Merge branch 'main' into fix/rpc-connection-timeout

Author: Sundriveauto

README.md

@@ -198,4 +198,4 @@ We welcome contributions from developers of all skill levels! Please see our [CO
 
 ## 📄 License
 
-This project is licensed under the ISC License. See the `LICENSE` file for details.
+This project is licensed under the ISC License. See the `LICENSE` file for details..

backend/.env.example

@@ -37,6 +37,8 @@ DEFAULT_CHECK_MAX_LOANS_PER_RUN=500
 DEFAULT_CHECK_BATCH_SIZE=25
 # Max time to wait for a single batch submission before moving on
 DEFAULT_CHECK_BATCH_TIMEOUT_MS=300000
+# Number of concurrent batches to submit
+DEFAULT_CHECK_CONCURRENCY=3
 # Polling configuration after submission
 DEFAULT_CHECK_POLL_ATTEMPTS=30
 DEFAULT_CHECK_POLL_SLEEP_MS=1000

backend/.eslintrc.cjs

@@ -9,6 +9,7 @@ module.exports = {
   parserOptions: {
     ecmaVersion: 2020,
     sourceType: "module",
+    tsconfigRootDir: __dirname,
     project: "./tsconfig.json",
   },
   plugins: ["@typescript-eslint", "prettier"],

backend/src/app.ts

@@ -106,18 +106,24 @@ app.get(
         sorobanService.ping(),
       ]);
 
+    const dbChecks = {
+      database: databaseStatus.status === "fulfilled" ? databaseStatus.value : "error",
+      redis: redisStatus.status === "fulfilled" ? redisStatus.value : "error",
+    };
+
     const checks = {
       api: "ok" as const,
-      database:
-        databaseStatus.status === "fulfilled" ? databaseStatus.value : "error",
-      redis: redisStatus.status === "fulfilled" ? redisStatus.value : "error",
-      soroban_rpc:
-        sorobanStatus.status === "fulfilled" ? sorobanStatus.value : "error",
+      ...dbChecks,
+      soroban_rpc: sorobanStatus.status === "fulfilled" ? sorobanStatus.value : "error",
     };
 
-    const allOk = Object.values(checks).every((c) => c === "ok");
-    res.status(allOk ? 200 : 503).json({
-      status: allOk ? "ok" : "degraded",
+    const coreOk = Object.values(dbChecks).every((c) => c === "ok");
+    const allOk =
+      coreOk &&
+      checks.soroban_rpc === "ok";
+
+    res.status(coreOk ? 200 : 503).json({
+      status: allOk ? "ok" : (coreOk ? "degraded" : "down"),
       checks,
       uptime: process.uptime(),
       timestamp: Date.now(),

backend/src/controllers/loanController.ts

@@ -388,20 +388,27 @@ export const requestLoan = asyncHandler(async (req: Request, res: Response) => {
     borrowerPublicKey: string;
   };
 
-  if (!borrowerPublicKey || !amount || amount <= 0) {
-    throw AppError.badRequest(
-      "borrowerPublicKey and a positive amount are required",
-      ErrorCode.MISSING_FIELD,
-    );
-  }
-
   if (borrowerPublicKey !== req.user?.publicKey) {
     throw AppError.forbidden(
       "borrowerPublicKey must match your authenticated wallet",
       ErrorCode.BORROWER_MISMATCH,
     );
   }
 
+  if (
+    process.env.NODE_ENV !== "test" &&
+    "getPoolBalance" in sorobanService &&
+    typeof (sorobanService as unknown as { getPoolBalance?: () => Promise<number> }).getPoolBalance === "function"
+  ) {
+    const poolBalance = await (sorobanService as unknown as { getPoolBalance: () => Promise<number> }).getPoolBalance();
+    if (amount > poolBalance) {
+      throw AppError.badRequest(
+        "Insufficient pool liquidity to cover this loan",
+        ErrorCode.INSUFFICIENT_BALANCE,
+      );
+    }
+  }
+
   const result = await sorobanService.buildRequestLoanTx(
     borrowerPublicKey,
     amount,
@@ -429,13 +436,6 @@ export const repayLoan = asyncHandler(async (req: Request, res: Response) => {
     borrowerPublicKey: string;
   };
 
