Repository navigation
Fix/platform audit repairs - #1580
Merged
mimijuwonlo-commits merged 7 commits intoOct 27, 2026
Merged
mimijuwonlo-commits merged 7 commits into
mimijuwonlo-commits merged 7 commits into
Conversation
- splits.controller: remove duplicated imports and add missing cache imports (the backend did not type-check); parse req.params.projectId instead of the whole params object, which made every GET /splits/:projectId return 400; return start/limit/hasMore alongside nextCursor; read page then count sequentially for a deterministic RPC order. - routes/splits: delete four inline handlers that the controller handlers registered earlier made unreachable. - email-provider: carry uid/prev through verifyEmailFlowToken; they were dropped, so every email-change confirmation was rejected. - splits.service: a database outage no longer hides an on-chain project on read; expiry is still enforced fail-closed on writes. - audit-log: normalise keys before redaction as documented, so api-key, Private-Key and similar no longer reach the audit log in clear text. - users: drop an unused, unversioned login token. - payout backfill: add .js extensions required by NodeNext resolution. - migrations: AddUniqueIndexTransactionHash.down no longer drops the txHash unique index the initial migration owns; the initial down uses IF EXISTS. Verified on PostgreSQL 16: 20 up, 20 down, 20 up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Use a checksum-valid CONTRACT_ID in setup and fixtures; env validation now checks StrKey checksums. - Pass the real StrKey through @stellar/stellar-sdk mocks. - Mock the off-chain expiration store in DB-less route tests, reset the read cache between split route tests, and answer get_balance as i128. - Capture logger output through a stream transport (Winston binds console.log at construction, so the redaction suite could never observe output). - Fix a syntax error in transactions-immutability and a cast in api-contract. - Add regressions: project lookup by id, malformed id, audit key normalisation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- deposit_property_tests: build Collaborator with alias/basis_points (the nonexistent share_bps field broke compilation of the whole suite). - prior_state_fixture_tests: give each layout its own Env borrow (E0597) and apply rustfmt. - address_validation_tests: expect InvalidSplit for a 13,000 bps split, as the test name and create_project's documented errors state. No contract code or interface changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…xact amounts
- Metadata, collaborator, recovery, pause/resume and allowlist actions only
submitted and immediately reported success. They now wait for ledger
confirmation, run under the single-flight submission guard, and stay
blocked while their outcome is unknown.
- Deposits were converted with Math.floor(parseFloat(x) * 1e7), which sent
one stroop less for inputs like 0.57 or 2.01. Add lib/amounts.ts (bigint
parsing/formatting) and a payout preview that mirrors the contract's
remainder-to-last rule. Recovery amounts are validated as whole stroops
within the unallocated balance.
- api-client: accept the backend's { projects, total } envelope (the
dashboard and project list called .map on an object), page through every
project, and map the allowlist `count` field.
- token presets: the listed USDC/EURC/XLM contract IDs failed StrKey
checksums; keep only the derived native XLM asset contracts.
- split-app: call useConnectionStatus() (it was referenced but never called).
- The app shell header/tabs in split-app-legacy are restyled on the new
design tokens in the same file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ects - Restore CreateSplitWizardLegacy from 758f922. Commit 0b40f28 replaced it with an older copy, dropping the Split-Naira#1267 error summary, aria-disabled submit and translated validation messages. - useFocusTrap: make a container with no focusable children focusable. - MobileDrawer: unmount content while closed so off-screen links are not tabbable; expose the open drawer as a labelled modal dialog. - useSplits: update the account ref after commit, not during render. - Remove TransactionStatusTimeline.types.ts: an unused component pasted into a .ts file that did not parse. - Test fixes: real next-intl for the locale test, i18n checker importable, bundle budget path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sign - Tailwind v4 never loaded tailwind.config.ts, so ink/muted/greenBright and other brand utilities generated no CSS. Define tokens in @theme (midnight navy surfaces, emerald primary, warm off-white text) and remove the unused JS config. - Shared primitives: token-based Button/buttonClasses (server-safe module), Card, SectionHeader, StatCard, StatusBadge; global focus ring and reduced-motion handling. - New public landing page at /{locale} (en + fr): how it works, features, Stellar/Soroban explanation, FAQ. No testimonials or metrics; the product preview is labelled as an illustrative example. The app moves to /{locale}/app. - DashboardView rewritten (it did not parse): per-token totals with bigint arithmetic instead of summing different tokens as floats, network-aware explorer links, empty state, working quick actions, confirmed-state copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Add .env.compose.example (referenced by the README but excluded by the .env.* ignore rule) and whitelist it. - Default NEXT_PUBLIC_API_BASE_URL to http://localhost:3001: the value is baked into browser JavaScript, which cannot resolve the `backend` service. - README: required CONTRACT_ID/SIMULATOR_ACCOUNT, routes, amount precision, transaction states, known limitations; remove nonexistent scripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Changes
Testing
PR Checklist
.env.exampleif neededDeploy Impact
Risk level
Contract changes
Database migrations
Environment variables
.env.exampleRollback plan
See release readiness checklist for
the full pre-deploy gate.