diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 3ea4c78..ea0376a 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -14,5 +14,6 @@ Closes # - [ ] Tests pass - [ ] No new lint warnings - [ ] Docs updated if needed +- [ ] CHANGELOG.md updated - [ ] PR targets `develop` - [ ] Supabase queries audited for SQL injection (no raw SQL, parameterized methods used) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8a344ce..4c20936 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -39,3 +39,17 @@ updates: # Flag major version bumps for manual review - dependency-name: "*" update-types: [version-update:semver-major] + + # GitHub Actions — monthly to reduce noise + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + open-pull-requests-limit: 5 + labels: + - dependencies + - github-actions + ignore: + # Flag major version bumps for manual review + - dependency-name: "*" + update-types: [version-update:semver-major] diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index a1ad2f7..e951a4a 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -11,6 +11,7 @@ on: permissions: contents: read pull-requests: write + issues: write jobs: npm-audit: @@ -42,6 +43,20 @@ jobs: repo: context.repo.repo, body: `### ${status} pnpm audit\n\`\`\`\n${output.slice(0, 6000)}\n\`\`\`` }); + - name: Create Issue on failure (Scheduled) + if: github.event_name == 'schedule' && steps.npm_audit.outcome == 'failure' + uses: actions/github-script@v7 + with: + script: | + const fs = require('fs'); + const output = fs.readFileSync('/tmp/npm-audit.txt', 'utf8'); + github.rest.issues.create({ + owner: context.repo.owner, + repo: context.repo.repo, + title: '🚨 Weekly pnpm audit failed: High-severity vulnerabilities detected', + body: `The weekly pnpm audit found high-severity vulnerabilities in JS dependencies.\n\n### Audit Output:\n\`\`\`\n${output.slice(0, 6000)}\n\`\`\``, + labels: ['security', 'devops'] + }); - name: Fail if audit found high/critical issues if: steps.npm_audit.outcome == 'failure' run: exit 1 @@ -54,7 +69,7 @@ jobs: - name: Install Rust toolchain uses: dtolnay/rust-toolchain@master with: - toolchain: "1.85.0" + toolchain: "1.88.0" - uses: Swatinem/rust-cache@v2 with: workspaces: apps/contracts @@ -79,6 +94,20 @@ jobs: repo: context.repo.repo, body: `### ${status} cargo audit\n\`\`\`\n${output.slice(0, 6000)}\n\`\`\`` }); + - name: Create Issue on failure (Scheduled) + if: github.event_name == 'schedule' && steps.cargo_audit.outcome == 'failure' + uses: actions/github-script@v7 + with: + script: | + const fs = require('fs'); + const output = fs.readFileSync('/tmp/cargo-audit.txt', 'utf8'); + github.rest.issues.create({ + owner: context.repo.owner, + repo: context.repo.repo, + title: '🚨 Weekly cargo audit failed: Vulnerabilities detected', + body: `The weekly cargo audit found vulnerabilities in Rust dependencies.\n\n### Audit Output:\n\`\`\`\n${output.slice(0, 6000)}\n\`\`\``, + labels: ['security', 'devops'] + }); - name: Fail if audit found vulnerabilities if: steps.cargo_audit.outcome == 'failure' run: exit 1 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9eeb65f..6f298f6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -51,17 +51,26 @@ jobs: TURBO_TEAM: ${{ secrets.TURBO_TEAM }} - run: pnpm test working-directory: apps/web + - name: Run tests with coverage + run: pnpm vitest run --coverage + working-directory: apps/web + - name: Upload coverage to Codecov + uses: codecov/codecov-action@v4 + with: + files: apps/web/coverage/lcov.info + flags: web + fail_ci_if_error: false - run: pnpm build working-directory: apps/web env: - NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL || 'https://placeholder.supabase.co' }} - NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY || 'placeholder' }} + NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }} + NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }} NEXT_PUBLIC_STELLAR_NETWORK: testnet NEXT_PUBLIC_ENERGY_TOKEN_ID: placeholder NEXT_PUBLIC_AUDIT_REGISTRY_ID: placeholder NEXT_PUBLIC_COMMUNITY_GOVERNANCE_ID: placeholder - SUPABASE_SERVICE_ROLE_KEY: placeholder - MINTER_SECRET_KEY: SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }} + MINTER_SECRET_KEY: ${{ secrets.MINTER_SECRET_KEY }} TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} TURBO_TEAM: ${{ secrets.TURBO_TEAM }} @@ -104,6 +113,21 @@ jobs: - name: Validate openapi.yaml run: npx --yes @redocly/cli@1 lint openapi.yaml --format=github-actions + license-compliance: + name: License compliance check + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: pnpm/action-setup@v4 + with: + version: 10 + - uses: actions/setup-node@v4 + with: + node-version: 22 + cache: pnpm + - run: pnpm install --frozen-lockfile + - run: npx license-checker --onlyAllow "$(node -e "const c=require('./.license-checker.json');console.log(c.allowedLicenses.join(';'))")" --excludePrivatePackages + contracts: name: Contracts (fmt + clippy + test) runs-on: ubuntu-latest @@ -128,14 +152,23 @@ jobs: - name: fmt run: cargo fmt --all -- --check working-directory: apps/contracts + env: + TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} + TURBO_TEAM: ${{ secrets.TURBO_TEAM }} - name: clippy run: cargo clippy --all-targets --all-features -- -D warnings working-directory: apps/contracts + env: + TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} + TURBO_TEAM: ${{ secrets.TURBO_TEAM }} - name: test run: cargo test --all working-directory: apps/contracts + env: + TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }} + TURBO_TEAM: ${{ secrets.TURBO_TEAM }} proptest: name: Property-based tests (proptest) @@ -177,3 +210,44 @@ jobs: - name: fuzz_vote (30 s) run: cargo fuzz run fuzz_vote -- -max_total_time=30 corpus/fuzz_vote working-directory: apps/contracts/fuzz + + image-scan: + name: Docker image vulnerability scan (Trivy) + runs-on: ubuntu-latest + needs: web + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@v4 + + - name: Build Docker image + run: | + docker build \ + --file apps/web/Dockerfile \ + --tag solarproof/web:${{ github.sha }} \ + . + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.28.0 + with: + image-ref: solarproof/web:${{ github.sha }} + format: sarif + output: trivy-results.sarif + severity: CRITICAL + exit-code: '1' + ignore-unfixed: true + + - name: Upload Trivy SARIF results as artifact + if: always() + uses: actions/upload-artifact@v4 + with: + name: trivy-scan-results + path: trivy-results.sarif + retention-days: 30 + + - name: Upload SARIF to GitHub Security tab + if: always() + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: trivy-results.sarif diff --git a/.github/workflows/contracts-ci.yml b/.github/workflows/contracts-ci.yml new file mode 100644 index 0000000..75f2601 --- /dev/null +++ b/.github/workflows/contracts-ci.yml @@ -0,0 +1,48 @@ +name: Contracts CI + +on: + pull_request: + branches: [main, develop] + paths: + - "apps/contracts/**" + - ".github/workflows/contracts-ci.yml" + push: + branches: [main, develop] + paths: + - "apps/contracts/**" + - ".github/workflows/contracts-ci.yml" + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + name: Rust contracts (fmt + clippy + test) + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@master + with: + toolchain: "1.85.0" + targets: wasm32-unknown-unknown + components: rustfmt, clippy + + - name: Cache Rust build artifacts + uses: Swatinem/rust-cache@v2 + with: + workspaces: apps/contracts + + - name: Check formatting + run: cargo fmt --all -- --check + working-directory: apps/contracts + + - name: Clippy + run: cargo clippy --all-targets --all-features -- -D warnings + working-directory: apps/contracts + + - name: Run tests + run: cargo test --all + working-directory: apps/contracts diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml new file mode 100644 index 0000000..40c9ebe --- /dev/null +++ b/.github/workflows/deploy-production.yml @@ -0,0 +1,49 @@ +name: Deploy Production + +on: + push: + branches: [main] + +jobs: + ci: + name: CI gate + uses: ./.github/workflows/ci.yml + secrets: inherit + + deploy: + name: Deploy to Vercel (production) + runs-on: ubuntu-latest + needs: ci + permissions: + deployments: write + environment: + name: production + url: ${{ steps.promote.outputs.url }} + steps: + - uses: actions/checkout@v4 + + - name: Install Vercel CLI + run: npm install -g vercel@latest + + - name: Build & deploy preview (green) + id: deploy + env: + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} + VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} + VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} + run: | + url=$(vercel deploy --token "$VERCEL_TOKEN" --yes 2>&1 | tail -1) + echo "url=$url" >> "$GITHUB_OUTPUT" + + - name: Promote to production + id: promote + env: + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} + VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} + run: | + vercel promote "${{ steps.deploy.outputs.url }}" \ + --token "$VERCEL_TOKEN" --scope "$VERCEL_ORG_ID" + echo "url=${{ steps.deploy.outputs.url }}" >> "$GITHUB_OUTPUT" + + - name: Write deployment URL to job summary + run: echo "### 🚀 Production deployed to ${{ steps.promote.outputs.url }}" >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/mutation-testing.yml b/.github/workflows/mutation-testing.yml new file mode 100644 index 0000000..2afd477 --- /dev/null +++ b/.github/workflows/mutation-testing.yml @@ -0,0 +1,85 @@ +name: Mutation Testing + +on: + schedule: + # Every Sunday at 02:00 UTC + - cron: '0 2 * * 0' + workflow_dispatch: + inputs: + target: + description: 'Which target to run (all | rust | typescript)' + required: false + default: 'all' + +concurrency: + group: mutation-testing + cancel-in-progress: true + +jobs: + rust-mutations: + name: Rust (cargo-mutants) + if: ${{ github.event_name == 'schedule' || github.event.inputs.target == 'all' || github.event.inputs.target == 'rust' }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@master + with: + toolchain: '1.85.0' + targets: wasm32-unknown-unknown + + - uses: Swatinem/rust-cache@v2 + with: + workspaces: apps/contracts + + - name: Install cargo-mutants + run: cargo install cargo-mutants --locked --version 24.11.0 + + - name: Run cargo-mutants + working-directory: apps/contracts + run: | + cargo mutants \ + --package audit_registry \ + --package energy_token \ + --output mutants-out \ + --timeout 120 \ + --jobs 2 + + - name: Upload mutation report + if: always() + uses: actions/upload-artifact@v4 + with: + name: cargo-mutants-report + path: apps/contracts/mutants-out/ + retention-days: 30 + + typescript-mutations: + name: TypeScript (Stryker) + if: ${{ github.event_name == 'schedule' || github.event.inputs.target == 'all' || github.event.inputs.target == 'typescript' }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: pnpm/action-setup@v4 + with: + version: 10 + + - uses: actions/setup-node@v4 + with: + node-version: 22 + cache: pnpm + + - run: pnpm install --frozen-lockfile + + - name: Run Stryker + working-directory: packages/stellar + run: pnpm test:mutation + + - name: Upload Stryker report + if: always() + uses: actions/upload-artifact@v4 + with: + name: stryker-report + path: packages/stellar/reports/mutation/ + retention-days: 30 diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml new file mode 100644 index 0000000..fd38aad --- /dev/null +++ b/.github/workflows/playwright.yml @@ -0,0 +1,46 @@ +name: E2E — Playwright Dashboard + +on: + push: + branches: [main, develop, 'fix/**', 'feat/**'] + pull_request: + branches: [main, develop] + +jobs: + playwright: + name: Playwright E2E + runs-on: ubuntu-latest + environment: staging + timeout-minutes: 20 + steps: + - uses: actions/checkout@v4 + + - uses: pnpm/action-setup@v4 + + - uses: actions/setup-node@v4 + with: + node-version: 22 + cache: pnpm + + - run: pnpm install --frozen-lockfile + + - name: Install Playwright browsers + run: pnpm --filter web exec playwright install --with-deps chromium + + - name: Run Playwright tests + run: pnpm --filter web exec playwright test + env: + CI: true + BASE_URL: ${{ vars.STAGING_URL || 'http://127.0.0.1:3000' }} + NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }} + NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }} + NEXT_PUBLIC_ENERGY_TOKEN_ID: ${{ secrets.NEXT_PUBLIC_ENERGY_TOKEN_ID }} + NEXT_PUBLIC_AUDIT_REGISTRY_ID: ${{ secrets.NEXT_PUBLIC_AUDIT_REGISTRY_ID }} + + - name: Upload screenshots on failure + if: failure() + uses: actions/upload-artifact@v4 + with: + name: playwright-screenshots + path: apps/web/test-results/ + retention-days: 7 diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index b829013..29bc116 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -5,10 +5,17 @@ on: types: [opened, synchronize, reopened] jobs: + ci: + name: CI gate + uses: ./.github/workflows/ci.yml + secrets: inherit + deploy-preview: + needs: ci runs-on: ubuntu-latest permissions: pull-requests: write + deployments: write steps: - uses: actions/checkout@v4 diff --git a/.license-checker.json b/.license-checker.json new file mode 100644 index 0000000..efb69f0 --- /dev/null +++ b/.license-checker.json @@ -0,0 +1,16 @@ +{ + "allowedLicenses": [ + "MIT", + "Apache-2.0", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "CC0-1.0", + "CC-BY-3.0", + "CC-BY-4.0", + "0BSD", + "Unlicense", + "Python-2.0", + "BlueOak-1.0.0" + ] +} diff --git a/CHANGELOG.md b/CHANGELOG.md index f941356..7ce85d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,49 @@ +## [1.15.0](https://github.com/AnnabelJoe/solarproof/compare/v1.14.0...v1.15.0) (2026-05-30) + +### Features + +* **contracts:** optimize Soroban storage for audit-registry ([f9055f7](https://github.com/AnnabelJoe/solarproof/commit/f9055f7bd652a4fedd4ca454386452bbe0d8d779)), closes [#281](https://github.com/AnnabelJoe/solarproof/issues/281) + +## [1.14.0](https://github.com/AnnabelJoe/solarproof/compare/v1.13.0...v1.14.0) (2026-05-30) + +### Features + +* **contracts:** optimize Soroban storage for audit-registry ([4def0e7](https://github.com/AnnabelJoe/solarproof/commit/4def0e722cfe10ae0d5daeb4965ea2597f8ca836)), closes [#281](https://github.com/AnnabelJoe/solarproof/issues/281) + +### Documentation + +* **docs:** write governance parameter tuning guide ([cd9a68c](https://github.com/AnnabelJoe/solarproof/commit/cd9a68c28eeede3309d23000487f682ec12d40c6)), closes [#279](https://github.com/AnnabelJoe/solarproof/issues/279) + +## [1.13.0](https://github.com/AnnabelJoe/solarproof/compare/v1.12.0...v1.13.0) (2026-05-30) + +### Features + +* implement rate limiting on /api/readings [#266](https://github.com/AnnabelJoe/solarproof/issues/266) ([b9e0b98](https://github.com/AnnabelJoe/solarproof/commit/b9e0b9888dcc2d54bc6ff89507d80bcd58d525a5)) + +## [1.12.0](https://github.com/AnnabelJoe/solarproof/compare/v1.11.0...v1.12.0) (2026-05-30) + +### Features + +* add dark mode toggle to settings and enhance theme support [#253](https://github.com/AnnabelJoe/solarproof/issues/253) ([249dd4f](https://github.com/AnnabelJoe/solarproof/commit/249dd4fafc5a3540ab2b0d55c10cb7705b1e7e66)) + +## [1.11.0](https://github.com/AnnabelJoe/solarproof/compare/v1.10.0...v1.11.0) (2026-05-30) + +### Features + +* implement global and section error boundaries [#256](https://github.com/AnnabelJoe/solarproof/issues/256) ([cc85f83](https://github.com/AnnabelJoe/solarproof/commit/cc85f83d86c9d83d90106b981a03aa07508868d1)) + +## [1.10.0](https://github.com/AnnabelJoe/solarproof/compare/v1.9.0...v1.10.0) (2026-05-30) + +### Features + +* add pagination and filtering to certificates [#258](https://github.com/AnnabelJoe/solarproof/issues/258) ([4d2bde0](https://github.com/AnnabelJoe/solarproof/commit/4d2bde06d7e6cf59102504433c0c59a8bc6fc5d1)) + +## [1.9.0](https://github.com/AnnabelJoe/solarproof/compare/v1.8.2...v1.9.0) (2026-05-29) + +### Features + +* configure log aggregation and retention ([#299](https://github.com/AnnabelJoe/solarproof/issues/299)) ([3ee0154](https://github.com/AnnabelJoe/solarproof/commit/3ee0154492cccc7ce78c61925c0b72c44120fdf4)) + ## [1.8.2](https://github.com/AnnabelJoe/solarproof/compare/v1.8.1...v1.8.2) (2026-05-29) ### Bug Fixes @@ -198,14 +244,68 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Added +- feat(contracts): implement certificate retirement in energy_token (4a22103) +- feat(contracts): optimize Soroban storage for audit-registry (f9055f7) - STRIDE-based threat model (`docs/THREAT_MODEL.md`) covering 13 attack vectors across all 6 STRIDE categories (#110) - TSDoc comments and inline explanations on all exported functions in `packages/stellar/src/index.ts`, `apps/web/src/lib/stellar.ts`, and `apps/web/src/lib/crypto.ts` (#103) - Vitest unit tests for `buildTransaction`, `anchorReading` (build_anchor_tx), `mintCertificates` (build_mint_tx), and `retireCertificate` (build_retire_tx) with mocked Stellar RPC (#118) ---- +## [1.9.0] - 2026-05-29 +### Added +- configure log aggregation and retention ([#299](https://github.com/AnnabelJoe/solarproof/issues/299)) -## [1.0.0] — 2026-04-21 +## [1.8.2] - 2026-05-29 +### Fixed +- use checked arithmetic in energy_token to prevent overflow ([#277](https://github.com/AnnabelJoe/solarproof/issues/277)) + +## [1.8.1] - 2026-05-29 +### Fixed +- add replay attack protection to audit_registry contract ([#280](https://github.com/AnnabelJoe/solarproof/issues/280)) + +## [1.8.0] - 2026-05-29 +### Added +- automate Stellar Testnet faucet funding in CI ([#303](https://github.com/AnnabelJoe/solarproof/issues/303)) +- **adr:** add ADR-005 monorepo structure and ADR-006 certificate retirement model ([#311](https://github.com/AnnabelJoe/solarproof/issues/311)) + +## [1.7.1] - 2026-05-29 +### Fixed +- implement CSRF protection for state-changing API endpoints ([#335](https://github.com/AnnabelJoe/solarproof/issues/335)) + +## [1.7.0] - 2026-05-28 +### Added +- **#145:** add Stellar explorer deep links for all on-chain transactions ([#145](https://github.com/AnnabelJoe/solarproof/issues/145)) +- add JSDoc to all public API functions ([#316](https://github.com/AnnabelJoe/solarproof/issues/316)) +- complete OpenAPI 3.0 spec for all API endpoints ([#307](https://github.com/AnnabelJoe/solarproof/issues/307)) +- document public verifier API for third-party integrations ([#313](https://github.com/AnnabelJoe/solarproof/issues/313)) + +## [1.6.0] - 2026-05-28 +### Added +- implement SEP-41 approve/allowance/transfer_from ([#286](https://github.com/AnnabelJoe/solarproof/issues/286)) +- document Ed25519 meter signing protocol and key lifecycle ([#309](https://github.com/AnnabelJoe/solarproof/issues/309)) + +## [1.5.0] - 2026-05-28 +### Added +- **api:** add Idempotency-Key header support to readings API ([#267](https://github.com/AnnabelJoe/solarproof/issues/267)) + +## [1.4.0] - 2026-05-28 +### Added +- **observability:** add OpenTelemetry APM instrumentation ([#291](https://github.com/AnnabelJoe/solarproof/issues/291)) +- enhance developer onboarding guide ([#308](https://github.com/AnnabelJoe/solarproof/issues/308)) + +## [1.3.0] - 2026-05-28 +### Added +- add /api/health and /api/ready endpoints ([#275](https://github.com/AnnabelJoe/solarproof/issues/275)) +- document pnpm --frozen-lockfile requirement ([#302](https://github.com/AnnabelJoe/solarproof/issues/302)) + +## [1.2.0] - 2026-05-28 +### Added +- add governance voting UI ([#265](https://github.com/AnnabelJoe/solarproof/issues/265)) + +## [1.1.0] - 2026-05-28 +### Added +- responsive dashboard, certificate detail page, toast notifications, and accessibility improvements (704c0a5) +## [1.0.0] - 2026-04-21 ### Added - End-to-end cryptographic proof pipeline: Ed25519 meter signing → on-chain anchor → certificate minting → retirement - Three Soroban smart contracts: `energy_token` (SEP-41), `audit_registry`, `community_governance` @@ -222,5 +322,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Architecture Decision Records (`docs/adr/`) - API reference (`docs/API.md`), deployment guide (`docs/DEPLOYMENT.md`), onboarding guide (`docs/ONBOARDING.md`) -[Unreleased]: https://github.com/AnnabelJoe/solarproof/compare/v1.0.0...HEAD +[Unreleased]: https://github.com/AnnabelJoe/solarproof/compare/v1.9.0...HEAD +[1.9.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.8.2...v1.9.0 +[1.8.2]: https://github.com/AnnabelJoe/solarproof/compare/v1.8.1...v1.8.2 +[1.8.1]: https://github.com/AnnabelJoe/solarproof/compare/v1.8.0...v1.8.1 +[1.8.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.7.1...v1.8.0 +[1.7.1]: https://github.com/AnnabelJoe/solarproof/compare/v1.7.0...v1.7.1 +[1.7.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.6.0...v1.7.0 +[1.6.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.5.0...v1.6.0 +[1.5.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.4.0...v1.5.0 +[1.4.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.3.0...v1.4.0 +[1.3.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.2.0...v1.3.0 +[1.2.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.1.0...v1.2.0 +[1.1.0]: https://github.com/AnnabelJoe/solarproof/compare/v1.0.0...v1.1.0 [1.0.0]: https://github.com/AnnabelJoe/solarproof/releases/tag/v1.0.0 diff --git a/README.md b/README.md index 147e3f2..3437889 100644 --- a/README.md +++ b/README.md @@ -125,6 +125,22 @@ To stop and remove containers (volumes are kept): docker compose down ``` +**Minimum host requirements for Docker Compose:** + +| Resource | Minimum | +|---|---| +| RAM | 2 GB available to Docker | +| CPU | 2 cores | +| Disk | 4 GB free | + +Resource limits per service (defined in `docker-compose.yml`): + +| Service | Memory limit | CPU limit | +|---|---|---| +| `web` | 1 GB | 1.0 core | +| `supabase-db` | 512 MB | 0.5 core | +| `redis` | 128 MB | 0.25 core | + ### Simulate a meter reading ```bash @@ -178,8 +194,8 @@ solarproof/ | Level | What | Status | |---|---|---| | 1 | Signed meter readings + on-chain anchoring | ✅ Current | -| 2 | Hardware HSM integration (YubiKey / TPM) | 🔜 Next | -| 3 | I-REC / Energy Web / TIGR bridge | 🔮 Future | +| 2 | Hardware HSM integration (YubiKey / TPM) | ✅ Completed | +| 3 | I-REC / Energy Web / TIGR bridge | 🔜 Next | --- diff --git a/SECURITY.md b/SECURITY.md index d602b43..a6e034f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,73 +1,87 @@ # Security Policy +SolarProof takes the security of our renewable energy infrastructure seriously. We appreciate the efforts of security researchers who help us maintain the integrity of our cryptographic proofs. + ## Supported Versions +We provide security updates for the following versions: + | Version | Supported | |---|---| | `main` branch | ✅ | | Older releases | ❌ | -We only provide security fixes for the current `main` branch. - --- ## Reporting a Vulnerability **Please do not open a public GitHub issue for security vulnerabilities.** -Report vulnerabilities by emailing: +If you discover a potential security issue, please report it to us via email: + +**[security@solarproof.dev](mailto:security@solarproof.dev)** -**security@solarproof.dev** +To help us address the issue quickly, please include: -Include as much detail as possible: +- A detailed description of the vulnerability and its potential impact. +- Step-by-step instructions to reproduce the issue (or a proof-of-concept). +- The affected component(s) (API, smart contracts, frontend, scripts). +- Any suggested remediations or mitigations. -- A description of the vulnerability and its potential impact -- Steps to reproduce or a proof-of-concept -- Affected component(s) (API, smart contracts, frontend, scripts) -- Any suggested mitigations +### Response Timeline -We will acknowledge your report within **48 hours** and aim to provide a resolution timeline within **7 days**. +- **Acknowledgment:** Within 48 hours of receipt. +- **Initial Evaluation:** Within 7 days of acknowledgment. +- **Resolution:** We aim to resolve critical issues within 14-21 days. --- ## Disclosure Process -1. You report the vulnerability privately to `security@solarproof.dev` -2. We acknowledge receipt within **48 hours** -3. We investigate and develop a fix (target: within 14 days for critical issues) -4. We coordinate a release date with you before public disclosure -5. We publish a security advisory and credit the reporter (unless you prefer to remain anonymous) +We follow [coordinated vulnerability disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure) and ask that you do the same. -We follow [responsible disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure) and ask that you do the same — please allow us reasonable time to patch before any public disclosure. +1. **Report:** You report the vulnerability privately to our security email. +2. **Evaluation:** We verify the issue and assess the risk. +3. **Fix:** We develop and test a security patch. +4. **Coordination:** We coordinate a release date with you. +5. **Disclosure:** We publish a security advisory and credit you for the discovery. --- ## Scope -The following are **in scope**: +### In Scope -- `POST /api/readings` — Ed25519 signature verification bypass -- `POST /api/certificates/[id]/retire` — unauthorized retirement -- `GET /api/verify` — data leakage or manipulation -- Soroban smart contracts (`energy_token`, `audit_registry`, `community_governance`) -- Authentication and authorization logic -- Supabase RLS policy bypasses +- **Meter Proofs:** Ed25519 signature verification bypasses. +- **Certificate Lifecycle:** Unauthorized retirement or minting of tokens. +- **Chain of Custody:** Data manipulation in the `/api/verify` or anchor registry. +- **Smart Contracts:** Vulnerabilities in `energy_token`, `audit_registry`, or `community_governance`. +- **Infrastructure:** Supabase RLS policy bypasses or authentication flaws. -The following are **out of scope**: +### Out of Scope -- Stellar testnet infrastructure (report to Stellar Foundation) -- Third-party dependencies (report upstream; we will patch promptly when fixes are available) -- Social engineering or phishing attacks -- Denial-of-service attacks without a demonstrated security impact +- Vulnerabilities in the Stellar network itself (please report to the [Stellar Foundation](https://stellar.org/security)). +- Attacks requiring physical access to a meter device (unless the attack scales to other devices). +- Social engineering, phishing, or denial-of-service (DoS) attacks. +- Third-party library vulnerabilities (unless they result from our specific usage). --- ## Bug Bounty -SolarProof does not currently operate a paid bug bounty program. We do publicly credit all responsible disclosures in our security advisories. +SolarProof does not currently operate a paid bug bounty program. However, we are happy to: + +- Publicly credit researchers in our security advisories. +- Provide a letter of appreciation for significant findings. +- Offer early access to upcoming features. --- -## PGP Key +## Encrypted Communication (PGP) + +For sensitive reports, you may use our PGP key to encrypt your email. + +**Fingerprint:** `8F3E 4D2A 1B9C 7E6D 5F4A 3B2C 1D0E 9F8A 7B6C 5D4E` (Placeholder) +**Public Key:** A link to the full public key will be provided here once the project reaches production. -A PGP key for encrypted communication will be published here once the project reaches production. In the meantime, please use the email above. +In the meantime, standard email to `security@solarproof.dev` is the preferred channel. diff --git a/apps/contracts/.cargo-mutants.toml b/apps/contracts/.cargo-mutants.toml new file mode 100644 index 0000000..c092a85 --- /dev/null +++ b/apps/contracts/.cargo-mutants.toml @@ -0,0 +1,25 @@ +# cargo-mutants configuration +# https://mutants.rs/configuration.html + +# Only mutate the two critical contracts; community_governance is lower priority +packages = ["audit_registry", "energy_token"] + +# Exclude generated/trivial code that doesn't need mutation coverage +exclude_globs = [] + +# Exclude simple getters and metadata functions that are trivially correct +exclude_re = [ + "AuditRegistry::get_version", + "AuditRegistry::admin", + "AuditRegistry::api_signer", + "EnergyToken::name", + "EnergyToken::symbol", + "EnergyToken::decimals", + "EnergyToken::admin", +] + +# Minimum mutation score threshold (0–100). CI fails below this. +minimum_test_coverage = 70 + +# Run tests in release mode for speed (Soroban SDK requires it for some features) +test_workspace = true diff --git a/apps/contracts/audit_registry/src/lib.rs b/apps/contracts/audit_registry/src/lib.rs index 68e5520..dc27611 100644 --- a/apps/contracts/audit_registry/src/lib.rs +++ b/apps/contracts/audit_registry/src/lib.rs @@ -21,7 +21,7 @@ //! |-----|-------------|-------|------| //! | `DataKey::Admin` | instance | `Address` | ~57 B | //! | `DataKey::TotalAnchors` | instance | `u32` | 4 B | -//! | `DataKey::Anchor(hash)` | persistent | `AuditAnchor` | 36 B | +//! | `DataKey::Bucket(id)` | persistent | `Map, u32>` | Var | //! //! ## Invariants //! 1. Each `reading_hash` can be anchored at most once. @@ -37,7 +37,7 @@ #![no_std] use soroban_sdk::{ - contract, contracterror, contractimpl, contracttype, symbol_short, Address, BytesN, Env, + contract, contracterror, contractimpl, contracttype, symbol_short, Address, BytesN, Env, Map, }; const VERSION: &str = "1.0.0"; @@ -66,9 +66,10 @@ pub enum DataKey { Admin, /// `Address` — the only address authorised to call `anchor()`. ApiSigner, - /// `AuditAnchor` — keyed by the 32-byte reading hash. - Anchor(BytesN<32>), - /// `bool` — keyed by the 32-byte nonce. + /// Bucketed storage for reading hashes to reduce ledger entry count. + /// `Map, u32>` — keyed by bucket index (0-1023). + Bucket(u32), + /// `bool` — keyed by the 32-byte nonce. Used for idempotency. Nonce(BytesN<32>), /// `u32` — total number of anchors stored. TotalAnchors, @@ -156,6 +157,9 @@ impl AuditRegistry { } /// Returns the current authorised API signer address. + /// + /// # Panics + /// * `"not initialized"` if the contract has not been initialised. pub fn api_signer(env: Env) -> soroban_sdk::Address { env.storage() .instance() @@ -163,10 +167,36 @@ impl AuditRegistry { .expect("not initialized") } - /// Anchor a reading hash on-chain. + /// Helper to get bucket ID from a hash (0-1023). + fn get_bucket_id(hash: &BytesN<32>) -> u32 { + let b0 = hash.get(0).unwrap_or(0) as u32; + let b1 = hash.get(1).unwrap_or(0) as u32; + ((b0 << 8) | b1) % 1024 + } + + /// Anchor a reading hash on-chain. Only the registered `api_signer` may call this. + /// + /// # Arguments + /// * `caller` — must equal the registered `api_signer`. + /// * `reading_hash` — 32-byte SHA-256 of `(meter_id || kwh_stroops_le || timestamp_le)`. + /// * `nonce` — 32-byte unique value; prevents replay of the same anchor call. + /// + /// # Authorization + /// Requires `caller` authorisation. Returns `Err(Error::Unauthorized)` if + /// `caller` is not the registered `api_signer`. + /// + /// # Errors + /// * `Error::Unauthorized` — caller is not the `api_signer`. + /// * `Error::AlreadyAnchored` — `reading_hash` or `nonce` was already used. /// /// # Events - /// Emits `(topic: "anchor", data: reading_hash)`. + /// Emits `(topic: "anchor", data: (reading_hash, ledger_sequence, ledger_timestamp))`. + /// + /// # Example + /// ```ignore + /// client.anchor(&api_signer, &reading_hash, &nonce).unwrap(); + /// assert!(client.is_anchored(&reading_hash)); + /// ``` pub fn anchor( env: Env, caller: soroban_sdk::Address, @@ -183,24 +213,28 @@ impl AuditRegistry { return Err(Error::Unauthorized); } - let nonce_key = DataKey::Nonce(nonce.clone()); - if env.storage().persistent().has(&nonce_key) { + // Use temporary storage for nonces (idempotency) to reduce persistent entry costs. + let nonce_key = DataKey::Nonce(nonce); + if env.storage().temporary().has(&nonce_key) { return Err(Error::AlreadyAnchored); } - let key = DataKey::Anchor(reading_hash.clone()); - if env.storage().persistent().has(&key) { + let bucket_id = Self::get_bucket_id(&reading_hash); + let bucket_key = DataKey::Bucket(bucket_id); + let mut bucket: Map, u32> = env + .storage() + .persistent() + .get(&bucket_key) + .unwrap_or_else(|| Map::new(&env)); + + if bucket.contains_key(reading_hash.clone()) { return Err(Error::AlreadyAnchored); } - env.storage().persistent().set(&nonce_key, &true); + env.storage().temporary().set(&nonce_key, &true); - let anchor = AuditAnchor { - reading_hash: reading_hash.clone(), - anchored_at_ledger: env.ledger().sequence(), - }; - - env.storage().persistent().set(&key, &anchor); + bucket.set(reading_hash.clone(), env.ledger().sequence()); + env.storage().persistent().set(&bucket_key, &bucket); let count: u32 = env .storage() @@ -223,17 +257,31 @@ impl AuditRegistry { } /// Returns the `AuditAnchor` for `reading_hash`, or `None` if not anchored. + /// + /// # Example + /// ```ignore + /// if let Some(anchor) = client.verify(&hash) { + /// println!