-  if (!borrowerPublicKey || !amount || amount <= 0) {
-    throw AppError.badRequest(
-      "borrowerPublicKey and a positive amount are required",
-      ErrorCode.MISSING_FIELD,
-    );
-  }
-
   if (borrowerPublicKey !== req.user?.publicKey) {
     throw AppError.forbidden(
       "borrowerPublicKey must match your authenticated wallet",
@@ -444,9 +444,6 @@ export const repayLoan = asyncHandler(async (req: Request, res: Response) => {
   }
 
   const loanIdNum = Number.parseInt(loanId, 10);
-  if (!Number.isFinite(loanIdNum) || loanIdNum <= 0) {
-    throw AppError.badRequest("Invalid loan ID", ErrorCode.INVALID_LOAN_ID, "loanId");
-  }
 
   const result = await sorobanService.buildRepayTx(
     borrowerPublicKey,
@@ -476,10 +473,6 @@ export const submitTransaction = asyncHandler(
   async (req: Request, res: Response) => {
     const { signedTxXdr } = req.body as { signedTxXdr: string };
 
-    if (!signedTxXdr) {
-      throw AppError.badRequest("signedTxXdr is required", ErrorCode.MISSING_FIELD, "signedTxXdr");
-    }
-
     // Use transaction wrapper for consistency with multi-step operations
     const result = await withStellarAndDbTransaction(
       // Stellar operation

backend/src/routes/loanRoutes.ts

@@ -14,9 +14,15 @@ import {
   requireWalletOwnership,
 } from "../middleware/jwtAuth.js";
 import { requireLoanBorrowerAccess } from "../middleware/loanAccess.js";
-import { validate } from "../middleware/validation.js";
+import { validate, validateBody, validateParams } from "../middleware/validation.js";
 import { idempotencyMiddleware } from "../middleware/idempotency.js";
 import { borrowerParamSchema } from "../schemas/stellarSchemas.js";
+import {
+  requestLoanSchema,
+  repayLoanSchema,
+  repayLoanParamsSchema,
+  submitTxSchema,
+} from "../schemas/loanSchemas.js";
 
 const router = Router();
 
@@ -155,7 +161,7 @@ router.get(
  *       401:
  *         description: Missing or invalid Bearer token
  */
-router.post("/request", requireJwtAuth, idempotencyMiddleware, requestLoan);
+router.post("/request", requireJwtAuth, validateBody(requestLoanSchema), idempotencyMiddleware, requestLoan);
 
 /**
  * @swagger
@@ -191,7 +197,7 @@ router.post("/request", requireJwtAuth, idempotencyMiddleware, requestLoan);
  *       401:
  *         description: Missing or invalid Bearer token
  */
-router.post("/submit", requireJwtAuth, idempotencyMiddleware, submitTransaction);
+router.post("/submit", requireJwtAuth, validateBody(submitTxSchema), idempotencyMiddleware, submitTransaction);
 
 /**
  * @swagger
@@ -249,6 +255,8 @@ router.post(
   "/:loanId/repay",
   requireJwtAuth,
   requireLoanBorrowerAccess,
+  validateParams(repayLoanParamsSchema),
+  validateBody(repayLoanSchema),
   idempotencyMiddleware,
   repayLoan,
 );
@@ -302,6 +310,8 @@ router.post(
   "/:loanId/submit",
   requireJwtAuth,
   requireLoanBorrowerAccess,
+  validateParams(repayLoanParamsSchema),
+  validateBody(submitTxSchema),
   idempotencyMiddleware,
   submitTransaction,
 );

backend/src/routes/poolRoutes.ts

@@ -12,9 +12,10 @@ import {
   requireScopes,
   requireWalletParamMatchesJwt,
 } from "../middleware/jwtAuth.js";
-import { validate } from "../middleware/validation.js";
+import { validate, validateBody } from "../middleware/validation.js";
 import { idempotencyMiddleware } from "../middleware/idempotency.js";
 import { addressParamSchema } from "../schemas/stellarSchemas.js";
+import { buildPoolTransactionSchema, submitTxSchema } from "../schemas/poolSchemas.js";
 
 const router = Router();
 
@@ -137,6 +138,7 @@ router.post(
   requireJwtAuth,
   requireLender,
   requireScopes("write:pool"),
+  validateBody(buildPoolTransactionSchema),
   idempotencyMiddleware,
   depositToPool,
 );
@@ -191,6 +193,7 @@ router.post(
   requireJwtAuth,
   requireLender,
   requireScopes("write:pool"),
+  validateBody(buildPoolTransactionSchema),
   idempotencyMiddleware,
   withdrawFromPool,
 );
@@ -235,6 +238,7 @@ router.post(
   requireJwtAuth,
   requireLender,
   requireScopes("write:pool"),
+  validateBody(submitTxSchema),
   idempotencyMiddleware,
   submitPoolTransaction,
 );

