diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 4efc7c387..e26a33e03 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -34,6 +34,6 @@ } } }, - "postCreateCommand": "cd /workspaces/Harvest-Finance/harvest-finance/backend && npm install", + "postCreateCommand": "cd /workspace/backend && npm install", "remoteUser": "node" } diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 845ae0fec..8bcc15c52 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -1,13 +1,12 @@ name: CD on: - push: - branches: - - main # → production - - develop # → staging + workflow_run: + workflows: ["CI"] + types: [completed] concurrency: - group: cd-${{ github.ref }} + group: cd-${{ github.event.workflow_run.head_branch }} cancel-in-progress: false env: @@ -19,13 +18,16 @@ jobs: detect-environment: name: Detect Target Environment runs-on: ubuntu-latest + if: >- + github.event.workflow_run.conclusion == 'success' && + (github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'develop') outputs: environment: ${{ steps.env.outputs.environment }} image_tag: ${{ steps.env.outputs.image_tag }} steps: - id: env run: | - if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then + if [[ "${{ github.event.workflow_run.head_branch }}" == "main" ]]; then echo "environment=production" >> "$GITHUB_OUTPUT" echo "image_tag=latest" >> "$GITHUB_OUTPUT" else @@ -57,8 +59,8 @@ jobs: - name: Build & push backend uses: docker/build-push-action@v6 with: - context: harvest-finance/backend - file: harvest-finance/backend/Dockerfile + context: backend + file: backend/Dockerfile push: true tags: | ${{ env.IMAGE_BACKEND }}:${{ github.sha }} @@ -71,8 +73,8 @@ jobs: - name: Build & push frontend uses: docker/build-push-action@v6 with: - context: harvest-finance/frontend - file: harvest-finance/frontend/Dockerfile + context: frontend + file: frontend/Dockerfile push: true tags: | ${{ env.IMAGE_FRONTEND }}:${{ github.sha }} @@ -95,6 +97,9 @@ jobs: - name: Deploy to staging via SSH uses: appleboy/ssh-action@v1 + env: + DATABASE_URL: ${{ secrets.DATABASE_URL }} + DIRECT_URL: ${{ secrets.DIRECT_URL }} with: host: ${{ secrets.STAGING_HOST }} username: ${{ secrets.STAGING_USER }} @@ -103,9 +108,11 @@ jobs: cd /opt/harvest-finance export IMAGE_TAG=${{ github.sha }} export REGISTRY=${{ env.REGISTRY }} + export DATABASE_URL="$DATABASE_URL" + export DIRECT_URL="$DIRECT_URL" docker compose -f docker-compose.staging.yml pull docker compose -f docker-compose.staging.yml up -d --remove-orphans - docker system prune -f + docker compose -f docker-compose.staging.yml exec backend npm run migration:run deploy-production: name: Deploy → Production @@ -120,6 +127,9 @@ jobs: - name: Deploy to production via SSH uses: appleboy/ssh-action@v1 + env: + DATABASE_URL: ${{ secrets.DATABASE_URL }} + DIRECT_URL: ${{ secrets.DIRECT_URL }} with: host: ${{ secrets.PROD_HOST }} username: ${{ secrets.PROD_USER }} @@ -128,12 +138,12 @@ jobs: cd /opt/harvest-finance export IMAGE_TAG=${{ github.sha }} export REGISTRY=${{ env.REGISTRY }} + export DATABASE_URL="$DATABASE_URL" + export DIRECT_URL="$DIRECT_URL" # Rolling update — zero downtime docker compose -f docker-compose.prod.yml pull - docker compose -f docker-compose.prod.yml up -d --remove-orphans --scale backend=2 - sleep 10 docker compose -f docker-compose.prod.yml up -d --remove-orphans - docker system prune -f + docker compose -f docker-compose.prod.yml exec backend npm run migration:run - name: Notify Slack on success if: success() diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a0fcd5b9e..ceac1b418 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,7 +2,7 @@ name: CI on: push: - branches: [main, develop, "feat/**", "fix/**"] + branches: [main, develop] pull_request: branches: [main, develop] @@ -11,7 +11,7 @@ concurrency: cancel-in-progress: true env: - NODE_VERSION: "20" + NODE_VERSION: "22" jobs: # ── Backend ────────────────────────────────────────────────────────────────── @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest defaults: run: - working-directory: harvest-finance/backend + working-directory: backend steps: - uses: actions/checkout@v4 @@ -28,17 +28,17 @@ jobs: with: node-version: ${{ env.NODE_VERSION }} cache: npm - cache-dependency-path: harvest-finance/backend/package-lock.json + cache-dependency-path: backend/package-lock.json - - run: npm ci || true - - run: npm run lint || true + - run: npm ci + - run: npm run lint backend-test: name: Backend — Unit + Integration Tests runs-on: ubuntu-latest defaults: run: - working-directory: harvest-finance/backend + working-directory: backend services: postgres: @@ -84,17 +84,17 @@ jobs: with: node-version: ${{ env.NODE_VERSION }} cache: npm - cache-dependency-path: harvest-finance/backend/package-lock.json + cache-dependency-path: backend/package-lock.json - run: npm ci - run: npm run build - - run: npm test -- --forceExit --passWithNoTests || true + - run: npm test -- --forceExit - name: Upload coverage uses: actions/upload-artifact@v4 if: always() with: name: backend-coverage - path: harvest-finance/backend/coverage/ + path: backend/coverage/ backend-build: name: Backend — Docker Build @@ -105,10 +105,9 @@ jobs: - uses: docker/setup-buildx-action@v3 - name: Build backend image uses: docker/build-push-action@v6 - continue-on-error: true with: - context: harvest-finance/backend - file: harvest-finance/backend/Dockerfile + context: backend + file: backend/Dockerfile push: false tags: harvest-finance-backend:${{ github.sha }} cache-from: type=gha @@ -120,7 +119,7 @@ jobs: runs-on: ubuntu-latest defaults: run: - working-directory: harvest-finance/frontend + working-directory: frontend steps: - uses: actions/checkout@v4 @@ -128,7 +127,7 @@ jobs: with: node-version: ${{ env.NODE_VERSION }} cache: npm - cache-dependency-path: harvest-finance/frontend/package-lock.json + cache-dependency-path: frontend/package-lock.json - run: npm ci - run: npm run lint @@ -138,7 +137,7 @@ jobs: runs-on: ubuntu-latest defaults: run: - working-directory: