Skip to content

fix: resolve four Stellar Wave issues (#1182 #1188 #1198 #1214)#1294

Open
thewealthyplace wants to merge 1 commit into
LabsCrypt:mainfrom
thewealthyplace:any-stellar-wave-fixes
Open

fix: resolve four Stellar Wave issues (#1182 #1188 #1198 #1214)#1294
thewealthyplace wants to merge 1 commit into
LabsCrypt:mainfrom
thewealthyplace:any-stellar-wave-fixes

Conversation

@thewealthyplace

@thewealthyplace thewealthyplace commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

[#1182] CORS: restrict non-production origin reflection

  • backend/src/app.ts: replaced the unconditional callback(null, true) for all origins when NODE_ENV !== 'production' with an explicit devOrigins allowlist (localhost 3000/3001 + 127.0.0.1 variants)
  • backend/src/__tests__/cors.test.ts: added two tests — one asserting an unlisted external origin (evil-corp.io) is rejected in development, and one asserting 127.0.0.1:3000 is allowed

[#1188] Migration 1787: create user_notification_preferences table

  • backend/migrations/1787000000017_user-notification-preferences.js: rewrote up() from addColumns('user_profiles', …) (which re-added columns that already exist and conflicted with 1773) to createTable('user_notification_preferences', …) with user_id FK, email_enabled, sms_enabled, phone, and timestamps; down() now drops the table
  • Migration 1793's addColumns(user_notification_preferences, …) and notificationService's SELECT digest_frequency now resolve against the correctly created table on a fresh DB

[#1198] DB pool: add connection and statement timeouts

  • backend/src/db/connection.ts: added connectionTimeoutMillis (from DB_CONN_TIMEOUT_MS, default 10 s) to the Pool config so getClient() rejects instead of hanging when all connections are checked out; added pool.on('connect') hook to SET statement_timeout (from DB_STATEMENT_TIMEOUT_MS, default 30 s) on every acquired connection
  • backend/src/__tests__/connection.test.ts: new test file asserting getClient rejects within the configured timeout when the pool is saturated; also asserts the env var is forwarded correctly
  • backend/.env.example and docs/ENVIRONMENT.md: document the two new env vars

[#1214] tsconfig: enable stricter compile-time checks

  • backend/tsconfig.json: uncommented noUnusedLocals, noUnusedParameters, noImplicitReturns, noFallthroughCasesInSwitch, and noImplicitOverride
  • Fixed all resulting errors across controllers (authController, indexerController, loanController), middleware (loanAccess, rateLimiter), services (eventIndexer, scoresService, webhookService, yieldHistoryService), cron (scoreDecayJob), routes, config, and tests (requestId, remittanceService, notificationService, connection, cors, database) so npm run typecheck passes green

Test plan

  • cd backend && npm run typecheck — exits 0 (no TypeScript errors)
  • cd backend && npx jest src/__tests__/cors.test.ts — new CORS tests pass
  • cd backend && npx jest src/__tests__/connection.test.ts — pool timeout test passes or skips gracefully when no DB is available
  • Bring up a fresh Postgres, run npm run migrate:up — migration chain applies end-to-end without errors (1773 → 1787 → 1793)
  • Start the server with NODE_ENV=development; confirm requests from https://evil-corp.io receive a CORS rejection

closes #1182
closes #1188
closes #1198
closes #1214

@thewealthyplace
fix: resolve four Stellar Wave issues (LabsCrypt#1182 LabsCrypt#1188 L…
32533b9 
…absCrypt#1198 LabsCrypt#1214)

- [LabsCrypt#1182] CORS: restrict non-production branch to localhost/dev
  allowlist instead of reflecting every origin; credentials:true only
  for allowlisted origins; add test asserting unlisted origin rejected
  even when NODE_ENV != production

- [LabsCrypt#1188] Migration 1787: rewrite to CREATE TABLE
  user_notification_preferences (user_id, email_enabled, sms_enabled,
  phone, timestamps) instead of re-adding columns that already exist on
  user_profiles; fix down() to drop the table; service and 1793 migration
  can now resolve the table on a fresh DB

- [LabsCrypt#1198] DB pool: add connectionTimeoutMillis (DB_CONN_TIMEOUT_MS) and
  statement_timeout per connection (DB_STATEMENT_TIMEOUT_MS) so
  getClient() rejects under exhaustion instead of hanging; add test
  asserting rejection within the timeout; document new env vars

- [LabsCrypt#1214] tsconfig: enable noUnusedLocals, noUnusedParameters,
  noImplicitReturns, noFallthroughCasesInSwitch, noImplicitOverride;
  fix all resulting errors across controllers, middleware, services,
  cron jobs, and tests so npm run typecheck passes green
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment