feat(auth): secure profile and certification validation (#1615)

Closes #1547
Closes #1548
Closes #1549
Closes #1550

Co-authored-by: mftee <falademaryam78@gmail.com>

Author: authenticeasy-sys

backend/package-lock.json

@@ -35,6 +35,7 @@
     "@nestjs/passport": "^11.0.5",
     "@nestjs/platform-express": "^11.0.1",
     "@nestjs/platform-socket.io": "^11.1.12",
+    "@nestjs/schedule": "^6.1.3",
     "@nestjs/swagger": "^11.1.5",
     "@nestjs/terminus": "^11.0.0",
     "@nestjs/throttler": "^6.4.0",

backend/package.json

@@ -7,6 +7,7 @@ import { ConfigModule, ConfigService } from '@nestjs/config';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';
 import { EventEmitterModule } from '@nestjs/event-emitter';
+import { ScheduleModule } from '@nestjs/schedule';
 import { UsersModule } from './users/users.module';
 import { AuthModule } from './auth/auth.module';
 import { ShipmentsModule } from './shipments/shipments.module';
@@ -56,6 +57,7 @@ const throttlerErrorMessage = (context: ExecutionContext): string => {
       },
     }),
     EventEmitterModule.forRoot({ wildcard: false, delimiter: '.' }),
+    ScheduleModule.forRoot(),
     ThrottlerModule.forRoot({
       errorMessage: throttlerErrorMessage,
       throttlers: [

backend/src/app.module.ts

@@ -12,6 +12,7 @@ import * as bcrypt from 'bcrypt';
 import { v4 as uuidv4 } from 'uuid';
 import { UsersService } from '../users/users.service';
 import { RegisterDto } from './dto/register.dto';
+import { UpdateProfileDto } from './dto/update-profile.dto';
 import { User } from '../users/entities/user.entity';
 import { JwtPayload } from './strategies/jwt.strategy';
 
@@ -200,7 +201,7 @@ export class AuthService {
 
   async updateProfile(
     userId: string,
-    dto: { firstName?: string; lastName?: string; walletAddress?: string },
+    dto: UpdateProfileDto,
   ): Promise<Omit<User, 'passwordHash' | 'refreshToken'>> {
     await this.usersService.update(userId, dto);
     const updated = await this.usersService.findOne(userId);

backend/src/auth/auth.service.ts

@@ -0,0 +1,57 @@
+import { validate } from 'class-validator';
+import { UpdateProfileDto } from './update-profile.dto';
+
+const VALID_PUBLIC_KEY =
+  'GAGD6MFNQ5IZQQQW6MOS6JWZALYR5P7ITCZP3NUQPNYLHWYBQVC6NNXB';
+
+async function getValidationErrors(dto: object): Promise<string[]> {
+  const errors = await validate(dto, {
+    whitelist: true,
+    forbidNonWhitelisted: false,
+  });
+  return errors.flatMap((error) => Object.values(error.constraints ?? {}));
+}
+
+describe('UpdateProfileDto', () => {
+  it('accepts a valid Stellar Ed25519 public key', async () => {
+    const dto = new UpdateProfileDto();
+    dto.walletAddress = VALID_PUBLIC_KEY;
+
+    expect(await getValidationErrors(dto)).toHaveLength(0);
+  });
+
+  it.each([
+    'not-a-stellar-key',
+    'SAGD6MFNQ5IZQQQW6MOS6JWZALYR5P7ITCZP3NUQPNYLHWYBQVC6NNXB',
+    'GAGD6MFNQ5IZQQQW6MOS6JWZALYR5P7ITCZP3NUQPNYLHWYBQVC6NNX',
+    // Same length/prefix as the valid key, but with a bad checksum.
+    'GAGD6MFNQ5IZQQQW6MOS6JWZALYR5P7ITCZP3NUQPNYLHWYBQVC6NNXC',
+  ])('rejects invalid Stellar public key %s', async (walletAddress) => {
+    const dto = new UpdateProfileDto();
+    dto.walletAddress = walletAddress;
+
+    const messages = await getValidationErrors(dto);
+    expect(messages).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining('valid Stellar Ed25519 public key'),
+      ]),
+    );
+  });
+
+  it('keeps the field optional when it is omitted or null', async () => {
+    const omitted = new UpdateProfileDto();
+    const cleared = new UpdateProfileDto();
+    cleared.walletAddress = null;
+
+    expect(await getValidationErrors(omitted)).toHaveLength(0);
+    expect(await getValidationErrors(cleared)).toHaveLength(0);
+  });
+
+  it('rejects non-string values when the field is supplied', async () => {
+    const dto = new UpdateProfileDto();
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    (dto as any).walletAddress = 123;
+
+    expect(await getValidationErrors(dto)).not.toHaveLength(0);
+  });
+});