harvest-finance/frontend + working-directory: frontend steps: - uses: actions/checkout@v4 @@ -146,11 +145,11 @@ jobs: with: node-version: ${{ env.NODE_VERSION }} cache: npm - cache-dependency-path: harvest-finance/frontend/package-lock.json + cache-dependency-path: frontend/package-lock.json - run: npm ci - - run: npm test -- --passWithNoTests - - run: npm run test:vitest -- --run --passWithNoTests + - run: npm test + - run: npm run test:vitest -- --run frontend-build: name: Frontend — Next.js Build @@ -158,7 +157,7 @@ jobs: needs: [frontend-lint, frontend-test] defaults: run: - working-directory: harvest-finance/frontend + working-directory: frontend env: NEXT_PUBLIC_API_URL: https://api.harvestfinance.io steps: @@ -168,15 +167,15 @@ jobs: with: node-version: ${{ env.NODE_VERSION }} cache: npm - cache-dependency-path: harvest-finance/frontend/package-lock.json + cache-dependency-path: frontend/package-lock.json - - run: npm ci || true - - run: npm run build || true + - run: npm ci + - run: npm run build - name: Upload build artifact uses: actions/upload-artifact@v4 with: name: frontend-build-${{ github.sha }} - path: harvest-finance/frontend/.next/ + path: frontend/.next/ retention-days: 3 # ── Smart Contracts ─────────────────────────────────────────────────────────── @@ -194,40 +193,42 @@ jobs: version: nightly - name: Run forge tests - working-directory: contracts - run: forge test -vvv || true + working-directory: contracts-legacy + run: forge test -vvv --skip "test/VaultMainnetFork.t.sol" - name: Forge coverage - working-directory: contracts - run: forge coverage --report lcov || true + working-directory: contracts-legacy + run: forge coverage --report lcov - name: Upload coverage uses: actions/upload-artifact@v4 with: name: contracts-coverage - path: contracts/lcov.info + path: contracts-legacy/lcov.info - # ── Smart Contract Fork Tests ───────────────────────────────────────────────── - contracts-fork-test: - name: Contracts — Mainnet Fork Tests + # ── Soroban Contracts ──────────────────────────────────────────────────────── + contracts-soroban: + name: Contracts — Soroban Build & Test runs-on: ubuntu-latest - # Only run on main/develop pushes (not every feature PR) to conserve RPC calls - if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') + defaults: + run: + working-directory: contracts-soroban/vault steps: - uses: actions/checkout@v4 - with: - submodules: recursive - - name: Install Foundry - uses: foundry-rs/foundry-toolchain@v1 + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@stable with: - version: nightly + components: rustfmt, clippy - - name: Run mainnet fork tests - working-directory: contracts - env: - ETH_RPC_URL: ${{ secrets.ETH_RPC_URL }} - run: make test-fork + - name: Cargo check + run: cargo check + + - name: Cargo test + run: cargo test + + - name: Cargo clippy + run: cargo clippy -- -D warnings # ── All-green gate ──────────────────────────────────────────────────────────── all-checks: @@ -237,5 +238,6 @@ jobs: - backend-build - frontend-build - contracts-test + - contracts-soroban steps: - run: echo "CI passed ✓" diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b44c9412a..31f9fc3d7 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - dir: [harvest-finance/backend, harvest-finance/frontend] + dir: [backend, frontend] defaults: run: working-directory: ${{ matrix.dir }} diff --git a/.gitignore b/.gitignore index 942c1031f..e41cf4722 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ # compiled output -/dist -/node_modules +dist/ +node_modules/ +target/ # Logs logs diff --git a/.gitmodules b/.gitmodules index 5c7d5d6c7..9cc4ae111 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,6 +1,6 @@ [submodule "contracts/lib/forge-std"] - path = contracts/lib/forge-std + path = contracts-legacy/lib/forge-std url = https://github.com/foundry-rs/forge-std [submodule "contracts/lib/openzeppelin-contracts"] - path = contracts/lib/openzeppelin-contracts + path = contracts-legacy/lib/openzeppelin-contracts url = https://github.com/OpenZeppelin/openzeppelin-contracts diff --git a/CREATE_PR_LINK.md b/CREATE_PR_LINK.md deleted file mode 100644 index d33c4203d..000000000 --- a/CREATE_PR_LINK.md +++ /dev/null @@ -1,86 +0,0 @@ -# Create Pull Request Link - -## 🚀 Direct PR Creation Link - -**Click here to create the Pull Request:** - -https://github.com/mrmoney10010-design/Harvest-Finance/compare/main...feature/platform-circuit-breaker - -## 📋 PR Details - -**Title:** `feat: implement platform-wide circuit breaker for deposits and withdrawals` - -**Base Branch:** `main` - -**Compare Branch:** `feature/platform-circuit-breaker` - -## 🔗 Alternative PR Creation Methods - -### Method 1: GitHub Web Interface -1. Visit: https://github.com/mrmoney10010-design/Harvest-Finance -2. Click the "Pull requests" tab -3. Click "New pull request" -4. Select base: `main` -5. Select compare: `feature/platform-circuit-breaker` -6. Click "Create pull request" - -### Method 2: Direct URL Parameters -``` -https://github.com/mrmoney10010-design/Harvest-Finance/compare/main...feature/platform-circuit-breaker?expand=1 -``` - -## 📝 PR Description Template - -```markdown -## Summary -Adds a platform-wide circuit breaker that allows administrators to instantly halt and resume all deposit and withdrawal operations across all service instances. - -## Purpose / Motivation -To protect user funds and limit platform liability during critical events (e.g. smart contract failures, third-party oracle/RPC failures, or malicious exploits), administrators need a quick, highly reliable way to pause all transactional actions (deposits and withdrawals) across all vault types (Stellar, farm-vaults, and insurance-funds). - -## Changes Made -- **PlatformCircuitBreakerService**: Implements breaker state validation, activation (`open`), and deactivation (`close`) with state persistence in Redis cache. -- **PlatformCircuitBreakerGuard**: Throws a `503 Service Unavailable` with a clear message `Maintenance Mode` when the circuit breaker is active. -- **Admin Endpoints**: Adds `POST /api/v1/admin/platform/circuit-breaker/open` and `/api/v1/admin/platform/circuit-breaker/close` with proper admin role checking and audit trail logging. -- **Controller Protections**: Applied `@UseGuards(PlatformCircuitBreakerGuard)` to deposit and withdrawal endpoints in: - - `VaultsController` - - `FarmVaultsController` - - `InsuranceFundController` -- **Unit and Integration Tests**: - - `platform-circuit-breaker.service.spec.ts` - - `platform-circuit-breaker.guard.spec.ts` - - `circuit-breaker.controller.spec.ts` - - `circuit-breaker.e2e-spec.ts` (End-to-end verification of endpoint blocking, propagation via Redis, and rapid toggles) - -## How to Test -1. Set up env variables and ensure Redis is running. -2. Run backend E2E tests: - ```bash - npm run test:e2e test/circuit-breaker.e2e-spec.ts - ``` -3. Test manually by authenticating as admin: - - Open circuit breaker: `POST /api/v1/admin/platform/circuit-breaker/open` - - Attempt deposit or withdraw; confirm it fails with `503 Service Unavailable (Maintenance Mode)`. - - Close circuit breaker: `POST /api/v1/admin/platform/circuit-breaker/close` - - Attempt deposit or withdraw; confirm it succeeds. - -## Related Issues -Implements the platform-wide circuit breaker specification. - -## Checklist -- [x] Code builds successfully -- [x] Tests added/updated -- [x] No console errors -- [x] Documentation updated -``` - -## 🎯 Quick Actions - -1. **Click the link above** to go directly to the PR creation page -2. **Review the changes** in the comparison view -3. **Fill in the PR description** using the template above -4. **Create the pull request** for review - ---- - -**Ready for Review!** 🚀 diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md deleted file mode 100644 index 426682455..000000000 --- a/GITHUB_ISSUES.md +++ /dev/null @@ -1,637 +0,0 @@ -# Harvest Finance GitHub Issues (200 Total) - -## Wave 1: Good First Issues (1-50) -*Low-complexity, self-contained tasks suitable for new contributors* - -### Documentation Issues (1-15) - -1. **Add API response DTO for AppController endpoints** - - Hint: `harvest-finance/backend/src/app.controller.ts` and `app.service.ts` return plain objects; create proper response DTOs in `src/app/dto/` - -2. **Add README for auth module DTOs** - - Hint: `harvest-finance/backend/src/auth/dto/` lacks inline documentation explaining field purposes - -3. **Document vault state machine transitions** - - Hint: `harvest-finance/backend/src/database/entities/vault.entity.ts` has VaultStatus enum; add state transition documentation - -4. **Add JSDoc comments to InputSanitizerService** - - Hint: `harvest-finance/backend/src/common/sanitization/input-sanitizer.service.ts` needs parameter/return type documentation - -5. **Document SorobanExceptionFilter error mappings** - - Hint: `harvest-finance/backend/src/common/filters/soroban-exception.filter.ts` lines 30-54; document error message matching logic - -6. **Add inline comments to stellar-retry.ts** - - Hint: `harvest-finance/backend/src/stellar/utils/stellar-retry.ts`; document the retry logic for different error codes - -7. **Create API versioning documentation** - - Hint: `harvest-finance/backend/src/common/config/versioning.config.ts`; document URI vs header versioning support - -8. **Document rate-limit.decorator.ts usage** - - Hint: `harvest-finance/backend/src/common/config/rate-limit.decorator.ts` is defined but never used; document its purpose - -9. **Add README section for multi-chain adapters** - - Hint: `harvest-finance/backend/src/multi-chain/adapters/stellar-yield.adapter.ts`; document how to add new chain adapters - -10. **Document ThrottlerExceptionFilter behavior** - - Hint: `harvest-finance/backend/src/common/filters/throttler-exception.filter.ts`; explain skip/countdown logic - -11. **Add OpenAPI examples to StellarTransactionStatusDto** - - Hint: `harvest-finance/backend/src/stellar/dto/stellar.dto.ts`; add example values for response DTOs - -12. **Document vault capacity calculation logic** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts` lines 112-116; document availableCapacity calculation - -13. **Add README to export module** - - Hint: `harvest-finance/backend/src/export/export.service.ts`; document CSV/Excel/PDF export options - -14. **Document RealtimeGateway room structure** - - Hint: `harvest-finance/backend/src/realtime/realtime.gateway.ts`; document admin vs farmer room patterns - -15. **Add API documentation for error response format** - - Hint: `harvest-finance/backend/src/common/filters/http-exception.filter.ts`; document consistent error response structure - -### Test Issues (16-30) - -16. **Add unit tests for InputSanitizerService.validateUUID** - - Hint: `harvest-finance/backend/src/common/sanitization/input-sanitizer.service.ts`; test valid/invalid UUIDs - -17. **Add unit tests for InputSanitizerService.validateStellarPublicKey** - - Hint: Test valid G-addresses and invalid formats - -18. **Add unit tests for InputSanitizerService.validateContractId** - - Hint: Test hex format validation for Soroban contract IDs - -19. **Add unit tests for InputSanitizerService.validateEmail** - - Hint: Test various email formats including edge cases - -20. **Add unit tests for InputSanitizerService.validateAmount** - - Hint: Test boundary values, negative, NaN, infinity - -21. **Add unit tests for InputSanitizerService.sanitizeString** - - Hint: Test max length, null byte removal, whitespace trimming - -22. **Add unit tests for stellar-retry.ts isRetryableStellarError** - - Hint: `harvest-finance/backend/src/stellar/utils/stellar-retry.ts`; test status codes 429, 500-599, result_codes - -23. **Add unit tests for throttler.config.ts** - - Hint: `harvest-finance/backend/src/common/config/throttler.config.ts`; test TTL/limit configurations - -24. **Add tests for stellar-yield.adapter.ts** - - Hint: `harvest-finance/backend/src/multi-chain/adapters/stellar-yield.adapter.spec.ts` exists but needs edge cases for empty results - -25. **Add integration tests for resetPassword flow** - - Hint: `harvest-finance/backend/src/auth/auth.service.ts` lines 289-332; test expired tokens, invalid signatures - -26. **Add unit tests for VaultsService.getUserTotalDeposits** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; test aggregation query - -27. **Add tests for SorobanIndexerService.query filtering** - - Hint: `harvest-finance/backend/src/soroban/soroban-indexer.service.ts` lines 249-268; test contractId, type, ledger range filters - -28. **Add tests for HttpExceptionFilter error mapping** - - Hint: `harvest-finance/backend/src/common/filters/http-exception.filter.ts`; test HttpException vs generic errors - -29. **Add tests for RealtimeGateway alert broadcasting** - - Hint: `harvest-finance/backend/src/realtime/realtime.gateway.ts` lines 74-78; test admin vs farmer targeting - -30. **Add E2E tests for Stellar health endpoint** - - Hint: `harvest-finance/backend/src/stellar/stellar.controller.ts` line 36-50; test connection check - -### Code Quality Issues (31-50) - -31. **Remove hardcoded JWT fallback secrets** - - Hint: `harvest-finance/backend/src/auth/strategies/jwt.strategy.ts` line 26; throw error instead of using fallback - -32. **Remove duplicate Stellar SDK dependencies** - - Hint: `harvest-finance/backend/package.json` lines 52 and 76; keep only `@stellar/stellar-sdk` - -33. **Fix CORS origin in RealtimeGateway** - - Hint: `harvest-finance/backend/src/realtime/realtime.gateway.ts` line 26; replace `origin: '*'` with env variable - -34. **Replace any type in stellar.service.ts** - - Hint: `harvest-finance/backend/src/stellar/services/stellar.service.ts` line 121; add proper type for balance mapping - -35. **Replace any type in retry.ts** - - Hint: `harvest-finance/backend/src/common/utils/retry.ts`; add proper generic types - -36. **Fix StellarStrategy placeholder inheritance** - - Hint: `harvest-finance/backend/src/auth/strategies/stellar.strategy.ts` lines 14-16; remove unused placeholder class - -37. **Add response DTO for logout endpoint** - - Hint: `harvest-finance/backend/src/auth/auth.controller.ts` line 128; create proper response DTO - -38. **Add response DTO for register endpoint** - - Hint: `harvest-finance/backend/src/auth/auth.controller.ts` line 67; verify AuthResponseDto completeness - -39. **Remove TODO comment in orders.service.ts** - - Hint: `harvest-finance/backend/src/orders/orders.service.ts` line 92; implement asset support or create follow-up issue - -40. **Fix magic numbers in vaults.service.ts** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts` line 95, 149; extract MAX_SAFE_DEPOSIT and large deposit threshold to constants - -41. **Add index hints to SorobanIndexerService** - - Hint: `harvest-finance/backend/src/soroban/soroban-indexer.service.ts`; add DB index recommendations for event queries - -42. **Add missing role validation in StellarStrategy** - - Hint: `harvest-finance/backend/src/auth/strategies/stellar.strategy.ts`; ensure role is set correctly for new users - -43. **Improve error messages in InputSanitizerService** - - Hint: Add more descriptive error messages with examples - -44. **Add null check for stellarTransactionId** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts` line 196; ensure proper null handling - -45. **Add validation for pagination in soroban controller** - - Hint: `harvest-finance/backend/src/soroban/soroban.controller.ts`; validate skip/limit bounds - -46. **Fix auth.service.ts reset token query** - - Hint: `harvest-finance/backend/src/auth/auth.service.ts` line 296; query should check resetPasswordExpires > now - -47. **Add proper error for missing STELLAR_SERVER_SECRET** - - Hint: `harvest-finance/backend/src/auth/strategies/stellar.strategy.ts` line 39; improve error message - -48. **Add response DTO for refresh endpoint** - - Hint: `harvest-finance/backend/src/auth/auth.controller.ts` line 110; verify TokenResponseDto format - -49. **Add validation to forgotPassword email** - - Hint: `harvest-finance/backend/src/auth/auth.service.ts`; add rate limiting per email - -50. **Document rate limit tiers in auth.controller.ts** - - Hint: `harvest-finance/backend/src/auth/auth.controller.ts`; explain short/medium/long throttling - -## Wave 2: Intermediate Improvements (51-100) -*Refactors, missing features, DX improvements, and expanded test coverage* - -### Testing & Coverage (51-65) - -51. **Add integration tests for deposit flow** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; test successful deposit, duplicate idempotency, capacity exceeded - -52. **Add integration tests for withdrawal flow** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; test sufficient balance, insufficient balance - -53. **Add unit tests for ContractCacheService** - - Hint: `harvest-finance/backend/src/common/cache/contract-cache.service.ts`; test cache hit/miss scenarios - -54. **Add tests for notification creation in vault service** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; test large deposit notification threshold - -55. **Add tests for vault WebSocket emissions** - - Hint: `harvest-finance/backend/src/realtime/vault.gateway.ts`; test deposit/withdrawal event emission - -56. **Add integration tests for Stellar escrow creation** - - Hint: `harvest-finance/backend/src/stellar/services/stellar.service.ts`; test fee-bump and retry paths - -57. **Add tests for SorobanIndexerService error handling** - - Hint: `harvest-finance/backend/src/soroban/soroban-indexer.service.ts`; test RPC failures, malformed responses - -58. **Add E2E tests for authentication flow** - - Hint: Test register, login, refresh, logout sequence - -59. **Add tests for multi-sig setup** - - Hint: `harvest-finance/backend/src/stellar/services/stellar.service.ts`; test threshold validation - -60. **Add tests for InputSanitizerService.validatePagination** - - Hint: Test skip/limit boundaries, max limit enforcement - -61. **Add