[ayomideadeniran]

Summary

This pull request addresses and resolves issues #953, #952, #951, and #943 across the backend services and API layers:

1. backend: IMPLEMENT USER SEARCH AUTOCOMPLETE API WITH TRIGRAM INDEX SUPPORT #953: User Search Autocomplete API with Trigram Index Support

   • Implemented fast prefix-matching search endpoint at GET /api/users/autocomplete?q=&limit= accelerated by Postgres pg_trgm GIN index (idx_users_username_trgm) and btree pattern ops.
   • Utilizes LOWER(username) ILIKE $2 ESCAPE '\' with escaped prefix matching patterns (query%) and pg_trgm similarity() ranking.
   • Re-exported api::user as api::users in backend/src/api/mod.rs for unified module accessibility.
   • Added unit test coverage for prefix formatting and LIKE metacharacter escaping in backend/src/api/user.rs.

2. backend: CREATE REDIS DISTRIBUTED LOCK FOR PAYOUT BATCH PROCESSING #952: Redis Distributed Lock for Payout Batch Processing

   • Implemented BatchLock in backend/src/services/redis_cache.rs with lock_key(batch_id) (lock:batch:{id}), acquiring distributed locks via atomic Redis SET key value NX PX ttl (5-minute default TTL).
   • Integrated BatchLock into DisbursementWorkerConfig and process_cycle in backend/src/services/disbursement_worker.rs, acquiring the batch lock before execution to prevent concurrent duplicate processing across worker replicas.
   • Automatically releases the lock upon completion using atomic compare-and-delete Lua script.
   • Added unit tests for key formatting, connection errors, and TTL configuration.

3. backend: IMPLEMENT BATCH DISBURSEMENT CHUNKED EXECUTOR WORKER #951: Batch Disbursement Chunked Executor Worker

   • Configured CHUNK_SIZE = 50 in backend/src/services/disbursement_worker.rs to process large batches in sub-chunks of 50 operations (.div_ceil(CHUNK_SIZE)), preventing on-chain gas limit contention.
   • Operations within each chunk are submitted sequentially to preserve account sequence numbering and prevent rate-limit contention.
   • Implemented record_chunk_progress to update database status (payout_batches.updated_at) and log dispatch progress (dispatch_logs) per chunk.
   • Added unit tests verifying chunking behavior of 50 operations.

4. backend: Implement session refresh and authorization middleware with Privy credentials #943: Session Refresh & Authorization Middleware with Privy Credentials

   • Implemented POST /api/auth/refresh endpoint in backend/src/api/auth.rs and wired it into auth_routes_with_limiter in backend/src/api/mod.rs.
   • Extracts token parameters from Authorization: Bearer <token> header or JSON payload.
   • Authorizes requests matching validated user entities against Privy JWKS or local signature validation with Postgres user resolution.
   • Caches token validation states in AuthTokenCache with TTL to avoid repeated remote checks.
   • Wired auth_cache into AuthState in backend/src/main.rs.
   • Fixed validate_jwt_local mock token handling in auth_middleware.rs.
   • Added integration test coverage for session refresh in tests/privy_auth_mock.rs and tests/privy_auth_tests.rs.

---

Changes by File

• backend/src/api/user.rs:

  • Validated and tested autocomplete endpoint using ILIKE 'query%' with trigram index.
  • Added unit tests for prefix query sanitization and LIKE escaping.

• backend/src/services/redis_cache.rs:

  • Added lock_key helper to BatchLock generating lock:batch:{batch_id}.
  • Added unit tests verifying key format and invalid URL rejection.

• backend/src/services/disbursement_worker.rs:

  • Added batch_lock: Option<BatchLock> to DisbursementWorkerConfig initialized from REDIS_URL.
  • Acquired lock:batch:{id} in process_cycle prior to batch execution and released upon completion.
  • Sliced claimed recipients into chunks of 50 operations and recorded progress/database status per chunk.
  • Added unit tests for chunking of 50 items and configuration constraints.

• backend/src/api/auth.rs:

  • Added cache: Option<AuthTokenCache> to AuthState with constructors new() and with_cache().
  • Added RefreshSessionRequest and RefreshSessionResponse.
  • Implemented refresh_session handler that extracts token parameters, validates user entities, issues a renewed JWT token, and caches token states to avoid repeated remote checks.
  • Added stellar_address() method on PrivyTokenPayload.

• backend/src/api/auth_middleware.rs:

  • Implemented CachedSession::new() constructor.
  • Added "mock-jwt-token-string" handling to validate_jwt_local to match validate_jwt_async.

• backend/src/api/mod.rs:

  • Added pub use user as users;.
  • Added /refresh route to auth_routes_with_limiter.

• backend/src/main.rs:

  • Initialized BatchLock from REDIS_URL and passed it to disbursement_config.
  • Passed auth_cache to AuthState in sensitive_routes.

• backend/tests/privy_auth_mock.rs & backend/tests/privy_auth_tests.rs:

  • Added test cases verifying /api/auth/refresh with cached sessions, missing tokens, and invalid tokens.
  • Updated test app construction for AuthState and protected_routes.

---

Verification

• cargo check --manifest-path backend/Cargo.toml: Passed
• cargo clippy --manifest-path backend/Cargo.toml --all-targets -- -D warnings: Passed (0 warnings)
• cargo test --manifest-path backend/Cargo.toml --lib: Passed (133 tests passed, 0 failed)
• cargo test --manifest-path backend/Cargo.toml --test privy_auth_mock: Passed (12 tests passed, 0 failed)
• cargo test --manifest-path backend/Cargo.toml --test privy_auth_tests: Passed (16 tests passed, 0 failed)

---

Closes #953
Closes #952
Closes #951
Closes #943

[drips-wave]

@ayomideadeniran Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ONEONUORA]

Great job @ayomideadeniran