx_portfolios_archived_at ON portfolios(archived_at)
+    WHERE archived_at IS NOT NULL;

backend/src/db/portfolioDb.ts

@@ -16,6 +16,7 @@ export interface PortfolioRow {
     version: number
     strategy?: string
     strategy_config?: Record<string, unknown>
+    archived_at?: Date
 }
 
 function rowToPortfolio(r: PortfolioRow) {
@@ -33,7 +34,8 @@ function rowToPortfolio(r: PortfolioRow) {
         lastRebalance: r.last_rebalance.toISOString(),
         version: r.version ?? 1,
         strategy: (r.strategy as import('../types/index.js').RebalanceStrategyType) || 'threshold',
-        strategyConfig: r.strategy_config || undefined
+        strategyConfig: r.strategy_config || undefined,
+        archivedAt: r.archived_at ? r.archived_at.toISOString() : undefined
     }
 }
 
@@ -66,19 +68,38 @@ export async function dbGetPortfolio(id: string) {
     return row ? rowToPortfolio(row) : undefined
 }
 
-export async function dbGetUserPortfolios(userAddress: string) {
-    const result = await query<PortfolioRow>(
-        'SELECT * FROM portfolios WHERE user_address = $1 ORDER BY created_at ASC',
-        [userAddress]
-    )
+export async function dbGetUserPortfolios(userAddress: string, includeArchived = false) {
+    const sql = includeArchived
+        ? 'SELECT * FROM portfolios WHERE user_address = $1 ORDER BY created_at ASC'
+        : 'SELECT * FROM portfolios WHERE user_address = $1 AND archived_at IS NULL ORDER BY created_at ASC'
+    const result = await query<PortfolioRow>(sql, [userAddress])
     return result.rows.map(rowToPortfolio)
 }
 
-export async function dbGetAllPortfolios() {
-    const result = await query<PortfolioRow>('SELECT * FROM portfolios ORDER BY created_at ASC')
+export async function dbGetAllPortfolios(includeArchived = false) {
+    const sql = includeArchived
+        ? 'SELECT * FROM portfolios ORDER BY created_at ASC'
+        : 'SELECT * FROM portfolios WHERE archived_at IS NULL ORDER BY created_at ASC'
+    const result = await query<PortfolioRow>(sql)
     return result.rows.map(rowToPortfolio)
 }
 
+export async function dbArchivePortfolio(id: string): Promise<boolean> {
+    const result = await query(
+        'UPDATE portfolios SET archived_at = NOW() WHERE id = $1 AND archived_at IS NULL',
+        [id]
+    )
+    return (result.rowCount ?? 0) > 0
+}
+
+export async function dbRestorePortfolio(id: string): Promise<boolean> {
+    const result = await query(
+        'UPDATE portfolios SET archived_at = NULL WHERE id = $1',
+        [id]
+    )
+    return (result.rowCount ?? 0) > 0
+}
+
 /**
  * Update a portfolio record.
  *
@@ -185,18 +206,19 @@ export async function dbDeletePortfolio(id: string) {
     return (result.rowCount ?? 0) > 0
 }
 
-export async function dbSearchPortfolios(searchQuery: string, limit: number, offset: number) {
+export async function dbSearchPortfolios(searchQuery: string, limit: number, offset: number, includeArchived = false) {
+    const archivedFilter = includeArchived ? '' : ' AND archived_at IS NULL'
     if (!searchQuery) {
         const result = await query<PortfolioRow>(
-            'SELECT * FROM portfolios ORDER BY created_at DESC LIMIT $1 OFFSET $2',
+            `SELECT * FROM portfolios WHERE 1=1${archivedFilter} ORDER BY created_at DESC LIMIT $1 OFFSET $2`,
             [limit, offset]
         )
         return result.rows.map(rowToPortfolio)
     }
 
     const result = await query<PortfolioRow>(
         `SELECT * FROM portfolios 
-         WHERE search_vector @@ plainto_tsquery('english', $1)
+         WHERE search_vector @@ plainto_tsquery('english', $1)${archivedFilter}
          ORDER BY ts_rank(search_vector, plainto_tsquery('english', $1)) DESC, created_at DESC
          LIMIT $2 OFFSET $3`,
         [searchQuery, limit, offset]

backend/src/db/schema.sql

@@ -80,6 +80,9 @@ CREATE TABLE IF NOT EXISTS notification_logs (
 CREATE INDEX IF NOT EXISTS idx_notification_logs_user ON notification_logs(user_id);
 CREATE INDEX IF NOT EXISTS idx_notification_logs_created_at ON notification_logs(created_at DESC);
 
+ALTER TABLE portfolios ADD COLUMN IF NOT EXISTS archived_at TIMESTAMPTZ;
+CREATE INDEX IF NOT EXISTS idx_portfolios_archived_at ON portfolios(archived_at) WHERE archived_at IS NOT NULL;
+
 CREATE TABLE IF NOT EXISTS portfolio_drafts (
     id VARCHAR(64) PRIMARY KEY,
     user_address VARCHAR(256) NOT NULL,

backend/src/middleware/idempotency.ts

@@ -26,15 +26,17 @@ export const idempotencyMiddleware: RequestHandler = async (req, res, next) => {
         ?? (req.headers['x-public-key'] as string | undefined)
         ?? 'anonymous'
 
+    const scopedKey = `${requestUser}:${key}`
+
     const requestHash = createHash('sha256')
         .update(req.method)
         .update(req.path)
         .update(stableStringify(req.body ?? {}))
         .update(requestUser)
         .digest('hex')
 
-    const existingRedis = await redisGetIdempotencyResult(key)
-    const existing = existingRedis ?? dbGetIdempotencyResult(key)
+    const existingRedis = await redisGetIdempotencyResult(scopedKey)
+    const existing = existingRedis ?? dbGetIdempotencyResult(scopedKey)
 
     if (existing) {
         if (existing.requestHash !== requestHash) {
@@ -65,10 +67,10 @@ export const idempotencyMiddleware: RequestHandler = async (req, res, next) => {
     res.json = (body: unknown) => {
         try {
             dbStoreIdempotencyResult(
-                key, requestHash, req.method, req.path, res.statusCode, body
+                scopedKey, requestHash, req.method, req.path, res.statusCode, body
             )
             redisStoreIdempotencyResult(
-                key, requestHash, req.method, req.path, res.statusCode, body
+                scopedKey, requestHash, req.method, req.path, res.statusCode, body
             )
         } catch {
             // Never fail the actual request due to idempotency storage errors