Skip to content

Add validation tests for create stream – duration minimum and amount … #658

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nanaabdul1172 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add validation tests for create stream – duration minimum and amount … #658

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b036bb1
Add validation tests for create stream – duration minimum and amount …
nanaabdul1172 Jul 25, 2026
ac74091
Merge branch 'main' into Validation-tests
nanaabdul1172 Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions BOUNDARY_TESTS_SUMMARY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
# Boundary Tests Implementation Summary

## Overview
Added comprehensive boundary tests for the POST /api/streams route validation rules, specifically for `durationSeconds` and `totalAmount` parameters.

## Tests Added

### Duration Boundary Tests
Located in: `backend/src/index.test.ts` (lines ~618-664)

1. **Test: durationSeconds = 59 (below minimum)**
- Sends request with `durationSeconds: 59`
- Expects: `400` status code
- Expects: Error message "durationSeconds must be at least 60 seconds"
- Validates the lower boundary is enforced

2. **Test: durationSeconds = 60 (minimum boundary)**
- Sends request with `durationSeconds: 60`
- Expects: `201` status code (success)
- Validates the exact minimum boundary is accepted

### Amount Precision Boundary Tests
Located in: `backend/src/index.test.ts` (lines ~666-744)

1. **Test: totalAmount = 0.0000001 (1 stroop - minimum valid)**
- Sends request with `totalAmount: 0.0000001` (7 decimal places)
- Expects: `201` status code (success)
- Validates that the smallest Stellar amount (1 stroop) is accepted

2. **Test: totalAmount = 0**
- Sends request with `totalAmount: 0`
- Expects: `400` status code
- Expects: Error message "Amount must be greater than zero"
- Validates zero amounts are rejected

3. **Test: totalAmount with 8 decimal places**
- Sends request with `totalAmount: 100.12345678` (8 decimal places)
- Expects: `400` status code
- Expects: Error message "Amount cannot have more than 7 decimal places"
- Validates precision limit is enforced

4. **Test: totalAmount with exactly 7 decimal places**
- Sends request with `totalAmount: 100.1234567` (7 decimal places)
- Expects: `201` status code (success)
- Validates the maximum precision boundary is accepted

## Validation Schema Reference
The validation logic tested here is implemented in:
- `backend/src/validation/schemas.ts`
- `durationSecondsSchema`: Enforces minimum of 60 seconds
- `totalAmountSchema`: Enforces positive values and maximum 7 decimal places

## Acceptance Criteria ✅
- ✅ Duration boundary (59 vs 60) is tested explicitly
- ✅ Stroop-level minimum amount (0.0000001) is accepted
- ✅ More than 7 decimal places is rejected with clear message "Amount cannot have more than 7 decimal places"
- ✅ Zero amount is rejected with clear message "Amount must be greater than zero"
- ✅ All tests follow the existing test pattern with proper assertions

## Test Structure
All boundary tests are organized under the existing `describe("POST /api/streams")` block with two sub-describe blocks:
1. `describe("Duration boundary tests")`
2. `describe("Amount precision boundary tests")`

This organization makes it easy to find and maintain these specific boundary test cases.

## Additional Fix
Fixed a syntax error in `backend/src/index.ts` (lines 1040-1090) where duplicate code was causing compilation failures. Removed the duplicate query parsing and filtering logic in the recipients route handler.
18 changes: 18 additions & 0 deletions backend/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

128 changes: 128 additions & 0 deletions backend/src/index.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -612,6 +612,134 @@ it("returns 400 when durationSeconds is below the 60-second minimum", async () =
]),
);
});

// ══════════════════════════════════════════════════════════════════════════
// Boundary Tests for Duration and Amount Validation
// ══════════════════════════════════════════════════════════════════════════

describe("Duration boundary tests", () => {
it("returns 400 when durationSeconds is 59 (below minimum)", async () => {
const response = await request(app)
.post("/api/streams")
.set("Authorization", "Bearer mock_token")
.send({
sender: SENDER_A,
recipient: RECIPIENT_1,
assetCode: "USDC",
totalAmount: 100,
durationSeconds: 59,
});

expect(response.status).toBe(400);
expect(response.body.code).toBe("VALIDATION_ERROR");
expect(response.body.error).toContain("durationSeconds must be at least 60 seconds");
expect(response.body.details).toEqual(
expect.arrayContaining([
expect.objectContaining({ field: "durationSeconds" }),
]),
);
});

it("returns 201 when durationSeconds is exactly 60 (minimum boundary)", async () => {
const response = await request(app)
.post("/api/streams")
.set("Authorization", "Bearer mock_token")
.send({
sender: SENDER_A,
recipient: RECIPIENT_1,
assetCode: "USDC",
totalAmount: 100,
durationSeconds: 60,
});

expect(response.status).toBe(201);
expect(response.body.data).toMatchObject({
durationSeconds: 60,
});
});
});

describe("Amount precision boundary tests", () => {
it("returns 201 when totalAmount is 0.0000001 (1 stroop - minimum valid)", async () => {
const response = await request(app)
.post("/api/streams")
.set("Authorization", "Bearer mock_token")
.send({
sender: SENDER_A,
recipient: RECIPIENT_1,
assetCode: "USDC",
totalAmount: 0.0000001,
durationSeconds: 120,
});

expect(response.status).toBe(201);
expect(response.body.data).toMatchObject({
totalAmount: 0.0000001,
});
});

it("returns 400 when totalAmount is 0", async () => {
const response = await request(app)
.post("/api/streams")
.set("Authorization", "Bearer mock_token")
.send({
sender: SENDER_A,
recipient: RECIPIENT_1,
assetCode: "USDC",
totalAmount: 0,
durationSeconds: 120,
});