("anchored at ledger {}", anchor.anchored_at_ledger); + /// } + /// ``` pub fn verify(env: Env, reading_hash: BytesN<32>) -> Option { - env.storage() - .persistent() - .get(&DataKey::Anchor(reading_hash)) + let bucket_id = Self::get_bucket_id(&reading_hash); + let bucket: Map, u32> = env.storage().persistent().get(&DataKey::Bucket(bucket_id))?; + let anchored_at_ledger = bucket.get(reading_hash.clone())?; + Some(AuditAnchor { + reading_hash, + anchored_at_ledger, + }) } /// Returns `true` if `reading_hash` has been anchored, `false` otherwise. pub fn is_anchored(env: Env, reading_hash: BytesN<32>) -> bool { - env.storage() - .persistent() - .has(&DataKey::Anchor(reading_hash)) + let bucket_id = Self::get_bucket_id(&reading_hash); + let bucket: Option, u32>> = env.storage().persistent().get(&DataKey::Bucket(bucket_id)); + match bucket { + Some(b) => b.contains_key(reading_hash), + None => false, + } } /// Returns the total number of reading hashes anchored so far. @@ -245,6 +293,9 @@ impl AuditRegistry { } /// Returns the admin address. + /// + /// # Panics + /// * `"not initialized"` if the contract has not been initialised. pub fn admin(env: Env) -> soroban_sdk::Address { env.storage() .instance() @@ -285,7 +336,8 @@ mod tests { fn test_anchor_and_verify() { let (env, api_signer, client) = setup(); let h = hash(&env); - client.anchor(&api_signer, &h).unwrap(); + let n = make_nonce(&env, 1); + client.anchor(&api_signer, &h, &n).unwrap(); assert!(client.is_anchored(&h)); assert_eq!(client.total_anchors(), 1); let anchor = client.verify(&h).unwrap(); @@ -296,7 +348,8 @@ mod tests { fn test_anchor_records_ledger_sequence() { let (env, api_signer, client) = setup(); let h = hash(&env); - client.anchor(&api_signer, &h).unwrap(); + let n = make_nonce(&env, 1); + client.anchor(&api_signer, &h, &n).unwrap(); let anchor = client.verify(&h).unwrap(); let _ = anchor.anchored_at_ledger; } @@ -305,16 +358,30 @@ mod tests { fn test_duplicate_anchor_rejected() { let (env, api_signer, client) = setup(); let h = hash(&env); - client.anchor(&api_signer, &h).unwrap(); - assert_eq!(client.anchor(&api_signer, &h), Err(Error::AlreadyAnchored)); + let n1 = make_nonce(&env, 1); + let n2 = make_nonce(&env, 2); + client.anchor(&api_signer, &h, &n1).unwrap(); + assert_eq!(client.anchor(&api_signer, &h, &n2), Err(Error::AlreadyAnchored)); + } + + #[test] + fn test_duplicate_nonce_rejected() { + let (env, api_signer, client) = setup(); + let h1 = BytesN::from_array(&env, &[1u8; 32]); + let h2 = BytesN::from_array(&env, &[2u8; 32]); + let n = make_nonce(&env, 1); + client.anchor(&api_signer, &h1, &n).unwrap(); + assert_eq!(client.anchor(&api_signer, &h2, &n), Err(Error::AlreadyAnchored)); } #[test] fn test_duplicate_anchor_does_not_increment_total() { let (env, api_signer, client) = setup(); let h = hash(&env); - client.anchor(&api_signer, &h).unwrap(); - let _ = client.anchor(&api_signer, &h); + let n1 = make_nonce(&env, 1); + let n2 = make_nonce(&env, 2); + client.anchor(&api_signer, &h, &n1).unwrap(); + let _ = client.anchor(&api_signer, &h, &n2); assert_eq!(client.total_anchors(), 1); } @@ -323,8 +390,8 @@ mod tests { let (env, api_signer, client) = setup(); let h1 = BytesN::from_array(&env, &[0xAAu8; 32]); let h2 = BytesN::from_array(&env, &[0xBBu8; 32]); - client.anchor(&api_signer, &h1).unwrap(); - client.anchor(&api_signer, &h2).unwrap(); + client.anchor(&api_signer, &h1, &make_nonce(&env, 1)).unwrap(); + client.anchor(&api_signer, &h2, &make_nonce(&env, 2)).unwrap(); assert!(client.is_anchored(&h1)); assert!(client.is_anchored(&h2)); assert_eq!(client.total_anchors(), 2); @@ -335,7 +402,7 @@ mod tests { let (env, _api_signer, client) = setup(); let attacker = soroban_sdk::Address::generate(&env); assert_eq!( - client.anchor(&attacker, &hash(&env)), + client.anchor(&attacker, &hash(&env), &make_nonce(&env, 1)), Err(Error::Unauthorized) ); } @@ -346,7 +413,7 @@ mod tests { let new_signer = soroban_sdk::Address::generate(&env); client.set_api_signer(&new_signer); assert_eq!( - client.anchor(&old_signer, &hash(&env)), + client.anchor(&old_signer, &hash(&env), &make_nonce(&env, 1)), Err(Error::Unauthorized) ); } @@ -372,7 +439,7 @@ mod tests { let (env, api_signer, client) = setup(); for i in 0u8..5 { client - .anchor(&api_signer, &BytesN::from_array(&env, &[i; 32])) + .anchor(&api_signer, &BytesN::from_array(&env, &[i; 32]), &make_nonce(&env, i)) .unwrap(); } assert_eq!(client.total_anchors(), 5); @@ -397,7 +464,7 @@ mod tests { let count: u8 = 50; for i in 0..count { let h = BytesN::from_array(&env, &[i; 32]); - client.anchor(&api_signer, &h).unwrap(); + client.anchor(&api_signer, &h, &make_nonce(&env, i)).unwrap(); } assert_eq!(client.total_anchors(), u32::from(count)); assert!(client.is_anchored(&BytesN::from_array(&env, &[0u8; 32]))); @@ -409,8 +476,8 @@ mod tests { let (env, api_signer, client) = setup(); let all_zeros = BytesN::from_array(&env, &[0x00u8; 32]); let all_ones = BytesN::from_array(&env, &[0xFFu8; 32]); - client.anchor(&api_signer, &all_zeros).unwrap(); - client.anchor(&api_signer, &all_ones).unwrap(); + client.anchor(&api_signer, &all_zeros, &make_nonce(&env, 1)).unwrap(); + client.anchor(&api_signer, &all_ones, &make_nonce(&env, 2)).unwrap(); assert!(client.is_anchored(&all_zeros)); assert!(client.is_anchored(&all_ones)); assert_eq!(client.total_anchors(), 2); @@ -431,7 +498,7 @@ mod tests { let new_signer = soroban_sdk::Address::generate(&env); client.set_api_signer(&new_signer); let h = hash(&env); - client.anchor(&new_signer, &h).unwrap(); + client.anchor(&new_signer, &h, &make_nonce(&env, 1)).unwrap(); assert!(client.is_anchored(&h)); } @@ -451,4 +518,26 @@ mod tests { soroban_sdk::String::from_str(&env, "1.0.0") ); } + + #[test] + fn test_issue_281_bucket_collision() { + let (env, api_signer, client) = setup(); + // Force hashes that likely end up in the same bucket + // Our bucket ID is ((hash[0] << 8) | hash[1]) % 1024 + // So any hash starting with 0x00 0x00 will be in bucket 0. + let mut h1_arr = [0u8; 32]; + h1_arr[2] = 1; + let h1 = BytesN::from_array(&env, &h1_arr); + + let mut h2_arr = [0u8; 32]; + h2_arr[2] = 2; + let h2 = BytesN::from_array(&env, &h2_arr); + + client.anchor(&api_signer, &h1, &make_nonce(&env, 1)).unwrap(); + client.anchor(&api_signer, &h2, &make_nonce(&env, 2)).unwrap(); + + assert!(client.is_anchored(&h1)); + assert!(client.is_anchored(&h2)); + assert_eq!(client.total_anchors(), 2); + } } diff --git a/apps/contracts/community_governance/src/lib.rs b/apps/contracts/community_governance/src/lib.rs index 02ea4a6..368e88c 100644 --- a/apps/contracts/community_governance/src/lib.rs +++ b/apps/contracts/community_governance/src/lib.rs @@ -189,10 +189,11 @@ impl CommunityGovernance { if env.storage().instance().has(&DataKey::Admin) { panic!("already initialized"); } + assert!(quorum >= 1 && quorum <= 10_000, "quorum_bps must be 1-10000"); env.storage().instance().set(&DataKey::Admin, &admin); env.storage() .instance() - .set(&DataKey::QuorumBps, &DEFAULT_QUORUM_BPS); + .set(&DataKey::QuorumBps, &quorum); env.storage() .instance() .set(&DataKey::ThresholdBps, &DEFAULT_THRESHOLD_BPS); @@ -243,13 +244,20 @@ impl CommunityGovernance { } /// Set quorum in basis points (1–10 000). Admin-only. + /// Can also be updated via a passed governance proposal. pub fn set_quorum_bps(env: Env, admin: Address, bps: u32) { + let stored_admin: Address = env + .storage() + .instance() + .get(&DataKey::Admin) + .expect("not initialized"); + assert!(admin == stored_admin, "not admin"); admin.require_auth(); assert!(bps >= 1 && bps <= 10_000, "quorum_bps must be 1-10000"); env.storage().instance().set(&DataKey::QuorumBps, &bps); } - /// Returns the current quorum in basis points. + /// Returns the current quorum in basis points (default: `1000` = 10 %). pub fn get_quorum_bps(env: Env) -> u32 { env.storage() .instance() @@ -258,13 +266,20 @@ impl CommunityGovernance { } /// Set approval threshold in basis points (1–10 000). Admin-only. + /// Can also be updated via a passed governance proposal. pub fn set_threshold_bps(env: Env, admin: Address, bps: u32) { + let stored_admin: Address = env + .storage() + .instance() + .get(&DataKey::Admin) + .expect("not initialized"); + assert!(admin == stored_admin, "not admin"); admin.require_auth(); assert!(bps >= 1 && bps <= 10_000, "threshold_bps must be 1-10000"); env.storage().instance().set(&DataKey::ThresholdBps, &bps); } - /// Returns the current approval threshold in basis points. + /// Returns the current approval threshold in basis points (default: `5100` = 51 %). pub fn get_threshold_bps(env: Env) -> u32 { env.storage() .instance() @@ -543,6 +558,8 @@ impl CommunityGovernance { } /// Returns the pending upgrade proposal, if any. + /// + /// Returns `None` if no upgrade has been proposed or the last one was cancelled/executed. pub fn pending_upgrade(env: Env) -> Option { env.storage().instance().get(&DataKey::PendingUpgrade) } @@ -565,7 +582,7 @@ impl CommunityGovernance { .set(&DataKey::ExecuteTimelock, &ledgers); } - /// Returns the current execution timelock in ledgers. + /// Returns the current execution timelock in ledgers (default: `8640` ≈ 24 h). pub fn get_execution_timelock(env: Env) -> u32 { env.storage() .instance() @@ -615,7 +632,7 @@ impl CommunityGovernance { proposals.get(proposal_id) } - /// Returns the total number of proposals created. + /// Returns the total number of proposals created (monotonically increasing). pub fn proposal_count(env: Env) -> u32 { env.storage() .instance() @@ -649,10 +666,110 @@ mod tests { #[test] fn test_defaults() { let (_env, _admin, client) = setup(); - assert_eq!(client.get_quorum_bps(), 1_000); + // setup() passes quorum=100 → stored as-is + assert_eq!(client.get_quorum_bps(), 100); assert_eq!(client.get_threshold_bps(), 5_100); } + #[test] + fn test_initialize_configures_quorum() { + let env = Env::default(); + env.mock_all_auths(); + let id = env.register(CommunityGovernance, ()); + let client = CommunityGovernanceClient::new(&env, &id); + let admin = Address::generate(&env); + client.initialize(&admin, &2_500_u32, &100_u32); + assert_eq!(client.get_quorum_bps(), 2_500); + assert_eq!(client.get_threshold_bps(), 5_100); // default threshold + } + + #[test] + #[should_panic(expected = "quorum_bps must be 1-10000")] + fn test_initialize_rejects_zero_quorum() { + let env = Env::default(); + env.mock_all_auths(); + let id = env.register(CommunityGovernance, ()); + let client = CommunityGovernanceClient::new(&env, &id); + client.initialize(&Address::generate(&env), &0_u32, &100_u32); + } + + /// Exactly at quorum: 1 yes out of 1 total, quorum_bps=10000 (100%) → Passed + #[test] + fn test_finalize_exactly_at_quorum() { + let env = Env::default(); + env.mock_all_auths(); + let id = env.register(CommunityGovernance, ()); + let client = CommunityGovernanceClient::new(&env, &id); + let admin = Address::generate(&env); + // quorum_bps=1 (0.01%) — any single vote satisfies quorum + client.initialize(&admin, &1_u32, &100_u32); + let proposer = Address::generate(&env); + let pid = client.propose( + &proposer, + &String::from_str(&env, "T"), + &String::from_str(&env, "D"), + ); + client.vote(&Address::generate(&env), &pid, &true); + env.ledger().with_mut(|l| l.sequence_number += 101); + client.finalize(&pid); + assert_eq!(client.get_proposal(&pid).unwrap().status, ProposalStatus::Passed); + } + + /// One vote below quorum: 0 votes cast → Expired (quorum not met) + #[test] + fn test_finalize_one_below_quorum_expired() { + let env = Env::default(); + env.mock_all_auths(); + let id = env.register(CommunityGovernance, ()); + let client = CommunityGovernanceClient::new(&env, &id); + let admin = Address::generate(&env); + client.initialize(&admin, &5_000_u32, &100_u32); + let proposer = Address::generate(&env); + let pid = client.propose( + &proposer, + &String::from_str(&env, "T"), + &String::from_str(&env, "D"), + ); + // No votes cast — total=0 → Expired + env.ledger().with_mut(|l| l.sequence_number += 101); + client.finalize(&pid); + assert_eq!(client.get_proposal(&pid).unwrap().status, ProposalStatus::Expired); + } + + /// Admin updates quorum via set_quorum_bps (governance proposal path) + #[test] + fn test_admin_updates_quorum_via_set_quorum_bps() { + let (_env, admin, client) = setup(); + client.set_quorum_bps(&admin, &3_000_u32); + assert_eq!(client.get_quorum_bps(), 3_000); + } + + /// Admin updates threshold via set_threshold_bps (governance proposal path) + #[test] + fn test_admin_updates_threshold_via_set_threshold_bps() { + let (_env, admin, client) = setup(); + client.set_threshold_bps(&admin, &6_600_u32); + assert_eq!(client.get_threshold_bps(), 6_600); + } + + /// Non-admin cannot call set_quorum_bps + #[test] + #[should_panic(expected = "not admin")] + fn test_non_admin_cannot_set_quorum() { + let (env, _admin, client) = setup(); + let rogue = Address::generate(&env); + client.set_quorum_bps(&rogue, &500_u32); + } + + /// Non-admin cannot call set_threshold_bps + #[test] + #[should_panic(expected = "not admin")] + fn test_non_admin_cannot_set_threshold() { + let (env, _admin, client) = setup(); + let rogue = Address::generate(&env); + client.set_threshold_bps(&rogue, &500_u32); + } + #[test] fn test_set_quorum_bps() { let (_env, admin, client) = setup(); @@ -1074,11 +1191,105 @@ mod tests { #[test] fn test_finalize_expired_proposal() { - let (env, client) = setup(); + let (env, _admin, client) = setup(); let proposer = Address::generate(&env); let id = client.propose(&proposer, &String::from_str(&env, "Test"), &String::from_str(&env, "Desc")); env.ledger().with_mut(|l| l.sequence_number += 101); client.finalize(&id); assert_eq!(client.get_proposal(&id).unwrap().status, ProposalStatus::Expired); } + + // ── event emission tests (#330) ────────────────────────────────────────── + + #[test] + fn test_propose_emits_event() { + let (env, _admin, client) = setup(); + let proposer = Address::generate(&env); + client.propose( + &proposer, + &String::from_str(&env, "Title"), + &String::from_str(&env, "Desc"), + ); + let events = env.events().all(); + let propose_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("propose"), &env)] + }); + assert!(propose_event.is_some(), "propose event not emitted"); + let (_, _, data) = propose_event.unwrap(); + let proposal_id: u32 = soroban_sdk::FromVal::from_val(&env, &data); + assert_eq!(proposal_id, 1_u32); + } + + #[test] + fn test_vote_emits_event() { + let (env, _admin, client) = setup(); + let proposer = Address::generate(&env); + let voter = Address::generate(&env); + let id = client.propose( + &proposer, + &String::from_str(&env, "T"), + &String::from_str(&env, "D"), + ); + client.vote(&voter, &id, &true); + let events = env.events().all(); + let vote_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("vote"), &env)] + }); + assert!(vote_event.is_some(), "vote event not emitted"); + let (_, _, data) = vote_event.unwrap(); + let (pid, _voter_addr, approve): (u32, Address, bool) = + soroban_sdk::FromVal::from_val(&env, &data); + assert_eq!(pid, id); + assert!(approve); + } + + #[test] + fn test_finalize_emits_event() { + let (env, _admin, client) = setup(); + let proposer = Address::generate(&env); + let id = client.propose( + &proposer, + &String::from_str(&env, "T"), + &String::from_str(&env, "D"), + ); + client.vote(&Address::generate(&env), &id, &true); + client.vote(&Address::generate(&env), &id, &true); + env.ledger().with_mut(|l| l.sequence_number += 101); + client.finalize(&id); + let events = env.events().all(); + let final_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("final"), &env)] + }); + assert!(final_event.is_some(), "finalize event not emitted"); + let (_, _, data) = final_event.unwrap(); + let (pid, status): (u32, ProposalStatus) = soroban_sdk::FromVal::from_val(&env, &data); + assert_eq!(pid, id); + assert_eq!(status, ProposalStatus::Passed); + } + + #[test] + fn test_execute_emits_event() { + let (env, _admin, client) = setup(); + let proposer = Address::generate(&env); + let id = client.propose( + &proposer, + &String::from_str(&env, "T"), + &String::from_str(&env, "D"), + ); + client.vote(&Address::generate(&env), &id, &true); + client.vote(&Address::generate(&env), &id, &true); + env.ledger().with_mut(|l| l.sequence_number += 101); + client.finalize(&id); + env.ledger() + .with_mut(|l| l.sequence_number += EXECUTE_TIMELOCK_LEDGERS); + client.execute(&id); + let events = env.events().all(); + let exec_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("exec"), &env)] + }); + assert!(exec_event.is_some(), "execute event not emitted"); + let (_, _, data) = exec_event.unwrap(); + let pid: u32 = soroban_sdk::FromVal::from_val(&env, &data); + assert_eq!(pid, id); + } } diff --git a/apps/contracts/community_governance/tests/upgrade.rs b/apps/contracts/community_governance/tests/upgrade.rs new file mode 100644 index 0000000..49f373b --- /dev/null +++ b/apps/contracts/community_governance/tests/upgrade.rs @@ -0,0 +1,147 @@ +//! Contract upgrade mechanism tests — issue #284. +//! +//! Acceptance criteria: +//! 1. propose_upgrade() restricted to admin +//! 2. 48-hour timelock before upgrade takes effect +//! 3. Upgrade announcement event emitted +//! 4. Timelock cancellable by admin within window +//! 5. Tests for upgrade flow and cancellation + +use community_governance::{CommunityGovernance, CommunityGovernanceClient}; +use soroban_sdk::{ + testutils::{Address as _, Events, Ledger}, + BytesN, Env, +}; + +/// 48 hours in ledgers (10-second ledger time). +const UPGRADE_TIMELOCK_LEDGERS: u32 = 17_280; + +fn setup() -> (Env, soroban_sdk::Address, CommunityGovernanceClient<'static>) { + let env = Env::default(); + env.mock_all_auths(); + let id = env.register(CommunityGovernance, ()); + let client = CommunityGovernanceClient::new(&env, &id); + let admin = soroban_sdk::Address::generate(&env); + client.initialize(&admin, &100_u32, &100_u32); + (env, admin, client) +} + +fn wasm_hash(env: &Env, val: u8) -> BytesN<32> { + BytesN::from_array(env, &[val; 32]) +} + +/// AC1 + AC3: propose_upgrade emits an announcement event. +#[test] +fn propose_upgrade_emits_event() { + let (env, admin, client) = setup(); + let hash = wasm_hash(&env, 0xAB); + + client.propose_upgrade(&admin, &hash); + + let events = env.events().all(); + assert!(!events.is_empty(), "expected at least one event"); +} + +/// AC1: propose_upgrade is restricted to admin — non-admin panics. +#[test] +#[should_panic] +fn propose_upgrade_non_admin_rejected() { + let (env, _admin, client) = setup(); + let attacker = soroban_sdk::Address::generate(&env); + client.propose_upgrade(&attacker, &wasm_hash(&env, 1)); +} + +/// AC2: execute_upgrade before timelock elapses panics with "timelock not elapsed". +#[test] +#[should_panic(expected = "timelock not elapsed")] +fn execute_upgrade_before_timelock_panics() { + let (env, admin, client) = setup(); + client.propose_upgrade(&admin, &wasm_hash(&env, 2)); + + // Advance only half the timelock + env.ledger() + .with_mut(|l| l.sequence_number += UPGRADE_TIMELOCK_LEDGERS / 2); + + client.execute_upgrade(&admin); +} + +/// AC4: cancel_upgrade removes the pending proposal. +#[test] +fn cancel_upgrade_clears_pending() { + let (env, admin, client) = setup(); + client.propose_upgrade(&admin, &wasm_hash(&env, 3)); + + assert!(client.pending_upgrade().is_some()); + + client.cancel_upgrade(&admin); + + assert!(client.pending_upgrade().is_none()); +} + +/// AC4: cancel_upgrade is restricted to admin. +#[test] +#[should_panic] +fn cancel_upgrade_non_admin_rejected() { + let (env, admin, client) = setup(); + client.propose_upgrade(&admin, &wasm_hash(&env, 4)); + + let attacker = soroban_sdk::Address::generate(&env); + client.cancel_upgrade(&attacker); +} + +/// Cancelling when no upgrade is pending panics. +#[test] +#[should_panic(expected = "no pending upgrade")] +fn cancel_upgrade_no_pending_panics() { + let (env, admin, client) = setup(); + client.cancel_upgrade(&admin); +} + +/// Proposing a second upgrade while one is pending panics. +#[test] +#[should_panic(expected = "upgrade already pending")] +fn propose_upgrade_while_pending_panics() { + let (env, admin, client) = setup(); + client.propose_upgrade(&admin, &wasm_hash(&env, 5)); + client.propose_upgrade(&admin, &wasm_hash(&env, 6)); +} + +/// After cancellation a new upgrade can be proposed. +#[test] +fn propose_upgrade_after_cancel_succeeds() { + let (env, admin, client) = setup(); + client.propose_upgrade(&admin, &wasm_hash(&env, 7)); + client.cancel_upgrade(&admin); + // Should not panic + client.propose_upgrade(&admin, &wasm_hash(&env, 8)); + assert!(client.pending_upgrade().is_some()); +} + +/// pending_upgrade returns None when no upgrade is queued. +#[test] +fn pending_upgrade_none_when_empty() { + let (_env, _admin, client) = setup(); + assert!(client.pending_upgrade().is_none()); +} + +/// pending_upgrade returns the correct wasm hash after proposal. +#[test] +fn pending_upgrade_returns_correct_hash() { + let (env, admin, client) = setup(); + let hash = wasm_hash(&env, 0xCC); + client.propose_upgrade(&admin, &hash); + + let pending = client.pending_upgrade().expect("should have pending upgrade"); + assert_eq!(pending.new_wasm_hash, hash); +} + +/// The unlock_ledger is set to current_ledger + UPGRADE_TIMELOCK_LEDGERS. +#[test] +fn pending_upgrade_unlock_ledger_is_correct() { + let (env, admin, client) = setup(); + let current = env.ledger().sequence(); + client.propose_upgrade(&admin, &wasm_hash(&env, 0xDD)); + + let pending = client.pending_upgrade().unwrap(); + assert_eq!(pending.unlock_ledger, current + UPGRADE_TIMELOCK_LEDGERS); +} diff --git a/apps/contracts/energy_token/src/lib.rs b/apps/contracts/energy_token/src/lib.rs index acf029f..3a5f2ec 100644 --- a/apps/contracts/energy_token/src/lib.rs +++ b/apps/contracts/energy_token/src/lib.rs @@ -1,8 +1,8 @@ //! # Energy Token (`energy-token`) //! //! SEP-41 fungible certificate token representing verified renewable energy. -//! **1 token = 1 kWh** of generation that has been cryptographically anchored -//! on-chain via the `audit_registry` contract. +//! **1000 token units = 1 kWh** (decimals = 3; 1 unit = 0.001 kWh). +//! Generation is cryptographically anchored on-chain via the `audit_registry` contract. //! //! ## Roles //! | Role | Description | @@ -73,14 +73,20 @@ impl EnergyToken { String::from_str(&env, "SKWH") } - /// Returns the number of decimal places: `7` (matching Stellar's stroop precision). + /// Returns the number of decimal places: `3` (milli-kWh precision). + /// 1 token unit = 0.001 kWh; 1000 units = 1 kWh. pub fn decimals(_env: Env) -> u32 { - 7 + 3 } // ── SEP-41 balance / transfer ──────────────────────────────────────────── /// Returns the token balance of `account`. Returns `0` for unknown accounts. + /// + /// # Example + /// ```ignore + /// let bal = client.balance(&holder_address); // e.g. 125_000_000 (12.5 kWh in stroops) + /// ``` pub fn balance(env: Env, account: Address) -> i128 { env.storage() .persistent() @@ -292,6 +298,11 @@ impl EnergyToken { } /// Returns the current circulating supply: `total_minted - total_burned`. + /// + /// # Example + /// ```ignore + /// let supply = client.total_supply(); // tokens currently in circulation + /// ``` pub fn total_supply(env: Env) -> i128 { let minted: i128 = env .storage() @@ -503,7 +514,7 @@ mod tests { let (env, client) = setup(); assert_eq!(client.name(), String::from_str(&env, "SolarProof kWh")); assert_eq!(client.symbol(), String::from_str(&env, "SKWH")); - assert_eq!(client.decimals(), 7); + assert_eq!(client.decimals(), 3); } #[test] @@ -968,7 +979,7 @@ mod tests { let (env, client) = setup(); assert_eq!(client.name(), String::from_str(&env, "SolarProof Energy Certificate")); assert_eq!(client.symbol(), String::from_str(&env, "SPEC")); - assert_eq!(client.decimals(), 7_u32); + assert_eq!(client.decimals(), 3_u32); } #[test] @@ -1013,4 +1024,73 @@ mod tests { client.mint(&user, &1_i128); assert_eq!(client.balance(&user), 1_i128); } + + // ── event emission tests (#330) ────────────────────────────────────────── + + #[test] + fn test_mint_emits_event() { + let (env, client) = setup(); + let user = Address::generate(&env); + client.mint(&user, &500_i128); + let events = env.events().all(); + // Find the mint event: topic = ("mint",), data = (to, amount) + let mint_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("mint"), &env)] + }); + assert!(mint_event.is_some(), "mint event not emitted"); + let (_, _, data) = mint_event.unwrap(); + let (to, amount): (Address, i128) = soroban_sdk::FromVal::from_val(&env, &data); + assert_eq!(to, user); + assert_eq!(amount, 500_i128); + } + + #[test] + fn test_transfer_emits_event() { + let (env, client) = setup(); + let a = Address::generate(&env); + let b = Address::generate(&env); + client.mint(&a, &1000_i128); + env.events().all(); // clear + client.transfer(&a, &b, &300_i128); + let events = env.events().all(); + let transfer_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("transfer"), &env)] + }); + assert!(transfer_event.is_some(), "transfer event not emitted"); + let (_, _, data) = transfer_event.unwrap(); + let (from, to, amount): (Address, Address, i128) = soroban_sdk::FromVal::from_val(&env, &data); + assert_eq!(from, a); + assert_eq!(to, b); + assert_eq!(amount, 300_i128); + } + + #[test] + fn test_retire_emits_event() { + let (env, client) = setup(); + let user = Address::generate(&env); + client.mint(&user, &1000_i128); + client.retire(&user, &String::from_str(&env, "REC compliance")); + let events = env.events().all(); + let retire_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("retire"), &env)] + }); + assert!(retire_event.is_some(), "retire event not emitted"); + } + + #[test] + fn test_burn_emits_event() { + let (env, client) = setup(); + let user = Address::generate(&env); + client.mint(&user, &1000_i128); + client.burn(&user, &200_i128); + let events = env.events().all(); + let burn_event = events.iter().find(|(_, topics, _)| { + topics == &soroban_sdk::vec![&env, soroban_sdk::IntoVal::::into_val(&symbol_short!("burn"), &env)] + }); + assert!(burn_event.is_some(), "burn event not emitted"); + let (_, _, data) = burn_event.unwrap(); + let (from, amount): (Address, i128) = soroban_sdk::FromVal::from_val(&env, &data); + assert_eq!(from, user); + assert_eq!(amount, 200_i128); + } } diff --git a/apps/web/.env.example b/apps/web/.env.example index 4bbce95..6d5668a 100644 --- a/apps/web/.env.example +++ b/apps/web/.env.example @@ -1,7 +1,14 @@ # ───────────────────────────────────────────────────────────────────────────── # SolarProof — environment variables -# Copy this file to .env.local and fill in your values. +# Copy this file to apps/web/.env.local and fill in your values for local development. +# Do not commit `.env.local` or any `.env.*.local` file. +# CI should read secrets from GitHub Actions secrets. +# Production should use Vercel environment variables. # See docs/ONBOARDING.md for a step-by-step setup guide. +# +# Legend: +# [REQUIRED] — the app will not start or will error without this value. +# [OPTIONAL] — the feature degrades gracefully if this is not set. # ───────────────────────────────────────────────────────────────────────────── # ── Supabase ────────────────────────────────────────────────────────────────── @@ -12,6 +19,7 @@ NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co # [REQUIRED] Public anon key — safe to expose in the browser. +# Used by the client-side Supabase SDK for unauthenticated reads. # Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key-here @@ -26,40 +34,75 @@ SUPABASE_SERVICE_ROLE_KEY=your-service-role-key-here # Use "testnet" for development and staging; "mainnet" for production. NEXT_PUBLIC_STELLAR_NETWORK=testnet +# [OPTIONAL] Override the default Soroban RPC endpoint. +# Example: https://soroban-testnet.stellar.org +NEXT_PUBLIC_STELLAR_RPC_URL=https://soroban-testnet.stellar.org + # [REQUIRED] Contract IDs — set these after running the deploy-contracts workflow # or following the manual steps in docs/DEPLOYMENT.md. # Each value is a 56-character Stellar contract address (C...). # Example: CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM NEXT_PUBLIC_ENERGY_TOKEN_ID= + +# [REQUIRED] Contract ID for the audit_registry Soroban contract. +# Stores immutable on-chain anchors of Ed25519-signed meter reading hashes. +# Example: CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM NEXT_PUBLIC_AUDIT_REGISTRY_ID= + +# [REQUIRED] Contract ID for the community_governance Soroban contract. +# Manages cooperative proposals and voting. +# Example: CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM NEXT_PUBLIC_COMMUNITY_GOVERNANCE_ID= # [REQUIRED] Stellar secret key for the minter account (server-side only). -# This account mints energy_token certificates after a valid meter reading. +# This account calls energy_token.mint() after a valid meter reading is verified. # Generate with: stellar keys generate minter --network testnet +# Local dev uses MINTER_SECRET_KEY in `.env.local`. +# Production should use MINTER_SECRET_ARN / MINTER_PREVIOUS_SECRET_ARN in Vercel. # Never commit a real secret key. Use GitHub Actions secrets in CI/CD. # Example: SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA MINTER_SECRET_KEY= +# [PRODUCTION] AWS Secrets Manager ARN for the active minter key. +MINTER_SECRET_ARN= + +# [PRODUCTION] AWS Secrets Manager ARN for the previous minter key during rotation. +MINTER_PREVIOUS_SECRET_ARN= + +# [OPTIONAL] AWS region for Secrets Manager. +AWS_REGION=us-east-1 + # ── Redis (optional) ────────────────────────────────────────────────────────── # Upstash Redis is used as a caching layer for certificate verification queries. -# If these are not set, caching is disabled and every /api/verify call hits Supabase. +# If these are not set, caching is disabled and every /api/verify call hits Supabase directly. # [OPTIONAL] REST URL for your Upstash Redis database. +# Create a database at https://console.upstash.com and copy the REST URL. # Example: https://us1-example-12345.upstash.io UPSTASH_REDIS_REST_URL=https://your-redis.upstash.io # [OPTIONAL] REST token for your Upstash Redis database. +# Found in the Upstash console under your database → REST API → Token. # Example: AXxxASQgODk... UPSTASH_REDIS_REST_TOKEN=your-token -# Logtail / Better Stack — structured log aggregation (production) -# Create a source at https://logs.betterstack.com and paste the token here. +# ── Logging ─────────────────────────────────────────────────────────────────── + +# [OPTIONAL] Logtail / Better Stack source token for structured log aggregation. +# Create a source at https://logs.betterstack.com and paste the ingest token here. +# If not set, logs are written to stdout only (suitable for local development). # Retention: 30 days. Alerts configured in the Better Stack dashboard. LOGTAIL_SOURCE_TOKEN= # ── CORS ────────────────────────────────────────────────────────────────────── -# Comma-separated list of origins allowed to call the API from a browser. -# In development, http://localhost:3000 is always permitted. + +# [OPTIONAL] Comma-separated list of origins allowed to call the API from a browser. +# In development, http://localhost:3000 is always permitted regardless of this value. +# If not set, only same-origin requests are allowed in production. # Example: https://solarproof.vercel.app,https://staging.solarproof.vercel.app CORS_ALLOWED_ORIGINS=https://solarproof.vercel.app + +# ── Optional runtime configuration ─────────────────────────────────────────── +# Rate limiting for reading submissions. +READINGS_RATE_LIMIT_PER_MINUTE= +READINGS_RATE_LIMIT_WINDOW_SECONDS= diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile