Skip to content

feat(tests): add regression suite for critical stream flows (#584)#2

Open
DevKingOche wants to merge 450 commits into
mainfrom
feature/584-regression-test-suite
Open

feat(tests): add regression suite for critical stream flows (#584)#2
DevKingOche wants to merge 450 commits into
mainfrom
feature/584-regression-test-suite

Conversation

@DevKingOche

Copy link
Copy Markdown
Owner

Summary

  • added an integration regression suite for the core stream and token flows
  • documented the regression test scope and execution steps
  • wired the suite into CI via a dedicated workflow

Testing

  • cargo test -p paystream-stream --test regression_suite

pntech20 and others added 30 commits May 23, 2026 09:35
- Add AllowedTokens/AllowedToken DataKey variants to types.rs
- Add ERR_TOKEN_NOT_ALLOWED error constant (E018)
- Add storage helpers: is_token_allowed, add_allowed_token,
  remove_allowed_token, get_allowed_tokens
- Add contract functions: add_allowed_token (admin), remove_allowed_token
  (admin), get_allowed_tokens (public)
- Guard create_stream and create_streams_batch against non-allowlisted tokens
- Allowlist is open (all tokens pass) until first token is added

Closes Vera3289#292
- Add ContractConfig packed struct: packs min_deposit, fee_bps,
  max_streams, admin_nonce, paused into a single ledger entry
- Add Config DataKey variant (replaces 5 individual instance-storage keys)
- Rewrite storage.rs with load_config/save_config; all scalar config
  accessors now read/write the single Config entry — reduces
  instance-storage reads per hot-path call from ≥3 to 1
- Add get_paused_cfg/set_paused_cfg backed by packed config
- Add early-exit in claimable_amount when elapsed == 0 (avoids 128-bit
  multiply in the common post-withdraw case)
- Document full storage layout in storage.rs header comment
- Old individual DataKey variants retained for on-chain backward compat

Closes Vera3289#272
- Replace X-API-Key-only middleware with JWT Bearer token support
- POST /auth/challenge: returns a one-time nonce (5 min TTL) for a
  given Stellar address
- POST /auth/verify: validates Ed25519 signature over the nonce using
  stellar-sdk Keypair.verify(), issues a 24h JWT on success
- api/middleware/auth.js: validates Bearer JWT; falls back to X-API-Key
  for backward compatibility
- Register /auth routes as public (no auth middleware) in server.js
- Add BearerAuth security scheme to Swagger config
- Add jsonwebtoken@9.0.2 to package.json
- Document JWT_SECRET in .env.example

Closes Vera3289#245
- services/indexer/src/migrate.js: PostgreSQL schema with
  indexer_cursor (singleton cursor for resume-after-restart) and
  stream_events (dedup via UNIQUE on tx_hash+event_type+stream_id)
- services/indexer/src/index.js: polls Soroban RPC getEvents every
  POLL_INTERVAL_MS (default 5s), decodes XDR topics/data, upserts
  events into PostgreSQL; advances cursor to latestLedger each poll;
  handles 'startLedger too old' reorg/gap recovery by jumping cursor
  to current ledger
- GET /events: query indexed events with stream_id, event_type,
  limit, offset filters
- GET /status: returns lastIndexedLedger and totalEvents count
- services/indexer/package.json: @stellar/stellar-sdk, pg, express
- services/indexer/.env.example: SOROBAN_RPC_URL, STREAM_CONTRACT_ID,
  DATABASE_URL, POLL_INTERVAL_MS, PORT

Closes Vera3289#247
Resolves Vera3289#271 - Add emergency global pause (pause_all/resume_all)
Resolves Vera3289#283 - Add per-employer stream count limit (default 1000)
Resolves Vera3289#270 - Contract upgrade mechanism with 48h timelock
Resolves Vera3289#266 - Environment variable validation (.env.example)