expect(response.status).toBe(400);
expect(response.body.code).toBe("VALIDATION_ERROR");
expect(response.body.error).toContain("Amount must be greater than zero");
expect(response.body.details).toEqual(
expect.arrayContaining([
expect.objectContaining({ field: "totalAmount" }),
]),
);
});

it("returns 400 when totalAmount has more than 7 decimal places", async () => {
const response = await request(app)
.post("/api/streams")
.set("Authorization", "Bearer mock_token")
.send({
sender: SENDER_A,
recipient: RECIPIENT_1,
assetCode: "USDC",
totalAmount: 100.12345678, // 8 decimal places
durationSeconds: 120,
});

expect(response.status).toBe(400);
expect(response.body.code).toBe("VALIDATION_ERROR");
expect(response.body.error).toContain("Amount cannot have more than 7 decimal places");
expect(response.body.details).toEqual(
expect.arrayContaining([
expect.objectContaining({ field: "totalAmount" }),
]),
);
});

it("returns 201 when totalAmount has exactly 7 decimal places", async () => {
const response = await request(app)
.post("/api/streams")
.set("Authorization", "Bearer mock_token")
.send({
sender: SENDER_A,
recipient: RECIPIENT_1,
assetCode: "USDC",
totalAmount: 100.1234567, // exactly 7 decimal places
durationSeconds: 120,
});

expect(response.status).toBe(201);
expect(response.body.data).toMatchObject({
totalAmount: 100.1234567,
});
});
});
Comment on lines +663 to +742

@coderabbitai coderabbitai Bot Jul 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What does JavaScript Number.prototype.toString()return for0.00000001, and when does it use exponential notation?

💡 Result:

For the number 0.00000001 (which is 10⁻⁸), JavaScript's Number.prototype.toString returns the string "1e-8" [1][2]. Exponential (scientific) notation is used by Number.prototype.toString when the radix is 10 and the absolute value of the number is either greater than or equal to 10²¹ or strictly less than 10⁻⁶ [1][3]. Specifically, the ECMAScript specification defines this behavior based on the exponent n in the number's representation [4][5]. When formatting a number in base 10, if the number cannot be represented without exceeding the range -5 to 21 for the exponent n, the engine switches to exponential notation [4][5]. In summary: - Result for 0.00000001: "1e-8" [1][2] - Threshold for exponential notation: magnitude < 10⁻⁶ or ≥ 10²¹ [1][3]

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Locate relevant files"
git ls-files | rg '(^|/)schemas\.ts$|(@|^|/)index\.test\.ts$|BOUNDARY_TESTS_SUMMARY\.md$|backend/src/validation' || true

echo
echo "Search decimal validation symbols"
rg -n "Amount cannot have more than 7 decimal places|decimal places|totalAmountSchema|totalAmount" backend/src validation BOUNDARY_TESTS_SUMMARY.md 2>/dev/null || true

echo
echo "Candidate schema/test summary"
for f in backend/src/validation/schemas.ts backend/src/index.test.ts BOUNDARY_TESTS_SUMMARY.md; do
  if [ -f "$f" ]; then
    echo "===== $f ====="
    wc -l "$f"
    if [ "$f" = "backend/src/validation/schemas.ts" ]; then
      ast-grep outline "$f" --match totalAmountSchema --view expanded || true
      sed -n '1,220p' "$f" | cat -n
    elif [ "$f" = "backend/src/index.test.ts" ]; then
      sed -n '620,760p' "$f" | cat -n
    elif [ "$f" = "BOUNDARY_TESTS_SUMMARY.md" ]; then
      sed -n '1,80p' "$f" | cat -n
    fi
  fi
done

Repository: ritik4ever/stellar-stream

Length of output: 34506

🏁 Script executed:

#!/bin/bash
set -euo pipefail

node - <<'JS'
const values = [0.00000001, 0.0000001, 100.12345678, 100.1234567, 0, 100];
for (const v of values) {
  const parts = String(v).split(".");
  const decimalStr = parts[1];
  console.log(JSON.stringify({ value: v, string: String(v), decimalStr, passes: !decimalStr || decimalStr.length <= 7 }));
}
JS

echo
echo "Relevant schema/validation tests"
sed -n '34,44p' backend/src/validation/schemas.ts | cat -n
sed -n '236,248p' backend/src/validation/schemas.test.ts | cat -n
sed -n '296,312p' backend/src/validation/schemas.test.ts | cat -n

Repository: ritik4ever/stellar-stream

Length of output: 2371

Cover the scientific-notation precision bypass.

totalAmountSchema counts decimal places with value.toString().split(".")[1]; 0.00000001 becomes 1e-8, which has no fractional substring and passes the “no more than 7 decimal places” check. Add a sub-stroop rejection case and switch the schema to stroop-scale/decimal-safe validation; update BOUNDARY_TESTS_SUMMARY.md where it claims >7 decimal precision is fully rejected until that case is covered.

📍 Affects 2 files
  • backend/src/index.test.ts#L663-L742 (this comment)
  • BOUNDARY_TESTS_SUMMARY.md#L36-L40
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/src/index.test.ts` around lines 663 - 742, The totalAmountSchema
decimal-place check is bypassed by scientific notation, allowing sub-stroop
values such as 0.00000001. Replace the string-based precision check with
stroop-scale/decimal-safe validation, add a rejection test in
backend/src/index.test.ts for that sub-stroop value, and update
BOUNDARY_TESTS_SUMMARY.md at lines 36-40 to reflect coverage only after the new
case is included.

});

// ---------------------------------------------------------------------------
Expand Down