Integrate all 25 open contributor PRs

.env.example

@@ -22,3 +22,11 @@ RATE_LIMIT_MAX_STRICT=10
 # LEDGER_RANGE_FAILURE_THRESHOLD=3
 # Stall window in ms since last successful tracker operation (default: 120000)
 # LEDGER_RANGE_STALL_THRESHOLD_MS=120000
+
+# Indexer RPC exponential backoff retry (#249)
+# Retry transient RPC failures (timeouts, connection resets, rate limits, 5xx)
+# with a doubling backoff up to the configured max. Resets on success.
+INDEXER_RPC_MAX_RETRIES=5
+INDEXER_RPC_INITIAL_BACKOFF_MS=1000
+INDEXER_RPC_BACKOFF_MULTIPLIER=2
+INDEXER_RPC_MAX_BACKOFF_MS=30000

__tests__/build-tx.test.ts

@@ -646,3 +646,37 @@ describe("POST /api/jobs/build-tx — Winston traces (#109)", () => {
     expect(meta.contractId).toBe(VALID_BODY.contractId);
   });
 });
+describe('POST /api/jobs/build-tx – CORS and security headers', () => {
+  it('rejects requests from unauthorized origins', async () => {
+    const res = await request(app)
+      .post('/api/jobs/build-tx')
+      .set('Origin', 'http://malicious.com')
+      .send({})
+      .expect(403);
+    expect(res.body).toEqual({
+      success: false,
+      error: 'Origin not allowed by CORS policy',
+    });
+  });
+
+  it('allows trusted origins and sets CORS response headers', async () => {
+    const res = await request(app)
+      .post('/api/jobs/build-tx')
+      .set('Origin', 'http://localhost:3000')
+      .send({}) // send empty body to trigger 400 validation error, but cors should pass first
+      .expect(400); 
+    expect(res.headers['access-control-allow-origin']).toBe('http://localhost:3000');
+    expect(res.headers['access-control-allow-methods']).toContain('POST');
+  });
+
+  it('sets security headers', async () => {
+    const res = await request(app)
+      .post('/api/jobs/build-tx')
+      .set('Origin', 'http://localhost:3000')
+      .send({})
+      .expect(400);
+    expect(res.headers['x-frame-options']).toBe('DENY');
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+  });
+});
+

__tests__/create-job-draft-validation.test.ts

@@ -0,0 +1,148 @@
+import request from "supertest";
+import express from "express";
+import { createJobDraftValidation } from "../src/middleware/create-job-draft-validation.js";
+
+const VALID_CLIENT =
+  "GAODBHVR63Z56MVQRBEJSYM2H5423LJ4WAPUUBOFG4JYY72S6ROKVZRX";
+const VALID_FREELANCER =
+  "GB5CRPXUGXZCG6BESL4CM4F3VUAGQGFNYNBHPBRJAGLXXSRYJSEGZHUV";
+const VALID_ARBITER =
+  "GABNCQRZNTG6MMITD33VHFITKJZ5PSYW2XVEXMP52BSMTPLU7WORDQNT";
+const VALID_TOKEN =
+  "CDD5WKK3WT3QVKXMXTJNDIXE4T73FK6GGXDSD6UTJAH6YYZU52SQ4MUH";
+
+const VALID_BODY = {
+  client: VALID_CLIENT,
+  freelancer: VALID_FREELANCER,
+  arbiter: VALID_ARBITER,
+  token: VALID_TOKEN,
+  autoReleaseDays: 7,
+  milestones: [{ amount: "10000000" }],
+};
+
+const VALID_LEGACY_BODY = {
+  clientAddress: VALID_CLIENT,
+  freelancerAddress: VALID_FREELANCER,
+  arbiterAddress: VALID_ARBITER,
+  tokenAddress: VALID_TOKEN,
+  milestones: [{ amount: "10000000" }],
+};
+
+function buildApp() {
+  const app = express();
+  app.use(express.json());
+  app.post("/create-job-draft", createJobDraftValidation, (req, res) => {
+    res.status(200).json({ success: true, data: req.body });
+  });
+  return app;
+}
+
+describe("createJobDraftValidation middleware – reusable Zod handler", () => {
+  it("passes a valid modern-naming body through to the handler", async () => {
+    const res = await request(buildApp())
+      .post("/create-job-draft")
+      .send(VALID_BODY)
+      .expect(200);
+
+    expect(res.body.success).toBe(true);
+    expect(res.body.data.freelancer).toBe(VALID_FREELANCER);
+  });
+
+  it("passes a valid legacy *Address body through to the handler", async () => {
+    const res = await request(buildApp())
+      .post("/create-job-draft")
+      .send(VALID_LEGACY_BODY)
+      .expect(200);
+
+    expect(res.body.success).toBe(true);
+    expect(res.body.data.freelancerAddress).toBe(VALID_FREELANCER);
+  });
+
+  it("rejects a missing freelancer with a field validation error", async () => {
+    const { freelancer: _f, ...rest } = VALID_BODY;
+    const res = await request(buildApp())
+      .post("/create-job-draft")
+      .send(rest)
+      .expect(400);
+
+    expect(res.body.success).toBe(false);
+    expect(res.body.error).toBe("ValidationError");
+    expect(res.body.details).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          field: "freelancer",
+          message: expect.stringMatching(/freelancer/i),
+        }),
+      ]),
+    );
+  });
+
+  it("rejects a malformed milestone amount as a field validation error", async () => {
+    const res = await request(buildApp())
+      .post("/create-job-draft")
+      .send({ ...VALID_BODY, milestones: [{ amount: "not-a-number" }] })
+      .expect(400);
+
+    expect(res.body.success).toBe(false);
+    expect(res.body.error).toBe("ValidationError");
+    expect(res.body.details).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          field: "milestones",
+          message: expect.stringMatching(/amount/i),
+        }),
+      ]),
+    );
+  });
+
+  it("rejects an invalid token contract address in the modern variant", async () => {
+    const res = await request(buildApp())
+      .post("/create-job-draft")
+      .send({ ...VALID_BODY, token: "not-a-contract-id" })
+      .expect(400);
+
+    expect(res.body.details).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          field: "token",
+          message: expect.stringMatching(/contract address/i),
+        }),
+      ]),
+    );
+  });
+
+  it("rejects an invalid arbiter address in the legacy variant", async () => {
+    const res = await request(buildApp())
+      .post("/create-job-draft")
+      .send({ ...VALID_LEGACY_BODY, arbiterAddress: "GSHORT" })
+      .expect(400);
+
+    expect(res.body.success).toBe(false);
+    expect(res.body.error).toBe("ValidationError");
+    expect(res.body.details).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          field: "arbiterAddress",
+          message: expect.stringMatching(/valid Stellar account address/i),
+        }),
+      ]),
+    );
+  });
+
+  it("rejects a missing tokenAddress in the legacy variant", async () => {
+    const { tokenAddress: _t, ...rest } = VALID_LEGACY_BODY;
+    const res = await request(buildApp())
+      .post("/create-job-draft")
+      .send(rest)
+      .expect(400);
+
+    expect(res.body.details).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          field: "tokenAddress",
+          message: expect.stringMatching(/tokenAddress/i),
+        }),
+      ]),
+    );
+  });
+});