- Vera3289#271: pause_all()/resume_all() admin functions; blocks create_stream
  and withdraw when paused; emits GlobalPaused event
- Vera3289#283: enforce EmployerStreamLimit per employer; admin can adjust via
  set_stream_limit(); returns E006 StreamLimitExceeded on breach
- Vera3289#270: schedule_upgrade()/execute_upgrade()/cancel_upgrade() with 48h
  timelock; emits UpgradeScheduled and UpgradeExecuted events
- Vera3289#266: .env.example documents all required vars; scripts/validate-env.sh
  validates presence, format (addresses, contract IDs, integers), and
  warns on deprecated vars; wired into init-testnet.sh
- Fix pre-existing pause/resume bug: add paused_at field to Stream so
  paused duration is excluded from claimable calculation
- All 24 tests pass
…1-283

feat: emergency pause, stream limit, upgrade timelock, env validation
feat(services): implement stream event indexer
feat(contract): implement token allowlist for streams
feat(api): implement JWT authentication for API
…ion-272

perf(contract): optimize storage layout for gas reduction
backend: add pg connection pooling with env-configurable settings
…edule

stream: add linear vesting streams and claimable support
Comprehensive pre-mainnet checklist covering security audit status,
test coverage, load testing, DR runbook, legal/compliance, infra,
frontend/SDK, and deployment execution steps.

Closes Vera3289#343
## Overview
Implements employee stream transfer functionality and comprehensive event schema documentation.

## Changes
- **Stream Transfer**: Added `transfer_stream(stream_id, new_employee)` method allowing employees to transfer stream rights to another address. Pending claimable amount is preserved during transfer.
- **Event Schema Docs**: Created `docs/events.md` documenting all emitted events (StreamCreated, Withdrawn, Paused, Resumed, Cancelled, ToppedUp, StreamTransferred) with field types, descriptions, and example payloads.
- **Event Refinement**: Updated event emission to use explicit typed events (stream_paused, stream_resumed, stream_cancelled, stream_transferred) instead of generic status events.
- **Transfer Index Helper**: Added `transfer_employee_stream()` storage helper to move stream ownership in the employee index safely.
- **Test Coverage**: Added `test_transfer_stream_preserves_claimable()` to verify claimable tokens are correctly preserved after transfer.

## Fixes
- Fixes Vera3289#276 Implement stream transfer (change employee)
- Fixes Vera3289#281 Add contract event schema documentation

## Acceptance Criteria
✅ `transfer_stream(stream_id, new_employee)` callable by current employee
✅ Pending claimable amount preserved
✅ Emits StreamTransferred event
✅ Employer cannot block transfer
✅ All events documented with field names and types
✅ Example event payloads included
✅ Published in docs/events.md
- Add transfer_stream(employee, stream_id, new_employee) callable by current employee
- Pending claimable amount preserved during transfer
- Emits StreamTransferred event
- Employer cannot block transfer
- Add transfer_employee_stream storage helper to update employee index
- Add test_transfer_stream_preserves_claimable test

Closes Vera3289#276
Document all emitted events with fields, types, and example payloads:
- StreamCreated, Withdrawn, Paused, Resumed, Cancelled, ToppedUp, StreamTransferred
- Each event includes topic format, field table, and example JSON payload

Closes Vera3289#281
- NotificationPreference model with email/webhook channels
- Per-event-type toggles for all 7 stream events
- CRUD operations: create, list, get, update, delete
- Unsubscribe via token (one-click opt-out from email links)
- backend/README.md documents endpoints and usage

Closes Vera3289#261
- Reject payloads > 1MB with 400 and field-level error message
- Strip unexpected fields not in the endpoint's allow-list
- Validate Stellar address format (56-char, G-prefix, base32) on all address fields
- error_response() helper builds structured 400 JSON body
- Unit tests for all four acceptance criteria

Closes Vera3289#254
Vera3289 and others added 30 commits June 2, 2026 08:29
feat(tests): add invariant tests for stream contract
…zation-286

feat(contract): optimize create_streams_batch gas cost
…ng-295

feat(ci): add code coverage reporting and threshold enforcement
…ra3289#443)

Bumps the patch-updates group in /demo with 4 updates: [react](https://github.com/facebook/react/tree/HEAD/packages/react), [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react), [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `react` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `@types/react` from 19.2.15 to 19.2.16
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.6 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `@types/react` from 19.2.15 to 19.2.16
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `vite` from 8.0.14 to 8.0.16
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@types/react"
  dependency-version: 19.2.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@types/react"
  dependency-version: 19.2.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [morgan](https://github.com/expressjs/morgan) from 1.10.1 to 1.11.0.
- [Release notes](https://github.com/expressjs/morgan/releases)
- [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md)
- [Commits](expressjs/morgan@1.10.1...1.11.0)