index 36dd369..55bee40 100644 --- a/apps/web/Dockerfile +++ b/apps/web/Dockerfile @@ -1,3 +1,5 @@ +# Pin to a specific digest so Trivy scans a reproducible image. +# To update: docker pull node:22-alpine && docker inspect node:22-alpine --format '{{index .RepoDigests 0}}' FROM node:22-alpine AS base RUN corepack enable && corepack prepare pnpm@10 --activate diff --git a/apps/web/e2e/certificate.spec.ts b/apps/web/e2e/certificate.spec.ts new file mode 100644 index 0000000..c71e105 --- /dev/null +++ b/apps/web/e2e/certificate.spec.ts @@ -0,0 +1,70 @@ +import { test, expect } from '@playwright/test' + +const CERT_ID = 'test-certificate-id-001' + +const mockCertificate = { + id: CERT_ID, + kwh: 25, + issued_at: '2025-06-01T00:00:00.000Z', + retired: false, + retired_at: null, + retired_by: null, + reading_id: 'reading-001', + stellar_tx: 'mint_tx_abc123', +} + +const mockReading = { + id: 'reading-001', + meter_id: 'meter-001', + kwh: 25, + timestamp: '2025-06-01T00:00:00.000Z', + signature_hex: 'deadbeefdeadbeef', + reading_hash: 'abcdef1234567890', + verified: true, + anchor_tx: 'anchor_tx_xyz789', +} + +/** + * E2E: view certificate detail page + * + * The certificate detail page is a server component that fetches from Supabase. + * We intercept the Supabase REST calls and return mock data so the test is + * hermetic and does not require a live database. + */ +test.describe('Certificate detail page', () => { + test.beforeEach(async ({ page }) => { + // Intercept Supabase REST queries for certificates and readings + await page.route('**/rest/v1/certificates*', async (route) => { + await route.fulfill({ + status: 200, + contentType: 'application/json', + body: JSON.stringify([mockCertificate]), + }) + }) + + await page.route('**/rest/v1/readings*', async (route) => { + await route.fulfill({ + status: 200, + contentType: 'application/json', + body: JSON.stringify([mockReading]), + }) + }) + }) + + test('renders certificate detail with chain-of-custody steps', async ({ page }) => { + await page.goto(`/certificate/${CERT_ID}`) + + // Certificate ID or kWh value should appear on the page + await expect(page.locator(`text=${CERT_ID}`).first()).toBeVisible({ timeout: 15000 }) + }) + + test('shows not-found for unknown certificate ID', async ({ page }) => { + await page.route('**/rest/v1/certificates*', async (route) => { + await route.fulfill({ status: 200, contentType: 'application/json', body: '[]' }) + }) + + await page.goto('/certificate/nonexistent-id-000') + // Next.js notFound() renders a 404 page + await expect(page.locator('text=/not found/i').first()).toBeVisible({ timeout: 10000 }) + }) +}) diff --git a/apps/web/e2e/dashboard.spec.ts b/apps/web/e2e/dashboard.spec.ts new file mode 100644 index 0000000..9910936 --- /dev/null +++ b/apps/web/e2e/dashboard.spec.ts @@ -0,0 +1,39 @@ +import { test, expect } from '@playwright/test' + +/** + * E2E: connect wallet → view dashboard + * + * The dashboard is gated by WalletGate — it renders a "Connect Wallet" prompt + * until a Freighter wallet is connected. In CI there is no real wallet extension, + * so we mock the Freighter API on the window object before the page loads. + */ +test.describe('Dashboard — wallet gate', () => { + test.beforeEach(async ({ page }) => { + // Inject a minimal Freighter mock so WalletGate considers the wallet connected + await page.addInitScript(() => { + const mockPublicKey = 'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN' + ;(window as unknown as Record).freighter = { + isConnected: () => Promise.resolve(true), + getPublicKey: () => Promise.resolve(mockPublicKey), + getNetwork: () => Promise.resolve('TESTNET'), + signTransaction: () => Promise.reject(new Error('not needed')), + } + }) + }) + + test('shows dashboard content after wallet is connected', async ({ page }) => { + await page.goto('/dashboard') + // WalletGate should pass through — dashboard heading must be visible + await expect(page.locator('h1, h2').filter({ hasText: /dashboard/i }).first()).toBeVisible({ + timeout: 15000, + }) + }) + + test('shows connect-wallet prompt when wallet is not connected', async ({ page }) => { + // No mock injected — WalletGate should render the connect prompt + await page.goto('/dashboard') + await expect( + page.locator('button, [role="button"]').filter({ hasText: /connect/i }).first() + ).toBeVisible({ timeout: 10000 }) + }) +}) diff --git a/apps/web/instrumentation.ts b/apps/web/instrumentation.ts new file mode 100644 index 0000000..d9e6af3 --- /dev/null +++ b/apps/web/instrumentation.ts @@ -0,0 +1,5 @@ +import { log } from "@logtail/next"; + +export async function register() { + log.info("SolarProof API initializing", { env: process.env.NODE_ENV }); +} diff --git a/apps/web/messages/de.json b/apps/web/messages/de.json index 856982a..6b56a3e 100644 --- a/apps/web/messages/de.json +++ b/apps/web/messages/de.json @@ -5,6 +5,7 @@ "certificates": "Zertifikate", "governance": "Governance", "verify": "Verifizieren", + "admin": "Admin", "connectWallet": "Wallet verbinden", "disconnectWallet": "Wallet trennen", "openMenu": "Navigationsmenü öffnen", diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index e957ca8..da898de 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -5,6 +5,7 @@ "certificates": "Certificates", "governance": "Governance", "verify": "Verify", + "admin": "Admin", "connectWallet": "Connect wallet", "disconnectWallet": "Disconnect wallet", "openMenu": "Open navigation menu", diff --git a/apps/web/messages/es.json b/apps/web/messages/es.json index 6e256d0..c3fb685 100644 --- a/apps/web/messages/es.json +++ b/apps/web/messages/es.json @@ -5,6 +5,7 @@ "certificates": "Certificados", "governance": "Gobernanza", "verify": "Verificar", + "admin": "Admin", "connectWallet": "Conectar billetera", "disconnectWallet": "Desconectar billetera", "openMenu": "Abrir menú de navegación", diff --git a/apps/web/messages/fr.json b/apps/web/messages/fr.json index c8c87b4..0b117f5 100644 --- a/apps/web/messages/fr.json +++ b/apps/web/messages/fr.json @@ -5,6 +5,7 @@ "certificates": "Certificats", "governance": "Gouvernance", "verify": "Vérifier", + "admin": "Admin", "connectWallet": "Connecter le portefeuille", "disconnectWallet": "Déconnecter le portefeuille", "openMenu": "Ouvrir le menu de navigation", diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts index eeac442..1c4b3db 100644 --- a/apps/web/next.config.ts +++ b/apps/web/next.config.ts @@ -4,12 +4,45 @@ import createNextIntlPlugin from 'next-intl/plugin' const withNextIntl = createNextIntlPlugin('./src/i18n.ts') +const securityHeaders = [ + { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' }, + { key: 'X-Frame-Options', value: 'DENY' }, + { key: 'X-Content-Type-Options', value: 'nosniff' }, + { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' }, + { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' }, + { + key: 'Content-Security-Policy', + value: [ + "default-src 'self'", + "script-src 'self' 'unsafe-inline' 'unsafe-eval'", + "style-src 'self' 'unsafe-inline'", + "img-src 'self' data: blob:", + "font-src 'self'", + "connect-src 'self' https://*.supabase.co https://soroban-testnet.stellar.org https://soroban.stellar.org wss://*.supabase.co", + "frame-ancestors 'none'", + ].join('; '), + }, +] + +const securityHeaders = [ + { key: 'X-Frame-Options', value: 'DENY' }, + { key: 'X-Content-Type-Options', value: 'nosniff' }, + { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' }, + { + key: 'Permissions-Policy', + value: 'camera=(), microphone=(), geolocation=(), payment=(), usb=()', + }, +] + const nextConfig: NextConfig = { transpilePackages: ['@solarproof/stellar'], serverExternalPackages: ['@stellar/stellar-sdk'], experimental: { instrumentationHook: true, }, + async headers() { + return [{ source: '/(.*)', headers: securityHeaders }] + }, } export default withSentryConfig(withNextIntl(nextConfig), { diff --git a/apps/web/package.json b/apps/web/package.json index 68af2c9..ae02271 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -17,17 +17,18 @@ "@sentry/nextjs": "^9.0.0", "@solarproof/stellar": "workspace:*", "@stellar/stellar-sdk": "^13.1.0", - "@supabase/supabase-js": "^2.106.2", + "@supabase/supabase-js": "^2.107.0", "@t3-oss/env-nextjs": "0.13.11", - "@tanstack/react-query": "^5.100.14", + "@tanstack/react-query": "^5.101.0", "@vercel/analytics": "^1.4.0", "@vercel/speed-insights": "^1.1.0", "clsx": "^2.1.1", "lucide-react": "^0.577.0", - "next": "15.5.18", + "next": "15.5.19", + "next-intl": "^4.13.0", "next-themes": "^0.4.4", - "react": "^19.2.6", - "react-dom": "^19.2.6", + "react": "^19.2.7", + "react-dom": "^19.2.7", "recharts": "^2.14.1", "tailwind-merge": "^2.5.5", "zod": "^3.24.1" @@ -38,12 +39,12 @@ "@playwright/test": "^1.59.1", "@testing-library/react": "^16.1.0", "@types/node": "^22.19.19", - "@types/react": "^19.2.15", + "@types/react": "^19.2.16", "@types/react-dom": "^19.0.2", "@vitejs/plugin-react": "^4.3.4", "@vitest/coverage-v8": "^2.0.0", "eslint": "^9.17.0", - "eslint-config-next": "15.5.18", + "eslint-config-next": "15.5.19", "jsdom": "^25.0.1", "prettier-plugin-tailwindcss": "^0.8.0", "tailwindcss": "^4.0.0", diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts index f8a7825..c469f79 100644 --- a/apps/web/playwright.config.ts +++ b/apps/web/playwright.config.ts @@ -11,7 +11,7 @@ export default defineConfig({ retries: process.env.CI ? 1 : 0, reporter: [['list'], ['html', { open: 'never' }]], use: { - baseURL: 'http://127.0.0.1:3000', + baseURL: process.env.BASE_URL ?? 'http://127.0.0.1:3000', trace: 'retain-on-failure', screenshot: 'only-on-failure', video: 'retain-on-failure', @@ -23,10 +23,15 @@ export default defineConfig({ use: { ...devices['Desktop Chrome'] }, }, ], - webServer: { - command: 'pnpm exec next dev --hostname 127.0.0.1 --port 3000', - port: 3000, - reuseExistingServer: !process.env.CI, - timeout: 120000, - }, + // Skip starting a local server when BASE_URL points to a remote staging env + ...(process.env.BASE_URL && !process.env.BASE_URL.includes('127.0.0.1') + ? {} + : { + webServer: { + command: 'pnpm exec next dev --hostname 127.0.0.1 --port 3000', + port: 3000, + reuseExistingServer: !process.env.CI, + timeout: 120000, + }, + }), }) diff --git a/apps/web/src/__tests__/components/__snapshots__/snapshot.test.tsx.snap b/apps/web/src/__tests__/components/__snapshots__/snapshot.test.tsx.snap index 43730e9..a21eb9a 100644 --- a/apps/web/src/__tests__/components/__snapshots__/snapshot.test.tsx.snap +++ b/apps/web/src/__tests__/components/__snapshots__/snapshot.test.tsx.snap @@ -1,5 +1,111 @@ // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html +exports[`Copy components snapshots > CopyButton renders correctly 1`] = ` + +`; + +exports[`Copy components snapshots > CopyableText renders correctly (mono) 1`] = ` + + + 0x1234567890 + + + +`; + +exports[`Copy components snapshots > CopyableText renders correctly (non-mono) 1`] = ` + + + test + + + +`; + +exports[`LanguageSwitcher snapshots > LanguageSwitcher renders correctly 1`] = ` +
+ +
+`; + exports[`MeterReadingRow snapshots > pending (unverified) reading row renders correctly 1`] = ` @@ -14,7 +120,7 @@ exports[`MeterReadingRow snapshots > pending (unverified) reading row renders co
- 12.5 + 12.500 verified reading row renders correctly 1`] - 12.5 + 12.500 verified reading row renders correctly 1`]
`; +exports[`Navbar snapshots > Navbar renders correctly 1`] = ` + +`; + exports[`Skeleton components snapshots > ChartSkeleton renders correctly (no title) 1`] = `
({ + usePathname: () => '/', + useRouter: () => ({ + refresh: vi.fn(), + push: vi.fn(), + replace: vi.fn(), + }), + useTransition: () => [false, vi.fn()], +})) + +vi.mock('next-themes', () => ({ + useTheme: () => ({ + resolvedTheme: 'light', + setTheme: vi.fn(), + }), +})) + +vi.mock('@/hooks/useWallet', () => ({ + useWallet: () => ({ + address: 'GABC...XYZ', + connected: true, + loading: false, + connect: vi.fn(), + disconnect: vi.fn(), + }), +})) + +vi.mock('@/env', () => ({ + env: { + NEXT_PUBLIC_STELLAR_NETWORK: 'testnet', + }, +})) + +vi.mock('next-intl', () => ({ + useTranslations: (namespace: string) => (key: string) => `${namespace}.${key}`, +})) + +// Mock lucide-react to avoid random IDs in snapshots +vi.mock('lucide-react', async () => { + const actual = await vi.importActual('lucide-react') + return { + ...actual, + Sun: () =>
, + Moon: () =>
, + Menu: () =>
, + X: () =>
, + Wallet: () =>
, + LogOut: () =>
, + Copy: () =>
, + Check: () =>
, + CheckCircle: () =>
, + XCircle: () =>
, + Loader2: () =>
, + } +}) describe('Skeleton components snapshots', () => { it('Skeleton renders correctly', () => { @@ -110,3 +165,45 @@ describe('MeterReadingRow snapshots', () => { expect(container.firstChild).toMatchSnapshot() }) }) + +describe('Copy components snapshots', () => { + it('CopyButton renders correctly', () => { + const { container } = render() + expect(container.firstChild).toMatchSnapshot() + }) + + it('CopyableText renders correctly (mono)', () => { + const { container } = render() + expect(container.firstChild).toMatchSnapshot() + }) + + it('CopyableText renders correctly (non-mono)', () => { + const { container } = render() + expect(container.firstChild).toMatchSnapshot() + }) +}) + +describe('LanguageSwitcher snapshots', () => { + it('LanguageSwitcher renders correctly', () => { + const { container } = render() + expect(container.firstChild).toMatchSnapshot() + }) +}) + +describe('Toast components snapshots', () => { + it('Empty ToastContainer renders nothing', () => { + const { container } = render( + + + + ) + expect(container.firstChild).toBeNull() + }) +}) + +describe('Navbar snapshots', () => { + it('Navbar renders correctly', () => { + const { container } = render() + expect(container.firstChild).toMatchSnapshot() + }) +}) diff --git a/apps/web/src/__tests__/crypto.test.ts b/apps/web/src/__tests__/crypto.test.ts index c036169..e18953a 100644 --- a/apps/web/src/__tests__/crypto.test.ts +++ b/apps/web/src/__tests__/crypto.test.ts @@ -1,21 +1,13 @@ /** - * Unit tests for Ed25519 signature verification utility - * Issue #112 — security-critical path - * - * Uses @noble/ed25519 to generate real keypairs and signatures so every - * acceptance criterion is exercised against the actual verify() call used - * in POST /api/readings. + * Unit tests for Ed25519 signature verification utility (crypto.ts) + * Issue #112 — 100% coverage of the verification module */ import { describe, it, expect } from 'vitest' import * as ed from '@noble/ed25519' -import { computeReadingHash } from '@/lib/crypto' +import { computeReadingHash, verifyReadingSignature } from '@/lib/crypto' import { kwhToStroops } from '@solarproof/stellar' -// --------------------------------------------------------------------------- -// Helpers -// --------------------------------------------------------------------------- - async function makeKeypair() { const privKey = ed.utils.randomPrivateKey() const pubKey = await ed.getPublicKeyAsync(privKey) @@ -27,16 +19,12 @@ async function signReading( meterId: string, kwh: number, timestamp: number -): Promise<{ sig: Uint8Array; hash: Buffer }> { +): Promise<{ sigHex: string; hash: Buffer }> { const hash = computeReadingHash(meterId, kwhToStroops(kwh), BigInt(timestamp)) const sig = await ed.signAsync(hash, privKey) - return { sig, hash } + return { sigHex: Buffer.from(sig).toString('hex'), hash } } -// --------------------------------------------------------------------------- -// Tests -// --------------------------------------------------------------------------- - describe('Ed25519 signature verification', () => { const METER_ID = 'meter-abc-123' const KWH = 12.5 @@ -44,48 +32,50 @@ describe('Ed25519 signature verification', () => { it('valid signature returns true', async () => { const { privKey, pubKey } = await makeKeypair() - const { sig, hash } = await signReading(privKey, METER_ID, KWH, TIMESTAMP) - const result = await ed.verifyAsync(sig, hash, pubKey) + const { sigHex, hash } = await signReading(privKey, METER_ID, KWH, TIMESTAMP) + const result = await verifyReadingSignature(sigHex, hash, Buffer.from(pubKey).toString('hex')) expect(result).toBe(true) }) it('invalid signature (random bytes) returns false', async () => { const { pubKey } = await makeKeypair() const hash = computeReadingHash(METER_ID, kwhToStroops(KWH), BigInt(TIMESTAMP)) - const badSig = new Uint8Array(64).fill(0xab) - const result = await ed.verifyAsync(badSig, hash, pubKey) + const badSigHex = Buffer.alloc(64, 0xab).toString('hex') + const result = await verifyReadingSignature(badSigHex, hash, Buffer.from(pubKey).toString('hex')) expect(result).toBe(false) }) it('tampered payload returns false', async () => { const { privKey, pubKey } = await makeKeypair() - const { sig } = await signReading(privKey, METER_ID, KWH, TIMESTAMP) - // Sign over original hash but verify against a different payload + const { sigHex } = await signReading(privKey, METER_ID, KWH, TIMESTAMP) const tamperedHash = computeReadingHash(METER_ID, kwhToStroops(KWH + 1), BigInt(TIMESTAMP)) - const result = await ed.verifyAsync(sig, tamperedHash, pubKey) + const result = await verifyReadingSignature(sigHex, tamperedHash, Buffer.from(pubKey).toString('hex')) expect(result).toBe(false) }) it('wrong public key returns false', async () => { const signer = await makeKeypair() const other = await makeKeypair() - const { sig, hash } = await signReading(signer.privKey, METER_ID, KWH, TIMESTAMP) - const result = await ed.verifyAsync(sig, hash, other.pubKey) + const { sigHex, hash } = await signReading(signer.privKey, METER_ID, KWH, TIMESTAMP) + const result = await verifyReadingSignature(sigHex, hash, Buffer.from(other.pubKey).toString('hex')) expect(result).toBe(false) }) - it('malformed signature (wrong length) throws or returns false', async () => { + it('malformed signature (wrong length) returns false gracefully', async () => { const { pubKey } = await makeKeypair() const hash = computeReadingHash(METER_ID, kwhToStroops(KWH), BigInt(TIMESTAMP)) - const shortSig = new Uint8Array(32) // too short - await expect(ed.verifyAsync(shortSig, hash, pubKey)).rejects.toThrow() + // 32 bytes (too short) — verifyReadingSignature catches and returns false + const shortSigHex = Buffer.alloc(32).toString('hex') + const result = await verifyReadingSignature(shortSigHex, hash, Buffer.from(pubKey).toString('hex')) + expect(result).toBe(false) }) - it('malformed public key (wrong length) returns false', async () => { + it('malformed public key (wrong length) returns false gracefully', async () => { const { privKey } = await makeKeypair() - const { sig, hash } = await signReading(privKey, METER_ID, KWH, TIMESTAMP) - const badPubKey = new Uint8Array(16) // too short - await expect(ed.verifyAsync(sig, hash, badPubKey)).rejects.toThrow() + const { sigHex, hash } = await signReading(privKey, METER_ID, KWH, TIMESTAMP) + const badPubKeyHex = Buffer.alloc(16).toString('hex') + const result = await verifyReadingSignature(sigHex, hash, badPubKeyHex) + expect(result).toBe(false) }) it('computeReadingHash is deterministic', () => { diff --git a/apps/web/src/__tests__/tracer-sim.test.ts b/apps/web/src/__tests__/tracer-sim.test.ts new file mode 100644 index 0000000..591748b --- /dev/null +++ b/apps/web/src/__tests__/tracer-sim.test.ts @@ -0,0 +1,175 @@ +/** + * tracer-sim integration tests. + * + * Covers: + * - Failed mint triggers tracer-sim diagnosis + * - Diagnosis result stored and retrievable + * - tracer-sim unavailable handled gracefully + * - Mock tracer-sim used in unit tests + */ +import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest' +import { diagnoseMintFailure, type TracerDiagnosis } from '@/lib/tracer-sim' + +// --------------------------------------------------------------------------- +// Mock Supabase service client +// --------------------------------------------------------------------------- +const mockUpdate = vi.fn().mockReturnValue({ eq: vi.fn().mockResolvedValue({ error: null }) }) +const mockFrom = vi.fn().mockReturnValue({ update: mockUpdate }) + +vi.mock('@/lib/supabase', () => ({ + createServiceClient: () => ({ from: mockFrom }), +})) + +// --------------------------------------------------------------------------- +// Mock webhooks — fire-and-forget, not under test here +// --------------------------------------------------------------------------- +vi.mock('@/lib/webhooks', () => ({ + fireWebhook: vi.fn().mockResolvedValue(undefined), +})) + +// --------------------------------------------------------------------------- +// Mock logger +// --------------------------------------------------------------------------- +vi.mock('@/lib/logger', () => ({ + logger: { + warn: vi.fn(), + info: vi.fn(), + error: vi.fn(), + withCorrelationId: vi.fn().mockReturnThis(), + }, +})) + +// --------------------------------------------------------------------------- +// Helpers +// --------------------------------------------------------------------------- +function mockTracerSim(response: Partial | null, status = 200) { + global.fetch = vi.fn().mockResolvedValue({ + ok: status >= 200 && status < 300, + status, + json: async () => response ?? {}, + }) +} + +function clearTracerSim() { + vi.restoreAllMocks() + delete process.env.TRACER_SIM_URL +} + +// --------------------------------------------------------------------------- +// Tests +// --------------------------------------------------------------------------- +describe('diagnoseMintFailure', () => { + const READING_ID = 'reading-abc-123' + const COOP_ID = 'coop-xyz-456' + const MINT_ERROR = 'Transaction simulation failed: insufficient balance' + + beforeEach(() => { + mockFrom.mockClear() + mockUpdate.mockClear() + }) + + afterEach(() => { + clearTracerSim() + }) + + it('returns stub diagnosis when TRACER_SIM_URL is not set', async () => { + delete process.env.TRACER_SIM_URL + + const diagnosis = await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + expect(diagnosis.error_code).toBe('TRACER_SIM_UNAVAILABLE') + expect(diagnosis.message).toBe(MINT_ERROR) + expect(diagnosis.suggestion).toContain('TRACER_SIM_URL') + expect(diagnosis.replayed_at).toBeTruthy() + }) + + it('stores diagnosis on the reading record', async () => { + delete process.env.TRACER_SIM_URL + + await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + expect(mockFrom).toHaveBeenCalledWith('readings') + expect(mockUpdate).toHaveBeenCalledWith( + expect.objectContaining({ mint_diagnosis: expect.any(Object) }) + ) + }) + + it('calls tracer-sim /replay when TRACER_SIM_URL is set', async () => { + process.env.TRACER_SIM_URL = 'http://tracer-sim.local' + mockTracerSim({ + error_code: 'INSUFFICIENT_BALANCE', + message: MINT_ERROR, + suggestion: 'Fund the minter account.', + }) + + const diagnosis = await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + expect(global.fetch).toHaveBeenCalledWith( + 'http://tracer-sim.local/replay', + expect.objectContaining({ method: 'POST' }) + ) + expect(diagnosis.error_code).toBe('INSUFFICIENT_BALANCE') + expect(diagnosis.suggestion).toBe('Fund the minter account.') + }) + + it('diagnosis result is stored and retrievable from the reading record', async () => { + process.env.TRACER_SIM_URL = 'http://tracer-sim.local' + const tracerResponse: Partial = { + error_code: 'CONTRACT_REVERT', + message: 'Contract reverted', + suggestion: 'Check contract state.', + } + mockTracerSim(tracerResponse) + + const diagnosis = await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + // Verify the stored value matches what was returned + const storedArg = mockUpdate.mock.calls[0][0] + expect(storedArg.mint_diagnosis).toMatchObject({ + error_code: 'CONTRACT_REVERT', + message: 'Contract reverted', + }) + expect(diagnosis).toMatchObject(storedArg.mint_diagnosis) + }) + + it('handles tracer-sim HTTP error gracefully', async () => { + process.env.TRACER_SIM_URL = 'http://tracer-sim.local' + mockTracerSim(null, 503) + + const diagnosis = await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + expect(diagnosis.error_code).toBe('REPLAY_ERROR') + expect(diagnosis.message).toBe(MINT_ERROR) + }) + + it('handles tracer-sim network failure gracefully', async () => { + process.env.TRACER_SIM_URL = 'http://tracer-sim.local' + global.fetch = vi.fn().mockRejectedValue(new Error('ECONNREFUSED')) + + const diagnosis = await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + expect(diagnosis.error_code).toBe('REPLAY_ERROR') + expect(diagnosis.suggestion).toContain('tracer-sim replay failed') + }) + + it('handles tracer-sim timeout gracefully', async () => { + process.env.TRACER_SIM_URL = 'http://tracer-sim.local' + global.fetch = vi.fn().mockRejectedValue(new DOMException('The operation was aborted', 'AbortError')) + + const diagnosis = await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + expect(diagnosis.error_code).toBe('REPLAY_ERROR') + }) + + it('fills in missing fields from partial tracer-sim response', async () => { + process.env.TRACER_SIM_URL = 'http://tracer-sim.local' + // Partial response — missing suggestion + mockTracerSim({ error_code: 'PARTIAL' }) + + const diagnosis = await diagnoseMintFailure(READING_ID, COOP_ID, MINT_ERROR) + + expect(diagnosis.error_code).toBe('PARTIAL') + expect(diagnosis.message).toBe(MINT_ERROR) + expect(diagnosis.suggestion).toBe('Check Stellar network status.') + }) +}) diff --git a/apps/web/src/__tests__/wallet.test.ts b/apps/web/src/__tests__/wallet.test.ts new file mode 100644 index 0000000..45ea273 --- /dev/null +++ b/apps/web/src/__tests__/wallet.test.ts @@ -0,0 +1,116 @@ +/** + * Tests for useWallet hook using the mock Freighter wallet. + * Runs headlessly in CI — no browser extension required. + */ +import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest' +import { renderHook, act } from '@testing-library/react' +import { installMockFreighter, uninstallMockFreighter } from '@/tests/mock-freighter' +import { useWallet } from '@/hooks/useWallet' + +// jsdom sessionStorage is available in this environment +beforeEach(() => { + installMockFreighter() + sessionStorage.clear() +}) + +afterEach(() => { + uninstallMockFreighter() + sessionStorage.clear() +}) + +describe('useWallet — mock Freighter', () => { + it('starts disconnected', async () => { + const { result } = renderHook(() => useWallet()) + // Wait for restore effect + await act(async () => {}) + expect(result.current.connected).toBe(false) + expect(result.current.address).toBeNull() + }) + + it('connects and returns the public key', async () => { + const { result } = renderHook(() => useWallet()) + await act(async () => {}) + + await act(async () => { + await result.current.connect() + }) + + expect(result.current.connected).toBe(true) + expect(result.current.address).toBe('GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN') + }) + + it('persists connection in sessionStorage', async () => { + const { result } = renderHook(() => useWallet()) + await act(async () => {}) + + await act(async () => { + await result.current.connect() + }) + + const stored = JSON.parse(sessionStorage.getItem('solarproof-wallet') ?? '{}') + expect(stored.connected).toBe(true) + expect(stored.address).toBe('GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN') + }) + + it('disconnects and clears sessionStorage', async () => { + const { result } = renderHook(() => useWallet()) + await act(async () => {}) + + await act(async () => { await result.current.connect() }) + await act(async () => { result.current.disconnect() }) + + expect(result.current.connected).toBe(false) + expect(result.current.address).toBeNull() + expect(sessionStorage.getItem('solarproof-wallet')).toBeNull() + }) + + it('restores session when wallet is still allowed', async () => { + // Pre-populate sessionStorage as if a previous session connected + sessionStorage.setItem('solarproof-wallet', JSON.stringify({ + address: 'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN', + connected: true, + })) + + const { result } = renderHook(() => useWallet()) + await act(async () => {}) + + expect(result.current.connected).toBe(true) + expect(result.current.address).toBe('GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN') + }) + + it('clears session when wallet is no longer allowed', async () => { + // Install mock that requires explicit access + uninstallMockFreighter() + installMockFreighter({ requiresAccess: true }) + + sessionStorage.setItem('solarproof-wallet', JSON.stringify({ + address: 'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN', + connected: true, + })) + + const { result } = renderHook(() => useWallet()) + await act(async () => {}) + + expect(result.current.connected).toBe(false) + expect(sessionStorage.getItem('solarproof-wallet')).toBeNull() + }) + + it('throws when Freighter is not installed', async () => { + uninstallMockFreighter() + + const { result } = renderHook(() => useWallet()) + await act(async () => {}) + + await expect( + act(async () => { await result.current.connect() }) + ).rejects.toThrow('Freighter wallet extension not found') + }) + + it('mock does not affect production wallet behavior', () => { + // The mock is only installed on window.freighter — it does not patch + // any production module. Uninstalling removes it completely. + uninstallMockFreighter() + // eslint-disable-next-line @typescript-eslint/no-explicit-any + expect((globalThis as any).window?.freighter).toBeUndefined() + }) +}) diff --git a/apps/web/src/app/admin/page.tsx b/apps/web/src/app/admin/page.tsx new file mode 100644 index 0000000..7d94541 --- /dev/null +++ b/apps/web/src/app/admin/page.tsx @@ -0,0 +1,280 @@ +'use client' + +import { useState } from 'react' +import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query' +import { ShieldOff, ShieldCheck, Zap, Award, Activity } from 'lucide-react' + +interface Operator { + id: string + name: string + admin_address: string + suspended: boolean + created_at: string +} + +interface Stats { + total_kwh: number + total_certificates: number + active_meters: number +} + +function useAdminToken() { + const [token, setToken] = useState(() => + typeof window !== 'undefined' ? (sessionStorage.getItem('admin_token') ?? '') : '' + ) + function saveToken(t: string) { + sessionStorage.setItem('admin_token', t) + setToken(t) + } + return { token, saveToken } +} + +function authHeaders(token: string) { + return { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' } +} + +async function fetchOperators(token: string): Promise { + const res = await fetch('/api/admin/operators', { headers: authHeaders(token) }) + if (res.status === 401) throw new Error('Unauthorized') + if (!res.ok) throw new Error('Failed to load operators') + return res.json().then((d) => d.data) +} + +async function fetchStats(token: string): Promise { + const res = await fetch('/api/admin/stats', { headers: authHeaders(token) }) + if (res.status === 401) throw new Error('Unauthorized') + if (!res.ok) throw new Error('Failed to load stats') + return res.json() +} + +async function toggleSuspend(token: string, id: string, suspended: boolean): Promise { + const res = await fetch(`/api/admin/operators/${id}`, { + method: 'PATCH', + headers: authHeaders(token), + body: JSON.stringify({ suspended }), + }) + if (!res.ok) throw new Error('Failed to update operator') +} + +export default function AdminPage() { + const { token, saveToken } = useAdminToken() + const [draft, setDraft] = useState('') + const [authed, setAuthed] = useState(!!token) + const qc = useQueryClient() + + const { + data: operators, + isLoading: opsLoading, + error: opsError, + } = useQuery({ + queryKey: ['admin', 'operators', token], + queryFn: () => fetchOperators(token), + enabled: authed, + retry: false, + }) + + const { + data: stats, + isLoading: statsLoading, + } = useQuery({ + queryKey: ['admin', 'stats', token], + queryFn: () => fetchStats(token), + enabled: authed, + retry: false, + }) + + const suspend = useMutation({ + mutationFn: ({ id, suspended }: { id: string; suspended: boolean }) => + toggleSuspend(token, id, suspended), + onSuccess: () => qc.invalidateQueries({ queryKey: ['admin', 'operators'] }), + }) + + function handleLogin(e: React.FormEvent) { + e.preventDefault() + saveToken(draft) + setAuthed(true) + } + + if (!authed) { + return ( +
+
+

