[huangji6693-max]

Closes #330

Summary

Secures the /api/sponsor fee-sponsorship endpoint (app/api/sponsor/route.ts) against unauthenticated and arbitrary transaction sponsorship abuse that could drain the platform treasury's XLM reserves.

Changes

1. Borrower Session Authentication & Authorization (app/api/sponsor/route.ts):
   • Enforces authenticated borrower sessions via requireAuthenticatedUser("borrower").
   • Properly catches and logs authentication/role redirects and UnauthorizedError exceptions, returning structured 401 Unauthorized or 403 Forbidden JSON responses.
   • Verifies that when a borrower session has a linked Stellar wallet address (user.walletAddress), the inner transaction's source account matches the authenticated borrower wallet and never spoofs the platform admin/sponsor account.
2. Inner Transaction XDR & Operation Validation (validateSponsoredTransactionXdr):
   • Rejects missing, oversized, malformed, or already fee-bumped (FeeBumpTransaction) XDR payloads with 400 Bad Request.
   • Enforces operation count bounds (1..=5 operations) and verifies every operation's source account matches the inner transaction's source account.
   • Inspects invokeHostFunction operations to verify they invoke an official TrustLend smart contract ID (resolved from CONTRACTS manifest env vars and TRUSTLEND_ALLOWED_CONTRACT_IDS) and call an approved borrower/protocol method (APPROVED_CONTRACT_METHODS) while blocking privileged admin methods (FORBIDDEN_CONTRACT_METHODS such as initialize, upgrade, pause, trigger_insurance_payout, etc.).
   • Restricts classic payment operations to approved TrustLend protocol memos (TL-RPY:, TL-FUND:, TL-DEPOSIT:, TL-WDR:) or the configured platform wallet, rejecting arbitrary transfers and non-protocol operation types.
3. Strict Per-User & Per-Wallet Rate Limits (lib/rate-limit.ts):
   • Adds SPONSOR_USER_POLICY (5 req / 1 m per user.id) and SPONSOR_WALLET_POLICY (5 req / 1 m per Stellar wallet address) via enforceSponsorRateLimit() in addition to the route-level IP rate limit.
4. Unit Tests (app/api/sponsor/route.test.ts):
   • Adds 14 unit tests covering 401 unauthenticated rejection, 403 non-borrower role rejection, malformed XDR / double-FeeBump rejection, unrecognized contract rejection, admin method rejection, unauthorized classic payment rejection, wallet mismatch rejection, valid contract & protocol payment sponsorship, and per-user / per-wallet rate limiting.

Verification

• npx vitest run — 1,033 passed, 0 failed
• npx tsc --noEmit — 0 errors

[vercel]

@huangji6693-max is attempting to deploy a commit to the thisisouvik's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 83b3556b-7527-4bc7-83b8-ada86a06d1e6

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}