Auth: Challenge Endpoint (POST /auth/challenge)

[codebestia]

Background

Sign In With Stellar requires the wallet to sign a server-generated message. The backend must issue a time-limited, single-use challenge string tied to the requesting wallet address. This is the first step of the two-step auth flow.

Proposed Steps

1. Create POST /auth/challenge route
2. Accept { address: string } in the request body
3. Validate that address is a valid Stellar public key (using StrKey.isValidEd25519PublicKey from @stellar/stellar-sdk)
4. Generate a cryptographically random nonce (crypto.randomBytes(32).toString('hex'))
5. Persist an AuthNonce record with expiresAt = now + 5 minutes
6. Return a structured challenge message that the wallet will sign
7. Clean up expired nonces on each call

Acceptance Criteria

• POST /auth/challenge with a valid Stellar address returns 200 with { message, nonce, expiresAt }
• POST /auth/challenge with an invalid address returns 400 with a clear error
• Nonce is persisted to AuthNonce table
• Expired nonces are cleaned up before each new challenge is generated
• The challenge message format is deterministic and matches what the frontend signs

[gloskull]

Hello, I have 4 years of experience delivering solutions for projects like this, covering backend, frontend, and smart contract development. After carefully reviewing your requirements, I have a clear understanding of the task and am confident in my ability to deliver a clean, efficient, and thoroughly tested solution on time. I prioritize code quality, maintainability, and industry best practices throughout the development process.

[leocagli]

I'd like to work on this issue, please assign me so I can begin implementation.

[josephchimebuka]

GM, I have reviewed this issue and taken the time to understand the requirements, current implementation, and the expected outcome. Based on my analysis, I believe this is something I can successfully handle and contribute to... Kindly assign

[OmniZlatoon]

Hi maintainer sir, I'm called Junior Brown , a full-stack and smart contract engineer building on Stellar. I specialize in designing and shipping scalable, secure systems end-to-end, from Soroban smart contracts to production-ready backend infrastructure and user-facing applications.

[grantfox-oss]

🦊 GrantFox — @josephchimebuka has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #6)
2. Your PR will be reviewed by the ShadeProtocol maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@josephchimebuka's PR #33 was approved and merged by @codebestia.

🏆 @josephchimebuka: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (417 total points). Track your full progress on GrantFox.

👏 Great work, @josephchimebuka! Keep contributing to ShadeProtocol.