Merge pull request #1730 from danielships/fix/issues-1575-1576-1577-1578-reason-length-webhook-secret-xlm-upload-limits

fix(backend): cap dispute and cancel reasons, require webhook secret length, drop unreachable XLM asset, add upload limits

Author: mftee

backend/src/documents/documents.controller.ts

@@ -15,6 +15,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
+import { Throttle } from '@nestjs/throttler';
 import {
   ApiTags,
   ApiOperation,
@@ -44,6 +45,8 @@ export class DocumentsController {
   constructor(private readonly documentsService: DocumentsService) {}
 
   @Post('upload')
+  // Uploads are expensive: far stricter than the global 60 requests/minute.
+  @Throttle({ default: { limit: 10, ttl: 60_000 } })
   @ApiOperation({ summary: 'Upload a document for a shipment' })
   @ApiConsumes('multipart/form-data')
   @ApiBody({

backend/src/documents/documents.service.ts

@@ -5,6 +5,7 @@ import {
   Logger,
   BadRequestException,
   ConflictException,
+  PayloadTooLargeException,
 } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
@@ -185,6 +186,26 @@ export class DocumentsService {
     };
   }
 
+  /** Total bytes a single user may store across all their uploads. */
+  private static readonly MAX_USER_STORAGE_BYTES = 500 * 1024 * 1024;
+
+  private async assertWithinStorageQuota(
+    uploaderId: string,
+    incomingBytes: number,
+  ): Promise<void> {
+    const rows =
+      (await this.documentRepo.find({
+        where: { uploaderId },
+        select: { sizeBytes: true },
+      })) ?? [];
+    const used = rows.reduce((sum, row) => sum + row.sizeBytes, 0);
+    if (used + incomingBytes > DocumentsService.MAX_USER_STORAGE_BYTES) {
+      throw new PayloadTooLargeException(
+        'Upload would exceed your storage quota; delete old documents first',
+      );
+    }
+  }
+
   private async persistDocument(
     file: Express.Multer.File | undefined,
     uploader: User,
@@ -195,6 +216,7 @@ export class DocumentsService {
     if (!file) {
       throw new BadRequestException('No file provided');
     }
+    await this.assertWithinStorageQuota(uploader.id, file.size ?? file.buffer?.length ?? 0);
     const persisted = this.persistFile(file);
 
     try {

backend/src/payments/settlement-asset.util.ts

@@ -1,4 +1,6 @@
-// MVP settlement-asset decision (issue #1276): TOKEN_CONTRACT_ADDRESS must be
+// MVP settlement-asset decision (issue #1276): only USD-pegged assets are
+// supported (XLM is not a settlement asset: the funding flow always settles
+// in USDC). TOKEN_CONTRACT_ADDRESS must be
 // a USD-pegged SEP-41 asset (e.g. USDC on Stellar), and Shipment.price (fiat
 // decimal, e.g. 1234.56) converts to the contract's i128 base units via a
 // fixed decimal shift — no live FX. Stellar SAC-wrapped assets and classic
@@ -12,7 +14,6 @@ const BASE_UNITS_PER_ASSET_UNIT = 10 ** SETTLEMENT_ASSET_DECIMALS;
 
 const SUPPORTED_SETTLEMENT_ASSETS: Record<string, number> = {
   USDC: SETTLEMENT_ASSET_DECIMALS,
-  XLM: SETTLEMENT_ASSET_DECIMALS,
 };
 
 export function resolveSettlementAssetDecimals(assetCode: string): number {

backend/src/shipments/shipments.controller.ts

@@ -30,16 +30,17 @@ import { RolesGuard } from '../auth/guards/roles.guard';
 import { UserRole } from '../common/enums/role.enum';
 import { ShipmentStatus } from '../common/enums/shipment-status.enum';
 import { User } from '../users/entities/user.entity';
-import { IsEnum, IsOptional, IsString } from 'class-validator';
+import { IsEnum, IsOptional, IsString, MaxLength } from 'class-validator';
 import { ApiPropertyOptional } from '@nestjs/swagger';
 import { Response } from 'express';
 import { ExportShipmentsDto } from './dto/export-shipments.dto';
 import { AnalyticsQueryDto } from './dto/analytics-query.dto';
 
 class DisputeBody {
-  @ApiPropertyOptional()
+  @ApiPropertyOptional({ maxLength: 2000 })
   @IsOptional()
   @IsString()
+  @MaxLength(2000)
   reason?: string;
 }
 
@@ -56,9 +57,10 @@ class ResolveDisputeBody {
 }
 
 class CancelBody {
-  @ApiPropertyOptional()
+  @ApiPropertyOptional({ maxLength: 2000 })
   @IsOptional()
   @IsString()
+  @MaxLength(2000)
   reason?: string;
 }
 

backend/src/webhooks/dto/create-webhook.dto.ts

@@ -1,5 +1,5 @@
 import { ApiProperty } from '@nestjs/swagger';
-import { IsString, IsUrl, MaxLength } from 'class-validator';
+import { IsString, IsUrl, MaxLength, MinLength } from 'class-validator';
 
 export class CreateWebhookDto {
   @ApiProperty({ example: 'https://partner.example.com/webhooks/freightflow' })
@@ -8,9 +8,11 @@ export class CreateWebhookDto {
 
   @ApiProperty({
     example: 'whsec_test_123',
-    description: 'Shared secret used to verify the HMAC signature.',
+    description:
+      'Shared secret used to verify the HMAC signature (at least 16 characters).',
   })
   @IsString()
+  @MinLength(16)
   @MaxLength(255)
   secret: string;
 }