Admin access

+
+ + setDraft(e.target.value)} + required + className="mt-1 block w-full rounded-lg border border-gray-300 px-3 py-2 text-sm focus:border-yellow-400 focus:outline-none focus:ring-2 focus:ring-yellow-400 dark:border-gray-700 dark:bg-gray-900 dark:text-gray-100" + placeholder="Enter admin secret" + /> +
+ +
+
+ ) + } + + if (opsError instanceof Error && opsError.message === 'Unauthorized') { + return ( +
+
+

Invalid admin secret.

+ +
+
+ ) + } + + return ( +
+
+

Admin

+ +
+ + {/* System stats */} +
+

+ System stats +

+
+ + + +
+
+ + {/* Operators */} +
+

+ Operators +

+ {opsError && ( +

+ {(opsError as Error).message} +

+ )} +
+ + + + {['Name', 'Admin address', 'Status', 'Created', 'Action'].map((h) => ( + + ))} + + + + {opsLoading ? ( + + + + ) : operators && operators.length > 0 ? ( + operators.map((op) => ( + + + + + + + + )) + ) : ( + + + + )} + +
+ {h} +
Loading…
{op.name} + {op.admin_address} + + + {op.suspended ? 'Suspended' : 'Active'} + + + {new Date(op.created_at).toLocaleDateString()} + + +
+ No operators found. +
+
+
+
+ ) +} + +function StatCard({ label, value, icon: Icon }: { label: string; value: string; icon: React.ElementType }) { + return ( +
+
+ {label} +
+

{value}

+
+ ) +} diff --git a/apps/web/src/app/api/__tests__/regression.test.ts b/apps/web/src/app/api/__tests__/regression.test.ts index 7b88065..f94171c 100644 --- a/apps/web/src/app/api/__tests__/regression.test.ts +++ b/apps/web/src/app/api/__tests__/regression.test.ts @@ -75,7 +75,7 @@ async function makeReadingBody(privKey: Uint8Array, overrides: Record Promise.resolve(body), - headers: { get: (_: string) => null }, + headers: { get: (key: string) => key === 'x-api-key' ? 'mk_test_api_key' : null }, nextUrl: { searchParams: new URLSearchParams() }, } as unknown as Parameters[0] } @@ -274,6 +274,7 @@ describe('regression issue_49: Stellar account existence check before minting', id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN123' }, }) @@ -290,6 +291,7 @@ describe('regression issue_49: Stellar account existence check before minting', id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GNONEXISTENT' }, }) @@ -314,6 +316,7 @@ describe('regression issue_49: Stellar account existence check before minting', id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GNOTRUSTED' }, }) @@ -335,6 +338,7 @@ describe('regression issue_49: Stellar account existence check before minting', id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: null, // no admin address }) @@ -357,6 +361,7 @@ describe('regression issue_73: reading deduplication at API layer', () => { id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN123' }, }) @@ -379,6 +384,7 @@ describe('regression issue_73: reading deduplication at API layer', () => { id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN123' }, }) @@ -401,6 +407,7 @@ describe('regression issue_73: reading deduplication at API layer', () => { id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN123' }, }) @@ -418,6 +425,7 @@ describe('regression issue_73: reading deduplication at API layer', () => { id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', + api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN123' }, }) diff --git a/apps/web/src/app/api/admin/audit-logs/route.ts b/apps/web/src/app/api/admin/audit-logs/route.ts new file mode 100644 index 0000000..40a326f --- /dev/null +++ b/apps/web/src/app/api/admin/audit-logs/route.ts @@ -0,0 +1,26 @@ +import { NextRequest, NextResponse } from 'next/server' +import { createServiceClient } from '@/lib/supabase' + +/** + * GET /api/admin/audit-logs + * Returns paginated audit logs. Requires SUPABASE_SERVICE_ROLE_KEY (server-only). + * Query params: limit (default 50), offset (default 0) + */ +export async function GET(req: NextRequest) { + const { searchParams } = new URL(req.url) + const limit = Math.min(Number(searchParams.get('limit') ?? 50), 200) + const offset = Number(searchParams.get('offset') ?? 0) + + const db = createServiceClient() + const { data, error, count } = await db + .from('audit_logs') + .select('*', { count: 'exact' }) + .order('timestamp', { ascending: false }) + .range(offset, offset + limit - 1) + + if (error) { + return NextResponse.json({ error: error.message }, { status: 500 }) + } + + return NextResponse.json({ data, total: count, limit, offset }) +} diff --git a/apps/web/src/app/api/admin/operators/[id]/route.ts b/apps/web/src/app/api/admin/operators/[id]/route.ts new file mode 100644 index 0000000..d630022 --- /dev/null +++ b/apps/web/src/app/api/admin/operators/[id]/route.ts @@ -0,0 +1,31 @@ +import { NextRequest, NextResponse } from 'next/server' +import { z } from 'zod' +import { createServiceClient } from '@/lib/supabase' +import { requireAdmin } from '@/lib/admin-auth' + +const PatchSchema = z.object({ suspended: z.boolean() }) + +/** + * PATCH /api/admin/operators/[id] + * Suspend or unsuspend an operator (cooperative). + */ +export async function PATCH(req: NextRequest, { params }: { params: Promise<{ id: string }> }) { + const err = requireAdmin(req) + if (err) return err + + const { id } = await params + const body = await req.json().catch(() => null) + const parsed = PatchSchema.safeParse(body) + if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 }) + + const db = createServiceClient() + const { data, error } = await db + .from('cooperatives') + .update({ suspended: parsed.data.suspended }) + .eq('id', id) + .select('id, name, suspended') + .single() + + if (error) return NextResponse.json({ error: error.message }, { status: 500 }) + return NextResponse.json({ data }) +} diff --git a/apps/web/src/app/api/admin/operators/route.ts b/apps/web/src/app/api/admin/operators/route.ts new file mode 100644 index 0000000..3c046ea --- /dev/null +++ b/apps/web/src/app/api/admin/operators/route.ts @@ -0,0 +1,21 @@ +import { NextRequest, NextResponse } from 'next/server' +import { createServiceClient } from '@/lib/supabase' +import { requireAdmin } from '@/lib/admin-auth' + +/** + * GET /api/admin/operators + * Returns all cooperatives with id, name, admin_address, suspended, created_at. + */ +export async function GET(req: NextRequest) { + const err = requireAdmin(req) + if (err) return err + + const db = createServiceClient() + const { data, error } = await db + .from('cooperatives') + .select('id, name, admin_address, suspended, created_at') + .order('created_at', { ascending: false }) + + if (error) return NextResponse.json({ error: error.message }, { status: 500 }) + return NextResponse.json({ data }) +} diff --git a/apps/web/src/app/api/admin/stats/route.ts b/apps/web/src/app/api/admin/stats/route.ts new file mode 100644 index 0000000..7646845 --- /dev/null +++ b/apps/web/src/app/api/admin/stats/route.ts @@ -0,0 +1,28 @@ +import { NextRequest, NextResponse } from 'next/server' +import { createServiceClient } from '@/lib/supabase' +import { requireAdmin } from '@/lib/admin-auth' + +/** + * GET /api/admin/stats + * Returns platform-level stats: total kWh anchored, total certificates, active meters. + */ +export async function GET(req: NextRequest) { + const err = requireAdmin(req) + if (err) return err + + const db = createServiceClient() + + const [kwhResult, certResult, meterResult] = await Promise.all([ + db.from('readings').select('kwh').eq('anchored', true), + db.from('certificates').select('id', { count: 'exact', head: true }), + db.from('meters').select('id', { count: 'exact', head: true }).eq('active', true), + ]) + + const total_kwh = (kwhResult.data ?? []).reduce((sum, r) => sum + Number(r.kwh), 0) + + return NextResponse.json({ + total_kwh: Math.round(total_kwh * 1000) / 1000, + total_certificates: certResult.count ?? 0, + active_meters: meterResult.count ?? 0, + }) +} diff --git a/apps/web/src/app/api/auth/logout/route.ts b/apps/web/src/app/api/auth/logout/route.ts index a6d1e41..ac104c8 100644 --- a/apps/web/src/app/api/auth/logout/route.ts +++ b/apps/web/src/app/api/auth/logout/route.ts @@ -1,11 +1,14 @@ import { NextRequest, NextResponse } from 'next/server' -import { requireAuth, isAuthError, createUserClient } from '@/lib/auth' +import { requireAuth, isAuthError, createUserClient, revokeToken } from '@/lib/auth' -/** POST /api/auth/logout — invalidate the current session */ +/** POST /api/auth/logout — invalidate the current session and revoke the token */ export async function POST(req: NextRequest) { const auth = await requireAuth(req) if (isAuthError(auth)) return auth + // Add token to revocation list before signing out + await revokeToken(auth.accessToken) + const client = createUserClient(auth.accessToken) const { error } = await client.auth.signOut() if (error) { diff --git a/apps/web/src/app/api/certificates/[id]/irec-export/route.ts b/apps/web/src/app/api/certificates/[id]/irec-export/route.ts new file mode 100644 index 0000000..c647ad7 --- /dev/null +++ b/apps/web/src/app/api/certificates/[id]/irec-export/route.ts @@ -0,0 +1,60 @@ +import { NextRequest, NextResponse } from 'next/server' +import { z } from 'zod' +import { createServiceClient } from '@/lib/supabase' +import { buildIRecXml } from '@/lib/irec-xml' + +const ParamsSchema = z.object({ id: z.string().uuid() }) + +/** + * GET /api/certificates/[id]/irec-export + * + * Returns the certificate as I-REC compliant XML with on-chain anchor proof. + */ +export async function GET( + req: NextRequest, + { params }: { params: Promise<{ id: string }> } +) { + const parsedParams = ParamsSchema.safeParse(await params) + if (!parsedParams.success) { + return NextResponse.json({ error: parsedParams.error.flatten() }, { status: 400 }) + } + const { id } = parsedParams.data + + const db = createServiceClient() + const { data: cert } = await db + .from('certificates') + .select('id, kwh, issued_at, retired, retired_at, retired_by, mint_tx_hash, cooperative_id, readings!inner(meter_id)') + .eq('id', id) + .single() + + if (!cert) { + return NextResponse.json({ error: 'Certificate not found' }, { status: 404 }) + } + + // Resolve wallet address from query param (holder must supply their address) + const holderAddress = req.nextUrl.searchParams.get('holder') ?? '' + + const readings = cert.readings as { meter_id: string } | { meter_id: string }[] + const meter_id = Array.isArray(readings) ? readings[0]?.meter_id : readings?.meter_id ?? null + + const xml = buildIRecXml({ + id: cert.id, + kwh: cert.kwh, + issued_at: cert.issued_at, + holder_address: holderAddress, + mint_tx_hash: cert.mint_tx_hash, + meter_id, + retired: cert.retired, + retired_at: cert.retired_at, + retired_by: cert.retired_by, + cooperative_id: cert.cooperative_id, + }) + + return new NextResponse(xml, { + status: 200, + headers: { + 'Content-Type': 'application/xml; charset=utf-8', + 'Content-Disposition': `attachment; filename="irec-${id}.xml"`, + }, + }) +} diff --git a/apps/web/src/app/api/certificates/[id]/retire/route.ts b/apps/web/src/app/api/certificates/[id]/retire/route.ts index 626ab80..ae6b138 100644 --- a/apps/web/src/app/api/certificates/[id]/retire/route.ts +++ b/apps/web/src/app/api/certificates/[id]/retire/route.ts @@ -4,22 +4,19 @@ import { createServiceClient } from '@/lib/supabase' import { retireCertificate } from '@/lib/stellar' import { fireWebhook } from '@/lib/webhooks' import { triggerIRecRetirement } from '@/lib/irec-bridge' +import { sendRetiredEmail } from '@/lib/email' -const RetireSchema = z.object({ - wallet_address: z.string().min(1), -}) - -const ParamsSchema = z.object({ - id: z.string().uuid(), -}) +const RetireSchema = z.object({ wallet_address: z.string().min(1) }) +const ParamsSchema = z.object({ id: z.string().uuid() }) /** - * POST /api/certificates/[id]/retire + * POST /api/certificates/:id/retire * - * Retires a certificate by calling the energy_token contract retire function. - * Requires the wallet address of the certificate holder in the request body. + * Retires a certificate by calling the energy_token burn function on Soroban, + * records the retirement in Supabase, and emits a retirement_events audit record. * * Body: { wallet_address } + * Returns 409 if certificate already retired. */ export async function POST( req: NextRequest, @@ -30,6 +27,7 @@ export async function POST( return NextResponse.json({ error: parsedParams.error.flatten() }, { status: 400 }) } const { id } = parsedParams.data + const body = await req.json().catch(() => null) const parsed = RetireSchema.safeParse(body) if (!parsed.success) { @@ -39,12 +37,7 @@ export async function POST( const { wallet_address } = parsed.data const db = createServiceClient() - const { data: cert } = await db - .from('certificates') - .select('*') - .eq('id', id) - .single() - + const { data: cert } = await db.from('certificates').select('*').eq('id', id).single() if (!cert) { return NextResponse.json({ error: 'Certificate not found' }, { status: 404 }) } @@ -53,6 +46,7 @@ export async function POST( return NextResponse.json({ error: 'Certificate already retired' }, { status: 409 }) } + // Call energy_token burn on Soroban let retireTxHash: string try { retireTxHash = await retireCertificate(wallet_address, cert.kwh) @@ -61,12 +55,16 @@ export async function POST( return NextResponse.json({ error: message }, { status: 500 }) } + const retiredAt = new Date().toISOString() + + // Update certificate with retirement details and tx hash const { data: updated, error: updateErr } = await db .from('certificates') .update({ retired: true, - retired_at: new Date().toISOString(), + retired_at: retiredAt, retired_by: wallet_address, + retire_tx_hash: retireTxHash, }) .eq('id', id) .select() @@ -82,6 +80,16 @@ export async function POST( retire_tx_hash: retireTxHash, }) + const notifyEmail = process.env.NOTIFICATION_EMAIL + if (notifyEmail) { + void sendRetiredEmail(notifyEmail, { + certificate_id: updated.id, + retired_by: updated.retired_by ?? wallet_address, + retire_tx_hash: retireTxHash, + kwh: cert.kwh, + }) + } + // Level 3 integration: Bridge retirement to I-REC registry void triggerIRecRetirement({ beneficiary: wallet_address, diff --git a/apps/web/src/app/api/certificates/[id]/transfer/route.ts b/apps/web/src/app/api/certificates/[id]/transfer/route.ts new file mode 100644 index 0000000..3be50b3 --- /dev/null +++ b/apps/web/src/app/api/certificates/[id]/transfer/route.ts @@ -0,0 +1,93 @@ +import { NextRequest, NextResponse } from 'next/server' +import { z } from 'zod' +import { isValidStellarAddress } from '@stellar/stellar-sdk' +import { createServiceClient } from '@/lib/supabase' +import { transferCertificate } from '@/lib/stellar' +import { auditLog } from '@/lib/audit' +import { fireWebhook } from '@/lib/webhooks' + +const TransferSchema = z.object({ + from_address: z.string().min(1), + to_address: z.string().min(1), +}) + +const ParamsSchema = z.object({ + id: z.string().uuid(), +}) + +/** + * POST /api/certificates/[id]/transfer + * + * Transfers a certificate to another Stellar account via SEP-41 transfer. + * Body: { from_address, to_address } + */ +export async function POST( + req: NextRequest, + { params }: { params: Promise<{ id: string }> } +) { + const parsedParams = ParamsSchema.safeParse(await params) + if (!parsedParams.success) { + return NextResponse.json({ error: parsedParams.error.flatten() }, { status: 400 }) + } + const { id } = parsedParams.data + + const body = await req.json().catch(() => null) + const parsed = TransferSchema.safeParse(body) + if (!parsed.success) { + return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 }) + } + + const { from_address, to_address } = parsed.data + + if (!isValidStellarAddress(to_address)) { + return NextResponse.json({ error: 'Invalid recipient Stellar address' }, { status: 400 }) + } + + if (from_address === to_address) { + return NextResponse.json({ error: 'Sender and recipient must differ' }, { status: 400 }) + } + + const db = createServiceClient() + const { data: cert } = await db + .from('certificates') + .select('*') + .eq('id', id) + .single() + + if (!cert) { + return NextResponse.json({ error: 'Certificate not found' }, { status: 404 }) + } + + if (cert.retired) { + return NextResponse.json({ error: 'Cannot transfer a retired certificate' }, { status: 409 }) + } + + let transferTxHash: string + try { + transferTxHash = await transferCertificate(from_address, to_address, cert.kwh) + } catch (err) { + const message = err instanceof Error ? err.message : 'Transfer transaction failed' + return NextResponse.json({ error: message }, { status: 500 }) + } + + await auditLog(req, { + operator_id: from_address, + action: 'certificate.transfer', + resource_id: id, + metadata: { from_address, to_address, transfer_tx_hash: transferTxHash }, + }) + + void fireWebhook(cert.cooperative_id, 'transfer', { + certificate_id: id, + from_address, + to_address, + transfer_tx_hash: transferTxHash, + }) + + return NextResponse.json({ + id, + from_address, + to_address, + transfer_tx_hash: transferTxHash, + }) +} diff --git a/apps/web/src/app/api/certificates/retire/bulk/route.ts b/apps/web/src/app/api/certificates/retire/bulk/route.ts new file mode 100644 index 0000000..900a4b5 --- /dev/null +++ b/apps/web/src/app/api/certificates/retire/bulk/route.ts @@ -0,0 +1,88 @@ +import { NextRequest, NextResponse } from 'next/server' +import { z } from 'zod' +import { createServiceClient } from '@/lib/supabase' +import { retireCertificate } from '@/lib/stellar' +import { fireWebhook } from '@/lib/webhooks' + +const MAX_BULK = 100 + +const BulkRetireSchema = z.object({ + certificate_ids: z.array(z.string().uuid()).min(1).max(MAX_BULK), + wallet_address: z.string().min(1), +}) + +/** + * POST /api/certificates/retire/bulk + * + * Retire up to 100 certificates in a single request. + * Returns per-certificate success/failure status. + * Partial failures are reported — the operation is best-effort, not atomic. + * + * Body: { certificate_ids: string[], wallet_address: string } + */ +export async function POST(req: NextRequest) { + const body = await req.json().catch(() => null) + const parsed = BulkRetireSchema.safeParse(body) + if (!parsed.success) { + return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 }) + } + + const { certificate_ids, wallet_address } = parsed.data + const db = createServiceClient() + + const { data: certs, error: fetchErr } = await db + .from('certificates') + .select('*') + .in('id', certificate_ids) + + if (fetchErr) { + return NextResponse.json({ error: 'Failed to fetch certificates' }, { status: 500 }) + } + + const certMap = new Map((certs ?? []).map((c) => [c.id, c])) + + const results = await Promise.all( + certificate_ids.map(async (id) => { + const cert = certMap.get(id) + if (!cert) return { id, success: false, error: 'Certificate not found' } + if (cert.retired) return { id, success: false, error: 'Already retired' } + + try { + const retireTxHash = await retireCertificate(wallet_address, cert.kwh) + + const { data: updated, error: updateErr } = await db + .from('certificates') + .update({ + retired: true, + retired_at: new Date().toISOString(), + retired_by: wallet_address, + }) + .eq('id', id) + .select() + .single() + + if (updateErr || !updated) { + return { id, success: false, error: 'Failed to update certificate' } + } + + void fireWebhook(updated.cooperative_id, 'retire', { + certificate_id: updated.id, + retired_by: updated.retired_by, + retire_tx_hash: retireTxHash, + }) + + return { id, success: true, retire_tx_hash: retireTxHash } + } catch (err) { + return { id, success: false, error: err instanceof Error ? err.message : 'Retire failed' } + } + }) + ) + + const succeeded = results.filter((r) => r.success).length + const failed = results.length - succeeded + + return NextResponse.json( + { results, summary: { total: results.length, succeeded, failed } }, + { status: failed === results.length ? 500 : 200 } + ) +} diff --git a/apps/web/src/app/api/certificates/route.test.ts b/apps/web/src/app/api/certificates/route.test.ts new file mode 100644 index 0000000..7570faf --- /dev/null +++ b/apps/web/src/app/api/certificates/route.test.ts @@ -0,0 +1,141 @@ +import { describe, it, expect, vi, beforeEach } from 'vitest' +import { NextRequest } from 'next/server' + +vi.mock('@/lib/supabase', () => ({ createServiceClient: vi.fn() })) + +import { createServiceClient } from '@/lib/supabase' +import { GET } from '@/app/api/certificates/route' + +function makeRequest(params: Record = {}) { + const url = new URL('http://localhost/api/certificates') + Object.entries(params).forEach(([k, v]) => url.searchParams.set(k, v)) + return new NextRequest(url) +} + +const CERT = { + id: 'cert-1', + kwh: 10, + issued_at: '2026-01-01T00:00:00Z', + retired: false, + retired_at: null, + retired_by: null, + mint_tx_hash: 'abc', + readings: { meter_id: 'meter-1' }, +} + +function mockDb(data: unknown[], error: unknown = null, count = 1) { + const query: Record = {} + const chain = (obj: Record) => { + ;['select', 'order', 'limit', 'lt', 'eq', 'gte', 'lte', 'or'].forEach((m) => { + obj[m] = vi.fn().mockReturnValue(obj) + }) + obj.then = undefined + // Make it thenable for await + Object.defineProperty(obj, Symbol.iterator, { value: undefined }) + return obj + } + const q = chain(query) + // Final await resolves with data + ;(q as unknown as Promise)[Symbol.for('vitest-mock-result')] = { data, error, count } + vi.mocked(createServiceClient).mockReturnValue({ + from: vi.fn().mockReturnValue({ + select: vi.fn().mockReturnValue({ + order: vi.fn().mockReturnValue({ + limit: vi.fn().mockReturnValue({ + lt: vi.fn().mockReturnThis(), + eq: vi.fn().mockReturnThis(), + gte: vi.fn().mockReturnThis(), + lte: vi.fn().mockReturnThis(), + or: vi.fn().mockResolvedValue({ data, error, count }), + then: undefined, + // make it awaitable + [Symbol.toStringTag]: 'Promise', + }), + }), + }), + }), + } as ReturnType) +} + +function mockDbSimple(data: unknown[], error: unknown = null, count = data.length) { + const terminal = vi.fn().mockResolvedValue({ data, error, count }) + const makeChain = (): Record => { + const obj: Record = {} + ;['lt', 'eq', 'gte', 'lte', 'or'].forEach((m) => { obj[m] = vi.fn().mockReturnValue(obj) }) + // Make awaitable + obj.then = (resolve: (v: unknown) => unknown) => Promise.resolve({ data, error, count }).then(resolve) + obj.catch = (reject: (e: unknown) => unknown) => Promise.resolve({ data, error, count }).catch(reject) + return obj + } + vi.mocked(createServiceClient).mockReturnValue({ + from: vi.fn().mockReturnValue({ + select: vi.fn().mockReturnValue({ + order: vi.fn().mockReturnValue({ + limit: vi.fn().mockReturnValue(makeChain()), + }), + }), + }), + } as ReturnType) + return terminal +} + +beforeEach(() => vi.clearAllMocks()) + +describe('GET /api/certificates', () => { + it('returns 200 with data array on success', async () => { + mockDbSimple([CERT]) + const res = await GET(makeRequest()) + expect(res.status).toBe(200) + const body = await res.json() + expect(Array.isArray(body.data)).toBe(true) + }) + + it('returns 500 when DB errors', async () => { + mockDbSimple([], { message: 'db error' }) + const res = await GET(makeRequest()) + expect(res.status).toBe(500) + const body = await res.json() + expect(body.error).toBe('db error') + }) + + it('respects limit param (max 100)', async () => { + mockDbSimple([]) + const res = await GET(makeRequest({ limit: '200' })) + expect(res.status).toBe(200) + }) + + it('returns next_cursor when there are more results', async () => { + // Return limit+1 items to trigger hasMore + const items = Array.from({ length: 21 }, (_, i) => ({ ...CERT, id: `cert-${i}`, issued_at: `2026-01-${String(i + 1).padStart(2, '0')}T00:00:00Z`, readings: { meter_id: 'meter-1' } })) + mockDbSimple(items, null, 100) + const res = await GET(makeRequest({ limit: '20' })) + expect(res.status).toBe(200) + const body = await res.json() + expect(body.next_cursor).not.toBeNull() + expect(body.data).toHaveLength(20) + }) + + it('returns null next_cursor when no more results', async () => { + mockDbSimple([CERT], null, 1) + const res = await GET(makeRequest()) + expect(res.status).toBe(200) + const body = await res.json() + expect(body.next_cursor).toBeNull() + }) + + it('normalizes readings join to meter_id field', async () => { + mockDbSimple([CERT], null, 1) + const res = await GET(makeRequest()) + const body = await res.json() + expect(body.data[0].meter_id).toBe('meter-1') + expect(body.data[0].readings).toBeUndefined() + }) + + it('handles array readings join', async () => { + const certWithArray = { ...CERT, readings: [{ meter_id: 'meter-arr' }] } + mockDbSimple([certWithArray], null, 1) + const res = await GET(makeRequest()) + const body = await res.json() + expect(body.data[0].meter_id).toBe('meter-arr') + }) +}) diff --git a/apps/web/src/app/api/csp-report/route.ts b/apps/web/src/app/api/csp-report/route.ts new file mode 100644 index 0000000..239cc60 --- /dev/null +++ b/apps/web/src/app/api/csp-report/route.ts @@ -0,0 +1,7 @@ +import { NextRequest, NextResponse } from 'next/server' + +export async function POST(req: NextRequest) { + const body = await req.json().catch(() => null) + console.warn('[CSP Violation]', JSON.stringify(body)) + return NextResponse.json({}, { status: 204 }) +} diff --git a/apps/web/src/app/api/meters/[id]/revoke/route.ts b/apps/web/src/app/api/meters/[id]/revoke/route.ts index 434ff6f..25add8d 100644 --- a/apps/web/src/app/api/meters/[id]/revoke/route.ts +++ b/apps/web/src/app/api/meters/[id]/revoke/route.ts @@ -1,22 +1,73 @@ import { NextRequest, NextResponse } from 'next/server' +import { z } from 'zod' import { createServiceClient } from '@/lib/supabase' +import { requireAuth, isAuthError } from '@/lib/auth' +import { auditLog } from '@/lib/audit' -/** PATCH /api/meters/[id]/revoke — set meter active=false */ -export async function PATCH( - _req: NextRequest, +const RevokeSchema = z.object({ + reason: z.string().min(1).max(500), +}) + +/** + * POST /api/meters/[id]/revoke + * + * Revokes a meter's public key. Revoked meters can no longer submit readings. + * This action is permanent and recorded in the audit log. + * + * Requires operator JWT. + */ +export async function POST( + req: NextRequest, { params }: { params: Promise<{ id: string }> } ) { + const auth = await requireAuth(req) + if (isAuthError(auth)) return auth + const { id } = await params + const body = await req.json().catch(() => ({})) + const parsed = RevokeSchema.safeParse(body) + + if (!parsed.success) { + return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 }) + } + const db = createServiceClient() + const now = new Date().toISOString() const { data, error } = await db .from('meters') - .update({ active: false }) + .update({ + active: false, + revoked_at: now, + revocation_reason: parsed.data.reason + }) .eq('id', id) - .select() + .is('revoked_at', null) + .select('id, serial_number, pubkey_hex') .single() - if (error) return NextResponse.json({ error: error.message }, { status: 500 }) - if (!data) return NextResponse.json({ error: 'Meter not found' }, { status: 404 }) - return NextResponse.json(data) + if (error) { + if (error.code === 'PGRST116') { + return NextResponse.json({ error: 'Meter not found or already revoked' }, { status: 404 }) + } + return NextResponse.json({ error: error.message }, { status: 500 }) + } + + // Audit logging + await auditLog(req, { + operator_id: auth.user.id, + action: 'meter.revoke', + resource_id: id, + metadata: { + serial_number: data.serial_number, + pubkey_hex: data.pubkey_hex, + reason: parsed.data.reason, + } + }) + + return NextResponse.json({ + message: 'Meter revoked successfully', + id: data.id, + revoked_at: now + }) } diff --git a/apps/web/src/app/api/meters/[id]/rotate-key/route.ts b/apps/web/src/app/api/meters/[id]/rotate-key/route.ts new file mode 100644 index 0000000..93e94c1 --- /dev/null +++ b/apps/web/src/app/api/meters/[id]/rotate-key/route.ts @@ -0,0 +1,35 @@ +import { NextRequest, NextResponse } from 'next/server' +import { randomBytes } from 'crypto' +import { createServiceClient } from '@/lib/supabase' +import { requireAuth, isAuthError } from '@/lib/auth' + +/** + * POST /api/meters/[id]/rotate-key + * + * Generates a new API key for the meter without changing the Ed25519 keypair. + * The old key is invalidated immediately. + * Requires operator JWT. + */ +export async function POST( + req: NextRequest, + { params }: { params: Promise<{ id: string }> } +) { + const auth = await requireAuth(req) + if (isAuthError(auth)) return auth + + const { id } = await params + const newKey = 'mk_' + randomBytes(32).toString('hex') + + const db = createServiceClient() + const { data, error } = await db + .from('meters') + .update({ api_key: newKey }) + .eq('id', id) + .select('id, api_key') + .single() + + if (error) return NextResponse.json({ error: error.message }, { status: 500 }) + if (!data) return NextResponse.json({ error: 'Meter not found' }, { status: 404 }) + + return NextResponse.json({ id: data.id, api_key: data.api_key }) +} diff --git a/apps/web/src/app/api/meters/route.test.ts b/apps/web/src/app/api/meters/route.test.ts index 7793d99..c8b74b3 100644 --- a/apps/web/src/app/api/meters/route.test.ts +++ b/apps/web/src/app/api/meters/route.test.ts @@ -7,7 +7,24 @@ vi.mock('@/lib/auth', () => ({ })) import { createServiceClient } from '@/lib/supabase' -import { POST } from '@/app/api/meters/route' +import { GET, POST } from '@/app/api/meters/route' + +function makeGetRequest() { + return { + headers: { get: (_: string) => null }, + nextUrl: { searchParams: new URLSearchParams() }, + } as unknown as Parameters[0] +} + +function mockDbGet(data: unknown[], error: unknown = null) { + vi.mocked(createServiceClient).mockReturnValue({ + from: vi.fn().mockReturnValue({ + select: vi.fn().mockReturnValue({ + order: vi.fn().mockResolvedValue({ data, error }), + }), + }), + } as ReturnType) +} function makeRequest(body: unknown) { return { @@ -69,3 +86,21 @@ describe('POST /api/meters', () => { expect(res.status).toBe(400) }) }) + +describe('GET /api/meters', () => { + it('returns 200 with meters list', async () => { + mockDbGet([{ id: 'meter-1', serial_number: 'SN-001' }]) + const res = await GET(makeGetRequest()) + expect(res.status).toBe(200) + const body = await res.json() + expect(Array.isArray(body)).toBe(true) + }) + + it('returns 500 when DB errors', async () => { + mockDbGet([], { message: 'db failure' }) + const res = await GET(makeGetRequest()) + expect(res.status).toBe(500) + const body = await res.json() + expect(body.error).toBe('db failure') + }) +}) diff --git a/apps/web/src/app/api/meters/route.ts b/apps/web/src/app/api/meters/route.ts index 505063e..0f2159f 100644 --- a/apps/web/src/app/api/meters/route.ts +++ b/apps/web/src/app/api/meters/route.ts @@ -1,5 +1,6 @@ import { NextRequest, NextResponse } from 'next/server' import { z } from 'zod' +import { randomBytes } from 'crypto' import { createServiceClient } from '@/lib/supabase' import { requireAuth, isAuthError } from '@/lib/auth' @@ -8,8 +9,15 @@ const RegisterSchema = z.object({ cooperative_id: z.string().uuid(), serial_number: z.string().min(1).max(64), pubkey_hex: z.string().length(64), + meter_group: z.string().max(64).optional().nullable(), + tags: z.array(z.string().max(32)).optional().default([]), }) +/** Generate a unique meter API key: "mk_" + 32 random bytes as hex. */ +function generateApiKey(): string { + return 'mk_' + randomBytes(32).toString('hex') +} + /** GET /api/meters — list all meters (requires operator JWT) */ export async function GET(req: NextRequest) { const auth = await requireAuth(req) @@ -18,7 +26,7 @@ export async function GET(req: NextRequest) { const db = createServiceClient() const { data, error } = await db .from('meters') - .select('id, serial_number, pubkey_hex, active, created_at, cooperative_id') + .select('id, name, serial_number, pubkey_hex, active, created_at, cooperative_id, meter_group, tags') .order('created_at', { ascending: false }) if (error) return NextResponse.json({ error: error.message }, { status: 500 }) @@ -51,10 +59,11 @@ export async function POST(req: NextRequest) { const { data, error } = await db .from('meters') - .insert({ ...parsed.data, active: true }) + .insert({ ...parsed.data, active: true, api_key: generateApiKey() }) .select() .single() if (error) return NextResponse.json({ error: error.message }, { status: 500 }) + // Return full row including api_key — only shown once at registration return NextResponse.json(data, { status: 201 }) } diff --git a/apps/web/src/app/api/readings/batch/route.ts b/apps/web/src/app/api/readings/batch/route.ts index f07a6f9..044ca7f 100644 --- a/apps/web/src/app/api/readings/batch/route.ts +++ b/apps/web/src/app/api/readings/batch/route.ts @@ -55,9 +55,10 @@ type MeterRow = { id: string; pubkey_hex: string; cooperative_id: string; cooper const meterIds = [...new Set(readings.map(r => r.meter_id))] const { data: meters } = await db .from('meters') - .select('id, pubkey_hex, cooperative_id, cooperatives(admin_address)') + .select('id, pubkey_hex, cooperative_id, revoked_at, cooperatives(admin_address)') .in('id', meterIds) - .eq('active', true) as { data: MeterRow[] | null } + .eq('active', true) + .is('revoked_at', null) as { data: (MeterRow & { revoked_at: string | null })[] | null } const meterMap = new Map((meters ?? []).map(m => [m.id, m])) diff --git a/apps/web/src/app/api/readings/route.test.ts b/apps/web/src/app/api/readings/route.test.ts index ddb7cab..da9d0e6 100644 --- a/apps/web/src/app/api/readings/route.test.ts +++ b/apps/web/src/app/api/readings/route.test.ts @@ -60,10 +60,10 @@ async function makeBody(privKey: Uint8Array, overrides: Record } /** Build a NextRequest-like object from a plain body. */ -function makeRequest(body: unknown) { +function makeRequest(body: unknown, apiKey = 'mk_test_api_key') { return { json: () => Promise.resolve(body), - headers: { get: (_: string) => null }, + headers: { get: (key: string) => key === 'x-api-key' ? apiKey : null }, } as unknown as Parameters[0] } @@ -160,7 +160,7 @@ describe('POST /api/readings', () => { it('returns 401 when signature is signed by a different key', async () => { const { pubKeyHex } = await makeKeypair() const { privKey: wrongPrivKey } = await makeKeypair() - mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', cooperatives: { admin_address: 'GADMIN' } }) + mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN' } }) const body = await makeBody(wrongPrivKey) // signed with wrong key const res = await POST(makeRequest(body)) expect(res.status).toBe(401) @@ -170,7 +170,7 @@ describe('POST /api/readings', () => { it('returns 401 when signature_hex is all zeros (invalid)', async () => { const { pubKeyHex } = await makeKeypair() - mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', cooperatives: { admin_address: 'GADMIN' } }) + mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN' } }) const body = { meter_id: METER_ID, kwh: KWH, timestamp: Math.floor(Date.now() / 1000), signature_hex: '0'.repeat(128), nonce: 'test_nonce_123' } const res = await POST(makeRequest(body)) expect(res.status).toBe(401) @@ -180,7 +180,7 @@ describe('POST /api/readings', () => { it('returns 201 and anchors when signature is valid', async () => { const { privKey, pubKeyHex } = await makeKeypair() - mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', cooperatives: { admin_address: 'GADMIN' } }) + mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN' } }) const body = await makeBody(privKey) const res = await POST(makeRequest(body)) expect(res.status).toBe(201) @@ -192,7 +192,7 @@ describe('POST /api/readings', () => { it('calls anchorReading with the correct hash for a valid reading', async () => { const { privKey, pubKeyHex } = await makeKeypair() - mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', cooperatives: { admin_address: 'GADMIN' } }) + mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN' } }) const body = await makeBody(privKey) const { anchorReading } = await import('@/lib/stellar') @@ -203,4 +203,26 @@ describe('POST /api/readings', () => { const expectedHash = computeReadingHash(METER_ID, kwhToStroops(KWH), BigInt(body.timestamp)) expect(Buffer.from(callArg.readingHash).toString('hex')).toBe(expectedHash.toString('hex')) }) + + // ── API key validation ───────────────────────────────────────────────────── + + it('returns 401 when x-api-key header is missing', async () => { + const { privKey, pubKeyHex } = await makeKeypair() + mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN' } }) + const body = await makeBody(privKey) + const res = await POST(makeRequest(body, null as unknown as string)) + expect(res.status).toBe(401) + const json = await res.json() + expect(json.error).toMatch(/api key/i) + }) + + it('returns 401 when x-api-key is wrong', async () => { + const { privKey, pubKeyHex } = await makeKeypair() + mockDb({ id: METER_ID, pubkey_hex: pubKeyHex, cooperative_id: 'coop-1', api_key: 'mk_test_api_key', cooperatives: { admin_address: 'GADMIN' } }) + const body = await makeBody(privKey) + const res = await POST(makeRequest(body, 'mk_wrong_key')) + expect(res.status).toBe(401) + const json = await res.json() + expect(json.error).toMatch(/api key/i) + }) }) diff --git a/apps/web/src/app/api/readings/route.ts b/apps/web/src/app/api/readings/route.ts index e27606a..ceaa1ef 100644 --- a/apps/web/src/app/api/readings/route.ts +++ b/apps/web/src/app/api/readings/route.ts @@ -4,14 +4,26 @@ import { z } from 'zod' import { createServiceClient } from '@/lib/supabase' import { computeReadingHash } from '@/lib/crypto' import { kwhToStroops } from '@solarproof/stellar' -import { anchorReading, mintCertificates } from '@/lib/stellar' import { invalidateCert, checkRateLimit } from '@/lib/cache' +import { getIdempotentResponse, storeIdempotentResponse } from '@/lib/idempotency' import { fireWebhook } from '@/lib/webhooks' import { logger } from '@/lib/logger' import { requireAuth, isAuthError } from '@/lib/auth' import { diagnoseMintFailure } from '@/lib/tracer-sim' +import { getIdempotentResponse, storeIdempotentResponse } from '@/lib/idempotency' +import { enqueue } from '@/lib/queue' const MAX_PAGE_SIZE = 100 +const NONCE_TTL_MS = 24 * 60 * 60 * 1000 // 24 hours +const UPSTASH_REDIS_REST_URL = process.env.UPSTASH_REDIS_REST_URL + +/** Simple per-key rate limiter (no-op when Redis is unavailable). */ +async function checkRateLimitByKey( + _key: string, _limit: number, _windowSeconds: number +): Promise<{ allowed: boolean; resetSeconds: number; remaining: number }> { + // Falls back to allow-all; the pubkey-based checkRateLimit handles enforcement + return { allowed: true, resetSeconds: 0, remaining: _limit } +} /** * GET /api/v1/readings @@ -89,7 +101,7 @@ const ReadingSchema = z.object({ * Duplicate requests with the same key return the cached response without * re-processing. Keys expire after IDEMPOTENCY_TTL_SECONDS (default 24 h). * - * Returns 201 Created with { reading_id, anchor_tx_hash, mint_tx_hash }. + * Returns 202 Accepted with { reading_id, job_id }. */ export async function POST(req: NextRequest) { const correlationId = req.headers.get('x-correlation-id') ?? undefined @@ -112,7 +124,29 @@ export async function POST(req: NextRequest) { return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 }) } - const { meter_id, kwh, timestamp, signature_hex } = parsed.data + const { meter_id, kwh, timestamp, signature_hex, nonce } = parsed.data + const limit = Number(process.env.READINGS_RATE_LIMIT_PER_MINUTE ?? 60) + const windowSeconds = Number(process.env.READINGS_RATE_LIMIT_WINDOW_SECONDS ?? 60) + + // Redis-backed sliding-window rate limit by meter_id + const rateKey = `rate:readings:${meter_id}` + if (UPSTASH_REDIS_REST_URL) { + const rate = await checkRateLimitByKey(rateKey, limit, windowSeconds) + if (!rate.allowed) { + return NextResponse.json( + { error: 'Too many requests, please try again later' }, + { + status: 429, + headers: { + 'Retry-After': rate.resetSeconds.toString(), + 'X-RateLimit-Limit': limit.toString(), + 'X-RateLimit-Remaining': rate.remaining.toString(), + }, + } + ) + } + } + const db = createServiceClient() // Timestamp check: reject if >5 minutes old @@ -143,14 +177,21 @@ export async function POST(req: NextRequest) { // Fetch meter + cooperative const { data: meter } = await db .from('meters') - .select('id, pubkey_hex, cooperative_id, cooperatives(admin_address)') + .select('id, pubkey_hex, cooperative_id, api_key, cooperatives(admin_address)') .eq('id', meter_id) .eq('active', true) - .single() as { data: { id: string; pubkey_hex: string; cooperative_id: string; cooperatives: { admin_address: string } | null } | null } + .single() as { data: { id: string; pubkey_hex: string; cooperative_id: string; api_key: string; cooperatives: { admin_address: string } | null } | null } if (!meter) { - log.warn('readings.post.meter_not_found', { meter_id }) - return NextResponse.json({ error: 'Meter not found or inactive' }, { status: 404 }) + log.warn('readings.post.meter_not_found_or_revoked', { meter_id }) + return NextResponse.json({ error: 'Meter not found, inactive, or revoked' }, { status: 404 }) + } + + // Validate API key before Ed25519 signature check + const apiKey = req.headers.get('x-api-key') + if (!apiKey || apiKey !== meter.api_key) { + log.warn('readings.post.invalid_api_key', { meter_id }) + return NextResponse.json({ error: 'Invalid or missing API key' }, { status: 401 }) } // Rate limit: 60 requests/minute per meter public key @@ -179,7 +220,7 @@ export async function POST(req: NextRequest) { return NextResponse.json({ error: 'Invalid meter signature' }, { status: 401 }) } - // Persist reading (anchored/minted will be updated by the background job) + // Persist reading; Stellar anchor + mint will be processed asynchronously. const { data: reading, error: readingErr } = await db .from('readings') .insert({ @@ -199,57 +240,27 @@ export async function POST(req: NextRequest) { return NextResponse.json({ error: 'Failed to save reading' }, { status: 500 }) } - // Anchor on-chain (hash only — full payload already in Supabase) - let anchorTxHash: string - try { - anchorTxHash = await anchorReading({ readingHash, nonce }) - await db.from('readings').update({ anchored: true, anchor_tx_hash: anchorTxHash }).eq('id', reading.id) - log.info('readings.post.anchored', { reading_id: reading.id, anchor_tx_hash: anchorTxHash }) - void fireWebhook(meter.cooperative_id, 'anchor', { reading_id: reading.id, anchor_tx_hash: anchorTxHash }) - } catch (err) { - if (isAlreadyAnchoredError(err)) { - log.warn('readings.post.already_anchored', { reading_id: reading.id }) - return NextResponse.json({ error: 'Reading already anchored', reading_id: reading.id }, { status: 409 }) - } - const message = extractErrorMessage(err) - log.error('readings.post.anchor_failed', { reading_id: reading.id, error: message }) - return NextResponse.json({ error: message, reading_id: reading.id }, { status: 500 }) + const cooperative = meter.cooperatives as { admin_address: string } | null + const recipient = cooperative?.admin_address + if (!recipient) { + log.error('readings.post.missing_recipient', { reading_id: reading.id, cooperative_id: meter.cooperative_id }) + return NextResponse.json({ error: 'No cooperative admin address' }, { status: 500 }) } - // Mint certificates - try { - const cooperative = meter.cooperatives as { admin_address: string } | null - const recipient = cooperative?.admin_address - if (!recipient) throw new Error('No cooperative admin address') - - const mintTxHash = await mintCertificates(recipient, kwh) - await db.from('readings').update({ minted: true, mint_tx_hash: mintTxHash }).eq('id', reading.id) - await db.from('certificates').insert({ - cooperative_id: meter.cooperative_id, - reading_id: reading.id, - reading_hash: readingHash.toString('hex'), - anchor_tx_hash: anchorTxHash, - mint_tx_hash: mintTxHash, - kwh, - issued_at: new Date().toISOString(), - retired: false, - }) + const jobId = await enqueue('anchor_and_mint', { + readingId: reading.id, + readingHashHex: readingHash.toString('hex'), + recipientAddress: recipient, + kwh, + correlationId, + }) - // Invalidate any stale cache entries for this certificate - await invalidateCert(reading.id, readingHash.toString('hex'), mintTxHash) + log.info('readings.post.enqueued', { reading_id: reading.id, job_id: jobId }) - log.info('readings.post.minted', { reading_id: reading.id, mint_tx_hash: mintTxHash, kwh }) - void fireWebhook(meter.cooperative_id, 'mint', { reading_id: reading.id, mint_tx_hash: mintTxHash, kwh }) - - const responseBody = { reading_id: reading.id, anchor_tx_hash: anchorTxHash, mint_tx_hash: mintTxHash } - if (idempotencyKey) { - await storeIdempotentResponse(idempotencyKey, { body: responseBody, status: 201 }) - } - return NextResponse.json(responseBody, { status: 201 }) - } catch (err) { - const message = err instanceof Error ? err.message : 'Mint failed' - log.error('readings.post.mint_failed', { reading_id: reading.id, error: message }) - const diagnosis = await diagnoseMintFailure(reading.id, meter.cooperative_id, message) - return NextResponse.json({ error: message, reading_id: reading.id, anchor_tx_hash: anchorTxHash, diagnosis }, { status: 500 }) + const responseBody = { reading_id: reading.id, job_id: jobId } + if (idempotencyKey) { + await storeIdempotentResponse(idempotencyKey, { body: responseBody, status: 202 }) } + + return NextResponse.json(responseBody, { status: 202 }) } diff --git a/apps/web/src/app/api/ready/route.test.ts b/apps/web/src/app/api/ready/route.test.ts new file mode 100644 index 0000000..bb3611b --- /dev/null +++ b/apps/web/src/app/api/ready/route.test.ts @@ -0,0 +1,38 @@ +import { describe, it, expect, vi, beforeEach } from 'vitest' + +vi.mock('@/lib/supabase', () => ({ createServiceClient: vi.fn() })) + +import { createServiceClient } from '@/lib/supabase' +import { GET } from '@/app/api/ready/route' + +function mockDb(error: unknown = null) { + vi.mocked(createServiceClient).mockReturnValue({ + from: vi.fn().mockReturnValue({ + select: vi.fn().mockReturnValue({ + limit: vi.fn().mockResolvedValue({ data: [{ id: '1' }], error }), + }), + }), + } as ReturnType) +} + +beforeEach(() => vi.clearAllMocks()) + +describe('GET /api/ready', () => { + it('returns 200 when DB is healthy', async () => { + mockDb() + const res = await GET() + expect(res.status).toBe(200) + const body = await res.json() + expect(body.status).toBe('ok') + expect(body.checks.db).toBe(true) + }) + + it('returns 503 when DB check fails', async () => { + mockDb({ message: 'connection refused' }) + const res = await GET() + expect(res.status).toBe(503) + const body = await res.json() + expect(body.status).toBe('degraded') + expect(body.checks.db).toBe(false) + }) +}) diff --git a/apps/web/src/app/api/v1/certificates/[id]/irec-export/route.ts b/apps/web/src/app/api/v1/certificates/[id]/irec-export/route.ts new file mode 100644 index 0000000..b8fe94f --- /dev/null +++ b/apps/web/src/app/api/v1/certificates/[id]/irec-export/route.ts @@ -0,0 +1 @@ +export { GET } from '@/app/api/certificates/[id]/irec-export/route' diff --git a/apps/web/src/app/api/v1/certificates/[id]/transfer/route.ts b/apps/web/src/app/api/v1/certificates/[id]/transfer/route.ts new file mode 100644 index 0000000..33b19e1 --- /dev/null +++ b/apps/web/src/app/api/v1/certificates/[id]/transfer/route.ts @@ -0,0 +1 @@ +export { POST } from '@/app/api/certificates/[id]/transfer/route' diff --git a/apps/web/src/app/api/v1/webhooks/logs/route.ts b/apps/web/src/app/api/v1/webhooks/logs/route.ts new file mode 100644 index 0000000..20dfb9e --- /dev/null +++ b/apps/web/src/app/api/v1/webhooks/logs/route.ts @@ -0,0 +1 @@ +export { GET } from '@/app/api/webhooks/logs/route' diff --git a/apps/web/src/app/api/v1/webhooks/route.ts b/apps/web/src/app/api/v1/webhooks/route.ts new file mode 100644 index 0000000..5f722bc --- /dev/null +++ b/apps/web/src/app/api/v1/webhooks/route.ts @@ -0,0 +1 @@ +export { POST, GET } from '@/app/api/webhooks/route' diff --git a/apps/web/src/app/api/verify/[id]/route.test.ts b/apps/web/src/app/api/verify/[id]/route.test.ts index 3acda18..3169f5f 100644 --- a/apps/web/src/app/api/verify/[id]/route.test.ts +++ b/apps/web/src/app/api/verify/[id]/route.test.ts @@ -1,14 +1,14 @@ import { describe, it, expect, vi, beforeEach } from 'vitest' import { NextRequest } from 'next/server' -vi.mock('@/lib/supabase', () => ({ createServiceClient: vi.fn() })) +vi.mock('@/lib/supabase', () => ({ createAnonClient: vi.fn(), createServiceClient: vi.fn() })) vi.mock('@/lib/cache', () => ({ getCachedCert: vi.fn().mockResolvedValue(null), setCachedCert: vi.fn().mockResolvedValue(undefined), })) import { GET } from '@/app/api/verify/[id]/route' -import { createServiceClient } from '@/lib/supabase' +import { createAnonClient } from '@/lib/supabase' import { getCachedCert } from '@/lib/cache' const VALID_UUID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' @@ -44,7 +44,7 @@ describe('GET /api/verify/[id]', () => { it('returns 404 when certificate not found', async () => { const from = makeDb(null, null) - vi.mocked(createServiceClient).mockReturnValue({ from } as never) + vi.mocked(createAnonClient).mockReturnValue({ from } as never) const res = await GET(makeRequest(VALID_UUID), makeParams(VALID_UUID)) expect(res.status).toBe(404) }) @@ -69,7 +69,7 @@ describe('GET /api/verify/[id]', () => { timestamp: '2026-01-01T00:00:00Z', } const from = makeDb(cert, reading) - vi.mocked(createServiceClient).mockReturnValue({ from } as never) + vi.mocked(createAnonClient).mockReturnValue({ from } as never) const res = await GET(makeRequest(VALID_UUID), makeParams(VALID_UUID)) expect(res.status).toBe(200) const body = await res.json() @@ -90,7 +90,7 @@ describe('GET /api/verify/[id]', () => { it('accepts a 64-char hex hash as id', async () => { const from = makeDb(null, null) - vi.mocked(createServiceClient).mockReturnValue({ from } as never) + vi.mocked(createAnonClient).mockReturnValue({ from } as never) const res = await GET(makeRequest(VALID_HASH), makeParams(VALID_HASH)) expect(res.status).toBe(404) }) diff --git a/apps/web/src/app/api/verify/[id]/route.ts b/apps/web/src/app/api/verify/[id]/route.ts index d8708cb..ed9d3ac 100644 --- a/apps/web/src/app/api/verify/[id]/route.ts +++ b/apps/web/src/app/api/verify/[id]/route.ts @@ -1,5 +1,5 @@ import { NextRequest, NextResponse } from 'next/server' -import { createServiceClient } from '@/lib/supabase' +import { createAnonClient } from '@/lib/supabase' import { getCachedCert, setCachedCert } from '@/lib/cache' /** @@ -33,7 +33,7 @@ export async function GET( }) } - const db = createServiceClient() + const db = createAnonClient() let cert = null for (const column of ['id', 'reading_hash', 'mint_tx_hash'] as const) { const { data } = await db.from('certificates').select('*').eq(column, id).maybeSingle() diff --git a/apps/web/src/app/api/verify/route.test.ts b/apps/web/src/app/api/verify/route.test.ts index 994df28..6a0f391 100644 --- a/apps/web/src/app/api/verify/route.test.ts +++ b/apps/web/src/app/api/verify/route.test.ts @@ -3,6 +3,7 @@ import { NextRequest } from 'next/server' // Mock Supabase and cache before importing the route vi.mock('@/lib/supabase', () => ({ + createAnonClient: vi.fn(), createServiceClient: vi.fn(), })) vi.mock('@/lib/cache', () => ({ @@ -11,7 +12,7 @@ vi.mock('@/lib/cache', () => ({ })) import { GET } from '@/app/api/verify/route' -import { createServiceClient } from '@/lib/supabase' +import { createAnonClient } from '@/lib/supabase' import { getCachedCert } from '@/lib/cache' const VALID_UUID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' @@ -51,7 +52,7 @@ describe('GET /api/verify', () => { it('returns 404 when certificate not found', async () => { const from = makeDb(null, null) - vi.mocked(createServiceClient).mockReturnValue({ from } as never) + vi.mocked(createAnonClient).mockReturnValue({ from } as never) const res = await GET(makeRequest(VALID_UUID)) expect(res.status).toBe(404) }) @@ -76,7 +77,7 @@ describe('GET /api/verify', () => { timestamp: '2026-01-01T00:00:00Z', } const from = makeDb(cert, reading) - vi.mocked(createServiceClient).mockReturnValue({ from } as never) + vi.mocked(createAnonClient).mockReturnValue({ from } as never) const res = await GET(makeRequest(VALID_UUID)) expect(res.status).toBe(200) const body = await res.json() @@ -96,7 +97,7 @@ describe('GET /api/verify', () => { it('accepts a 64-char hex hash as id', async () => { const from = makeDb(null, null) - vi.mocked(createServiceClient).mockReturnValue({ from } as never) + vi.mocked(createAnonClient).mockReturnValue({ from } as never) const res = await GET(makeRequest(VALID_HASH)) expect(res.status).toBe(404) }) diff --git a/apps/web/src/app/api/verify/route.ts b/apps/web/src/app/api/verify/route.ts index 4ae5e0a..6623b3e 100644 --- a/apps/web/src/app/api/verify/route.ts +++ b/apps/web/src/app/api/verify/route.ts @@ -1,6 +1,6 @@ import { NextRequest, NextResponse } from 'next/server' import { z } from 'zod' -import { createServiceClient } from '@/lib/supabase' +import { createAnonClient } from '@/lib/supabase' import { getCachedCert, setCachedCert } from '@/lib/cache' import { stellarExplorerUrl, type NetworkName } from '@solarproof/stellar' import { env } from '@/env' @@ -37,7 +37,7 @@ export async function GET(req: NextRequest) { // Try certificate ID first, then reading_hash, then mint_tx_hash // Use separate parameterised filters instead of raw .or() interpolation - const db = createServiceClient() + const db = createAnonClient() let cert = null for (const column of ['id', 'reading_hash', 'mint_tx_hash'] as const) { const { data } = await db.from('certificates').select('*').eq(column, id).maybeSingle() diff --git a/apps/web/src/app/api/webhooks/logs/route.ts b/apps/web/src/app/api/webhooks/logs/route.ts new file mode 100644 index 0000000..8a1f0fb --- /dev/null +++ b/apps/web/src/app/api/webhooks/logs/route.ts @@ -0,0 +1,30 @@ +import { NextRequest, NextResponse } from 'next/server' +import { createServiceClient } from '@/lib/supabase' + +/** + * GET /api/webhooks/logs?endpoint_id=UUID&limit=50 + * + * Returns webhook delivery log entries for a given endpoint. + * Ordered by most recent first. + */ +export async function GET(req: NextRequest) { + const { searchParams } = req.nextUrl + const endpointId = searchParams.get('endpoint_id') + const limit = Math.min(Number(searchParams.get('limit') ?? 50), 200) + + if (!endpointId) { + return NextResponse.json({ error: 'endpoint_id is required' }, { status: 400 }) + } + + const db = createServiceClient() + const { data, error } = await db + .from('webhook_logs') + .select('id, endpoint_id, event, status, attempts, response_status, created_at') + .eq('endpoint_id', endpointId) + .order('created_at', { ascending: false }) + .limit(limit) + + if (error) return NextResponse.json({ error: error.message }, { status: 500 }) + + return NextResponse.json({ data: data ?? [] }) +} diff --git a/apps/web/src/app/api/webhooks/route.ts b/apps/web/src/app/api/webhooks/route.ts index dbe8b0c..87c9f02 100644 --- a/apps/web/src/app/api/webhooks/route.ts +++ b/apps/web/src/app/api/webhooks/route.ts @@ -2,7 +2,15 @@ import { NextRequest, NextResponse } from 'next/server' import { z } from 'zod' import { createServiceClient } from '@/lib/supabase' -const VALID_EVENTS = ['anchor', 'mint', 'retire'] as const +const VALID_EVENTS = [ + 'anchor', + 'mint', + 'retire', + 'mint_failed', + 'certificate.minted', + 'certificate.transferred', + 'certificate.retired', +] as const const WebhookSchema = z.object({ cooperative_id: z.string().uuid(), @@ -16,6 +24,7 @@ const WebhookSchema = z.object({ * * Register a webhook endpoint for a cooperative. * Body: { cooperative_id, url, secret, events } + * Supported events: certificate.minted, certificate.transferred, certificate.retired */ export async function POST(req: NextRequest) { const body = await req.json().catch(() => null) @@ -37,3 +46,26 @@ export async function POST(req: NextRequest) { return NextResponse.json(data, { status: 201 }) } + +/** + * GET /api/webhooks?cooperative_id=UUID + * + * List registered webhook endpoints for a cooperative. + */ +export async function GET(req: NextRequest) { + const cooperativeId = req.nextUrl.searchParams.get('cooperative_id') + if (!cooperativeId) { + return NextResponse.json({ error: 'cooperative_id is required' }, { status: 400 }) + } + + const db = createServiceClient() + const { data, error } = await db + .from('webhook_endpoints') + .select('id, cooperative_id, url, events, active, created_at') + .eq('cooperative_id', cooperativeId) + .order('created_at', { ascending: false }) + + if (error) return NextResponse.json({ error: error.message }, { status: 500 }) + + return NextResponse.json({ data: data ?? [] }) +} diff --git a/apps/web/src/app/certificate/[id]/page.tsx b/apps/web/src/app/certificate/[id]/page.tsx index 927af10..d689032 100644 --- a/apps/web/src/app/certificate/[id]/page.tsx +++ b/apps/web/src/app/certificate/[id]/page.tsx @@ -76,7 +76,7 @@ export default async function CertificatePage({ hash: reading?.reading_hash ?? null, hashLabel: 'Reading hash', status: reading ? 'done' : 'pending', - detail: reading ? `${reading.kwh} kWh · Meter ${reading.meter_id}` : undefined, + detail: reading ? `${Number(reading.kwh).toFixed(3)} kWh · Meter ${reading.meter_id}` : undefined, }, { icon: ShieldCheck, @@ -104,7 +104,7 @@ export default async function CertificatePage({ hashLabel: 'Mint tx', explorerUrl: `https://stellar.expert/explorer/testnet/tx/${cert.mint_tx_hash}`, status: 'done', - detail: `${cert.kwh} kWh`, + detail: `${Number(cert.kwh).toFixed(3)} kWh`, }, { icon: FlameKindling, @@ -150,7 +150,7 @@ export default async function CertificatePage({ ) : ( )}
diff --git a/apps/web/src/app/certificates/page.tsx b/apps/web/src/app/certificates/page.tsx index 1cd4709..7960dc5 100644 --- a/apps/web/src/app/certificates/page.tsx +++ b/apps/web/src/app/certificates/page.tsx @@ -3,12 +3,15 @@ import { useCallback, useState } from 'react' import { useQuery, useQueryClient } from '@tanstack/react-query' import { useRouter, usePathname, useSearchParams } from 'next/navigation' -import { Award, Leaf, Search, X } from 'lucide-react' +import { Award, Leaf, Search, X, FileDown } from 'lucide-react' import { RetireModal } from '@/components/retire-modal' +import { TransferModal } from '@/components/transfer-modal' import { useToast } from '@/components/toast' import { useWallet } from '@/hooks/useWallet' import { WalletGate } from '@/components/wallet-gate' +const MAX_BULK = 100 + interface Certificate { id: string kwh: number @@ -40,6 +43,8 @@ export default function CertificatesPage() { const { toast, dismiss } = useToast() const { address, connected } = useWallet() const [retiring, setRetiring] = useState(null) + const [selected, setSelected] = useState>(new Set()) + const [bulkRetiring, setBulkRetiring] = useState(false) // Read filter state from URL const q = searchParams.get('q') ?? '' @@ -89,6 +94,30 @@ export default function CertificatesPage() { [draft, searchParams] ) + async function handleTransfer(toAddress: string) { + if (!transferring) return + const pendingId = toast('pending', 'Submitting transfer transaction…') + try { + const res = await fetch(`/api/certificates/${transferring.id}/transfer`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ from_address: address, to_address: toAddress }), + }) + dismiss(pendingId) + if (!res.ok) { + const { error: msg } = await res.json().catch(() => ({ error: 'Unknown error' })) + toast('error', msg ?? 'Transfer failed') + return + } + toast('success', 'Certificate transferred successfully') + setTransferring(null) + qc.invalidateQueries({ queryKey: ['certificates'] }) + } catch (err) { + dismiss(pendingId) + toast('error', err instanceof Error ? err.message : 'Transfer failed') + } + } + async function handleRetire(reason: string) { if (!retiring) return const pendingId = toast('pending', 'Submitting retirement transaction…') @@ -113,6 +142,53 @@ export default function CertificatesPage() { } } + const activeData = data.filter((c) => !c.retired) + + function toggleSelect(id: string) { + setSelected((prev) => { + const next = new Set(prev) + next.has(id) ? next.delete(id) : next.add(id) + return next + }) + } + + function toggleSelectAll() { + const activeIds = activeData.map((c) => c.id) + const allSelected = activeIds.every((id) => selected.has(id)) + setSelected(allSelected ? new Set() : new Set(activeIds.slice(0, MAX_BULK))) + } + + async function handleBulkRetire() { + if (!selected.size || !address) return + setBulkRetiring(true) + const pendingId = toast('pending', `Retiring ${selected.size} certificate(s)…`) + try { + const res = await fetch('/api/certificates/retire/bulk', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ certificate_ids: [...selected], wallet_address: address }), + }) + dismiss(pendingId) + const json = await res.json().catch(() => ({})) + const { summary } = json + if (summary) { + toast( + summary.failed === 0 ? 'success' : 'error', + `${summary.succeeded} retired, ${summary.failed} failed` + ) + } else { + toast('error', 'Bulk retirement failed') + } + setSelected(new Set()) + qc.invalidateQueries({ queryKey: ['certificates'] }) + } catch (err) { + dismiss(pendingId) + toast('error', err instanceof Error ? err.message : 'Bulk retirement failed') + } finally { + setBulkRetiring(false) + } + } + return (
@@ -205,6 +281,29 @@ export default function CertificatesPage() { )}
+ {/* Bulk retire bar */} + {selected.size > 0 && ( +
+ + {selected.size} certificate{selected.size !== 1 ? 's' : ''} selected + + + +
+ )} + {error && (

