Fix duplicate logger binding, unpaginated issue labeling, fake SEP-10 challenge, and hardcoded e2e secret

e2e-tests/test/setup.ts

@@ -32,8 +32,12 @@ export const TEST_CONFIG = {
   networkPassphrase: 'Standalone Network ; February 2017',
 
   // Throwaway test keypair, freshly funded via friendbot on every run against
-  // an ephemeral local network. PUBLIC/REUSABLE; never commit real secrets.
-  issuer: Keypair.fromSecret('SBLXYLBT346LAKZRPSQ73XJUQWIKTTO3GEICHFNJDQ3WORVHG5G5GVR4'),
+  // an ephemeral local network. Generated at setup time so no secret key is
+  // ever committed to source control; set E2E_ISSUER_SECRET to pin a stable
+  // identity instead (e.g. from the docker-compose test harness).
+  issuer: process.env.E2E_ISSUER_SECRET
+    ? Keypair.fromSecret(process.env.E2E_ISSUER_SECRET)
+    : Keypair.random(),
 
   // A syntactically valid (real checksum) Stellar address to submit through
   // the real on-chain add_to_denylist call. sanctions-oracle's

examples/full-stack-demo/README.md

@@ -27,7 +27,8 @@ The app listens on `http://localhost:3000` and exposes:
 
 Use environment variables to customize runtime values:
 
-- `SERVER_ACCOUNT_ID`
+- `SERVER_SECRET_KEY` — Stellar secret key used to sign SEP-10 challenges in `/challenge`. Falls back to an ephemeral random keypair (regenerated on every restart) if unset — fine for a single local run, not for anything shared.
+- `SERVER_ACCOUNT_ID` — must match `SERVER_SECRET_KEY`'s public key; defaults to that public key when omitted
 - `RPC_URL`
 - `CONTRACT_ID`
 - `START_LEDGER`

examples/full-stack-demo/server.js

@@ -1,14 +1,30 @@
 const express = require('express');
 const bodyParser = require('body-parser');
-const { createSep10Middleware } = require('sep10-auth');
+const { createSep10Middleware, generateChallenge } = require('sep10-auth');
 const { HorizonListener, HttpWebhookSender, RpcEventSource } = require('horizon-listener');
 const { MockSanctionsProvider, syncSanctionsToDenylist } = require('sanctions-oracle');
 const { Keypair, Networks } = require('@stellar/stellar-sdk');
 
 const app = express();
 app.use(bodyParser.json());
 
-const SERVER_ACCOUNT_ID = process.env.SERVER_ACCOUNT_ID || 'GABCDEFGHIJKLMNOPQRSTUVWXYZ23456789ABCDEFGH';
+// The server keypair signs SEP-10 challenge transactions in /challenge; its
+// public key must match SERVER_ACCOUNT_ID, which the middleware uses to
+// verify those same challenges in /private. Set SERVER_SECRET_KEY to a
+// stable value in any environment other than local dev.
+const SERVER_SECRET_KEY = process.env.SERVER_SECRET_KEY;
+let serverKeypair;
+if (SERVER_SECRET_KEY) {
+  serverKeypair = Keypair.fromSecret(SERVER_SECRET_KEY);
+} else {
+  serverKeypair = Keypair.random();
+  console.warn(
+    'SERVER_SECRET_KEY not set; using an ephemeral in-memory keypair for local development only. ' +
+      'This key is regenerated on every restart. Set SERVER_SECRET_KEY for a stable server identity.',
+  );
+}
+
+const SERVER_ACCOUNT_ID = process.env.SERVER_ACCOUNT_ID || serverKeypair.publicKey();
 const NETWORK_PASSPHRASE = process.env.NETWORK_PASSPHRASE || Networks.TESTNET;
 const HOME_DOMAIN = process.env.HOME_DOMAIN || 'localhost:3000';
 const WEB_AUTH_DOMAIN = process.env.WEB_AUTH_DOMAIN || 'localhost:3000';
@@ -61,8 +77,12 @@ app.get('/sync', async (req, res) => {
 
 app.get('/challenge', (req, res) => {
   const clientKeypair = Keypair.random();
-  const challenge = `SIMULATED-CHALLENGE-FOR-${clientKeypair.publicKey()}`;
-  res.json({ challenge, address: clientKeypair.publicKey() });
+  const challenge = generateChallenge(clientKeypair.publicKey(), serverKeypair, {
+    homeDomain: HOME_DOMAIN,
+    webAuthDomain: WEB_AUTH_DOMAIN,
+    networkPassphrase: NETWORK_PASSPHRASE,
+  });
+  res.json({ ...challenge, address: clientKeypair.publicKey() });
 });
 
 const WEBHOOK_URL = process.env.WEBHOOK_URL || 'http://localhost:3000/webhook/events';

scripts/apply-package-labels.js

@@ -33,14 +33,14 @@ async function ensureLabel(name, color, description) {
 }
 
 async function applyLabelToOpenIssues(label) {
-  const issues = await octokit.request('GET /repos/{owner}/{repo}/issues', {
+  const issues = await octokit.paginate('GET /repos/{owner}/{repo}/issues', {
     owner: repoOwner,
     repo: repoName,
     state: 'open',
     per_page: 100,
   });
 
-  for (const issue of issues.data) {
+  for (const issue of issues) {
     // Skip pull requests
     if (issue.pull_request) continue;
     // Heuristic: add label if the package name appears in title/body