feat(treasury): approval/rejection voting UI for multisig proposals (#132)

apps/backend/drizzle/0008_treasury_multisig_voting.sql

@@ -0,0 +1,32 @@
+CREATE TYPE "public"."treasury_proposal_status" AS ENUM('active', 'approved', 'rejected', 'executed', 'expired');--> statement-breakpoint
+CREATE TYPE "public"."proposal_vote_type" AS ENUM('approve', 'reject');--> statement-breakpoint
+CREATE TABLE "treasury_proposals" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"contract_id" text NOT NULL,
+	"proposal_id" text NOT NULL,
+	"conversation_id" uuid,
+	"status" "treasury_proposal_status" DEFAULT 'active' NOT NULL,
+	"approvals_count" integer DEFAULT 0 NOT NULL,
+	"rejections_count" integer DEFAULT 0 NOT NULL,
+	"recipient" text,
+	"amount" text,
+	"token" text,
+	"threshold" integer DEFAULT 3 NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "proposal_votes" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"treasury_proposal_id" uuid NOT NULL,
+	"user_id" uuid NOT NULL,
+	"vote" "proposal_vote_type" NOT NULL,
+	"signature" text,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "treasury_proposals" ADD CONSTRAINT "treasury_proposals_conversation_id_conversations_id_fk" FOREIGN KEY ("conversation_id") REFERENCES "public"."conversations"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "proposal_votes" ADD CONSTRAINT "proposal_votes_treasury_proposal_id_treasury_proposals_id_fk" FOREIGN KEY ("treasury_proposal_id") REFERENCES "public"."treasury_proposals"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "proposal_votes" ADD CONSTRAINT "proposal_votes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "treasury_proposals_contract_proposal_idx" ON "treasury_proposals" USING btree ("contract_id","proposal_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "proposal_votes_proposal_user_unique" ON "proposal_votes" USING btree ("treasury_proposal_id","user_id");

apps/backend/drizzle/meta/_journal.json

@@ -57,6 +57,13 @@
       "when": 1782345600000,
       "tag": "0007_user_devices",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1751001600000,
+      "tag": "0008_treasury_multisig_voting",
+      "breakpoints": true
     }
   ]
 }

apps/backend/src/db/schema.ts

@@ -207,6 +207,8 @@ export const treasuryProposalStatusEnum = pgEnum('treasury_proposal_status', [
   'expired',
 ]);
 
+export const proposalVoteTypeEnum = pgEnum('proposal_vote_type', ['approve', 'reject']);
+
 export const treasuryProposals = pgTable(
   'treasury_proposals',
   {
@@ -219,6 +221,10 @@ export const treasuryProposals = pgTable(
     status: treasuryProposalStatusEnum('status').notNull().default('active'),
     approvalsCount: integer('approvals_count').notNull().default(0),
     rejectionsCount: integer('rejections_count').notNull().default(0),
+    recipient: text('recipient'),
+    amount: text('amount'),
+    token: text('token'),
+    threshold: integer('threshold').notNull().default(3),
     createdAt: timestamp('created_at').notNull().defaultNow(),
     updatedAt: timestamp('updated_at').notNull().defaultNow(),
   },
@@ -230,6 +236,28 @@ export const treasuryProposals = pgTable(
 export type TreasuryProposal = typeof treasuryProposals.$inferSelect;
 export type NewTreasuryProposal = typeof treasuryProposals.$inferInsert;
 
+export const proposalVotes = pgTable(
+  'proposal_votes',
+  {
+    id: uuid('id').primaryKey().defaultRandom(),
+    treasuryProposalId: uuid('treasury_proposal_id')
+      .notNull()
+      .references(() => treasuryProposals.id, { onDelete: 'cascade' }),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    vote: proposalVoteTypeEnum('vote').notNull(),
+    signature: text('signature'),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('proposal_votes_proposal_user_unique').on(table.treasuryProposalId, table.userId),
+  ],
+);
+
+export type ProposalVote = typeof proposalVotes.$inferSelect;
+export type NewProposalVote = typeof proposalVotes.$inferInsert;
+
 // ─── Relations ────────────────────────────────────────────────────────────────
 
 export const usersRelations = relations(users, ({ many }) => ({
@@ -238,6 +266,7 @@ export const usersRelations = relations(users, ({ many }) => ({
   messages: many(messages),
   transfers: many(tokenTransfers),
   devices: many(devices),
+  proposalVotes: many(proposalVotes),
 }));
 
 export const walletsRelations = relations(wallets, ({ one }) => ({
@@ -292,6 +321,22 @@ export const oneTimePreKeysRelations = relations(oneTimePreKeys, ({ one }) => ({
   device: one(devices, { fields: [oneTimePreKeys.deviceId], references: [devices.id] }),
 }));
 
+export const treasuryProposalsRelations = relations(treasuryProposals, ({ one, many }) => ({
+  conversation: one(conversations, {
+    fields: [treasuryProposals.conversationId],
+    references: [conversations.id],
+  }),
+  votes: many(proposalVotes),
+}));
+
+export const proposalVotesRelations = relations(proposalVotes, ({ one }) => ({
+  proposal: one(treasuryProposals, {
+    fields: [proposalVotes.treasuryProposalId],
+    references: [treasuryProposals.id],
+  }),
+  user: one(users, { fields: [proposalVotes.userId], references: [users.id] }),
+}));
+
 // ─── Types ────────────────────────────────────────────────────────────────────
 
 export type User = typeof users.$inferSelect;

apps/backend/src/routes/treasury.ts

@@ -1,5 +1,8 @@
-import { Router } from 'express';
+import { Router, type Response } from 'express';
 import { z } from 'zod';
+import { and, desc, eq, inArray } from 'drizzle-orm';
+import { db } from '../db/index.js';
+import { treasuryProposals, proposalVotes } from '../db/schema.js';
 import { requireAuth, type AuthRequest } from '../middleware/auth.js';
 import { validate } from '../middleware/validate.js';
 