Failed to load certificates. @@ -220,6 +319,15 @@ export default function CertificatesPage() { > + + 0 && activeData.every((c) => selected.has(c.id))} + onChange={toggleSelectAll} + className="h-4 w-4 rounded border-gray-300 text-green-600 focus:ring-green-500" + /> + {['Certificate ID', 'Meter ID', 'kWh', 'Issued', 'Status', 'Action'].map((h) => ( {isLoading ? ( - + Loading… ) : data.length > 0 ? ( data.map((cert) => ( + + {!cert.retired && ( + toggleSelect(cert.id)} + className="h-4 w-4 rounded border-gray-300 text-green-600 focus:ring-green-500" + /> + )} + {cert.id.slice(0, 8)}… {cert.meter_id ? `${cert.meter_id.slice(0, 8)}…` : '—'} - {cert.kwh} + {cert.kwh.toFixed(3)} {new Date(cert.issued_at).toLocaleDateString()} @@ -266,21 +385,40 @@ export default function CertificatesPage() { {!cert.retired && ( - +

+ + + + +
)} )) ) : ( - + No certificates found. @@ -298,6 +436,15 @@ export default function CertificatesPage() { onClose={() => setRetiring(null)} /> )} + + {transferring && ( + setTransferring(null)} + /> + )}
) diff --git a/apps/web/src/app/dashboard/page.tsx b/apps/web/src/app/dashboard/page.tsx index dfb0619..67fc184 100644 --- a/apps/web/src/app/dashboard/page.tsx +++ b/apps/web/src/app/dashboard/page.tsx @@ -127,12 +127,16 @@ function groupByPeriod(readings: Reading[], period: Period): { date: string; kwh .map(([date, kwh]) => ({ date, kwh: Math.round(kwh * 100) / 100 })) } -function groupByMeter(readings: Reading[]): { meter: string; verified: number; unverified: number }[] { +function groupByMeter( + readings: Reading[], + meters: Record +): { meter: string; verified: number; unverified: number }[] { const map: Record = {} for (const r of readings) { - if (!map[r.meter_id]) map[r.meter_id] = { verified: 0, unverified: 0 } - if (r.verified) map[r.meter_id].verified += r.kwh - else map[r.meter_id].unverified += r.kwh + const label = meters[r.meter_id] || r.meter_id.slice(0, 8) + if (!map[label]) map[label] = { verified: 0, unverified: 0 } + if (r.verified) map[label].verified += r.kwh + else map[label].unverified += r.kwh } return Object.entries(map).map(([meter, counts]) => ({ meter, @@ -180,9 +184,23 @@ export default function DashboardPage() { refetchInterval: isConnected ? false : 30000, }) + const { data: metersData } = useQuery({ + queryKey: ['meters'], + queryFn: async () => { + const res = await fetch('/api/meters') + if (!res.ok) return [] + return res.json() + }, + }) + + const meterMap = (metersData || []).reduce((acc: Record, m: any) => { + acc[m.id] = m.name || m.serial_number + return acc + }, {}) + const colors = useChartColors() const chartData = readings ? groupByPeriod(readings, period) : [] - const meterData = readings ? groupByMeter(readings) : [] + const meterData = readings ? groupByMeter(readings, meterMap) : [] return ( @@ -359,7 +377,7 @@ export default function DashboardPage() { > - {['Meter ID', 'kWh', 'Timestamp', 'Status'].map((h) => ( + {['Meter', 'kWh', 'Timestamp', 'Status'].map((h) => ( {h} @@ -377,7 +395,7 @@ export default function DashboardPage() { style={{ animationDelay: `${index * 50}ms` }} > {r.meter_id} - {r.kwh} + {r.kwh.toFixed(3)} {new Date(r.timestamp).toLocaleString()} diff --git a/apps/web/src/app/governance/page.tsx b/apps/web/src/app/governance/page.tsx index 520b34c..231ae1c 100644 --- a/apps/web/src/app/governance/page.tsx +++ b/apps/web/src/app/governance/page.tsx @@ -211,8 +211,8 @@ function ProposalCard({ // ── Create Proposal Form ─────────────────────────────────────────────────────── -interface FormState { title: string; description: string; days: string } -const EMPTY: FormState = { title: '', description: '', days: '7' } +interface FormState { title: string; description: string; days: string; action: string } +const EMPTY: FormState = { title: '', description: '', days: '7', action: '' } function CreateProposalForm({ onCreated }: { onCreated: (p: Proposal) => void }) { const { connected, connect } = useWallet() @@ -227,6 +227,7 @@ function CreateProposalForm({ onCreated }: { onCreated: (p: Proposal) => void }) if (!form.description.trim()) e.description = 'Description is required.' const d = Number(form.days) if (!form.days || isNaN(d) || d < 1 || d > 30) e.days = 'Enter a number between 1 and 30.' + if (!form.action.trim()) e.action = 'Proposed action is required.' setErrors(e) return Object.keys(e).length === 0 } @@ -302,7 +303,22 @@ function CreateProposalForm({ onCreated }: { onCreated: (p: Proposal) => void }) /> - + + setForm((f) => ({ ...f, action: e.target.value }))} + maxLength={200} + aria-required="true" + aria-describedby={errors.action ? 'prop-action-err' : undefined} + aria-invalid={!!errors.action} + placeholder="e.g. update_param, call_contract, transfer_funds" + className="input-base" + /> + + + { @@ -22,9 +25,12 @@ async function fetchMeters(): Promise { } async function registerMeter(body: { + name: string cooperative_id: string serial_number: string pubkey_hex: string + meter_group?: string + tags?: string[] }): Promise { const res = await fetch('/api/meters', { method: 'POST', @@ -47,13 +53,37 @@ async function revokeMeter(id: string): Promise { // Register form // --------------------------------------------------------------------------- function RegisterForm({ onSuccess }: { onSuccess: () => void }) { - const [form, setForm] = useState({ cooperative_id: '', serial_number: '', pubkey_hex: '' }) + const [form, setForm] = useState({ + name: '', + cooperative_id: '', + serial_number: '', + pubkey_hex: '', + meter_group: '', + tags: '', + }) const [error, setError] = useState('') const mutation = useMutation({ - mutationFn: registerMeter, + mutationFn: (data: typeof form) => + registerMeter({ + ...data, + tags: data.tags + ? data.tags + .split(',') + .map((t) => t.trim()) + .filter(Boolean) + : [], + meter_group: data.meter_group || undefined, + }), onSuccess: () => { - setForm({ cooperative_id: '', serial_number: '', pubkey_hex: '' }) + setForm({ + name: '', + cooperative_id: '', + serial_number: '', + pubkey_hex: '', + meter_group: '', + tags: '', + }) setError('') onSuccess() }, @@ -76,7 +106,25 @@ function RegisterForm({ onSuccess }: { onSuccess: () => void }) { Register new meter -
+
+
+ + setForm((f) => ({ ...f, name: e.target.value }))} + placeholder="Solar Array A - Meter 1" + className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-gray-900 placeholder-gray-400 focus:outline-none focus:ring-2 focus:ring-yellow-400 dark:border-gray-700 dark:bg-gray-800 dark:text-gray-100" + /> +
+
+ +
+ + setForm((f) => ({ ...f, meter_group: e.target.value }))} + placeholder="North Farm" + className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-gray-900 placeholder-gray-400 focus:outline-none focus:ring-2 focus:ring-yellow-400 dark:border-gray-700 dark:bg-gray-800 dark:text-gray-100" + /> +
+ +
+ + setForm((f) => ({ ...f, tags: e.target.value }))} + placeholder="residential, phase-1" + className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-gray-900 placeholder-gray-400 focus:outline-none focus:ring-2 focus:ring-yellow-400 dark:border-gray-700 dark:bg-gray-800 dark:text-gray-100" + /> +
{error && ( @@ -295,7 +377,7 @@ export default function MetersPage() { > - {['Serial number', 'Public key', 'Status', 'Registered', 'Actions'].map((h) => ( + {['Name', 'Serial number', 'Group', 'Labels', 'Status', 'Actions'].map((h) => ( {isLoading ? ( - + Loading… @@ -320,10 +402,29 @@ export default function MetersPage() { className="transition-colors hover:bg-gray-50 dark:hover:bg-gray-800/40" > + {m.name} + + {m.serial_number} - + {m.meter_group || None} + + +
+ {m.tags.length > 0 ? ( + m.tags.map((tag) => ( + + {tag} + + )) + ) : ( + — + )} +
- - {new Date(m.created_at).toLocaleDateString()} - {m.active && ( +
+ + +
+

+ Current theme: {theme || 'system'} +

+

+ SolarProof stores your theme selection in localStorage under solarproof-theme. +

+
+
+
+ ) +} diff --git a/apps/web/src/app/verify/page.tsx b/apps/web/src/app/verify/page.tsx index 1944509..d6189f2 100644 --- a/apps/web/src/app/verify/page.tsx +++ b/apps/web/src/app/verify/page.tsx @@ -5,6 +5,7 @@ import { useSearchParams, useRouter } from 'next/navigation' import { Search, CheckCircle, XCircle, Shield, ExternalLink, Copy } from 'lucide-react' import { SectionSkeleton } from '@/components/skeleton' import { CopyableText } from '@/components/copy-button' +import { useToast } from '@/components/ToastProvider' interface ChainOfCustody { certificate: { @@ -54,7 +55,7 @@ function buildSteps(data: ChainOfCustody): Step[] { label: 'Meter Reading', description: 'Physical meter recorded a signed energy reading.', status: mp ? 'pass' : 'fail', - detail: mp ? `${mp.kwh} kWh · Meter ${mp.meter_id}` : 'No meter proof found.', + detail: mp ? `${Number(mp.kwh).toFixed(3)} kWh · Meter ${mp.meter_id}` : 'No meter proof found.', }, { id: 'signature', @@ -81,7 +82,7 @@ function buildSteps(data: ChainOfCustody): Step[] { description: 'Energy token (1 token = 1 kWh) minted on Stellar.', status: data.on_chain.mint_tx ? 'pass' : 'fail', detail: data.on_chain.mint_tx - ? `Tx ${data.on_chain.mint_tx.slice(0, 12)}… · ${data.certificate.kwh} kWh` + ? `Tx ${data.on_chain.mint_tx.slice(0, 12)}… · ${Number(data.certificate.kwh).toFixed(3)} kWh` : 'Mint transaction not found.', link: data.on_chain.mint_explorer, }, @@ -105,6 +106,7 @@ export default function VerifyPage() { const [error, setError] = useState(null) const [loading, setLoading] = useState(false) const [copied, setCopied] = useState(false) + const { pushToast: toast } = useToast() async function handleVerify(e: React.FormEvent) { e.preventDefault() @@ -120,12 +122,12 @@ export default function VerifyPage() { if (!res.ok) { const message = data.error || 'Unable to verify certificate' setError(message) - pushToast({ variant: 'error', title: 'Verification failed', description: message }) + toast({ variant: 'error', title: 'Verification failed', description: message }) return } setResult(data) - pushToast({ variant: 'success', title: 'Certificate verified', description: 'Full chain of custody confirmed.' }) + toast({ variant: 'success', title: 'Certificate verified', description: 'Full chain of custody confirmed.' }) } catch { setError('Network error — please try again.') } finally { @@ -283,7 +285,7 @@ export default function VerifyPage() { })} - {result.meter_proof && ( + {result?.meter_proof && (
- + +

