fix: JWT wallet passthrough, duration-aware premium, Unix-second timestamps, pagination clamping

[CelestinaBeing]

Summary

Four backend bug fixes across policy.controller.ts, policy.service.ts, and claims.service.ts:

#112 — confirmPolicy does not pass wallet from JWT to service

Root cause: When req.user?.walletAddress and req.wallet were both absent, authedWallet was undefined and no UnauthorizedException was thrown. The service received only dto and never saw the JWT-verified wallet.

Fix:

• confirmPolicy now explicitly throws UnauthorizedException('Not authenticated') when authedWallet is falsy.
• authedWallet is passed to confirmAndCreatePolicy(dto, authedWallet) as a typed second argument.
• The service validates tx.source === authenticatedWallet (JWT wallet) first, then tx.source === dto.walletAddress, so neither can be spoofed independently.

#111 — calculatePremium does not account for duration

Root cause: calculatePremium(coverageXlm, premiumRate) ignored duration, so a 30-day and a 365-day policy quoted the same premium.

Fix:

• calculatePremium signature extended to (coverageXlm, premiumRate, durationDays).
• Formula: Math.ceil(coverage * rate * duration / (10000 * 30)) — pro-rated against a 30-day base period, matching the PolicyEngine contract.
• Both the quote in buyPolicy (controller) and the stored premiumPaid in createPolicy (service) now pass dto.duration.

#113 — createPolicy uses JavaScript Date milliseconds vs Soroban Unix seconds

Root cause: new Date() includes milliseconds; Soroban timestamps are Unix seconds. A policy stored with endTime = new Date(ms) where ms % 1000 ≠ 0 could expire 0–999 ms before the on-chain contract expected.

Fix:

const nowSeconds = Math.floor(Date.now() / 1000);
const endTimeSeconds = nowSeconds + dto.duration * 24 * 3600;
const now = new Date(nowSeconds * 1000);      // ms component = 0
const endTime = new Date(endTimeSeconds * 1000); // ms component = 0

#114 — getClaimsByWallet pagination can skip rows or return unbounded results

Root cause: Raw page and limit values were passed straight to Prisma. page=0 produced skip = -limit (Prisma error or negative offset), limit=0 produced take=0 (empty result forever), and limit=100000 could return the entire table.

Fix:

const safePage  = Math.max(1, page);
const safeLimit = Math.min(Math.max(1, limit), 100);
skip: (safePage - 1) * safeLimit,
take: safeLimit,

Page numbers are 1-based; limit is clamped to 1–100.

Files changed

File	Issues
src/policy/policy.controller.ts	#111, #112
src/policy/policy.service.ts	#111, #112, #113
src/claims/claims.service.ts	#114

Closes #111, Closes #112, Closes #113, Closes #114

[drips-wave]

@CelestinaBeing Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits