Feat/backend global validation pipe

backend/package.json

@@ -6,21 +6,58 @@
     "build": "nest build",
     "start": "nest start",
     "start:dev": "nest start --watch",
-    "start:prod": "node dist/main"
+    "start:prod": "node dist/main",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r find-node-modules node_modules/.bin/jest --runInBand",
+    "test:e2e": "jest --config ./test/jest-e2e.json"
   },
   "dependencies": {
     "@nestjs/common": "^10.0.0",
     "@nestjs/core": "^10.0.0",
     "@nestjs/platform-express": "^10.0.0",
     "@nestjs/swagger": "^7.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.4",
     "reflect-metadata": "^0.1.13",
     "rxjs": "^7.8.0",
     "swagger-ui-express": "^5.0.0"
   },
   "devDependencies": {
     "@nestjs/cli": "^10.0.0",
-    "@types/express": "^4.17.0",
-    "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "@nestjs/schematics": "^10.0.0",
+    "@nestjs/testing": "^10.0.0",
+    "@types/express": "^4.17.17",
+    "@types/jest": "^29.5.2",
+    "@types/node": "^20.3.1",
+    "@types/supertest": "^2.0.12",
+    "jest": "^29.5.0",
+    "source-map-support": "^0.5.21",
+    "supertest": "^6.3.3",
+    "ts-jest": "^29.1.0",
+    "ts-loader": "^9.4.3",
+    "ts-node": "^10.9.1",
+    "tsconfig-paths": "^4.2.0",
+    "typescript": "^5.1.3"
+  },
+  "jest": {
+    "moduleFileExtensions": [
+      "js",
+      "json",
+      "ts"
+    ],
+    "rootDir": "src",
+    "testRegex": ".*\\.spec\\.ts$",
+    "transform": {
+      "^.+\\.(t|j)s$": "ts-jest"
+    },
+    "collectCoverageFrom": [
+      "**/*.(t|j)s"
+    ],
+    "coverageDirectory": "../coverage",
+    "testEnvironment": "node"
   }
 }
+
+

backend/src/app.module.ts

@@ -1,9 +1,14 @@
 import { Module } from '@nestjs/common';
+import { AppController } from './app.controller';
+import { AppService } from './app.service';
 import { ResolverModule } from './resolver/resolver.module';
 import { VaultModule } from './vault/vault.module';
 import { AuctionModule } from './auction/auction.module';
 
 @Module({
   imports: [ResolverModule, VaultModule, AuctionModule],
+  controllers: [AppController],
+  providers: [AppService],
 })
 export class AppModule {}
+

backend/src/auction/dto/auction.dto.ts

@@ -1,3 +1,4 @@
+import { IsNotEmpty, IsNumberString, Matches } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
 
 export class AuctionInfoDto {
@@ -45,12 +46,19 @@ export class AuctionListItemDto {
 
 export class PlaceBidDto {
   @ApiProperty({ description: 'Bidder Stellar address', example: 'GXYZ9876STELLAR1234BIDDERADDRESS' })
+  @IsNotEmpty()
+  @Matches(/^G[A-Z2-7]{55}$/, {
+    message: 'Invalid Stellar wallet address format',
+  })
   bidder: string;
 
   @ApiProperty({ description: 'Bid amount in XLM', example: '150.00' })
+  @IsNotEmpty()
+  @IsNumberString()
   amount: string;
 }
 
+
 export class BidResponseDto {
   @ApiProperty({ description: 'Whether the bid was accepted', example: true })
   success: boolean;

backend/src/auth/dto/login.dto.ts

@@ -0,0 +1,17 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsNotEmpty, IsString, Matches } from 'class-validator';
+
+export class LoginDto {
+  @ApiProperty({ description: 'Stellar wallet address', example: 'GABC1234STELLAR5678WALLETADDRESS' })
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^G[A-Z2-7]{55}$/, {
+    message: 'Invalid Stellar wallet address format',
+  })
+  address: string;
+
+  @ApiProperty({ description: 'Signature for authentication', example: 'sig_abc123...' })
+  @IsString()
+  @IsNotEmpty()
+  signature: string;
+}

backend/src/main.ts

@@ -1,10 +1,19 @@
+import { ValidationPipe } from '@nestjs/common';
 import { NestFactory } from '@nestjs/core';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { AppModule } from './app.module';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
 
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+    }),
+  );
+
   const config = new DocumentBuilder()
     .setTitle('Alien Gateway API')
     .setVersion('1.0')

backend/src/resolver/dto/resolver.dto.ts

@@ -1,3 +1,4 @@
+import { IsNotEmpty, IsString, Matches } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
 
 export class ResolveResponseDto {
@@ -13,15 +14,31 @@ export class ResolveResponseDto {
 
 export class RegisterUsernameDto {
   @ApiProperty({ description: 'Username to register (without @)', example: 'alice' })
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^[a-zA-Z0-9_]{3,20}$/, {
+    message: 'Username must be 3-20 characters long and contain only letters, numbers, and underscores',
+  })
   username: string;
 