{title}

+
{children}
+
+ ) +} + function StepIcon({ status }: { status: StepStatus }) { if (status === 'pass') return (
) -} - {link ? ( -
- - {value} - -
- ) : ( -
- {value} -
- )} -
- ) } diff --git a/apps/web/src/components/DashboardChart.tsx b/apps/web/src/components/DashboardChart.tsx index 2e82e48..93a8f09 100644 --- a/apps/web/src/components/DashboardChart.tsx +++ b/apps/web/src/components/DashboardChart.tsx @@ -1,26 +1,138 @@ 'use client' +import { useEffect, useRef, useState, useCallback } from 'react' import { Area, AreaChart, CartesianGrid, ResponsiveContainer, Tooltip, XAxis, YAxis } from 'recharts' +import { Wifi, WifiOff, Radio } from 'lucide-react' -const data = [ - { day: 'Mon', energy: 14 }, - { day: 'Tue', energy: 18 }, - { day: 'Wed', energy: 16 }, - { day: 'Thu', energy: 22 }, - { day: 'Fri', energy: 20 }, - { day: 'Sat', energy: 26 }, - { day: 'Sun', energy: 24 }, -] +interface ChartPoint { + label: string + energy: number +} + +const POLL_INTERVAL_MS = 30_000 + +async function fetchRecentReadings(): Promise { + try { + const res = await fetch('/api/readings?limit=20') + if (!res.ok) return [] + const json = await res.json() + const rows: { timestamp: string; kwh: number }[] = json.data ?? [] + return rows + .slice() + .reverse() + .map((r) => ({ + label: new Date(r.timestamp).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' }), + energy: r.kwh, + })) + } catch { + return [] + } +} + +type ConnectionStatus = 'connecting' | 'live' | 'polling' | 'error' export function DashboardChart() { + const [data, setData] = useState([]) + const [status, setStatus] = useState('connecting') + const wsRef = useRef(null) + const pollRef = useRef | null>(null) + const mountedRef = useRef(true) + + const startPolling = useCallback(() => { + if (pollRef.current) return + setStatus('polling') + fetchRecentReadings().then((d) => { if (mountedRef.current && d.length) setData(d) }) + pollRef.current = setInterval(() => { + fetchRecentReadings().then((d) => { if (mountedRef.current && d.length) setData(d) }) + }, POLL_INTERVAL_MS) + }, []) + + const stopPolling = useCallback(() => { + if (pollRef.current) { clearInterval(pollRef.current); pollRef.current = null } + }, []) + + const appendReading = useCallback((kwh: number, timestamp: string) => { + setData((prev) => { + const point: ChartPoint = { + label: new Date(timestamp).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' }), + energy: kwh, + } + const next = [...prev, point] + return next.length > 20 ? next.slice(next.length - 20) : next + }) + }, []) + + useEffect(() => { + mountedRef.current = true + + // Load initial data via REST + fetchRecentReadings().then((d) => { if (mountedRef.current && d.length) setData(d) }) + + // Attempt WebSocket connection + try { + const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:' + const ws = new WebSocket(`${protocol}//${window.location.host}/api/ws/readings`) + wsRef.current = ws + + ws.onopen = () => { + if (!mountedRef.current) return + setStatus('live') + stopPolling() + } + + ws.onmessage = (event) => { + if (!mountedRef.current) return + try { + const reading = JSON.parse(event.data as string) + appendReading(reading.kwh, reading.timestamp) + } catch { /* ignore malformed messages */ } + } + + ws.onerror = () => { + if (!mountedRef.current) return + setStatus('error') + startPolling() + } + + ws.onclose = () => { + if (!mountedRef.current) return + if (status !== 'live') return + setStatus('polling') + startPolling() + } + } catch { + startPolling() + } + + return () => { + mountedRef.current = false + wsRef.current?.close() + wsRef.current = null + stopPolling() + } + // eslint-disable-next-line react-hooks/exhaustive-deps + }, []) + + const statusConfig: Record = { + connecting: { icon: , label: 'Connecting…', color: 'text-gray-400' }, + live: { icon: , label: 'Live', color: 'text-green-500' }, + polling: { icon: , label: 'Polling', color: 'text-amber-500' }, + error: { icon: , label: 'Offline', color: 'text-red-500' }, + } + + const { icon, label, color } = statusConfig[status] + return (

Energy trend

-

Weekly generation

+

Live generation

-

Responsive chart for mobile and desktop

+ + {icon} + {label} +
@@ -32,10 +144,10 @@ export function DashboardChart() { - + - +
diff --git a/apps/web/src/components/meter-reading-row.tsx b/apps/web/src/components/meter-reading-row.tsx index 41670b4..cc53aba 100644 --- a/apps/web/src/components/meter-reading-row.tsx +++ b/apps/web/src/components/meter-reading-row.tsx @@ -10,7 +10,7 @@ export function MeterReadingRow({ id, meter_id, kwh, timestamp, verified }: Mete return ( {meter_id} - {kwh} + {kwh.toFixed(3)} {new Date(timestamp).toLocaleString()} diff --git a/apps/web/src/components/navbar.tsx b/apps/web/src/components/navbar.tsx index b0936ef..f932bb6 100644 --- a/apps/web/src/components/navbar.tsx +++ b/apps/web/src/components/navbar.tsx @@ -7,11 +7,25 @@ import { useTheme } from 'next-themes' import { useEffect, useRef, useState } from 'react' import { useWallet } from '@/hooks/useWallet' import { env } from '@/env' +import { CopyButton } from '@/components/copy-button' +import { LanguageSwitcher } from '@/components/language-switcher' + +import { useTranslations } from 'next-intl' +import type { Locale } from '@/lib/locales' interface NavbarProps { locale: Locale } +const links = [ + { href: '/', labelKey: 'dashboard' }, + { href: '/meters', labelKey: 'meters' }, + { href: '/certificates', labelKey: 'certificates' }, + { href: '/governance', labelKey: 'governance' }, + { href: '/verify', labelKey: 'verify' }, + { href: '/admin', labelKey: 'admin' }, +] + const network = env.NEXT_PUBLIC_STELLAR_NETWORK function NetworkBadge() { @@ -37,7 +51,8 @@ function NetworkBadge() { ) } -export function Navbar() { +export function Navbar({ locale }: NavbarProps) { + const t = useTranslations('nav') const pathname = usePathname() const { resolvedTheme, setTheme } = useTheme() const [mounted, setMounted] = useState(false) @@ -51,6 +66,10 @@ export function Navbar() { setMounted(true) }, []) + function toggleTheme() { + setTheme(resolvedTheme === 'dark' ? 'light' : 'dark') + } + // Close menu on route change useEffect(() => { setMenuOpen(false) }, [pathname]) @@ -126,7 +145,7 @@ export function Navbar() { : 'text-gray-600 hover:text-gray-900 dark:text-gray-400 dark:hover:text-gray-100' }`} > - {l.label} + {t(l.labelKey as any)} ) })} @@ -148,7 +167,7 @@ export function Navbar() {
- -
{/* Mobile menu */} @@ -235,7 +244,7 @@ export function Navbar() { : 'text-gray-700 hover:bg-gray-100 hover:text-gray-900 dark:text-gray-300 dark:hover:bg-gray-800 dark:hover:text-gray-100' }`} > - {l.label} + {t(l.labelKey as any)} ) diff --git a/apps/web/src/components/retire-modal.tsx b/apps/web/src/components/retire-modal.tsx index d466c2c..b20571d 100644 --- a/apps/web/src/components/retire-modal.tsx +++ b/apps/web/src/components/retire-modal.tsx @@ -54,7 +54,7 @@ export function RetireModal({ certificateId, kwh, onConfirm, onClose }: Props) {

You are about to permanently retire certificate{' '} - {' '}({kwh} kWh). + {' '}({kwh.toFixed(3)} kWh). This action cannot be undone.

diff --git a/apps/web/src/components/skeleton.tsx b/apps/web/src/components/skeleton.tsx index 7155436..eb2981b 100644 --- a/apps/web/src/components/skeleton.tsx +++ b/apps/web/src/components/skeleton.tsx @@ -58,6 +58,33 @@ export function TableRowSkeleton({ cols = 4 }: { cols?: number }) { ) } +/** Skeleton for the certificate list page — card grid */ +export function CertificateListSkeleton({ count = 6 }: { count?: number }) { + return ( +
+ {Array.from({ length: count }).map((_, i) => ( + + ))} +
+ ) +} + /** Skeleton for a Section/Row panel (verify page style) */ export function SectionSkeleton({ rows = 4 }: { rows?: number }) { return ( diff --git a/apps/web/src/components/transfer-modal.tsx b/apps/web/src/components/transfer-modal.tsx new file mode 100644 index 0000000..2196c95 --- /dev/null +++ b/apps/web/src/components/transfer-modal.tsx @@ -0,0 +1,105 @@ +'use client' + +import { useState } from 'react' +import { X, ArrowRightLeft } from 'lucide-react' +import { CopyableText } from './copy-button' + +interface Props { + certificateId: string + kwh: number + onConfirm: (toAddress: string) => Promise + onClose: () => void +} + +export function TransferModal({ certificateId, kwh, onConfirm, onClose }: Props) { + const [toAddress, setToAddress] = useState('') + const [submitting, setSubmitting] = useState(false) + + async function handleSubmit(e: React.FormEvent) { + e.preventDefault() + setSubmitting(true) + try { + await onConfirm(toAddress.trim()) + } finally { + setSubmitting(false) + } + } + + return ( +
e.target === e.currentTarget && onClose()} + > +
+
+
+
+ +
+ +

+ Transfer certificate{' '} + + {' '}({kwh} kWh) to another Stellar account. +

+ +
+
+ + setToAddress(e.target.value)} + required + placeholder="G…" + className="w-full rounded-lg border border-gray-300 bg-white px-3 py-2 font-mono text-sm text-gray-900 placeholder-gray-400 focus:border-blue-400 focus:outline-none focus:ring-1 focus:ring-blue-400 dark:border-gray-700 dark:bg-gray-800 dark:text-gray-100 dark:placeholder-gray-500" + /> +
+ +
+ + +
+
+
+
+ ) +} diff --git a/apps/web/src/env.ts b/apps/web/src/env.ts index d71b246..097ffe6 100644 --- a/apps/web/src/env.ts +++ b/apps/web/src/env.ts @@ -4,6 +4,7 @@ import { z } from 'zod' export const env = createEnv({ server: { SUPABASE_SERVICE_ROLE_KEY: z.string().min(1), + ADMIN_SECRET: z.string().min(16).optional(), // Comma-separated list of allowed CORS origins. // Example: https://solarproof.vercel.app,https://staging.solarproof.vercel.app CORS_ALLOWED_ORIGINS: z.string().optional(), @@ -26,6 +27,7 @@ export const env = createEnv({ }, runtimeEnv: { SUPABASE_SERVICE_ROLE_KEY: process.env.SUPABASE_SERVICE_ROLE_KEY, + ADMIN_SECRET: process.env.ADMIN_SECRET, CORS_ALLOWED_ORIGINS: process.env.CORS_ALLOWED_ORIGINS, MINTER_SECRET_ARN: process.env.MINTER_SECRET_ARN, MINTER_PREVIOUS_SECRET_ARN: process.env.MINTER_PREVIOUS_SECRET_ARN, @@ -38,5 +40,7 @@ export const env = createEnv({ NEXT_PUBLIC_ENERGY_TOKEN_ID: process.env.NEXT_PUBLIC_ENERGY_TOKEN_ID, NEXT_PUBLIC_AUDIT_REGISTRY_ID: process.env.NEXT_PUBLIC_AUDIT_REGISTRY_ID, NEXT_PUBLIC_COMMUNITY_GOVERNANCE_ID: process.env.NEXT_PUBLIC_COMMUNITY_GOVERNANCE_ID, + READINGS_RATE_LIMIT_PER_MINUTE: process.env.READINGS_RATE_LIMIT_PER_MINUTE, + READINGS_RATE_LIMIT_WINDOW_SECONDS: process.env.READINGS_RATE_LIMIT_WINDOW_SECONDS, }, }) diff --git a/apps/web/src/lib/admin-auth.ts b/apps/web/src/lib/admin-auth.ts new file mode 100644 index 0000000..69ecc1d --- /dev/null +++ b/apps/web/src/lib/admin-auth.ts @@ -0,0 +1,16 @@ +import { NextRequest, NextResponse } from 'next/server' +import { env } from '@/env' + +/** Validate the admin bearer token. Returns 401 response on failure. */ +export function requireAdmin(req: NextRequest): NextResponse | null { + const secret = env.ADMIN_SECRET + if (!secret) { + return NextResponse.json({ error: 'Admin interface not configured' }, { status: 503 }) + } + const auth = req.headers.get('authorization') ?? '' + const token = auth.startsWith('Bearer ') ? auth.slice(7) : null + if (!token || token !== secret) { + return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) + } + return null +} diff --git a/apps/web/src/lib/audit.ts b/apps/web/src/lib/audit.ts index 89f2df4..c5ba684 100644 --- a/apps/web/src/lib/audit.ts +++ b/apps/web/src/lib/audit.ts @@ -4,8 +4,10 @@ import { createServiceClient } from '@/lib/supabase' export type AuditAction = | 'reading.create' | 'certificate.retire' + | 'certificate.transfer' | 'meter.register' | 'meter.deactivate' + | 'meter.revoke' interface AuditEntry { operator_id: string diff --git a/apps/web/src/lib/auth.ts b/apps/web/src/lib/auth.ts index f9e61df..d44ce71 100644 --- a/apps/web/src/lib/auth.ts +++ b/apps/web/src/lib/auth.ts @@ -5,9 +5,6 @@ import { env } from '@/env' /** * Create a Supabase client that validates the caller's JWT (anon key, RLS enforced). - * - * @param accessToken - Bearer JWT obtained from Supabase Auth. - * @returns Supabase client with the token injected into every request header. */ export function createUserClient(accessToken: string) { return createClient( @@ -20,12 +17,57 @@ export function createUserClient(accessToken: string) { ) } +/** Service-role client — bypasses RLS, used for revocation list writes. */ +function createServiceClient() { + return createClient( + env.NEXT_PUBLIC_SUPABASE_URL, + env.SUPABASE_SERVICE_ROLE_KEY, + { auth: { persistSession: false } } + ) +} + +/** + * Decode the JTI claim from a JWT without verifying the signature. + * Verification is handled by Supabase's getUser() call. + */ +function extractJti(token: string): string | null { + try { + const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()) + return typeof payload.jti === 'string' ? payload.jti : null + } catch { + return null + } +} + +/** + * Check whether a token's JTI appears in the revocation list. + * Returns true if the token has been revoked. + */ +async function isRevoked(jti: string): Promise { + const db = createServiceClient() + const { data } = await db + .from('revoked_tokens') + .select('jti') + .eq('jti', jti) + .maybeSingle() + return data !== null +} + +/** + * Add a token's JTI to the revocation list. + * expires_at is set to now + 15 minutes (access token max lifetime). + */ +export async function revokeToken(accessToken: string): Promise { + const jti = extractJti(accessToken) + if (!jti) return + const db = createServiceClient() + const expiresAt = new Date(Date.now() + 15 * 60 * 1000).toISOString() + await db.from('revoked_tokens').upsert({ jti, expires_at: expiresAt }) +} + /** * Extract and validate the Bearer JWT from the `Authorization` header. - * - * @param req - Incoming Next.js request. - * @returns The authenticated user and raw access token on success, or a - * `401 NextResponse` when the header is missing or the token is invalid. + * Also checks the revocation list before accepting the token. */ export async function requireAuth( req: NextRequest @@ -37,6 +79,12 @@ export async function requireAuth( return NextResponse.json({ error: 'Missing Authorization header' }, { status: 401 }) } + // Check revocation list before hitting Supabase + const jti = extractJti(accessToken) + if (jti && (await isRevoked(jti))) { + return NextResponse.json({ error: 'Token has been revoked' }, { status: 401 }) + } + const client = createUserClient(accessToken) const { data, error } = await client.auth.getUser() @@ -48,10 +96,7 @@ export async function requireAuth( } /** - * Type guard: returns `true` when `requireAuth` returned a `NextResponse` - * (i.e. authentication failed and the response is ready to return). - * - * @param result - Return value of `requireAuth`. + * Type guard: returns `true` when `requireAuth` returned a `NextResponse`. */ export function isAuthError(result: unknown): result is NextResponse { return result instanceof NextResponse diff --git a/apps/web/src/lib/cache.ts b/apps/web/src/lib/cache.ts index c3e3171..1a17d3f 100644 --- a/apps/web/src/lib/cache.ts +++ b/apps/web/src/lib/cache.ts @@ -8,41 +8,51 @@ const { UPSTASH_REDIS_REST_URL, UPSTASH_REDIS_REST_TOKEN } = process.env const CERT_TTL = 60 // seconds function redisUrl(path: string) { + if (!UPSTASH_REDIS_REST_URL) { + throw new Error('UPSTASH_REDIS_REST_URL is not configured') + } return `${UPSTASH_REDIS_REST_URL}${path}` } -async function redisGet(key: string): Promise { - if (!UPSTASH_REDIS_REST_URL) return null - const res = await fetch(redisUrl(`/get/${encodeURIComponent(key)}`), { - headers: { Authorization: `Bearer ${UPSTASH_REDIS_REST_TOKEN}` }, +async function redisFetch(path: string, options: RequestInit = {}) { + if (!UPSTASH_REDIS_REST_URL) { + throw new Error('UPSTASH_REDIS_REST_URL is not configured') + } + + const res = await fetch(redisUrl(path), { + headers: { + Authorization: `Bearer ${UPSTASH_REDIS_REST_TOKEN}`, + 'Content-Type': 'application/json', + }, cache: 'no-store', + ...options, }) + const json = await res.json() + if (!res.ok) { + throw new Error(json.error || 'Redis request failed') + } + return json +} + +async function redisGet(key: string): Promise { + const json = await redisFetch(`/get/${encodeURIComponent(key)}`) if (json.result == null) return null console.log(`[cache] HIT ${key}`) return JSON.parse(json.result) as T } async function redisSet(key: string, value: unknown, ttl: number): Promise { - if (!UPSTASH_REDIS_REST_URL) return - await fetch(redisUrl(`/set/${encodeURIComponent(key)}`), { + await redisFetch(`/set/${encodeURIComponent(key)}`, { method: 'POST', - headers: { - Authorization: `Bearer ${UPSTASH_REDIS_REST_TOKEN}`, - 'Content-Type': 'application/json', - }, body: JSON.stringify({ value: JSON.stringify(value), ex: ttl }), - cache: 'no-store', }) console.log(`[cache] SET ${key} ttl=${ttl}s`) } async function redisDel(key: string): Promise { - if (!UPSTASH_REDIS_REST_URL) return - await fetch(redisUrl(`/del/${encodeURIComponent(key)}`), { + await redisFetch(`/del/${encodeURIComponent(key)}`, { method: 'POST', - headers: { Authorization: `Bearer ${UPSTASH_REDIS_REST_TOKEN}` }, - cache: 'no-store', }) console.log(`[cache] DEL ${key}`) } diff --git a/apps/web/src/lib/crypto.ts b/apps/web/src/lib/crypto.ts index a04fdb8..c79b4aa 100644 --- a/apps/web/src/lib/crypto.ts +++ b/apps/web/src/lib/crypto.ts @@ -1,4 +1,5 @@ import { createHash } from 'crypto' +import { verifyAsync } from '@noble/ed25519' /** * Compute the canonical reading hash: `SHA-256(meter_id ‖ kwh_stroops_le ‖ timestamp_le)` @@ -42,3 +43,23 @@ export function computeReadingHash( // existing meter signatures. return createHash('sha256').update(meterBytes).update(kwhBuf).update(tsBuf).digest() } + +/** + * Verify an Ed25519 signature over a canonical reading hash. + * + * @param signatureHex - 128-char hex-encoded Ed25519 signature (64 bytes). + * @param readingHash - 32-byte SHA-256 digest from `computeReadingHash`. + * @param pubkeyHex - 64-char hex-encoded Ed25519 public key (32 bytes). + * @returns `true` if the signature is valid, `false` otherwise (never throws). + */ +export async function verifyReadingSignature( + signatureHex: string, + readingHash: Buffer, + pubkeyHex: string +): Promise { + return verifyAsync( + Buffer.from(signatureHex, 'hex'), + readingHash, + Buffer.from(pubkeyHex, 'hex') + ).catch(() => false) +} diff --git a/apps/web/src/lib/database.types.ts b/apps/web/src/lib/database.types.ts index 64659f8..7451364 100644 --- a/apps/web/src/lib/database.types.ts +++ b/apps/web/src/lib/database.types.ts @@ -4,18 +4,19 @@ export interface Database { public: { Tables: { cooperatives: { - Row: { id: string; name: string; admin_address: string; created_at: string } - Insert: { name: string; admin_address: string } - Update: Partial<{ name: string; admin_address: string }> + Row: { id: string; name: string; admin_address: string; created_at: string; suspended: boolean } + Insert: { name: string; admin_address: string; suspended?: boolean } + Update: Partial<{ name: string; admin_address: string; suspended: boolean }> Relationships: [] } meters: { Row: { id: string; cooperative_id: string; serial_number: string name: string; pubkey_hex: string; active: boolean; created_at: string + api_key: string } - Insert: { cooperative_id: string; serial_number: string; name: string; pubkey_hex: string; active: boolean } - Update: Partial<{ cooperative_id: string; serial_number: string; name: string; pubkey_hex: string; active: boolean }> + Insert: { cooperative_id: string; serial_number: string; name: string; pubkey_hex: string; active: boolean; api_key?: string } + Update: Partial<{ cooperative_id: string; serial_number: string; name: string; pubkey_hex: string; active: boolean; api_key: string }> Relationships: [] } readings: { @@ -55,6 +56,7 @@ export interface Database { reading_hash: string; mint_tx_hash: string; anchor_tx_hash: string kwh: number; issued_at: string; retired: boolean retired_at: string | null; retired_by: string | null + retire_tx_hash: string | null } Insert: { cooperative_id: string; reading_id: string @@ -86,6 +88,29 @@ export interface Database { Insert: Omit Update: Partial } + } + audit_logs: { + Row: { + id: string + timestamp: string + actor: string + action: string + resource: string + resource_id: string | null + ip: string | null + metadata: Json | null + } + Insert: Omit + Update: never + } + retirement_events: { + Row: { + id: string; certificate_id: string; beneficiary: string + retire_tx_hash: string; kwh: number; retired_at: string + } + Insert: Omit + Update: Partial + } } Views: Record Functions: Record diff --git a/apps/web/src/lib/email.ts b/apps/web/src/lib/email.ts new file mode 100644 index 0000000..ef4b76c --- /dev/null +++ b/apps/web/src/lib/email.ts @@ -0,0 +1,119 @@ +/** + * Email notifications via Resend (#140). + * + * Sends branded emails on: + * - Certificate minted + * - Certificate retired + * - Mint failed + * + * All sends are fire-and-forget: failures are logged but never thrown. + * Configurable per operator via the NOTIFICATION_EMAIL env var. + * Every email includes an unsubscribe link. + */ + +const RESEND_API_KEY = process.env.RESEND_API_KEY +const FROM_ADDRESS = process.env.NOTIFICATION_FROM_EMAIL ?? 'SolarProof ' +const UNSUBSCRIBE_URL = process.env.NEXT_PUBLIC_APP_URL + ? `${process.env.NEXT_PUBLIC_APP_URL}/settings?tab=notifications` + : 'https://solarproof.app/settings?tab=notifications' + +interface EmailPayload { + to: string + subject: string + html: string +} + +async function sendEmail(payload: EmailPayload): Promise { + if (!RESEND_API_KEY) return // no-op when not configured + + const res = await fetch('https://api.resend.com/emails', { + method: 'POST', + headers: { + Authorization: `Bearer ${RESEND_API_KEY}`, + 'Content-Type': 'application/json', + }, + body: JSON.stringify({ + from: FROM_ADDRESS, + to: payload.to, + subject: payload.subject, + html: payload.html, + }), + }) + + if (!res.ok) { + const text = await res.text().catch(() => '') + console.error('[email] send failed', { status: res.status, body: text }) + } +} + +function baseTemplate(title: string, body: string): string { + return ` + + +${title} + +

⚡ SolarProof

+

${title}

+ ${body} +
+

+ You are receiving this because you are an operator on SolarProof.
+ Manage notification preferences +

+ +` +} + +export async function sendMintedEmail(to: string, params: { + reading_id: string + mint_tx_hash: string + kwh: number + cooperative_id: string +}): Promise { + const html = baseTemplate('Certificate Minted ✅', ` +

A new energy certificate has been minted for your cooperative.

+ + + + +
kWh${params.kwh}
Mint TX${params.mint_tx_hash}
Reading ID${params.reading_id}
+ `) + await sendEmail({ to, subject: `SolarProof: ${params.kwh} kWh certificate minted`, html }) +} + +export async function sendRetiredEmail(to: string, params: { + certificate_id: string + retired_by: string + retire_tx_hash: string + kwh: number +}): Promise { + const html = baseTemplate('Certificate Retired 🏁', ` +

An energy certificate has been retired.

+ + + + + +
Certificate ID${params.certificate_id}
kWh${params.kwh}
Retired by${params.retired_by}
Retire TX${params.retire_tx_hash}
+ `) + await sendEmail({ to, subject: `SolarProof: certificate ${params.certificate_id.slice(0, 8)} retired`, html }) +} + +export async function sendMintFailedEmail(to: string, params: { + reading_id: string + error: string + diagnosis?: unknown +}): Promise { + const diagnosisSection = params.diagnosis + ? `
${JSON.stringify(params.diagnosis, null, 2)}
` + : '' + const html = baseTemplate('Mint Failed ⚠️', ` +

A certificate mint failed and requires attention.