tests for password reset token expiration** - - Hint: `harvest-finance/backend/src/auth/auth.service.ts`; test token validity window - -62. **Add integration tests for portfolio aggregation** - - Hint: `harvest-finance/backend/src/portfolio/portfolio.service.ts`; test balance aggregation - -63. **Add tests for export service formats** - - Hint: `harvest-finance/backend/src/export/export.service.ts`; test CSV, Excel, PDF generation - -64. **Add tests for community reactions** - - Hint: `harvest-finance/backend/src/community/community.service.ts`; test reaction creation - -65. **Add tests for achievement unlock conditions** - - Hint: `harvest-finance/backend/src/achievements/achievements.service.ts`; test event triggers - -### Architecture & Refactoring (66-80) - -66. **Replace ConsoleLogService with structured logger** - - Hint: Find and replace console.log statements with proper logging - -67. **Add Repository pattern for Vault entity** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; extract data access to repository - -68. **Create DepositRepository with custom queries** - - Hint: Extract deposit queries from vaults.service.ts - -69. **Add pagination support to getPublicVaults** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; add skip/limit parameters - -70. **Extract notification logic to NotificationHelper** - - Hint: `harvest-finance/backend/src/notifications/notifications.service.ts`; reduce duplication - -71. **Add CircuitBreaker for Stellar network calls** - - Hint: `harvest-finance/backend/src/stellar/services/stellar.service.ts`; add circuit breaker pattern - -72. **Refactor SorobanExceptionFilter to use error codes** - - Hint: Replace fragile string matching with error type mapping - -73. **Add ResponseInterceptor for consistent API responses** - - Hint: Wrap all responses in standard format - -74. **Split StellarService into smaller services** - - Hint: Separate escrow, payment, and account services - -75. **Add Domain Events for key operations** - - Hint: Emits events for deposits, withdrawals, escrow changes - -76. **Implement Event Sourcing for deposit history** - - Hint: Store deposit events instead of just state - -77. **Add CQRS pattern for vault queries** - - Hint: Separate read/write models for vault operations - -78. **Create DTO factory for test data** - - Hint: Reduce test boilerplate with factory pattern - -79. **Add Mapper service for entity/DTO conversion** - - Hint: Centralize mapping logic from vaults.service.ts - -80. **Implement Specification pattern for queries** - - Hint: Replace inline query conditions with reusable specs - -### Developer Experience (81-100) - -81. **Add pre-commit hooks configuration** - - Hint: Add husky and lint-staged for code quality - -82. **Add GitHub Codespaces devcontainer** - - Hint: Create `.devcontainer/devcontainer.json` for consistent dev environment - -83. **Add VSCode snippets for common DTOs** - - Hint: Create `.vscode/snippets` for NestJS patterns - -84. **Add Makefile for common dev commands** - - Hint: Make targets for test, lint, build, db commands - -85. **Add commit message convention documentation** - - Hint: Document conventional commits format - -86. **Add architecture decision records (ADRs)** - - Hint: Document key decisions in `docs/adr/` - -87. **Create CONTRIBUTING.md with detailed guidelines** - - Hint: Expand current file with PR process, coding standards - -88. **Add debug configuration for VSCode** - - Hint: Create `.vscode/launch.json` for debugging tests - -89. **Add npm scripts for database migrations** - - Hint: Scripts for fresh DB setup in development - -90. **Add Swagger customization for auth endpoints** - - Hint: Better docs for JWT and Stellar auth - -91. **Create seed script for test data** - - Hint: CLI command to generate realistic test vaults and users - -92. **Add npm script for type checking** - - Hint: Separate script from build for faster type checking - -93. **Add environment validation at startup** - - Hint: Validate required env vars in main.ts - -94. **Add logging configuration documentation** - - Hint: Document pino configuration options - -95. **Add health check endpoint for dependencies** - - Hint: Extended health check for DB, Redis, Stellar RPC - -96. **Add metrics endpoint for Prometheus** - - Hint: Expose basic metrics for monitoring - -97. **Add rate limit configuration per endpoint** - - Hint: Document current rate limits and customization - -98. **Add batch operations for deposits** - - Hint: Process multiple deposits in single transaction - -99. **Add async event handlers for withdrawals** - - Hint: Fire events after withdrawal confirmation - -100. **Add graceful shutdown for WebSocket connections** - - Hint: Proper cleanup on app termination - -## Wave 3: Feature Work & Integrations (101-150) -*New capabilities, API extensions, and cross-chain features* - -### New Features (101-120) - -101. **Add Polygon chain adapter** - - Hint: `harvest-finance/backend/src/multi-chain/interfaces/chain-adapter.interface.ts`; implement PolygonYieldAdapter - -102. **Add Ethereum chain adapter** - - Hint: Implement EthereumYieldAdapter for L1 yields - -103. **Add Solana chain adapter** - - Hint: Implement SolanaYieldAdapter for SPL token vaults - -104. **Create PaymentService for fiat on-ramp** - - Hint: New service to integrate with payment providers - -105. **Add webhook endpoint for external notifications** - - Hint: Endpoint to receive payment confirmations, chain events - -106. **Implement vault cloning feature** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; create new vault from existing template - -107. **Add vault migration between chains** - - Hint: Cross-chain vault position transfer feature - -108. **Create AnalyticsService for yield comparisons** - - Hint: Compare yields across different strategies - -109. **Add scheduled vault rebalancing** - - Hint: Auto-shift positions based on APY changes - -110. **Implement yield compounding automation** - - Hint: Auto-reinvest