backend/src/auth/dto/update-profile.dto.spec.ts

@@ -1,5 +1,6 @@
 import { IsString, IsOptional, MinLength, MaxLength } from 'class-validator';
 import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsStellarEd25519PublicKey } from '../../common/validators/is-stellar-ed25519-public-key.decorator';
 
 export class UpdateProfileDto {
   @ApiPropertyOptional({ example: 'John' })
@@ -16,8 +17,12 @@ export class UpdateProfileDto {
   @MaxLength(50)
   lastName?: string;
 
-  @ApiPropertyOptional({ example: 'GABCDE...XYZ' })
+  @ApiPropertyOptional({
+    example: 'GAGD6MFNQ5IZQQQW6MOS6JWZALYR5P7ITCZP3NUQPNYLHWYBQVC6NNXB',
+    description: 'Optional Stellar Ed25519 account public key (StrKey)',
+  })
   @IsOptional()
   @IsString()
-  walletAddress?: string;
+  @IsStellarEd25519PublicKey()
+  walletAddress?: string | null;
 }

backend/src/auth/dto/update-profile.dto.ts

@@ -0,0 +1,33 @@
+import { CarrierCertificationExpiryScheduler } from './carrier-certification-expiry.scheduler';
+import { CarrierCertificationsService } from './carrier-certifications.service';
+
+describe('CarrierCertificationExpiryScheduler', () => {
+  it('runs the expiry sweep when the module starts and on schedule', async () => {
+    const certificationsService = {
+      revokeExpiredCertifications: jest.fn().mockResolvedValue(2),
+    } as unknown as CarrierCertificationsService;
+    const scheduler = new CarrierCertificationExpiryScheduler(
+      certificationsService,
+    );
+
+    await scheduler.onModuleInit();
+    await scheduler.sweep();
+
+    expect(
+      certificationsService.revokeExpiredCertifications,
+    ).toHaveBeenCalledTimes(2);
+  });
+
+  it('contains sweep failures so the scheduler remains alive', async () => {
+    const certificationsService = {
+      revokeExpiredCertifications: jest
+        .fn()
+        .mockRejectedValue(new Error('db down')),
+    } as unknown as CarrierCertificationsService;
+    const scheduler = new CarrierCertificationExpiryScheduler(
+      certificationsService,
+    );
+
+    await expect(scheduler.sweep()).resolves.toBeUndefined();
+  });
+});

backend/src/carriers/carrier-certification-expiry.scheduler.spec.ts

@@ -0,0 +1,36 @@
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { Cron, CronExpression } from '@nestjs/schedule';
+import { CarrierCertificationsService } from './carrier-certifications.service';
+
+/**
+ * Runs the expiry cleanup independently of request traffic. The service method
+ * is atomic, so multiple application instances can safely run this job.
+ */
+@Injectable()
+export class CarrierCertificationExpiryScheduler implements OnModuleInit {
+  private readonly logger = new Logger(
+    CarrierCertificationExpiryScheduler.name,
+  );
+
+  constructor(
+    private readonly certificationsService: CarrierCertificationsService,
+  ) {}
+
+  async onModuleInit(): Promise<void> {
+    await this.sweep();
+  }
+
+  @Cron(CronExpression.EVERY_MINUTE)
+  async sweep(): Promise<void> {
+    try {
+      const revoked =
+        await this.certificationsService.revokeExpiredCertifications();
+      if (revoked > 0) {
+        this.logger.log(`Revoked ${revoked} expired carrier certification(s)`);
+      }
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Certification expiry sweep failed: ${message}`);
+    }
+  }
+}