   @ApiProperty({ description: 'Stellar wallet address to link', example: 'GABC1234STELLAR5678WALLETADDRESS' })
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^G[A-Z2-7]{55}$/, {
+    message: 'Invalid Stellar wallet address format',
+  })
   walletAddress: string;
 
   @ApiProperty({ description: 'Zero-knowledge commitment hash', example: '0xabc123...' })
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^0x[a-fA-F0-9]{64}$/, {
+    message: 'Commitment must be a 32-byte hex string prefixed with 0x',
+  })
   commitment: string;
 }
 
+
 export class RegisterResponseDto {
   @ApiProperty({ description: 'Whether registration succeeded', example: true })
   success: boolean;

backend/src/vault/dto/vault.dto.ts

@@ -1,3 +1,4 @@
+import { IsBoolean, IsIn, IsNotEmpty, IsNumberString, IsString } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
 
 export class VaultBalanceDto {
@@ -30,18 +31,27 @@ export class PaymentDto {
 
 export class AutoPayDto {
   @ApiProperty({ description: 'Auto-pay rule ID', example: 'ap_xyz789' })
+  @IsString()
+  @IsNotEmpty()
   id: string;
 
   @ApiProperty({ description: 'Recipient username', example: 'bob' })
+  @IsString()
+  @IsNotEmpty()
   recipient: string;
 
   @ApiProperty({ description: 'Amount per interval in XLM', example: '5.00' })
+  @IsNotEmpty()
+  @IsNumberString()
   amount: string;
 
   @ApiProperty({ description: 'Payment interval', example: 'monthly', enum: ['daily', 'weekly', 'monthly'] })
+  @IsNotEmpty()
+  @IsIn(['daily', 'weekly', 'monthly'])
   interval: string;
 
   @ApiProperty({ description: 'Whether the rule is active', example: true })
+  @IsBoolean()
   active: boolean;
 }
 

backend/test/app.e2e-spec.ts

@@ -1,11 +1,10 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { INestApplication } from '@nestjs/common';
-import request from 'supertest';
-import { App } from 'supertest/types';
+import * as request from 'supertest';
 import { AppModule } from './../src/app.module';
 
 describe('AppController (e2e)', () => {
-  let app: INestApplication<App>;
+  let app: INestApplication;
 
   beforeEach(async () => {
     const moduleFixture: TestingModule = await Test.createTestingModule({

backend/test/validation.e2e-spec.ts

@@ -0,0 +1,102 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import * as request from 'supertest';
+import { AppModule } from './../src/app.module';
+
+describe('Global Validation (e2e)', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    app.useGlobalPipes(
+      new ValidationPipe({
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        transform: true,
+      }),
+    );
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  describe('Resolver Registration Validation', () => {
+    it('should return 400 when username is too short', () => {
+      return request(app.getHttpServer())
+        .post('/resolver/register')
+        .send({
+          username: 'al',
+          walletAddress: 'GABC1234STELLAR5678WALLETADDRESS',
+          commitment: '0xabc1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd',
+        })
+        .expect(400)
+        .expect((res) => {
+          expect(res.body.message).toContain('Username must be 3-20 characters long and contain only letters, numbers, and underscores');
+        });
+    });
+
+    it('should return 400 when wallet address is invalid', () => {
+      return request(app.getHttpServer())
+        .post('/resolver/register')
+        .send({
+          username: 'alice',
+          walletAddress: 'INVALID_ADDRESS',
+          commitment: '0xabc1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd',
+        })
+        .expect(400)
+        .expect((res) => {
+          expect(res.body.message).toContain('Invalid Stellar wallet address format');
+        });
+    });
+
+    it('should return 400 when commitment is not a hex string', () => {
+      return request(app.getHttpServer())
+        .post('/resolver/register')
+        .send({
+          username: 'alice',
+          walletAddress: 'GABC1234STELLAR5678WALLETADDRESS',
+          commitment: 'not-a-hex-string',
+        })
+        .expect(400)
+        .expect((res) => {
+          expect(res.body.message).toContain('Commitment must be a 32-byte hex string prefixed with 0x');
+        });
+    });
+
+    it('should return 400 when extra fields are provided (forbidNonWhitelisted)', () => {
+      return request(app.getHttpServer())
+        .post('/resolver/register')
+        .send({
+          username: 'alice',
+          walletAddress: 'GABC1234STELLAR5678WALLETADDRESS',
+          commitment: '0xabc1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd',
+          extraField: 'should-not-be-here',
+        })
+        .expect(400)
+        .expect((res) => {
+          expect(res.body.message).toContain('property extraField should not exist');
+        });
+    });
+  });
+
+  describe('Auction Bid Validation', () => {
+    it('should return 400 when amount is not a number string', () => {
+      return request(app.getHttpServer())
+        .post('/auction/1/bid')
+        .send({
+          bidder: 'GABC1234STELLAR5678WALLETADDRESS',
+          amount: 'not-a-number',
+        })
+        .expect(400)
+        .expect((res) => {
+          expect(res.body.message).toContain('amount must be a number string');
+        });
+    });
+  });
+});