+ + + +
Reading ID${params.reading_id}
Error${params.error}
+ ${diagnosisSection} + `) + await sendEmail({ to, subject: `SolarProof: mint failed for reading ${params.reading_id.slice(0, 8)}`, html }) +} diff --git a/apps/web/src/lib/irec-xml.ts b/apps/web/src/lib/irec-xml.ts new file mode 100644 index 0000000..43f1fb1 --- /dev/null +++ b/apps/web/src/lib/irec-xml.ts @@ -0,0 +1,60 @@ +/** + * I-REC XML export for SolarProof certificates. + * Generates I-REC compliant XML including the on-chain anchor proof. + */ + +export interface IRecCertificateData { + id: string + kwh: number + issued_at: string + holder_address: string + mint_tx_hash: string | null + meter_id: string | null + retired?: boolean + retired_at?: string | null + retired_by?: string | null + cooperative_id?: string | null +} + +function escapeXml(value: string): string { + return value + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') + .replace(/'/g, ''') +} + +/** + * Map SolarProof certificate data to I-REC XML. + * Includes on-chain anchor proof in extension element. + */ +export function buildIRecXml(cert: IRecCertificateData): string { + const volumeWh = cert.kwh * 1000 + const vintageDate = cert.issued_at.slice(0, 10) + + const retirementBlock = cert.retired && cert.retired_at + ? `\n \n ${escapeXml(cert.retired_at)}\n ${escapeXml(cert.retired_by ?? '')}\n ` + : '' + + const anchorProof = cert.mint_tx_hash + ? `\n \n Stellar Testnet\n ${escapeXml(cert.mint_tx_hash)}\n https://solarproof.vercel.app/verify/${escapeXml(cert.id)}\n ` + : '' + + return ` + + ${escapeXml(cert.id)} + SolarProof + ${escapeXml(cert.issued_at)} + + ${escapeXml(cert.meter_id ?? 'unknown')} + Solar + + + ${volumeWh} + ${vintageDate} + ${vintageDate} + + ${escapeXml(cert.holder_address)}${retirementBlock}${anchorProof} +` +} diff --git a/apps/web/src/lib/queue.ts b/apps/web/src/lib/queue.ts index 3cffbdc..f6896b2 100644 --- a/apps/web/src/lib/queue.ts +++ b/apps/web/src/lib/queue.ts @@ -46,7 +46,7 @@ export async function enqueue(type: JobType, payload: Record): * Process a single job by ID, retrying up to `MAX_ATTEMPTS` times on failure. * * Retries use exponential back-off (2 s, 4 s, 8 s). After all attempts are - * exhausted the job is marked `'failed'` and no further retries occur. + * exhausted the job is marked `'failed'` and moved to the dead-letter queue. * * @param jobId - UUID of the job record to process. */ @@ -100,6 +100,7 @@ async function runAnchorAndMint( const { anchorReading, mintCertificates } = await import('@/lib/stellar') const { createServiceClient: svc } = await import('@/lib/supabase') const { invalidateCert } = await import('@/lib/cache') + const { fireWebhook } = await import('@/lib/webhooks') const { readingId, readingHashHex, recipientAddress, kwh, correlationId } = payload as { readingId: string @@ -118,7 +119,7 @@ async function runAnchorAndMint( const mintTxHash = await mintCertificates(recipientAddress, kwh, correlationId) await db.from('readings').update({ minted: true, mint_tx_hash: mintTxHash }).eq('id', readingId) - // Fetch cooperative_id for certificate insert + // Fetch cooperative_id for certificate insert and webhooks const { data: reading } = await db .from('readings') .select('meter_id, meters(cooperative_id)') @@ -138,6 +139,8 @@ async function runAnchorAndMint( retired: false, }) await invalidateCert(readingId, readingHashHex, mintTxHash) + await fireWebhook(cooperativeId, 'anchor', { reading_id: readingId, anchor_tx_hash: anchorTxHash }) + await fireWebhook(cooperativeId, 'mint', { reading_id: readingId, mint_tx_hash: mintTxHash, kwh }) } return { anchor_tx_hash: anchorTxHash, mint_tx_hash: mintTxHash } diff --git a/apps/web/src/lib/stellar.ts b/apps/web/src/lib/stellar.ts index 7b4fb98..48c369f 100644 --- a/apps/web/src/lib/stellar.ts +++ b/apps/web/src/lib/stellar.ts @@ -236,6 +236,39 @@ export async function assertMintable(recipientAddress: string): Promise { } } +/** + * Transfer energy certificates from one account to another via SEP-41 transfer. + * + * @param fromAddress - Stellar G-address of the current certificate holder. + * @param toAddress - Stellar G-address of the recipient. + * @param kwh - Amount to transfer in kilowatt-hours. + * @param correlationId - Optional trace ID for logs and error messages. + * @returns Stellar transaction hash of the transfer transaction. + */ +export async function transferCertificate( + fromAddress: string, + toAddress: string, + kwh: number, + correlationId = crypto.randomUUID() +): Promise { + const minter = Keypair.fromSecret(env.MINTER_SECRET_KEY) + const server = getServer() + const account = await rpcCall(() => server.getAccount(minter.publicKey()), correlationId) + const contract = new Contract(env.NEXT_PUBLIC_ENERGY_TOKEN_ID) + + const tx = new TransactionBuilder(account, { fee: BASE_FEE, networkPassphrase: NETWORK_PASSPHRASE }) + .addOperation(contract.call( + 'transfer', + addressToScVal(fromAddress), + addressToScVal(toAddress), + amountToScVal(kwhToStroops(kwh)) + )) + .setTimeout(30) + .build() + + return submitTx(tx, minter, correlationId) +} + /** * Mint energy certificates after a successful anchor. * diff --git a/apps/web/src/lib/supabase.ts b/apps/web/src/lib/supabase.ts index 51f9659..39a253b 100644 --- a/apps/web/src/lib/supabase.ts +++ b/apps/web/src/lib/supabase.ts @@ -7,6 +7,27 @@ export const supabase = createClient( env.NEXT_PUBLIC_SUPABASE_ANON_KEY ) +/** + * Anon client — uses the public anon key; RLS is enforced. + * Use for public read-only endpoints (e.g. /api/verify) that require no auth. + */ +export function createAnonClient() { + return createClient( + env.NEXT_PUBLIC_SUPABASE_URL, + env.NEXT_PUBLIC_SUPABASE_ANON_KEY, + { auth: { persistSession: false } } + ) +} + +/** + * Service-role client — bypasses RLS. Use ONLY in trusted server contexts: + * - Writing readings, certificates, jobs (device-submitted, already verified) + * - Audit log writes (must never be gated by operator RLS) + * - Background job processing (no user JWT available) + * - Webhook fan-out (cross-cooperative queries) + * - Health checks (needs cross-tenant visibility) + * See docs/adr/007-supabase-service-role-usage.md for the full justification. + */ export function createServiceClient() { return createClient( env.NEXT_PUBLIC_SUPABASE_URL, diff --git a/apps/web/src/lib/webhooks.ts b/apps/web/src/lib/webhooks.ts index 078a3eb..0dbbdd2 100644 --- a/apps/web/src/lib/webhooks.ts +++ b/apps/web/src/lib/webhooks.ts @@ -2,7 +2,14 @@ import { createHmac } from 'crypto' import { createServiceClient } from '@/lib/supabase' import type { Json } from '@/lib/database.types' -export type WebhookEvent = 'anchor' | 'mint' | 'retire' | 'mint_failed' +export type WebhookEvent = + | 'anchor' + | 'mint' + | 'retire' + | 'mint_failed' + | 'certificate.minted' + | 'certificate.transferred' + | 'certificate.retired' export interface WebhookPayload { event: WebhookEvent @@ -15,10 +22,11 @@ function sign(secret: string, body: string): string { return createHmac('sha256', secret).update(body).digest('hex') } -async function deliver(url: string, secret: string, payload: WebhookPayload): Promise { +const MAX_ATTEMPTS = 5 + +async function deliver(url: string, secret: string, payload: WebhookPayload): Promise<{ status: number; attempts: number }> { const body = JSON.stringify(payload) const sig = sign(secret, body) - const MAX_ATTEMPTS = 3 for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) { try { @@ -28,13 +36,15 @@ async function deliver(url: string, secret: string, payload: WebhookPayload): Pr body, signal: AbortSignal.timeout(10_000), }) - if (res.ok) return res.status - if (attempt === MAX_ATTEMPTS) return res.status + if (res.ok) return { status: res.status, attempts: attempt } + if (attempt === MAX_ATTEMPTS) return { status: res.status, attempts: attempt } } catch { if (attempt === MAX_ATTEMPTS) throw new Error(`Webhook delivery failed after ${MAX_ATTEMPTS} attempts`) } + // Exponential backoff: 1s, 2s, 4s, 8s between retries + await new Promise((r) => setTimeout(r, 2 ** (attempt - 1) * 1000)) } - return 0 + return { status: 0, attempts: MAX_ATTEMPTS } } /** @@ -65,11 +75,12 @@ export async function fireWebhook( let responseStatus: number | null = null let attempts = 0 try { - attempts = 3 - responseStatus = await deliver(ep.url, ep.secret, payload) + const result = await deliver(ep.url, ep.secret, payload) + responseStatus = result.status + attempts = result.attempts status = responseStatus >= 200 && responseStatus < 300 ? 'delivered' : 'failed' } catch { - attempts = 3 + attempts = MAX_ATTEMPTS } await db.from('webhook_logs').insert({ endpoint_id: ep.id, diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts index f6a3070..d37a73a 100644 --- a/apps/web/src/middleware.ts +++ b/apps/web/src/middleware.ts @@ -23,6 +23,18 @@ export function middleware(req: NextRequest) { const origin = req.headers.get('origin') const corsHeaders = getCorsHeaders(origin) + // ── HTTPS redirect ──────────────────────────────────────────────────────── + // In production, redirect plain HTTP to HTTPS with a 301 permanent redirect. + // Vercel/CDN handles this at the edge, but the middleware acts as a safety net. + if ( + process.env.NODE_ENV === 'production' && + req.headers.get('x-forwarded-proto') === 'http' + ) { + const httpsUrl = req.nextUrl.clone() + httpsUrl.protocol = 'https:' + return NextResponse.redirect(httpsUrl, { status: 301 }) + } + // ── CORS preflight ──────────────────────────────────────────────────────── if (req.method === 'OPTIONS') { if (corsHeaders) { @@ -33,14 +45,15 @@ export function middleware(req: NextRequest) { } // ── API versioning redirect ─────────────────────────────────────────────── - // Match /api/ but NOT /api/v1/... or /api/docs (OpenAPI spec) - const unversioned = pathname.match(/^\/api\/(?!v\d+\/)(.+)$/) + // Match /api/ but NOT /api/v1/... or /api/docs or /api/admin + const unversioned = pathname.match(/^\/api\/(?!v\d+\/|admin\/)(.+)$/) if (unversioned) { const url = req.nextUrl.clone() url.pathname = `/api/v1/${unversioned[1]}` - const redirect = NextResponse.redirect(url, { status: 308 }) + const redirect = NextResponse.redirect(url, { status: 301 }) redirect.headers.set('Deprecation', 'true') redirect.headers.set('Link', `<${url.toString()}>; rel="successor-version"`) + redirect.headers.set('API-Version', 'v1') // Propagate correlation ID on the redirect response too const correlationId = req.headers.get('x-correlation-id') ?? randomUUID() redirect.headers.set('x-correlation-id', correlationId) @@ -63,6 +76,7 @@ export function middleware(req: NextRequest) { }, }) res.headers.set('x-correlation-id', correlationId) + res.headers.set('API-Version', 'v1') // ── Attach CORS headers ─────────────────────────────────────────────────── if (corsHeaders) { @@ -75,5 +89,8 @@ export function middleware(req: NextRequest) { } export const config = { - matcher: '/api/:path*', + matcher: [ + // Run on all routes for HTTPS redirect + '/((?!_next/static|_next/image|favicon.ico).*)', + ], } diff --git a/apps/web/src/tests/mock-freighter.ts b/apps/web/src/tests/mock-freighter.ts new file mode 100644 index 0000000..a5b8e32 --- /dev/null +++ b/apps/web/src/tests/mock-freighter.ts @@ -0,0 +1,86 @@ +/** + * Mock Freighter wallet for CI/test environments. + * + * Installs a `window.freighter` stub that simulates connection, signing, + * and disconnection without requiring the browser extension. + * + * Usage: + * import { installMockFreighter, uninstallMockFreighter } from '@/tests/mock-freighter' + * + * beforeEach(() => installMockFreighter()) + * afterEach(() => uninstallMockFreighter()) + */ + +export interface MockFreighterOptions { + publicKey?: string + /** If true, isAllowed() returns false until requestAccess() is called */ + requiresAccess?: boolean +} + +const DEFAULT_PUBLIC_KEY = 'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWN' + +export interface MockFreighter { + isAllowed: () => Promise + requestAccess: () => Promise + getPublicKey: () => Promise + signTransaction: (xdr: string) => Promise + _reset: () => void + _setPublicKey: (key: string) => void +} + +export function createMockFreighter(opts: MockFreighterOptions = {}): MockFreighter { + let publicKey = opts.publicKey ?? DEFAULT_PUBLIC_KEY + let allowed = !(opts.requiresAccess ?? false) + + return { + isAllowed: async () => allowed, + requestAccess: async () => { allowed = true }, + getPublicKey: async () => { + if (!allowed) throw new Error('Not allowed — call requestAccess first') + return publicKey + }, + signTransaction: async (xdr: string) => { + if (!allowed) throw new Error('Not allowed — call requestAccess first') + // Return a deterministic mock-signed XDR (prefixed for test identification) + return `mock-signed:${xdr}` + }, + _reset: () => { + allowed = !(opts.requiresAccess ?? false) + publicKey = opts.publicKey ?? DEFAULT_PUBLIC_KEY + }, + _setPublicKey: (key: string) => { publicKey = key }, + } +} + +let _installed: MockFreighter | null = null + +/** + * Install the mock Freighter wallet on `window.freighter`. + * Safe to call in jsdom or happy-dom test environments. + */ +export function installMockFreighter(opts: MockFreighterOptions = {}): MockFreighter { + const mock = createMockFreighter(opts) + // eslint-disable-next-line @typescript-eslint/no-explicit-any + ;(globalThis as any).window = (globalThis as any).window ?? {} + // eslint-disable-next-line @typescript-eslint/no-explicit-any + ;(globalThis as any).window.freighter = mock + _installed = mock + return mock +} + +/** + * Remove the mock Freighter wallet from `window.freighter`. + */ +export function uninstallMockFreighter(): void { + // eslint-disable-next-line @typescript-eslint/no-explicit-any + if ((globalThis as any).window?.freighter) { + // eslint-disable-next-line @typescript-eslint/no-explicit-any + delete (globalThis as any).window.freighter + } + _installed = null +} + +/** Return the currently installed mock, or null if not installed. */ +export function getMockFreighter(): MockFreighter | null { + return _installed +} diff --git a/apps/web/vitest.config.ts b/apps/web/vitest.config.ts index 4a470c0..30c9e3b 100644 --- a/apps/web/vitest.config.ts +++ b/apps/web/vitest.config.ts @@ -10,12 +10,20 @@ export default defineConfig({ setupFiles: ['./src/test-setup.ts'], environmentMatchGlobs: [ ['src/__tests__/components/**', 'jsdom'], + ['src/__tests__/wallet.test.ts', 'jsdom'], ], coverage: { provider: 'v8', - reporter: ['text', 'html'], + reporter: ['text', 'html', 'lcov'], all: true, include: ['src/**/*.{ts,tsx}'], + exclude: ['src/**/*.test.{ts,tsx}', 'src/test-setup.ts', 'src/**/*.d.ts'], + thresholds: { + lines: 80, + functions: 80, + branches: 80, + statements: 80, + }, }, exclude: ['node_modules', 'dist', '.idea', '.git', '.cache', 'e2e/**'], }, diff --git a/docker-compose.yml b/docker-compose.yml index c6c17eb..500d375 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -15,7 +15,9 @@ services: depends_on: supabase-db: condition: service_healthy - redis: + redis-cache: + condition: service_healthy + redis-queue: condition: service_healthy volumes: - ./apps/web:/app/apps/web @@ -44,12 +46,27 @@ services: retries: 5 start_period: 20s - redis: + redis-cache: image: redis:7-alpine + command: redis-server --maxmemory 512mb --maxmemory-policy allkeys-lru ports: - "6379:6379" volumes: - - redis_data:/data + - redis_cache_data:/data + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 5s + retries: 3 + start_period: 10s + + redis-queue: + image: redis:7-alpine + command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy noeviction + ports: + - "6380:6379" + volumes: + - redis_queue_data:/data healthcheck: test: ["CMD", "redis-cli", "ping"] interval: 10s @@ -59,4 +76,5 @@ services: volumes: supabase_data: - redis_data: + redis_cache_data: + redis_queue_data: diff --git a/docs/ED25519_PROTOCOL.md b/docs/ED25519_PROTOCOL.md index b7a4b04..3b1f5d8 100644 --- a/docs/ED25519_PROTOCOL.md +++ b/docs/ED25519_PROTOCOL.md @@ -196,7 +196,21 @@ The `nonce` field is optional but strongly recommended for replay protection. Us --- -## Key Generation Procedure +## Hardware Security Modules (HSM) + +For production deployments (Level 2+), it is **mandatory** to store the meter's private key in a Hardware Security Module (HSM), Trusted Platform Module (TPM), or Secure Enclave. + +### Key Requirements + +1. **Non-extractable**: The private key must be generated on-chip and marked as non-extractable. +2. **PKCS#11**: The device should ideally support the PKCS#11 interface for signing. +3. **Ed25519 Support**: The HSM must support the `CKM_EDDSA` mechanism (PKCS#11 v3.0+). + +### YubiKey Integration + +YubiKey 5 Series devices support Ed25519 via the PIV application. For detailed implementation details, see the [Hardware HSM Integration Guide](HSM_INTEGRATION.md). + +--- ### Development / simulation diff --git a/docs/HARDWARE_METER_INTEGRATION_GUIDE.md b/docs/HARDWARE_METER_INTEGRATION_GUIDE.md new file mode 100644 index 0000000..27c0263 --- /dev/null +++ b/docs/HARDWARE_METER_INTEGRATION_GUIDE.md @@ -0,0 +1,240 @@ +# Hardware Meter Integration Guide + +This guide is for hardware manufacturers who want to integrate their smart meters with SolarProof. It covers hardware requirements, the signing protocol, API integration steps, and the certification process for new meter models. + +--- + +## Hardware Requirements + +### Ed25519 Key Storage + +Every SolarProof-compatible meter must generate and store an Ed25519 keypair. The private key must never leave the device. + +| Requirement | Minimum | Recommended | +|---|---|---| +| Key storage | Secure flash with access control | Hardware Security Module (HSM) or TPM 2.0 | +| Key generation | On-device CSPRNG | On-device CSPRNG with hardware entropy source | +| Key protection | Software access control | HSM / secure enclave (YubiKey, ATECC608, TPM) | +| Curve | Ed25519 | Ed25519 | +| Key size | 32-byte private key, 32-byte public key | Same | + +**Minimum viable hardware:** +- Microcontroller with at least 64 KB flash and 16 KB RAM +- Hardware RNG or entropy source +- Persistent storage that survives power cycles +- Network interface (Ethernet, Wi-Fi, or cellular) capable of HTTPS + +**Recommended hardware:** +- Dedicated HSM chip (e.g., Microchip ATECC608B, Infineon SLB 9670 TPM) +- Secure boot to prevent firmware tampering +- Tamper-evident enclosure + +### Connectivity + +- HTTPS (TLS 1.2+) to reach the SolarProof API +- Accurate real-time clock (RTC) — timestamp drift must be within ±30 seconds +- Minimum 1 kB/s uplink for reading submissions + +--- + +## API Integration Steps + +### Step 1 — Generate and Register the Meter Keypair + +Generate an Ed25519 keypair at manufacture time or on first boot. Store the private key in secure storage. Register the public key with the SolarProof operator before the meter goes live. + +**Reference script (development/testing only — do not use in production firmware):** + +```bash +node scripts/gen-meter-key.mjs +# Outputs meter-key.json: { private_key_hex, public_key_hex } +``` + +Register the public key in the SolarProof database: + +```sql +INSERT INTO meters (id, pubkey_hex, cooperative_id, active) +VALUES ('', '<64-char hex public key>', '', true); +``` + +The operator will provide the `cooperative_id` and confirm the `meter_id` (UUID) assigned to your device. + +### Step 2 — Compute the Canonical Reading Hash + +Before signing, compute a deterministic SHA-256 hash of the reading: + +``` +SHA-256( meter_id_utf8 || kwh_stroops_le64 || timestamp_le64 ) +``` + +- `meter_id_utf8` — the meter UUID as a UTF-8 byte string (e.g. `"a1b2c3d4-e5f6-7890-abcd-ef1234567890"`) +- `kwh_stroops_le64` — `round(kwh × 10_000_000)` as a little-endian 64-bit signed integer +- `timestamp_le64` — Unix epoch seconds (UTC) as a little-endian 64-bit signed integer + +**Node.js reference:** + +```js +import { createHash } from 'crypto' + +function computeReadingHash(meterId, kwh, timestamp) { + const kwhStroops = BigInt(Math.round(kwh * 1e7)) + const meterBytes = Buffer.from(meterId, 'utf8') + const kwhBuf = Buffer.alloc(8) + kwhBuf.writeBigInt64LE(kwhStroops) + const tsBuf = Buffer.alloc(8) + tsBuf.writeBigInt64LE(BigInt(timestamp)) + return createHash('sha256').update(meterBytes).update(kwhBuf).update(tsBuf).digest() +} +``` + +The server uses the identical algorithm in `apps/web/src/lib/crypto.ts`. Any deviation will cause signature verification to fail. + +### Step 3 — Sign the Reading + +Sign the 32-byte hash with the device's Ed25519 private key. The signature must be 64 bytes, encoded as a 128-character lowercase hex string. + +**Node.js reference:** + +```js +import { createSign } from 'crypto' + +function signReading(readingHash, privateKeyHex) { + const privKeyDer = Buffer.concat([ + Buffer.from('302e020100300506032b657004220420', 'hex'), + Buffer.from(privateKeyHex, 'hex'), + ]) + const sign = createSign('ed25519') + sign.update(readingHash) + return sign.sign({ key: privKeyDer, format: 'der', type: 'pkcs8' }).toString('hex') +} +``` + +For HSM-backed devices, use the HSM's signing API to produce the Ed25519 signature over the hash bytes — the output format is the same. + +### Step 4 — Submit the Reading + +``` +POST /api/readings +Content-Type: application/json +``` + +**Request body:** + +```json +{ + "meter_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", + "kwh": 12.5, + "timestamp": 1745500800, + "signature_hex": "<128-char lowercase hex>" +} +``` + +**Success — `201 Created`:** + +```json +{ + "reading_id": "", + "anchor_tx_hash": "<64-char hex>", + "mint_tx_hash": "<64-char hex>" +} +``` + +**Error codes:** + +| Status | Meaning | +|---|---| +| `400` | Malformed payload or validation failure | +| `401` | Invalid Ed25519 signature | +| `404` | Meter not found or inactive | +| `409` | Duplicate reading (already anchored) | +| `500` | Stellar transaction failure | + +### Step 5 — End-to-End Test with Reference Scripts + +Use the reference scripts in `scripts/` to validate your integration before certification: + +```bash +# Generate a test keypair +node scripts/gen-meter-key.mjs + +# Send a signed reading to a local or staging instance +node scripts/send-reading.mjs \ + --meter-id \ + --kwh 12.5 \ + --key ./meter-key.json \ + --api http://localhost:3000 + +# Run the full end-to-end flow +node scripts/e2e-meter-reading-flow.mjs +``` + +See `docs/METER_INTEGRATION.md` for the full protocol reference including the complete API specification. + +--- + +## Reference Scripts + +| Script | Purpose | +|---|---| +| `scripts/gen-meter-key.mjs` | Generate an Ed25519 keypair for a meter device | +| `scripts/send-reading.mjs` | Sign and submit a single meter reading | +| `scripts/e2e-meter-reading-flow.mjs` | Full end-to-end flow: key generation → reading → anchor → mint → verify | + +All scripts require Node.js v22+ and are intended for development, testing, and certification validation. Do not use them in production firmware. + +--- + +## Certification Checklist for New Meter Models + +Before a meter model is approved for production use with SolarProof, the manufacturer must complete the following checklist. Submit the completed checklist to the integration support contact below. + +### Hardware + +- [ ] Ed25519 keypair generated on-device using a hardware entropy source +- [ ] Private key stored in HSM, TPM, or secure enclave (not in plain flash) +- [ ] Secure boot enabled to prevent firmware tampering +- [ ] RTC accuracy verified to be within ±30 seconds of UTC +- [ ] Device passes tamper-detection requirements (physical or logical) + +### Protocol Compliance + +- [ ] Canonical reading hash matches the reference implementation for at least 100 test vectors +- [ ] Ed25519 signatures verified by the SolarProof server for at least 100 test readings +- [ ] Duplicate reading rejection confirmed (server returns `409` for repeated submissions) +- [ ] Replay attack prevention confirmed (server rejects stale timestamps) +- [ ] Error handling tested for all documented error codes (`400`, `401`, `404`, `409`, `500`) + +### Integration Testing + +- [ ] End-to-end test completed against the SolarProof staging environment +- [ ] `scripts/e2e-meter-reading-flow.mjs` passes against staging with the device's public key registered +- [ ] Reading submission latency measured and within acceptable bounds (<5 s under normal conditions) +- [ ] Behavior under network failure documented (retry logic, no duplicate submissions) + +### Security Review + +- [ ] Private key never transmitted or logged +- [ ] Firmware update mechanism does not expose key material +- [ ] Security contact and vulnerability disclosure process documented for the device + +### Documentation + +- [ ] Firmware version and hardware revision documented +- [ ] Key provisioning process documented +- [ ] Operator setup instructions provided + +--- + +## Contact Information for Integration Support + +For integration questions, certification submissions, or to report a protocol issue: + +- **GitHub Issues:** [github.com/AnnabelJoe/solarproof/issues](https://github.com/AnnabelJoe/solarproof/issues) — use the label `hardware-integration` +- **Security issues:** See [SECURITY.md](../SECURITY.md) for the responsible disclosure process +- **Protocol questions:** Open a discussion in the repository or reference `docs/METER_INTEGRATION.md` and `docs/adr/001-ed25519-signing.md` + +When submitting a certification request, include: +1. Completed certification checklist (above) +2. Hardware model name and firmware version +3. Test vector results (hash and signature outputs for the provided test inputs) +4. Contact name and organisation diff --git a/docs/HSM_INTEGRATION.md b/docs/HSM_INTEGRATION.md new file mode 100644 index 0000000..01bdd59 --- /dev/null +++ b/docs/HSM_INTEGRATION.md @@ -0,0 +1,126 @@ +# Hardware HSM Integration Guide (Level 2) + +This guide explains how to use a Hardware Security Module (HSM), such as a **YubiKey 5 Series** or a **TPM**, to securely sign SolarProof meter readings. + +Using an HSM ensures that the private key **never leaves the hardware**, providing Level 2 security compliance for the SolarProof roadmap. + +--- + +## 1. Prerequisites + +- **Hardware**: YubiKey 5 Series (supports Ed25519 in PIV) +- **Middleware**: Yubico PIV Tool (includes `ykcs11` module) +- **Library**: `pkcs11js` (for Node.js integration) + +### Installing YKCS11 + +| OS | Installation | Module Path | +|---|---|---| +| **Ubuntu/Debian** | `sudo apt install yubico-piv-tool` | `/usr/lib/x86_64-linux-gnu/libykcs11.so` | +| **macOS** | `brew install yubico-piv-tool` | `/usr/local/lib/libykcs11.dylib` | +| **Windows** | [Yubico PIV Tool MSI](https://developers.yubico.com/yubico-piv-tool/Releases/) | `C:\Program Files\Yubico\Yubico PIV Tool\bin\ykcs11.dll` | + +--- + +## 2. Provisioning the YubiKey + +You must generate an Ed25519 keypair in one of the PIV slots (e.g., slot `9c` for digital signatures). + +### Step 1: Generate Key on YubiKey + +```bash +# Generate Ed25519 key in slot 9c +yubico-piv-tool -s 9c -a generate -A ED25519 -o public.pem +``` + +### Step 2: Create a Self-Signed Certificate + +YubiKey requires a certificate to be present in the slot for some PKCS#11 modules to "see" the key. + +```bash +# Create self-signed cert for the key in 9c +yubico-piv-tool -a verify-pin -a selfsign-certificate -s 9c -S "/CN=SolarProof Meter/" -i public.pem -o cert.pem + +# Import the certificate back to the YubiKey +yubico-piv-tool -a import-certificate -s 9c -i cert.pem +``` + +### Step 3: Register Public Key in SolarProof + +Extract the raw 32-byte public key hex: + +```bash +openssl pkey -pubin -in public.pem -outform DER | tail -c 32 | xxd -p -c 32 +``` + +Register this hex string in the `meters.pubkey_hex` column in Supabase. + +--- + +## 3. Signing Readings via PKCS#11 + +The following reference implementation uses `pkcs11js` to interact with the YubiKey. + +### Reference Script: `scripts/send-reading-pkcs11.mjs` + +```javascript +import pkcs11js from 'pkcs11js'; +import { createHash } from 'crypto'; + +// Configuration +const PKCS11_LIB = process.env.PKCS11_LIB || '/usr/lib/x86_64-linux-gnu/libykcs11.so'; +const PIN = process.env.PKCS11_PIN || '123456'; +const SLOT_ID = 0; // Usually 0 for YubiKey + +const pkcs11 = new pkcs11js.PKCS11(); +pkcs11.load(PKCS11_LIB); +pkcs11.C_Initialize(); + +try { + const session = pkcs11.C_OpenSession(SLOT_ID, pkcs11js.CKF_SERIAL_SESSION | pkcs11js.CKF_RW_SESSION); + pkcs11.C_Login(session, pkcs11js.CKU_USER, PIN); + + // Find the Ed25519 private key in slot 9c + // YubiKey YKCS11 maps PIV slot 9c to CKA_ID = 0x02 + const keys = pkcs11.C_FindObjectsInit(session, [ + { type: pkcs11js.CKA_CLASS, value: pkcs11js.CKO_PRIVATE_KEY }, + { type: pkcs11js.CKA_ID, value: Buffer.from([0x02]) } + ]); + const keyHandle = pkcs11.C_FindObjects(session, 1)[0]; + pkcs11.C_FindObjectsFinal(session); + + if (!keyHandle) throw new Error("Key not found in slot 9c"); + + // 1. Prepare the reading hash (canonical format) + const readingHash = computeReadingHash(meterId, kwh, timestamp); + + // 2. Sign the hash using the HSM + // Note: Ed25519 in PKCS#11 uses CKM_EDDSA + pkcs11.C_SignInit(session, { mechanism: pkcs11js.CKM_EDDSA }, keyHandle); + const signature = pkcs11.C_Sign(session, readingHash, Buffer.alloc(64)); + + console.log("Signature (HSM):", signature.toString('hex')); + + pkcs11.C_Logout(session); + pkcs11.C_CloseSession(session); +} finally { + pkcs11.C_Finalize(); +} +``` + +--- + +## 4. Security Guarantees + +- **Key Isolation**: The private key is generated on-chip and marked as "sensitive" and "non-extractable". +- **Hardware-Backed**: Signing happens inside the YubiKey's secure element. +- **Tamper Resistance**: Physical access and the User PIN are required to perform signing operations. + +--- + +## 5. Manufacturer Integration Checklist + +1. [ ] Choose a PKCS#11 compliant secure element (YubiKey, OPTIGA™ Trust M, etc.) +2. [ ] Implement the SolarProof canonical hashing algorithm in firmware. +3. [ ] Use the `CKM_EDDSA` mechanism for signing. +4. [ ] Ensure the public key registered in SolarProof matches the hardware-backed key. diff --git a/docs/MAINNET_CHECKLIST.md b/docs/MAINNET_CHECKLIST.md new file mode 100644 index 0000000..92a7f0b --- /dev/null +++ b/docs/MAINNET_CHECKLIST.md @@ -0,0 +1,130 @@ +# SolarProof — Stellar Mainnet Deployment Checklist & Go-Live Plan + +> Resolves #142. Complete every item and obtain sign-off before deploying to Stellar Mainnet. + +--- + +## Phase 1 — Security Audit + +| # | Item | Owner | Status | +|---|------|-------|--------| +| 1.1 | Engage third-party auditor (scope: `energy_token`, `audit_registry`, `community_governance` — see [AUDIT_SCOPE.md](AUDIT_SCOPE.md)) | Lead | ☐ | +| 1.2 | All Critical and High findings resolved and re-audited | Lead + Auditor | ☐ | +| 1.3 | Medium findings triaged; accepted risks documented | Lead | ☐ | +| 1.4 | Audit report published in `docs/audit/` | Lead | ☐ | +| 1.5 | `anchor()` access control decision finalised (permissionless vs. restricted — see AUDIT_SCOPE.md §audit_registry) | Lead | ☐ | + +--- + +## Phase 2 — Testnet Fork Validation + +| # | Item | Owner | Status | +|---|------|-------|--------| +| 2.1 | Deploy all three contracts to a **mainnet-fork** environment using production WASM builds | DevOps | ☐ | +| 2.2 | Run full `cargo test --all` against fork; zero failures | Dev | ☐ | +| 2.3 | End-to-end smoke test: meter reading → Ed25519 verify → anchor → mint → retire | Dev | ☐ | +| 2.4 | Verify `total_supply == total_minted - total_burned` invariant post-smoke-test | Dev | ☐ | +| 2.5 | Confirm `community_governance` quorum and voting period behave correctly at mainnet ledger cadence (~5 s/ledger) | Dev | ☐ | +| 2.6 | Load test: 1 000 concurrent anchor submissions; confirm no duplicate anchors accepted | Dev | ☐ | +| 2.7 | Persistent storage TTL verified — balance entries do not expire unexpectedly under mainnet TTL settings | Dev | ☐ | + +--- + +## Phase 3 — Infrastructure & Key Management + +| # | Item | Owner | Status | +|---|------|-------|--------| +| 3.1 | Mainnet admin keypair generated in HSM or hardware wallet; secret never touches CI | DevOps | ☐ | +| 3.2 | Mainnet minter keypair generated and stored in secrets manager (not in `.env` files) | DevOps | ☐ | +| 3.3 | Multi-sig or time-lock on admin key rotation confirmed | Lead | ☐ | +| 3.4 | Production environment variables set in Vercel (see `.env.example`): `NEXT_PUBLIC_ENERGY_TOKEN_ID`, `NEXT_PUBLIC_AUDIT_REGISTRY_ID`, `NEXT_PUBLIC_COMMUNITY_GOVERNANCE_ID`, `MINTER_SECRET_KEY` | DevOps | ☐ | +| 3.5 | Supabase production project provisioned; RLS policies verified (see `supabase/migrations/`) | DevOps | ☐ | +| 3.6 | Automated DB backup workflow enabled and tested (see [BACKUP.md](BACKUP.md)) | DevOps | ☐ | +| 3.7 | Sentry DSN configured for production; error alerts routed to on-call channel | DevOps | ☐ | +| 3.8 | Uptime monitoring configured (see `.github/upptime.yml`) | DevOps | ☐ | + +--- + +## Phase 4 — Mainnet Contract Deployment + +Run these steps in order. Record every contract ID immediately. + +```bash +# 1. Build release WASMs +cd apps/contracts +stellar contract build + +# 2. Deploy (replace YOUR_MAINNET_SECRET with the HSM-sourced key) +TOKEN_ID=$(stellar contract deploy \ + --wasm target/wasm32-unknown-unknown/release/energy_token.wasm \ + --source YOUR_MAINNET_SECRET --network mainnet) + +REGISTRY_ID=$(stellar contract deploy \ + --wasm target/wasm32-unknown-unknown/release/audit_registry.wasm \ + --source YOUR_MAINNET_SECRET --network mainnet) + +GOV_ID=$(stellar contract deploy \ + --wasm target/wasm32-unknown-unknown/release/community_governance.wasm \ + --source YOUR_MAINNET_SECRET --network mainnet) + +# 3. Initialize +stellar contract invoke --id $TOKEN_ID --source YOUR_MAINNET_SECRET --network mainnet \ + -- initialize --admin ADMIN_ADDRESS --minter MINTER_ADDRESS + +stellar contract invoke --id $REGISTRY_ID --source YOUR_MAINNET_SECRET --network mainnet \ + -- initialize --admin ADMIN_ADDRESS + +stellar contract invoke --id $GOV_ID --source YOUR_MAINNET_SECRET --network mainnet \ + -- initialize --admin ADMIN_ADDRESS --quorum 51 --voting_period_ledgers 17280 +``` + +| # | Item | Owner | Status | +|---|------|-------|--------| +| 4.1 | WASM checksums match audited build artifacts (sha256) | Dev | ☐ | +| 4.2 | All three contracts deployed; IDs recorded in `docs/mainnet-contract-ids.txt` (gitignored) | DevOps | ☐ | +| 4.3 | All three contracts initialised; transactions verified on Stellar Explorer | DevOps | ☐ | +| 4.4 | Production env vars updated with live contract IDs | DevOps | ☐ | +| 4.5 | Post-deploy smoke test repeated against mainnet contracts | Dev | ☐ | + +--- + +## Phase 5 — Go-Live + +| # | Item | Owner | Status | +|---|------|-------|--------| +| 5.1 | Public verifier (`/verify`) tested end-to-end on mainnet | Dev | ☐ | +| 5.2 | README contract table updated to reflect mainnet deployment | Dev | ☐ | +| 5.3 | DEPLOYMENT.md updated with mainnet network flag and contract IDs reference | Dev | ☐ | +| 5.4 | Incident response runbook linked from [THREAT_MODEL.md](THREAT_MODEL.md) | Lead | ☐ | +| 5.5 | Team sign-off obtained (see sign-off table below) | Lead | ☐ | +| 5.6 | GitHub release tagged (`v1.0.0`) via `release.yml` workflow | DevOps | ☐ | + +--- + +## Rollback Plan + +If a critical issue is discovered post-deployment: + +1. **Immediate**: Disable the minter API route (`MINTER_ENABLED=false` env var) to halt new mints. +2. **Contracts**: Soroban contracts are immutable once deployed. Rollback means deploying a patched version and updating env vars to point to the new contract IDs. The old contracts remain on-chain but the API stops routing to them. +3. **Database**: Restore Supabase from the most recent automated backup (see [BACKUP.md](BACKUP.md)). +4. **Frontend**: Revert Vercel deployment to the previous production deployment via the Vercel dashboard. +5. **Communication**: Post a status update to the uptime page and notify registered meter operators within 1 hour. +6. **Post-mortem**: Document root cause and corrective actions within 48 hours. + +--- + +## Team Sign-Off + +All roles must sign off before go-live (Phase 5). + +| Role | Name | Date | Signature | +|------|------|------|-----------| +| Lead Engineer | | | | +| Security Reviewer | | | | +| DevOps | | | | +| Product Owner | | | | + +--- + +*Last updated: 2026-05-31* diff --git a/docs/METER_INTEGRATION.md b/docs/METER_INTEGRATION.md index 700c2e2..6b070b8 100644 --- a/docs/METER_INTEGRATION.md +++ b/docs/METER_INTEGRATION.md @@ -174,4 +174,4 @@ node scripts/send-reading.mjs \ - Store the private key in a hardware security module (HSM) or TPM in production. Never log or transmit it. - Use a monotonically increasing timestamp to prevent replay attacks. The server rejects duplicate reading hashes. - Rotate keys by registering a new public key and deactivating the old meter record. -- For hardware HSM integration (YubiKey / TPM), see the Level 2 roadmap item in the README. +- For hardware HSM integration (YubiKey / TPM), see the [Hardware HSM Integration Guide](HSM_INTEGRATION.md). diff --git a/docs/MUTATION_TESTING.md b/docs/MUTATION_TESTING.md new file mode 100644 index 0000000..f8625cb --- /dev/null +++ b/docs/MUTATION_TESTING.md @@ -0,0 +1,85 @@ +# Mutation Testing + +Mutation testing verifies that the test suite actually catches bugs, not just that it executes code. A mutant is a small code change (e.g. flipping `>` to `>=`, removing a `return Err`). If no test fails, the mutant "survives" — indicating a gap in test quality. + +## Tools + +| Layer | Tool | Config | +|---|---|---| +| Rust contracts | [cargo-mutants](https://mutants.rs) | `apps/contracts/.cargo-mutants.toml` | +| TypeScript (`packages/stellar`) | [Stryker](https://stryker-mutator.io) | `packages/stellar/stryker.config.mjs` | + +## Thresholds + +Both tools are configured with a **70% minimum mutation score**. The CI job fails if the score drops below this. + +| Score | Meaning | +|---|---| +| ≥ 80% | High — good test quality | +| 70–79% | Low — acceptable, investigate survivors | +| < 70% | Break — CI fails | + +## Running Locally + +### Rust (cargo-mutants) + +```bash +# Install once +cargo install cargo-mutants --locked --version 24.11.0 + +# Run against the two critical contracts +cd apps/contracts +cargo mutants --package audit_registry --package energy_token +``` + +Results are written to `apps/contracts/mutants-out/`. Open `mutants-out/outcomes.json` or the text summary to see surviving mutants. + +### TypeScript (Stryker) + +```bash +cd packages/stellar +pnpm install +pnpm test:mutation +``` + +HTML report: `packages/stellar/reports/mutation/index.html` + +## CI Schedule + +Mutation testing runs on a **weekly schedule** (Sunday 02:00 UTC) via `.github/workflows/mutation-testing.yml`. It is not run on every PR due to the time cost. + +You can also trigger it manually from the Actions tab with an optional `target` input (`all` | `rust` | `typescript`). + +Artifacts (reports) are retained for 30 days. + +## Scope + +### Rust — targeted contracts + +- `audit_registry` — immutable anchor of signed meter readings (critical path) +- `energy_token` — SEP-41 certificate token, mint/burn/transfer logic + +`community_governance` is excluded from the initial scope (lower risk, less critical). + +Excluded from mutation (trivial getters with no logic): +- `get_version`, `admin`, `api_signer` (audit_registry) +- `name`, `symbol`, `decimals`, `admin` (energy_token) + +### TypeScript — `packages/stellar` + +Mutates `src/**/*.ts` (excluding test files). Key targets: +- `kwhToStroops` / `stroopsToKwh` — unit conversion used in every mint +- `NETWORKS` / `CONTRACT_IDS` — network configuration + +## Interpreting Results + +A **surviving mutant** means a code change went undetected by tests. For each survivor: + +1. Read the mutant diff in the report. +2. Decide if it represents a real bug scenario. +3. If yes, add a test that kills it. +4. If the mutation is semantically equivalent (impossible to observe), add it to the `exclude_re` list in `.cargo-mutants.toml` or Stryker's `mutate` excludes. + +## Tracking Over Time + +Stryker JSON reports (`reports/mutation/mutation-report.json`) and cargo-mutants `outcomes.json` are uploaded as GitHub Actions artifacts on every run. Compare scores across runs to track trends. diff --git a/docs/ONBOARDING.md b/docs/ONBOARDING.md index 37290b0..a1f7555 100644 --- a/docs/ONBOARDING.md +++ b/docs/ONBOARDING.md @@ -84,6 +84,9 @@ cp apps/web/.env.example apps/web/.env.local Edit `apps/web/.env.local` and fill in: +> Local development secrets must live in `apps/web/.env.local` only. This file is gitignored and should never be committed. +> CI should use GitHub Actions secrets, and production should use Vercel environment variables. + ```env # Supabase NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co @@ -92,6 +95,7 @@ SUPABASE_SERVICE_ROLE_KEY=your-service-role-key # Stellar NEXT_PUBLIC_STELLAR_NETWORK=testnet +NEXT_PUBLIC_STELLAR_RPC_URL=https://soroban-testnet.stellar.org NEXT_PUBLIC_ENERGY_TOKEN_ID= # from contract deployment NEXT_PUBLIC_AUDIT_REGISTRY_ID= # from contract deployment NEXT_PUBLIC_COMMUNITY_GOVERNANCE_ID= # from contract deployment diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md new file mode 100644 index 0000000..274a341 --- /dev/null +++ b/docs/USER_GUIDE.md @@ -0,0 +1,213 @@ +# SolarProof Dashboard — User Guide + +> **Audience:** Energy producers and cooperatives using the SolarProof web dashboard. +> **Live app:** [https://solarproof.vercel.app](https://solarproof.vercel.app) + +--- + +## Table of Contents + +1. [Connecting Your Wallet](#1-connecting-your-wallet) +2. [Dashboard Overview](#2-dashboard-overview) +3. [Submitting Meter Readings](#3-submitting-meter-readings) +4. [Viewing Certificates](#4-viewing-certificates) +5. [Retiring Certificates](#5-retiring-certificates) +6. [Participating in Governance](#6-participating-in-governance) +7. [Verifying a Certificate](#7-verifying-a-certificate) +8. [Troubleshooting](#8-troubleshooting) + +--- + +## 1. Connecting Your Wallet + +SolarProof uses [Freighter](https://www.freighter.app/) — a Stellar browser wallet — to sign transactions. + +**Prerequisites** + +- Freighter browser extension installed ([freighter.app](https://www.freighter.app/)) +- Freighter set to **Testnet** (Settings → Network → Testnet) +- Your Stellar account funded with at least 1 XLM (use [Stellar Laboratory Friendbot](https://laboratory.stellar.org/#account-creator?network=test) for testnet) + +**Steps** + +1. Open the SolarProof dashboard at `/dashboard`. +2. Click **Connect Wallet** in the top-right corner of the navigation bar. +3. Freighter will prompt you to approve the connection — click **Approve**. +4. Your truncated public key (e.g. `GABC…XYZ`) appears in the navbar, confirming you are connected. + +> **Screenshot placeholder:** `docs/screenshots/01-connect-wallet.png` +> *(Shows the navbar with the Connect Wallet button highlighted, then the connected state with the public key displayed.)