Merge branch 'main' into feat/issue-152-matching-engine

Author: LaPoshBaby

.github/workflows/backend.yml

@@ -5,7 +5,6 @@ on:
     branches: [main, develop]
     paths: [backend/**]
   pull_request:
-    branches: [main]
     paths: [backend/**]
   workflow_dispatch:
 

.github/workflows/ci.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main, develop]
   pull_request:
-    branches: [main]
 
 jobs:
   frontend:
@@ -99,6 +98,24 @@ jobs:
       - name: Secret scanning
         run: gitleaks detect --config .gitleaks.toml --source . --no-git --exit-code 1
 
+  openapi-lint:
+    name: OpenAPI Spec Validation (Spectral)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Validate OpenAPI spec with Spectral (built-in OAS rules)
+        run: npx @stoplight/spectral-cli@6.14.3 lint docs/api/openapi.yaml --ruleset .spectral.yaml
+
+      - name: Install dependencies for custom validation
+        run: npm ci
+
+      - name: Validate project-specific conventions (429, descriptions, summaries)
+        run: node scripts/validate-openapi.js
+
   zap_scan:
     name: DAST Security Scan (OWASP ZAP)
     runs-on: ubuntu-latest

.github/workflows/contracts.yml

@@ -5,11 +5,10 @@ on:
     branches: [main, develop]
     paths: [contracts/**]
   pull_request:
-    branches: [main]
     paths: [contracts/**]
   workflow_dispatch:
   schedule:
-    # Nightly deep fuzz run — 1 000 000 iterations every day at 03:00 UTC
+    # Nightly deep fuzz run -- 1 000 000 iterations every day at 03:00 UTC
     - cron: "0 3 * * *"
 
 jobs:
@@ -40,15 +39,16 @@ jobs:
       - name: Run Clippy
         run: cargo clippy --workspace -- -D warnings
 
-      - name: Run tests (skip duplicate fuzz run — handled by dedicated fuzz job)
-        run: cargo test --workspace -- --skip fuzz::
+      - name: Run tests (skip duplicate fuzz run -- handled by dedicated fuzz job)
+        run: "cargo test --features testutils --workspace -- --skip fuzz::"
 
       - name: Build WASM
         run: cargo build --workspace --target wasm32v1-none --release
 
   fuzz:
-    name: Fuzz Tests (100k iterations)
+    name: Fuzz Tests (10k iterations)
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: contracts
@@ -67,15 +67,16 @@ jobs:
         with:
           workspaces: contracts
 
-      - name: Run fuzz tests (100k iterations)
-        run: FUZZ_ITERATIONS=100000 cargo test --features testutils -- fuzz
+      - name: Run fuzz tests (10k iterations)
+        run: cargo test --features testutils -- fuzz
         env:
-          FUZZ_ITERATIONS: 100000
+          FUZZ_ITERATIONS: 10000
 
   deep-fuzz:
-    name: Deep Fuzz (1M iterations — nightly)
+    name: Deep Fuzz (1M iterations -- nightly)
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     defaults:
       run:
         working-directory: contracts
@@ -95,7 +96,7 @@ jobs:
           workspaces: contracts
 
       - name: Run deep fuzz tests (1M iterations)
-        run: FUZZ_ITERATIONS=1000000 cargo test --features testutils -- fuzz
+        run: cargo test --features testutils -- fuzz
         env:
           FUZZ_ITERATIONS: 1000000
 

.github/workflows/extension.yml

@@ -10,7 +10,6 @@ on:
   pull_request:
     paths:
       - "extension/**"
-    branches: [main]
 
 jobs:
   build:

.github/workflows/frontend.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main, develop]
   pull_request:
-    branches: [main]
 
 jobs:
   frontend-build:

.github/workflows/image-scan.yml

@@ -11,7 +11,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   workflow_dispatch:
 
 jobs:

.github/workflows/sbom.yml

@@ -11,7 +11,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   workflow_dispatch:
 
 jobs:

.github/workflows/secret-scanning.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches: [main, develop]
   pull_request:
-    branches: [main]
   workflow_dispatch:
 
 permissions:

.spectral.yaml

@@ -0,0 +1,27 @@
+# Spectral API linting ruleset for Stellar-IndigoPay
+#
+# Extends the built-in `spectral:oas` ruleset which validates OpenAPI 3.x
+# structure (media examples, schema types, server URLs, path parameters,
+# trailing slashes, operation tags, typed enums, etc.).
+#
+# Custom-project-specific validations (e.g., 429 on mutation endpoints,
+# inline response descriptions) are handled by a separate Node.js script
+# in scripts/validate-openapi.js — Spectral's built-in functions cannot
+# assert on specific response status code keys, and Spectral 6.x YAML
+# rulesets do not support custom JavaScript functions out-of-the-box.
+#
+extends: "spectral:oas"
+
+rules:
+  # ── Severity overrides for intentional omissions ────────────────
+  # operationId is recommended but not required — simple or internal
+  # endpoints may omit it without reducing documentation quality.
+  operation-operationId: warn
+
+  # operation-description is recommended — if the summary is
+  # sufficiently descriptive, a separate description may be omitted.
+  operation-description: warn
+
+  # Unused components are a minor housekeeping concern, not a spec
+  # validity issue. Downgraded to info to avoid CI noise.
+  oas3-unused-component: info

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ### Features
 
+* **backend,frontend:** add Idempotency-Key support for donation recording (closes #148)
+  - Accept `Idempotency-Key` header (UUID v4) on `POST /api/donations`; store response and replay within 24 hours
+  - New `idempotency_keys` table via migration 016 with index on `created_at`
+  - Hourly pg-boss cleanup cron (`idempotencyCleanup`) purges expired keys (configurable via `IDEMPOTENCY_CLEANUP_CRON`)
+  - Frontend: `DonateForm` and `bridge` generate `crypto.randomUUID()` per donation attempt
+  - Documented in OpenAPI spec with 200 replay response
+  - 11 new tests: 5 unit (donations), 8 unit (cleanup), 3 integration (testcontainers)
+
 * **docs:** add CONTRIBUTORS.md to credit community work (GF-015, closes #64)
 
 * **backend:** implement Soroban RPC retry with exponential backoff and circuit breaker (GF-043, closes #100)