---
updated-dependencies:
- dependency-name: morgan
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@bull-board/api](https://github.com/felixmosh/bull-board/tree/HEAD/packages/api) from 5.23.0 to 7.1.5.
- [Release notes](https://github.com/felixmosh/bull-board/releases)
- [Changelog](https://github.com/felixmosh/bull-board/blob/master/CHANGELOG.md)
- [Commits](https://github.com/felixmosh/bull-board/commits/v7.1.5/packages/api)

---
updated-dependencies:
- dependency-name: "@bull-board/api"
  dependency-version: 7.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [zaproxy/action-baseline](https://github.com/zaproxy/action-baseline) from 0.12.0 to 0.15.0.
- [Release notes](https://github.com/zaproxy/action-baseline/releases)
- [Changelog](https://github.com/zaproxy/action-baseline/blob/master/CHANGELOG.md)
- [Commits](zaproxy/action-baseline@v0.12.0...v0.15.0)

---
updated-dependencies:
- dependency-name: zaproxy/action-baseline
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 4 to 7.
- [Release notes](https://github.com/anchore/scan-action/releases)
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md)
- [Commits](anchore/scan-action@v4...v7)

---
updated-dependencies:
- dependency-name: anchore/scan-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5 to 6.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@v5...v6)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2 to 3.
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](dependabot/fetch-metadata@v2...v3)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…ns/dependabot/fetch-metadata-3

chore(deps): bump dependabot/fetch-metadata from 2 to 3
…ns/actions/checkout-6

chore(deps): bump actions/checkout from 4 to 6
…ns/docker/metadata-action-6

chore(deps): bump docker/metadata-action from 5 to 6
…ns/anchore/scan-action-7

chore(deps): bump anchore/scan-action from 4 to 7
…ns/zaproxy/action-baseline-0.15.0

chore(deps): bump zaproxy/action-baseline from 0.12.0 to 0.15.0
…/bull-board/api-7.1.5

chore(deps): bump @bull-board/api from 5.23.0 to 7.1.5
Bumps [@bull-board/express](https://github.com/felixmosh/bull-board/tree/HEAD/packages/express) from 5.23.0 to 7.1.5.
- [Release notes](https://github.com/felixmosh/bull-board/releases)
- [Changelog](https://github.com/felixmosh/bull-board/blob/master/CHANGELOG.md)
- [Commits](https://github.com/felixmosh/bull-board/commits/v7.1.5/packages/express)

---
updated-dependencies:
- dependency-name: "@bull-board/express"
  dependency-version: 7.1.5
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@aws-sdk/client-secrets-manager](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-secrets-manager) from 3.1057.0 to 3.1061.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-secrets-manager/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/clients/client-secrets-manager)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-secrets-manager"
  dependency-version: 3.1061.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [bullmq](https://github.com/taskforcesh/bullmq) from 5.77.6 to 5.78.0.
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.77.6...v5.78.0)

---
updated-dependencies:
- dependency-name: bullmq
  dependency-version: 5.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…/morgan-1.11.0

chore(deps): bump morgan from 1.10.1 to 1.11.0
…/bullmq-5.78.0

chore(deps): bump bullmq from 5.77.6 to 5.78.0
…/aws-sdk/client-secrets-manager-3.1061.0

chore(deps): bump @aws-sdk/client-secrets-manager from 3.1057.0 to 3.1061.0
…/bull-board/express-7.1.5

chore(deps): bump @bull-board/express from 5.23.0 to 7.1.5
Vera3289#455)

Bumps the patch-updates group in /demo with 1 update: [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react).


Updates `@types/react` from 19.2.16 to 19.2.17
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

---
updated-dependencies:
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…pdates (Vera3289#465)

Bumps the patch-updates group with 3 updates in the / directory: [bullmq](https://github.com/taskforcesh/bullmq), [ioredis](https://github.com/luin/ioredis) and [prettier](https://github.com/prettier/prettier).


Updates `bullmq` from 5.78.0 to 5.78.1
- [Release notes](https://github.com/taskforcesh/bullmq/releases)
- [Commits](taskforcesh/bullmq@v5.78.0...v5.78.1)

Updates `ioredis` from 5.11.0 to 5.11.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.11.0...v5.11.1)

Updates `prettier` from 3.8.3 to 3.8.4
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.8.4)

---
updated-dependencies:
- dependency-name: bullmq
  dependency-version: 5.78.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: ioredis
  dependency-version: 5.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: prettier
  dependency-version: 3.8.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.