earned yields into vault - -111. **Add batch withdrawal processing** - - Hint: Process multiple withdrawals with single transaction - -112. **Create referral system** - - Hint: Track referrals and distribute rewards - -113. **Add social sharing for vault performance** - - Hint: Generate shareable vault performance cards - -114. **Implement vault whitelisting** - - Hint: Allow owners to restrict vault access - -115. **Add time-based vault locking** - - Hint: Lock deposits until specific date - -116. **Create emergency withdrawal feature** - - Hint: Allow withdrawal despite vault issues - -117. **Add multi-signature vault approval** - - Hint: Require multiple approvals for large operations - -118. **Implement vault pause/resume** - - Hint: Admin ability to pause vault operations - -119. **Add gasless transaction support** - - Hint: Meta-transactions for better UX - -120. **Create vault performance oracle** - - Hint: External data source for vault metrics - -### API Extensions (121-140) - -121. **Add GraphQL API layer** - - Hint: Alternative to REST with flexible queries - -122. **Create REST API pagination headers** - - Hint: Link headers for next/prev pages - -123. **Add async webhook delivery system** - - Hint: Queue and retry webhook notifications - -124. **Implement API key management** - - Hint: Per-user API keys with permissions - -125. **Add request signing for webhooks** - - Hint: HMAC verification for payloads - -126. **Create WebSocket room management** - - Hint: Dynamic room creation for events - -127. **Add file upload service** - - Hint: Support document uploads for verification - -128. **Implement search API for vaults** - - Hint: Full-text search with filters - -129. **Add bulk operations endpoint** - - Hint: Process multiple operations in one request - -130. **Create export scheduling feature** - - Hint: Schedule recurring exports - -131. **Add real-time price feed integration** - - Hint: Connect to price oracle for vault valuation - -132. **Implement subscription billing** - - Hint: Tiered API access based on subscription - -133. **Add IP allowlisting for API access** - - Hint: Security feature for enterprise customers - -134. **Create API usage analytics** - - Hint: Track and report API consumption - -135. **Add request replay protection** - - Hint: Idempotency keys for all mutations - -136. **Implement API response caching** - - Hint: CDN-friendly cache headers - -137. **Add data export rate limiting** - - Hint: Prevent abuse of export endpoints - -138. **Create custom field support** - - Hint: Allow custom metadata on entities - -139. **Add audit log API** - - Hint: Retrieve audit history for compliance - -140. **Implement soft delete for entities** - - Hint: Recover deleted data within grace period - -### Frontend Features (141-150) - -141. **Add vault performance charting** - - Hint: `harvest-finance/frontend/src/components/YieldChart.tsx`; enhance with historical data - -142. **Create mobile-responsive vault list** - - Hint: `harvest-finance/frontend/src/app/dashboard/mobile/page.tsx`; improve mobile UX - -143. **Add wallet connection persistence** - - Hint: Store wallet selection across sessions - -144. **Implement push notifications** - - Hint: Web Push API for deposit/withdrawal alerts - -145. **Add dark mode toggle** - - Hint: Use next-themes for theme switching - -146. **Create vault comparison view** - - Hint: Side-by-side vault performance comparison - -147. **Add transaction history export** - - Hint: Export user's transaction history - -148. **Implement keyboard shortcuts** - - Hint: Power user navigation shortcuts - -149. **Add onboarding tutorial** - - Hint: Interactive guide for new users - -150. **Create vault health dashboard** - - Hint: Show active/inactive vault status - -## Wave 4: Advanced / Strategic (151-200) -*Performance optimization, security hardening, architecture, observability, and scalability* - -### Security Issues (151-170) - -151. **Fix CORS security in RealtimeGateway** - - Hint: `harvest-finance/backend/src/realtime/realtime.gateway.ts`; replace `origin: '*'` with whitelist - -152. **Add input sanitization for Stellar transaction XDR** - - Hint: `harvest-finance/backend/src/auth/strategies/stellar.strategy.ts`; validate XDR size limits - -153. **Implement rate limiting for password reset** - - Hint: `harvest-finance/backend/src/auth/auth.service.ts`; add per-email rate limits - -154. **Add SQL injection protection for dynamic queries** - - Hint: `harvest-finance/backend/src/soroban/soroban-indexer.service.ts`; use parameterized queries - -155. **Add request size limits for uploads** - - Hint: `harvest-finance/backend/src/app.module.ts`; add body parser limits - -156. **Implement CSRF protection for state-changing endpoints** - - Hint: Add CSRF tokens for non-GET requests - -157. **Add security headers middleware** - - Hint: Helmet.js configuration for XSS, HSTS, CSP - -158. **Audit JWT refresh token storage** - - Hint: `harvest-finance/backend/src/auth/auth.service.ts`; hash tokens in database - -159. **Add vault access control checks** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; verify owner permissions - -160. **Implement secret rotation mechanism** - - Hint: Key rotation for JWT secrets and Stellar keys - -161. **Add audit logging for sensitive operations** - - Hint: Log all vault modifications and fund transfers - -162. **Implement IP-based anomaly detection** - - Hint: Alert on suspicious login patterns - -163. **Add two-factor authentication support** - - Hint: TOTP integration for user accounts - -164. **Implement session invalidation on password change** - - Hint: Revoke all sessions when password is changed - -165. **Add validation for Stellar network passphrase** - - Hint: Prevent testnet/mainnet confusion attacks - -166. **Add secrets encryption at rest** - - Hint: Encrypt sensitive values in database - -167. **Implement role-based access control** - - Hint: Fine-grained permissions for vault operations - -168. **Add audit log tamper detection** - - Hint: Hash chain for log integrity verification - -169. **Implement device fingerprint tracking** - - Hint: Track devices for suspicious activity - -170. **Add transaction replay protection** - - Hint: Nonce tracking for Stellar transactions - -### Performance Issues (171-190) - -171. **Add database connection pooling optimization** - - Hint: `harvest-finance/backend/src/database/data-source.ts`; tune pool settings - -172. **Implement query result caching for vault lists** - - Hint: Cache public vault queries for 60 seconds - -173. **Add Redis caching for expensive calculations** - - Hint: `harvest-finance/backend/src/vaults/vaults.service.ts`; cache APY history - -174. **Optimize SorobanIndexerService batch inserts** - - Hint: `harvest-finance/backend/src/soroban/soroban-indexer.service.ts`; use COPY for bulk inserts - -175. **Add database indexes for frequent queries** - - Hint: Index vault owner_id, deposit user_id, status - -176. **Implement background job for notifications** - - Hint: Use Bull queue for async notification sending - -177. **Add pagination cursor optimization** - - Hint: Keyset pagination instead of offset for large datasets - -178. **Implement lazy loading for vault deposits** - - Hint: Only load deposits when requested - -179. **Add compression for API responses** - - Hint: Enable gzip compression in main.ts - -180. **Optimize Stellar SDK calls with connection pooling** - - Hint: Reuse HTTP agents for Horizon connections - -181. **Add memory profiling for large operations** - - Hint: Monitor heap usage during batch processing - -182. **Implement streaming responses for large exports** - - Hint: `harvest-finance/backend/src/export/export.service.ts`; use streams instead of buffers - -183. **Add query complexity limits** - - Hint: Prevent overly complex GraphQL queries - -184. **Optimize WebSocket connection handling** - - Hint: Use rooms efficiently, limit broadcast size - -185. **Add CDN caching for static assets** - - Hint: Cache frontend assets with long TTL - -186. **Add request timeouts for external API calls** - - Hint: Prevent hanging on unresponsive services - -187. **Implement query result streaming** - - Hint: Stream large query results to avoid memory spikes - -188. **Add database read replica support** - - Hint: Route read queries to replicas - -189. **Optimize vault aggregation queries** - - Hint: Pre-compute totals with materialized views - -190. **Add connection timeout configuration** - - Hint: Configure timeouts for all external connections - -### Architecture & Observability (191-200) - -191. **Add distributed tracing with OpenTelemetry** - - Hint: Trace requests across services - -192. **Implement custom metrics for business KPIs** - - Hint: Track deposits, withdrawals, vault creations - -193. **Add structured logging for audit trail** - - Hint: JSON logs with correlation IDs - -194. **Implement circuit breaker dashboard** - - Hint: Monitor Stellar service health - -195. **Add health check aggregation** - - Hint: Single endpoint for all dependency health - -196. **Implement graceful degradation for services** - - Hint: Fallback responses when services are down - -197. **Add performance benchmarks CI check** - - Hint: Fail CI on performance regressions - -198. **Create system architecture diagram** - - Hint: Document component interactions and data flow - -199. **Add deployment runbook** - - Hint: Document rollback, scaling procedures - -200. **Implement chaos engineering tests** - - Hint: Regular failure injection testing \ No newline at end of file diff --git a/GITHUB_ISSUES_201_400.md b/GITHUB_ISSUES_201_400.md deleted file mode 100644 index b8107f865..000000000 --- a/GITHUB_ISSUES_201_400.md +++ /dev/null @@ -1,823 +0,0 @@ -# Harvest Finance GitHub Issues (201-400) - -Frontend/backend-focused continuation of the issue backlog. Organized into waves below. - - -## Wave 5: Frontend — Good First Issues (201-250) - -### 201. **Add aria-label attributes to the Button component** - - Hint: frontend/src/components/ui/Button/Button.tsx — icon-only variants expose no accessible name. - - Ensure loading/disabled states are announced to screen readers. - - Labels: frontend, good first issue - -### 202. **Add loading skeletons to VaultCard** - - Hint: frontend/src/components/dashboard/VaultCard.tsx — render components/ui/Skeleton while data is undefined. - - Keep skeleton dimensions matching the final card to avoid layout shift. - - Labels: frontend, good first issue - -### 203. **Document the useNotifications hook** - - Hint: frontend/src/hooks/useNotifications.ts — add JSDoc describing return shape and event channels. - - Include a minimal usage example for toasts vs in-app badges. - - Labels: frontend, good first issue - -### 204. **Add alt-text fallback for vault imagery in VaultTable** - - Hint: frontend/src/components/dashboard/VaultTable.tsx — derive alt from vault name when image missing. - - Labels: frontend, good first issue - -### 205. **Memoize expensive selectors in the portfolio store** - - Hint: frontend/src/store — wrap derived totals with useMemo / reselect to prevent re-render storms. - - Labels: frontend, good first issue - -### 206. **Add keyboard focus ring to Modal close button** - - Hint: frontend/src/components/ui/Modal/Modal.tsx — ensure :focus-visible outline is visible. - - Labels: frontend, good first issue - -### 207. **Create a reusable EmptyState component** - - Hint: frontend/src/components/ui — used by vaults/portfolio/transactions pages when lists are empty. - - Labels: frontend, good first issue - -### 208. **Add rel=noopener to external links in landing** - - Hint: frontend/src/components/landing — audit anchor tags that open docs/marketplaces in new tabs. - - Labels: frontend, good first issue - -### 209. **Document the lib/api client request helpers** - - Hint: frontend/src/lib/api — explain auth header injection, error normalization, and base URL resolution. - - Labels: frontend, good