@@ -18,24 +21,124 @@ const proposeSchema = z.object({
   token: z.string().min(1),
   recipient: z.string().regex(/^G[A-Z2-7]{55}$/, 'Invalid Stellar public key'),
   ttl: z.enum(['24h', '72h', '7d']),
+  conversationId: z.string().uuid().optional(),
+  threshold: z.number().int().min(1).optional(),
+});
+
+const voteSchema = z.object({
+  signature: z.string().optional(),
 });
 
 /**
  * POST /treasury/propose
- * Body: { amount, token, recipient, ttl }
- * Stub: records intent and returns the ledger count for TTL.
+ * Body: { amount, token, recipient, ttl, conversationId?, threshold? }
  */
 treasuryRouter.post('/propose', validate(proposeSchema), async (req, res) => {
-  const { amount, token, recipient, ttl } = req.body as z.infer<typeof proposeSchema>;
+  const { amount, token, recipient, ttl, conversationId, threshold } =
+    req.body as z.infer<typeof proposeSchema>;
+
+  const [proposal] = await db
+    .insert(treasuryProposals)
+    .values({
+      contractId: process.env.GROUP_TREASURY_CONTRACT_ID ?? 'stub',
+      proposalId: `prop-${Date.now()}`,
+      conversationId: conversationId ?? null,
+      status: 'active',
+      recipient,
+      amount: String(amount),
+      token,
+      threshold: threshold ?? 3,
+    })
+    .returning();
+
+  res.status(201).json({ ...proposal, ttlLedgers: TTL_LEDGERS[ttl] });
+});
+
+/**
+ * GET /treasury/proposals?conversationId=
+ * Returns proposals (optionally filtered by conversationId) with the
+ * authenticated user's vote status included in each row.
+ */
+treasuryRouter.get('/proposals', async (req, res) => {
   const auth = (req as AuthRequest).auth!;
+  const cid = typeof req.query.conversationId === 'string' ? req.query.conversationId : null;
+
+  const rows = await db
+    .select()
+    .from(treasuryProposals)
+    .where(cid ? eq(treasuryProposals.conversationId, cid) : undefined)
+    .orderBy(desc(treasuryProposals.createdAt));
+
+  if (rows.length === 0) {
+    res.json([]);
+    return;
+  }
+
+  const ids = rows.map((r) => r.id);
+  const votes = await db
+    .select({ treasuryProposalId: proposalVotes.treasuryProposalId, vote: proposalVotes.vote })
+    .from(proposalVotes)
+    .where(and(eq(proposalVotes.userId, auth.userId), inArray(proposalVotes.treasuryProposalId, ids)));
+
+  const votedMap = new Map(votes.map((v) => [v.treasuryProposalId, v.vote]));
+
+  res.json(
+    rows.map((r) => ({
+      ...r,
+      hasVoted: votedMap.has(r.id),
+      myVote: votedMap.get(r.id) ?? null,
+    })),
+  );
+});
+
+async function handleVote(req: AuthRequest, res: Response, vote: 'approve' | 'reject'): Promise<void> {
+  const auth = req.auth!;
+  const { id } = req.params as { id: string };
+  const { signature } = req.body as z.infer<typeof voteSchema>;
+
+  const [proposal] = await db
+    .select()
+    .from(treasuryProposals)
+    .where(eq(treasuryProposals.id, id))
+    .limit(1);
+
+  if (!proposal) {
+    res.status(404).json({ error: 'Proposal not found' });
+    return;
+  }
+
+  if (proposal.status !== 'active') {
+    res.status(409).json({ error: 'Proposal is no longer active' });
+    return;
+  }
+
+  try {
+    await db.insert(proposalVotes).values({
+      treasuryProposalId: proposal.id,
+      userId: auth.userId,
+      vote,
+      signature: signature ?? null,
+    });
+  } catch (err: unknown) {
+    if ((err as { code?: string })?.code === '23505') {
+      res.status(409).json({ error: 'Already voted on this proposal' });
+      return;
+    }
+    throw err;
+  }
+
+  res.json({ success: true });
+}
+
+/**
+ * POST /treasury/proposals/:id/approve
+ * POST /treasury/proposals/:id/reject
+ * Body: { signature?: string }
+ */
+treasuryRouter.post('/proposals/:id/approve', validate(voteSchema), async (req, res) => {
+  await handleVote(req as AuthRequest, res, 'approve');
+});
 
-  // In production this would submit a multisig proposal transaction via Soroban SDK.
-  // For now, return the resolved ledger TTL so the frontend can display it.
-  res.status(201).json({
-    proposer: auth.userId,
-    amount,
-    token,
-    recipient,
-    ttlLedgers: TTL_LEDGERS[ttl],
-  });
+treasuryRouter.post('/proposals/:id/reject', validate(voteSchema), async (req, res) => {
+  await handleVote(req as AuthRequest, res, 'reject');
 });