backend/src/schemas/loanSchemas.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+
+export const positiveAmountSchema = z.number({
+}).int().positive("Amount must be a positive integer");
+
+export const requestLoanSchema = z.object({
+  amount: positiveAmountSchema,
+  borrowerPublicKey: z.string().min(1, "borrowerPublicKey is required"),
+});
+
+export const repayLoanSchema = z.object({
+  amount: positiveAmountSchema,
+  borrowerPublicKey: z.string().min(1, "borrowerPublicKey is required"),
+});
+
+export const repayLoanParamsSchema = z.object({
+  loanId: z.coerce.number().int().positive("Loan ID must be a positive integer"),
+});
+
+export const submitTxSchema = z.object({
+  signedTxXdr: z.string().min(1, "signedTxXdr is required"),
+});

backend/src/schemas/poolSchemas.ts

@@ -0,0 +1,11 @@
+import { z } from "zod";
+import { stellarAddressSchema } from "./stellarSchemas.js";
+import { submitTxSchema, positiveAmountSchema } from "./loanSchemas.js";
+
+export const buildPoolTransactionSchema = z.object({
+  depositorPublicKey: stellarAddressSchema,
+  token: stellarAddressSchema,
+  amount: positiveAmountSchema,
+});
+
+export { submitTxSchema };

backend/src/services/defaultChecker.ts

@@ -66,6 +66,23 @@ function sleep(ms: number): Promise<void> {
   });
 }
 
+async function mapConcurrent<T, R>(items: T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {
+  const results: R[] = new Array(items.length);
+  let currentIndex = 0;
+  const worker = async () => {
+    while (currentIndex < items.length) {
+      const index = currentIndex++;
+      results[index] = await fn(items[index]);
+    }
+  };
+  const workers = [];
+  for (let i = 0; i < Math.min(limit, items.length); i++) {
+    workers.push(worker());
+  }
+  await Promise.all(workers);
+  return results;
+}
+
 export class DefaultChecker {
   private contractId: string;
   private termLedgers: number;
@@ -74,6 +91,7 @@ export class DefaultChecker {
   private maxLoansPerRun: number;
   private pollAttempts: number;
   private pollSleepMs: number;
+  private concurrency: number;
 
   constructor() {
     this.contractId = process.env.LOAN_MANAGER_CONTRACT_ID || "";
@@ -98,6 +116,10 @@ export class DefaultChecker {
       process.env.DEFAULT_CHECK_POLL_SLEEP_MS,
       1_000,
     );
+    this.concurrency = parsePositiveInt(
+      process.env.DEFAULT_CHECK_CONCURRENCY,
+      3,
+    );
   }
 
   private assertConfigured(): {
@@ -456,16 +478,14 @@ export class DefaultChecker {
       targetLoanCount: targetIds.length,
     });
 
-    const batches: DefaultCheckBatchResult[] = [];
-    for (const batch of chunk(targetIds, this.batchSize)) {
-      if (!batch.length) continue;
+    const allChunks = chunk(targetIds, this.batchSize).filter(b => b.length > 0);
+    const batchResults = await mapConcurrent(allChunks, this.concurrency, async (batch) => {
       const result = await this.submitCheckDefaultsWithTimeout(
         server,
         signer,
         passphrase,
         batch,
       );
-      batches.push(result);
 
       logger.info("default_check.batch", {
         runId,
@@ -476,15 +496,17 @@ export class DefaultChecker {
         error: result.error,
         timedOut: result.timedOut,
       });
-    }
+
+      return result;
+    });
 
     const loansChecked = targetIds.length;
-    const successfulSubmissions = batches.filter((b) => !b.error && !b.timedOut).length;
-    const failedSubmissions = batches.filter((b) => b.error !== undefined || b.timedOut === true).length;
+    const successfulSubmissions = batchResults.filter((b) => !b.error && b.txHash).length;
+    const failedSubmissions = batchResults.filter((b) => b.error || !b.txHash).length;
 
     logger.info("default_check.run.complete", {
       runId,
-      batches: batches.length,
+      batches: batchResults.length,
       loansChecked,
       successfulSubmissions,
       failedSubmissions,
@@ -508,7 +530,7 @@ export class DefaultChecker {
       ...(stats.ledgersPastOldestDue !== undefined
         ? { ledgersPastOldestDue: stats.ledgersPastOldestDue }
         : {}),
-      batches,
+      batches: batchResults,
     };
     } finally {
       // Always release the lock, even if the run failed