first issue - -### 210. **Add a confirmed-delete guard to community GroupCard remove** - - Hint: frontend/src/components/community/GroupCard.tsx — require a second confirmation before deletion. - - Labels: frontend, good first issue - -### 211. **Extract shared currency formatting util** - - Hint: frontend/src/lib — consolidate number/USD formatting duplicated across BalanceDisplay and VaultOverview. - - Labels: frontend, good first issue - -### 212. **Add Storybook-style prop docs to Card** - - Hint: frontend/src/components/ui/Card/Card.tsx — document padding/elevation/as variants. - - Labels: frontend, good first issue - -### 213. **Fix inconsistent button sizes across dashboard** - - Hint: Compare frontend/src/components/ui/Button/Button.tsx with dashboard DepositModal/WithdrawModal triggers. - - Labels: frontend, good first issue - -### 214. **Add an accessible label to ThemeToggle** - - Hint: frontend/src/components/ui/ThemeToggle.tsx — announce current light/dark state on toggle. - - Labels: frontend, good first issue - -### 215. **Add unit tests for lib/validations schemas** - - Hint: frontend/src/lib/validations — cover deposit amount, email, and Stellar public key schemas. - - Labels: frontend, good first issue - -### 216. **Document the i18n message structure** - - Hint: frontend/src/messages and src/i18n — explain key namespacing and how to add a new locale. - - Labels: frontend, good first issue - -### 217. **Add a hover/focus state to ListingCard** - - Hint: frontend/src/components/marketplace/ListingCard.tsx — add elevation and cursor pointer. - - Labels: frontend, good first issue - -### 218. **Replace hardcoded color literals with theme tokens** - - Hint: Audit frontend/src/components/dashboard for raw hex values that bypass the theme provider. - - Labels: frontend, good first issue - -### 219. **Add a max-width container to settings page** - - Hint: frontend/src/app/settings/page.tsx — prevent over-stretching on ultra-wide viewports. - - Labels: frontend, good first issue - -### 220. **Add a favicon/theme-color metadata** - - Hint: frontend/src/app/layout.tsx — set icons and themeColor for mobile/PWA. - - Labels: frontend, good first issue - -### 221. **Document the freighter wallet adapter** - - Hint: frontend/src/lib/freighter — explain connect, sign, and public key retrieval flows. - - Labels: frontend, good first issue - -### 222. **Add reduced-motion support to YieldChart animations** - - Hint: frontend/src/components/YieldChart.tsx — respect prefers-reduced-motion. - - Labels: frontend, good first issue - -### 223. **Add a tooltip to StrategyBadge variants** - - Hint: frontend/src/components/ui/Badge/StrategyBadge.tsx — explain each strategy type on hover. - - Labels: frontend, good first issue - -### 224. **Add input character counters to CreatePostForm** - - Hint: frontend/src/components/community/CreatePostForm.tsx — show remaining characters vs max length. - - Labels: frontend, good first issue - -### 225. **Standardize error message copy in auth pages** - - Hint: frontend/src/app/login, signup, forgot-password, reset-password — centralize strings in messages. - - Labels: frontend, good first issue - -### 226. **Add a skip-to-content link in layout** - - Hint: frontend/src/app/layout.tsx — improve keyboard navigation for screen readers. - - Labels: frontend, good first issue - -### 227. **Document the analytics tracking wrapper** - - Hint: frontend/src/lib/analytics — describe event names and when page views fire. - - Labels: frontend, good first issue - -### 228. **Add loading state to WalletConnectModal submit** - - Hint: frontend/src/components/wallet/WalletConnectModal.tsx — disable button + spinner during connect. - - Labels: frontend, good first issue - -### 229. **Add accessible table captions to TransactionTable** - - Hint: frontend/src/components/portfolio/TransactionTable.tsx — add a describing the data. - - Labels: frontend, good first issue - -### 230. **Extract a shared Spinner component** - - Hint: frontend/src/components/ui — replace ad-hoc spinners in dashboard/modals with one component. - - Labels: frontend, good first issue - -### 231. **Add a responsive breakpoint check to Admin dashboard** - - Hint: frontend/src/app/admin/dashboard — ensure charts stack on small screens. - - Labels: frontend, good first issue - -### 232. **Document the types directory contracts** - - Hint: frontend/src/types — describe Vault, Deposit, Strategy DTOs and their backend source. - - Labels: frontend, good first issue - -### 233. **Add focus trap to ExportKeyModal** - - Hint: frontend/src/components/wallet/ExportKeyModal.tsx — keep Tab focus inside the modal. - - Labels: frontend, good first issue - -### 234. **Add a clear-all button to notification center** - - Hint: frontend/src/components/Notification — let users dismiss all at once. - - Labels: frontend, good first issue - -### 235. **Add a default sort to VaultTable** - - Hint: frontend/src/components/dashboard/VaultTable.tsx — default sort by TVL or APY descending. - - Labels: frontend, good first issue - -### 236. **Document the app router route groups** - - Hint: frontend/src/app — explain (marketing) vs dashboard layout boundaries and shared loaders. - - Labels: frontend, good first issue - -### 237. **Add a friendly empty state to YieldAnalytics page** - - Hint: frontend/src/app/yield-analytics/page.tsx — guide users when no history exists. - - Labels: frontend, good first issue - -### 238. **Add alt text to SeasonalTipCard illustrations** - - Hint: frontend/src/components/seasonal-tips/SeasonalTipCard.tsx — describe imagery for AT users. - - Labels: frontend, good first issue - -### 239. **Add a reusable ConfirmDialog primitive** - - Hint: frontend/src/components/ui — back DeleteVault/Withdraw confirmations with one accessible dialog. - - Labels: frontend, good first issue - -### 240. **Add visible labels (not just placeholders) to auth forms** - - Hint: frontend/src/app/login, signup — associate