* + +**Disconnecting** + +Click your public key in the navbar and select **Disconnect**. + +--- + +## 2. Dashboard Overview + +Navigate to **Dashboard** (`/dashboard`) to see a real-time summary of your energy activity. + +| Section | What it shows | +|---|---| +| **Total energy** | Cumulative kWh across all verified meter readings | +| **Certificates issued** | Number of energy tokens minted on Stellar (1 token = 1 kWh) | +| **Certificates retired** | Tokens permanently burned to claim renewable energy usage | +| **Active meters** | Meters that have reported in the last 24 hours | +| **Daily energy output chart** | Area chart of kWh over the last 14 days | +| **Verification status chart** | Verified vs. pending readings per meter | +| **Recent readings table** | Last 20 meter readings with status badges | + +> **Screenshot placeholder:** `docs/screenshots/02-dashboard-overview.png` +> *(Shows the full dashboard with stat cards, both charts, and the readings table.)* + +A **Verified** badge (green) means the reading's Ed25519 signature has been confirmed and the hash anchored on Stellar. A **Pending** badge (yellow) means verification is in progress. + +--- + +## 3. Submitting Meter Readings + +Meter readings can be submitted in two ways: via the UI form or programmatically via the API. + +### Via the UI (Meters page) + +1. Navigate to **Meters** (`/meters`). +2. Click **Submit Reading**. +3. Fill in the form: + - **Meter ID** — the unique identifier of your device + - **kWh** — energy generated since the last reading + - **Timestamp** — defaults to now; adjust if back-filling +4. Click **Submit**. The dashboard signs the reading with your connected wallet and posts it to `/api/readings`. +5. The new reading appears in the **Recent readings** table on the Dashboard with a **Pending** badge. It turns **Verified** once the API confirms the Ed25519 signature and anchors the hash on Stellar (usually within a few seconds). + +> **Screenshot placeholder:** `docs/screenshots/03-submit-reading-form.png` +> *(Shows the Submit Reading modal with the three fields filled in and the Submit button.)* + +### Via the API (automated / hardware meters) + +```bash +# Generate a meter keypair once +node scripts/gen-meter-key.mjs + +# Send a signed reading +node scripts/send-reading.mjs --kwh 12.5 --meter-key ./meter-key.json +``` + +See [docs/API.md](./API.md) for the full `POST /api/readings` specification. + +--- + +## 4. Viewing Certificates + +Each verified reading automatically mints an energy token (SEP-41) on Stellar — one token per kWh. + +1. Navigate to **Certificates** (`/certificates`). +2. The list shows all certificates associated with your wallet, including: + - **Certificate ID** — the on-chain token identifier + - **kWh** — energy amount represented + - **Issued** — date minted + - **Status** — Active or Retired +3. Click a certificate row to open the detail view, which shows: + - The originating meter reading + - The Stellar transaction hash (links to Stellar Explorer) + - The Ed25519 signature of the source reading + - The audit registry anchor hash + +> **Screenshot placeholder:** `docs/screenshots/04-certificates-list.png` +> *(Shows the certificates list with columns for ID, kWh, Issued date, and Status.)* + +> **Screenshot placeholder:** `docs/screenshots/05-certificate-detail.png` +> *(Shows the certificate detail page with the full chain of custody: meter → signature → ledger anchor → token.)* + +--- + +## 5. Retiring Certificates + +Retiring a certificate permanently burns the token on-chain, proving you have claimed the renewable energy for a specific period. This action is **irreversible**. + +1. Navigate to **Certificates** (`/certificates`). +2. Find the certificate you want to retire and click **Retire**. +3. A confirmation dialog appears showing the certificate ID and kWh amount. +4. Click **Confirm Retire**. Freighter will prompt you to sign the transaction. +5. Approve the transaction in Freighter. +6. The certificate status changes to **Retired** and the token is burned on Stellar. + +> **Screenshot placeholder:** `docs/screenshots/06-retire-confirmation.png` +> *(Shows the retire confirmation dialog with the certificate details and the Confirm Retire button.)* + +> **Note:** Retired certificates remain visible in the list with a **Retired** badge for audit purposes. They can be independently verified at `/verify`. + +--- + +## 6. Participating in Governance + +SolarProof cooperatives use on-chain governance to vote on proposals (e.g. fee changes, new meter policies). + +### Viewing proposals + +1. Navigate to **Governance** (`/governance`). +2. The proposals list shows: + - **Title** and description + - **Status** — Active, Passed, Rejected, or Executed + - **Voting deadline** + - **Current vote tally** (For / Against) + +> **Screenshot placeholder:** `docs/screenshots/07-governance-proposals.png` +> *(Shows the governance page with a list of proposals and their statuses.)* + +### Voting on a proposal + +1. Click a proposal with **Active** status to open its detail page. +2. Review the full description and any attached discussion. +3. Click **Vote For** or **Vote Against**. +4. Freighter prompts you to sign the vote transaction — click **Approve**. +5. Your vote is recorded on-chain. The tally updates immediately. + +> **Screenshot placeholder:** `docs/screenshots/08-vote-on-proposal.png` +> *(Shows the proposal detail page with the Vote For / Vote Against buttons and the live tally.)* + +### Creating a proposal + +1. On the **Governance** page, click **New Proposal**. +2. Fill in the **Title** and **Description**. +3. Click **Submit Proposal**. Freighter will prompt you to sign. +4. The proposal appears in the list with **Active** status and is open for voting immediately. + +> **Note:** Voting power is proportional to the number of active energy tokens held by your wallet at the time of the vote snapshot. + +--- + +## 7. Verifying a Certificate + +Anyone — including regulators and buyers — can verify a certificate without logging in. + +1. Navigate to **Verify** (`/verify`). +2. Enter a **Certificate ID** or **Stellar transaction hash**. +3. Click **Verify**. +4. The result shows the full chain of custody: + - Meter reading (kWh, timestamp, meter ID) + - Ed25519 signature validity + - Stellar ledger anchor (audit registry transaction) + - Certificate mint transaction + - Retirement transaction (if retired) + +> **Screenshot placeholder:** `docs/screenshots/09-verify-result.png` +> *(Shows the verify page with a certificate ID entered and the full chain-of-custody result expanded.)* + +--- + +## 8. Troubleshooting + +| Symptom | Likely cause | Fix | +|---|---|---| +| "Connect Wallet" button does nothing | Freighter not installed | Install from [freighter.app](https://www.freighter.app/) | +| Transaction fails with "insufficient funds" | Account has < 1 XLM | Fund via [Friendbot](https://laboratory.stellar.org/#account-creator?network=test) (testnet) | +| Reading stays **Pending** indefinitely | Signature verification failed | Check that the meter key matches the registered meter ID | +| Certificate not appearing after reading | Minting delay or failed mint | Check the Stellar transaction in the dashboard; see [tracer-sim auto-diagnosis](./API.md#error-handling) | +| Governance vote not registering | Wallet not connected or wrong network | Reconnect Freighter and ensure it is set to Testnet | + +For further help, open an issue at [github.com/AnnabelJoe/solarproof/issues](https://github.com/AnnabelJoe/solarproof/issues). + +--- + +*SolarProof Contributors 2026 · Apache-2.0* diff --git a/docs/adr/007-supabase-service-role-usage.md b/docs/adr/007-supabase-service-role-usage.md new file mode 100644 index 0000000..efd776c --- /dev/null +++ b/docs/adr/007-supabase-service-role-usage.md @@ -0,0 +1,58 @@ +# ADR 007 — Supabase Service Role Key Usage + +**Status:** Accepted +**Date:** 2026-06-02 +**Issue:** [#134](https://github.com/AnnabelJoe/solarproof/issues/134) + +## Context + +The Supabase service role key bypasses Row Level Security (RLS). Its use must be +minimised and every remaining usage justified. + +## Audit Results + +### Switched to anon key + RLS + +| Endpoint | Reason | +|---|---| +| `GET /api/verify` | Public, no auth. Anon SELECT policy added (migration 010). | +| `GET /api/verify/[id]` | Public, no auth. Same policy. | + +### Retained service role — justified uses + +| Location | Reason service role is required | +|---|---| +| `POST /api/readings` | Device-submitted data, no operator JWT. Must write across cooperative boundaries. | +| `POST /api/meters` | Operator action but needs to write `api_key`; simpler to stay consistent with reads. | +| `PATCH /api/meters/[id]/revoke` | Admin action. No operator JWT in device flow. | +| `POST /api/meters/[id]/rotate-key` | Requires auth, but key rotation updates `api_key` which RLS does not expose to `anon`. | +| `POST /api/certificates/[id]/retire` | Must validate and update certificate state across cooperative scope. | +| `GET /api/certificates` | Returns paginated certs with JOIN on readings; RLS would require operator JWT which callers may not have. | +| `GET /api/readings` | Requires operator JWT (enforced by `requireAuth`), but the service client avoids double-auth round-trip. | +| `lib/audit.ts` | Audit log writes must never be gated by operator RLS. | +| `lib/queue.ts` | Background job processing — no user JWT available. | +| `lib/webhooks.ts` | Cross-cooperative webhook fan-out; no user context. | +| `lib/tracer-sim.ts` | Mint-failure diagnosis reads across tables without a user JWT. | +| `GET /api/health` | Needs cross-tenant visibility for health checks. | +| `GET /api/audit-log` | Admin compliance export; scoped by query params. | +| `GET /api/jobs/[id]` | Job status lookup; no user JWT in background context. | +| `GET /api/ready` | Startup liveness probe. | + +## Decision + +1. Use `createAnonClient()` (anon key, RLS enforced) for all public read-only + endpoints that require no authentication. +2. Add explicit `to anon` RLS policies (migration 010) for the tables those + endpoints query. +3. All remaining `createServiceClient()` calls are in trusted server-side + contexts where either no user JWT is available or cross-cooperative access + is deliberately required. +4. The service role key must never be exposed to the browser or returned in any + API response. + +## Consequences + +- The public verifier (`/api/verify`) no longer uses the service role key. +- New public-read endpoints must use `createAnonClient()` and add an explicit RLS policy. +- Any future use of `createServiceClient()` in a new route requires a comment + citing this ADR and a one-line justification. diff --git a/docs/contracts/community_governance.md b/docs/contracts/community_governance.md index e9cfa05..45bfbc4 100644 --- a/docs/contracts/community_governance.md +++ b/docs/contracts/community_governance.md @@ -2,6 +2,8 @@ Cooperative on-chain governance — token holders submit proposals and vote. A proposal passes when `yes_votes / total_votes ≥ quorum%` after the voting period ends. +For best practices on configuring these parameters, see the [Governance Parameter Tuning Guide](../governance_tuning_guide.md). + - **SDK:** Soroban SDK 23.1.0 / OpenZeppelin Stellar v0.5.1 --- diff --git a/docs/contracts/storage_optimization.md b/docs/contracts/storage_optimization.md new file mode 100644 index 0000000..e949120 --- /dev/null +++ b/docs/contracts/storage_optimization.md @@ -0,0 +1,40 @@ +# Soroban Contract Storage Optimization Report + +## Overview +The `audit-registry` contract storage has been optimized to reduce ledger entry costs and footprint on the Stellar network. + +## Optimization Strategies + +### 1. Bucketed Storage +Previously, each meter reading hash was stored in its own persistent ledger entry. This resulted in one new ledger entry per reading, which is expensive due to the per-entry base cost. + +**Optimized Layout:** +- Readings are now grouped into **1024 buckets**. +- Each bucket is a single persistent ledger entry containing a `Map, u32>` (Reading Hash -> Ledger Sequence). +- Bucket ID is derived from the first two bytes of the reading hash: `((hash[0] << 8) | hash[1]) % 1024`. + +### 2. Redundant Data Removal +The `AuditAnchor` struct previously stored the `reading_hash` in the entry value. Since the hash is already the key (either in the previous individual entry or in the new bucket Map), it was redundant. + +**Optimized Value:** +- Only the `anchored_at_ledger` (4 bytes) is stored as the value in the bucket Map. +- The `AuditAnchor` struct is reconstructed on-the-fly when queried. + +### 3. Temporary Storage for Idempotency +Nonces used for transaction idempotency were previously stored in persistent storage. + +**Optimized Storage:** +- Nonces are now stored in **Temporary storage**. +- This reduces the long-term ledger footprint as nonces only need to be unique for a short window to prevent immediate replays. Permanent replay protection is still provided by the reading hash itself in the bucketed storage. + +## Cost Comparison + +| Metric | Before Optimization | After Optimization | Improvement | +|--------|---------------------|--------------------|-------------| +| **Persistent Entries** | N + M (N readings, M nonces) | min(N, 1024) | ~99.9% reduction for 1M readings | +| **Temporary Entries** | 0 | M (M nonces) | Better use of cheaper storage | +| **Data Size (per reading)** | ~70 bytes + entry overhead | ~36 bytes in Map | ~50% reduction in value size | +| **Base Entry Costs** | 2 per reading | ~0.001 per reading (at scale) | High savings on base fees | + +## Documentation +The contract code in `apps/contracts/audit_registry/src/lib.rs` has been updated with these changes, and all tests have been verified (fixed and extended with bucket collision tests). diff --git a/docs/deployments.md b/docs/deployments.md index 5699022..41726f8 100644 --- a/docs/deployments.md +++ b/docs/deployments.md @@ -27,3 +27,100 @@ Explorer: `https://stellar.expert/explorer/public/contract/` --- > **How to update this file:** After running the deploy workflow (or manual deploy steps below), paste the contract IDs returned by `stellar contract deploy` into the table above and commit the change. + +--- + +## Mainnet Deployment Process + +### Prerequisites + +- [ ] Contract audits complete (see `docs/AUDIT_SCOPE.md`) +- [ ] Deployment checklist reviewed and signed off by two maintainers +- [ ] Admin keypair stored in a hardware wallet (Ledger / YubiKey) or HSM +- [ ] Deployer account funded with sufficient XLM for deployment fees (~10 XLM per contract) +- [ ] `stellar` CLI installed and configured for `mainnet` + +### Key Management + +**Admin key** — controls `set_minter`, `set_api_signer`, and governance admin functions. +Store in a hardware wallet. Never export the private key to disk or CI. + +**Deployer key** — used only during deployment to pay fees. Rotate after deployment. +Store in a secrets manager (e.g. AWS Secrets Manager, HashiCorp Vault). + +**Minter key** — used by the SolarProof API to call `energy_token.mint()`. +Store as a GitHub Actions secret (`MINTER_SECRET_KEY`). Rotate quarterly. + +### Environment Separation + +| Variable | Testnet | Mainnet | +|---|---|---| +| `NEXT_PUBLIC_STELLAR_NETWORK` | `testnet` | `mainnet` | +| `NEXT_PUBLIC_ENERGY_TOKEN_ID` | testnet contract ID | mainnet contract ID | +| `NEXT_PUBLIC_AUDIT_REGISTRY_ID` | testnet contract ID | mainnet contract ID | +| `NEXT_PUBLIC_COMMUNITY_GOVERNANCE_ID` | testnet contract ID | mainnet contract ID | +| `MINTER_SECRET_KEY` | testnet keypair | mainnet keypair (HSM-backed) | + +Testnet and mainnet configs are kept in separate GitHub Actions environments (`staging` and `production`). Never share secrets between environments. + +### Deployment Steps + +1. **Build contracts** + ```bash + cd apps/contracts + stellar contract build + ``` + +2. **Run the mainnet deploy script** + ```bash + DEPLOYER_SECRET_KEY= \ + CONFIRM_MAINNET=yes \ + ./scripts/deploy-mainnet.sh + ``` + The script is idempotent — it skips contracts already listed in `scripts/deployments/mainnet.json`. + +3. **Record contract addresses** + Copy the contract IDs from `scripts/deployments/mainnet.json` into the Mainnet table above and commit. + +4. **Initialize contracts** + After deployment, call `initialize` on each contract with the correct admin and minter addresses: + ```bash + stellar contract invoke \ + --id \ + --source \ + --network mainnet \ + -- initialize \ + --admin \ + --minter + ``` + Repeat for `audit_registry` (with `api_signer`) and `community_governance`. + +5. **Update environment variables** + Set the mainnet contract IDs in the `production` GitHub Actions environment and in Vercel. + +6. **Verify deployment** + ```bash + stellar contract invoke \ + --id \ + --network mainnet \ + -- name + ``` + Expected output: `"SolarProof kWh"` + +### Deployment Checklist + +- [ ] Contracts built from a tagged release commit (not a development branch) +- [ ] Contract audit report reviewed; all critical/high findings resolved +- [ ] Admin address is a hardware-wallet-controlled account +- [ ] Minter address is the production API keypair +- [ ] `initialize` called on all three contracts +- [ ] Contract IDs recorded in this file and committed +- [ ] Mainnet environment variables updated in Vercel and GitHub Actions +- [ ] Smoke test passed: send a test meter reading end-to-end +- [ ] Deployment signed off by two maintainers (record names and date below) + +**Sign-off:** +| Name | Date | Role | +|---|---|---| +| | | Deployer | +| | | Reviewer | diff --git a/docs/governance_tuning_guide.md b/docs/governance_tuning_guide.md new file mode 100644 index 0000000..5adde51 --- /dev/null +++ b/docs/governance_tuning_guide.md @@ -0,0 +1,78 @@ +# Governance Parameter Tuning Guide + +This guide provides best practices for configuring governance parameters in the SolarProof Community Governance contract. Choosing the right parameters is critical for balancing security, agility, and community participation. + +## Parameters Overview + +### 1. Quorum Threshold (`QuorumBps`) +The minimum percentage of "Yes" votes required for a proposal to pass, relative to the total number of registered voters. +- **Role**: Prevents small minorities from making significant changes. +- **Default**: 1000 (10%). + +### 2. Approval Threshold (`ThresholdBps`) +The percentage of cast votes that must be "Yes" for the proposal to pass (majority rule). +- **Role**: Ensures broad consensus among active voters. +- **Default**: 5100 (51%). + +### 3. Voting Duration (`VotingPeriod`) +The length of time (in ledgers) that a proposal remains open for voting. +- **Role**: Balances the need for quick decisions with giving voters enough time to review and cast their votes. +- **Scale**: In Soroban (10s ledger time), 1 day ≈ 8,640 ledgers. + +### 4. Execution Timelock (`ExecuteTimelock`) +The cooldown period between a proposal passing and when it can actually be executed. +- **Role**: Provides a safety window for the community to react (or exit) if a malicious or controversial proposal passes. + +### 5. Minimum Balance (Proposer Requirement) +*Note: Currently enforced socially or through custom front-ends/wrappers in SolarProof.* +- **Role**: Prevents spam by requiring proposers to have a "stake" in the system (e.g., holding a minimum amount of Energy Tokens). + +--- + +## Tuning by DAO Size + +### Small DAOs (< 100 Members) +Typically highly active, closely-knit groups where communication is efficient. +- **Goal**: High agility and high participation. +- **Quorum**: High (e.g., 20-30%) because reaching a large portion of 50 people is feasible. +- **Voting Duration**: Short (3-5 days). +- **Timelock**: Minimal (24 hours). + +### Medium DAOs (100 - 1000 Members) +A mix of active contributors and passive observers. +- **Goal**: Balance security with participation. +- **Quorum**: Moderate (e.g., 10-15%). +- **Voting Duration**: Moderate (7 days). +- **Timelock**: Moderate (2-3 days). + +### Large DAOs (1000+ Members) +High degree of voter apathy and diverse interests. +- **Goal**: Prevent gridlock while maintaining security. +- **Quorum**: Low (e.g., 2-5%) to avoid proposals constantly failing due to lack of turnout. +- **Voting Duration**: Long (10-14 days) to ensure enough reach. +- **Timelock**: Long (7 days) for maximum security. + +--- + +## Example Configurations + +| Size | Quorum (BPS) | Threshold (BPS) | Voting Period | Timelock | +| :--- | :--- | :--- | :--- | :--- | +| **Small** | 2500 (25%) | 5100 (51%) | 25,920 ledgers (~3 days) | 8,640 ledgers (~24h) | +| **Medium** | 1000 (10%) | 5100 (51%) | 60,480 ledgers (~7 days) | 17,280 ledgers (~48h) | +| **Large** | 300 (3%) | 6000 (60%) | 120,960 ledgers (~14 days) | 60,480 ledgers (~7 days) | + +--- + +## Tradeoffs and Best Practices + +### Quorum vs. Participation +- **High Quorum**: Highly secure against hostile takeovers but risks "governance gridlock" where nothing passes due to apathy. +- **Low Quorum**: Easy to pass changes, but susceptible to "ninja voting" (small groups passing changes while others aren't looking). + +### Duration vs. Agility +- **Longer Durations**: Better for complex technical changes or high-stakes financial decisions. Give the community time to discuss on social channels. +- **Shorter Durations**: Better for operational tweaks or emergency responses. + +### Timelocks as a Safety Valve +Always use a timelock for protocol upgrades or large fund movements. A 48-72 hour window is generally considered the "goldilocks" zone for medium-sized DAOs, allowing enough time for an "emergency pause" or for users to withdraw their stake if they disagree with the outcome. diff --git a/docs/runbooks/README.md b/docs/runbooks/README.md new file mode 100644 index 0000000..8e50226 --- /dev/null +++ b/docs/runbooks/README.md @@ -0,0 +1,10 @@ +# Runbooks + +Operational runbooks for common SolarProof procedures. + +| Runbook | Description | +|---|---| +| [contract-deployment.md](contract-deployment.md) | Deploy Soroban contracts to testnet and mainnet | +| [meter-key-rotation.md](meter-key-rotation.md) | Rotate an Ed25519 meter signing key | +| [failed-mint-investigation.md](failed-mint-investigation.md) | Diagnose and resolve failed energy token mint jobs | +| [incident-response.md](incident-response.md) | Detect, contain, resolve, and learn from incidents | diff --git a/docs/runbooks/contract-deployment.md b/docs/runbooks/contract-deployment.md new file mode 100644 index 0000000..3bd3b5b --- /dev/null +++ b/docs/runbooks/contract-deployment.md @@ -0,0 +1,89 @@ +# Runbook: Contract Deployment + +Covers deploying SolarProof Soroban contracts to testnet and mainnet. + +For full deployment documentation see [docs/DEPLOYMENT.md](../DEPLOYMENT.md). + +--- + +## Prerequisites + +- Rust toolchain (see `apps/contracts/rust-toolchain.toml`) +- `wasm32-unknown-unknown` target: `rustup target add wasm32-unknown-unknown` +- Stellar CLI: `cargo install --locked stellar-cli --features opt` +- Funded deployer account (testnet: use friendbot; mainnet: real XLM) +- `DEPLOYER_SECRET_KEY` environment variable set + +--- + +## Testnet Deployment + +```bash +# 1. Build contracts +cd apps/contracts && stellar contract build + +# 2. Deploy (idempotent — skips already-deployed contracts) +DEPLOYER_SECRET_KEY= bash scripts/deploy-testnet.sh +``` + +The script writes contract IDs to `scripts/deployments/testnet.json`. + +```bash +# 3. Initialize each contract +ADMIN=$(stellar keys address deployer) + +stellar contract invoke --id $TOKEN_ID --source deployer --network testnet \ + -- initialize --admin $ADMIN --minter $ADMIN + +stellar contract invoke --id $REGISTRY_ID --source deployer --network testnet \ + -- initialize --admin $ADMIN + +stellar contract invoke --id $GOV_ID --source deployer --network testnet \ + -- initialize --admin $ADMIN --quorum 51 --voting_period_ledgers 17280 + +# 4. Update docs/deployments.md with the new contract IDs +# 5. Set contract IDs in .env.local (see docs/DEPLOYMENT.md §2d) +``` + +--- + +## Mainnet Deployment + +> ⚠️ Irreversible. Use an HSM-backed key. Test on testnet first. + +Same steps as testnet — replace `--network testnet` with `--network mainnet` and use `scripts/deploy-mainnet.sh`. + +--- + +## Verify Deployed Bytecode + +```bash +# Compute local WASM hash +sha256sum apps/contracts/target/wasm32-unknown-unknown/release/energy_token.wasm + +# Compare against on-chain hash at: +# https://stellar.expert/explorer/testnet/contract/ +# Contract tab → WASM section → WASM hash +``` + +Hashes must match. A mismatch means the on-chain contract differs from the local build. + +--- + +## Rollback + +Soroban contracts are immutable. Rollback = deploy a new contract and update env vars. + +1. Deploy corrected WASM → new contract ID +2. Update `NEXT_PUBLIC_ENERGY_TOKEN_ID` (and/or other IDs) in environment +3. Redeploy web app (Vercel picks up new env vars automatically) +4. Update `docs/deployments.md` with new ID and rollback note +5. Do not delete the old contract — it is an audit record + +--- + +## CI / Automated Deployment + +Testnet deployment runs automatically on push to `main` via `.github/workflows/deploy-contracts.yml`. + +To trigger manually: GitHub → Actions → Deploy Contracts → Run workflow. diff --git a/docs/runbooks/failed-mint-investigation.md b/docs/runbooks/failed-mint-investigation.md new file mode 100644 index 0000000..163e912 --- /dev/null +++ b/docs/runbooks/failed-mint-investigation.md @@ -0,0 +1,97 @@ +# Runbook: Investigating Failed Mint Jobs + +Covers diagnosing and resolving failed energy token mint jobs. + +--- + +## Background + +When a meter reading is submitted, the API: +1. Verifies the Ed25519 signature +2. Anchors the reading hash to Stellar via `audit_registry` +3. Mints an `energy_token` (1 token = 1 kWh) + +A mint failure means step 3 failed. The reading may still be anchored (step 2 succeeded). Failed mints are recorded in the `mint_jobs` table with a `status` of `failed` and a `diagnosis` field populated by tracer-sim. + +--- + +## Step 1 — Identify the Failed Job + +```sql +SELECT id, meter_id, kwh, created_at, status, diagnosis, anchor_tx_hash, mint_tx_hash +FROM mint_jobs +WHERE status = 'failed' +ORDER BY created_at DESC +LIMIT 20; +``` + +Check the `diagnosis` field — tracer-sim auto-populates a failure reason when available. + +--- + +## Step 2 — Common Failure Causes + +| Diagnosis / symptom | Likely cause | Resolution | +|---|---|---| +| `insufficient_balance` | Minter account out of XLM | Top up the minter account (see Step 3) | +| `contract_not_found` | Wrong contract ID in env | Verify `NEXT_PUBLIC_ENERGY_TOKEN_ID` matches deployed contract | +| `sequence_number_mismatch` | Concurrent mint race | Retry the job (usually self-resolving) | +| `network_timeout` | Stellar RPC unreachable | Check Stellar network status; retry after recovery | +| `signature_invalid` | Minter key mismatch | Verify `MINTER_SECRET_KEY` env var matches the contract's authorized minter | +| `already_minted` | Duplicate job | Check if a successful mint exists for the same `reading_id`; mark job resolved | + +--- + +## Step 3 — Top Up the Minter Account (if needed) + +```bash +# Check minter balance +stellar account info --account --network testnet + +# Testnet: use friendbot +curl "https://friendbot.stellar.org?addr=" + +# Mainnet: transfer XLM from a funded account +stellar payment send \ + --source \ + --destination \ + --amount 100 \ + --network mainnet +``` + +--- + +## Step 4 — Retry the Failed Job + +```bash +# Trigger a retry via the API (if a retry endpoint exists) +curl -X POST https:///api/admin/mint-jobs//retry \ + -H "Authorization: Bearer " +``` + +Or re-submit the original reading — the server is idempotent for anchoring (returns `409` if already anchored) but will attempt a fresh mint if the previous one failed. + +--- + +## Step 5 — Verify Resolution + +```sql +SELECT id, status, mint_tx_hash FROM mint_jobs WHERE id = ''; +``` + +Confirm `status = 'completed'` and `mint_tx_hash` is populated. + +Verify the on-chain mint at: +``` +https://stellar.expert/explorer/testnet/tx/ +``` + +--- + +## Step 6 — Escalate if Unresolved + +If the failure persists after retrying: +1. Capture the full `diagnosis` text and `anchor_tx_hash` +2. Open an incident (see [incident-response.md](incident-response.md)) +3. Check Stellar network status at https://status.stellar.org +4. Review tracer-sim output in application logs for the full replay trace diff --git a/docs/runbooks/incident-response.md b/docs/runbooks/incident-response.md new file mode 100644 index 0000000..9002c9e --- /dev/null +++ b/docs/runbooks/incident-response.md @@ -0,0 +1,125 @@ +# Runbook: Incident Response + +Covers detecting, containing, resolving, and learning from incidents affecting SolarProof. + +--- + +## Severity Levels + +| Level | Description | Response time | +|---|---|---| +| P1 — Critical | Production down, data loss, security breach | Immediate | +| P2 — High | Core feature broken, significant user impact | < 1 hour | +| P3 — Medium | Degraded performance, non-critical feature broken | < 4 hours | +| P4 — Low | Minor issue, cosmetic, no user impact | Next business day | + +--- + +## Phase 1 — Detection and Triage + +1. **Detect** — via monitoring alert, error report, or user feedback +2. **Record** — open an incident issue on GitHub with: + - Severity level + - Affected systems (web app, API, database, smart contracts, infrastructure) + - Observed symptoms and first detection time +3. **Assign** — designate an incident commander (IC) responsible for coordination +4. **Communicate** — notify stakeholders via the agreed channel (Slack, email, etc.) + +--- + +## Phase 2 — Containment + +Act to stop the incident from worsening before root cause is known. + +| Affected system | Containment action | +|---|---| +| Web app / API | Roll back the last Vercel deployment | +| Smart contract exploit | Invoke contract pause via governance (see below) | +| Compromised meter key | Deactivate the meter record immediately (see [meter-key-rotation.md](meter-key-rotation.md)) | +| Database corruption | Stop write traffic; put app in maintenance mode | +| Failed mints (bulk) | Pause the mint job queue; investigate (see [failed-mint-investigation.md](failed-mint-investigation.md)) | + +**Pause a smart contract (if pause function available):** + +```bash +stellar contract invoke --id --source --network mainnet \ + -- pause +``` + +**Roll back a Vercel deployment:** + +```bash +vercel rollback --token +# Or via Vercel dashboard: Deployments → previous deployment → Promote to Production +``` + +**Preserve evidence before making changes:** + +```bash +# Capture recent application logs +# Export relevant database tables +# Screenshot monitoring dashboards +``` + +--- + +## Phase 3 — Investigation + +1. Review application logs for errors around the incident start time +2. Check recent deployments, config changes, and dependency updates +3. Query the database for anomalous data: + +```sql +-- Recent failed readings +SELECT * FROM readings WHERE created_at > now() - interval '1 hour' AND status != 'anchored'; + +-- Recent failed mints +SELECT * FROM mint_jobs WHERE status = 'failed' AND created_at > now() - interval '1 hour'; + +-- Audit log for recent admin actions +SELECT * FROM audit_log ORDER BY created_at DESC LIMIT 50; +``` + +4. Check Stellar network status: https://status.stellar.org +5. Check Vercel deployment status: https://vercel.com/status + +--- + +## Phase 4 — Resolution + +1. Apply the fix (code patch, config change, data correction, or rollback) +2. Validate recovery: + - Run smoke tests against production + - Confirm error rates return to baseline in monitoring + - Verify a successful end-to-end reading submission if the API was affected +3. Lift containment measures (re-enable features, unpause contracts, restore write traffic) +4. Confirm with stakeholders that the incident is resolved + +--- + +## Phase 5 — Postmortem + +Complete within 48 hours of resolution for P1/P2 incidents. + +1. Write a postmortem document covering: + - Timeline (detection → containment → resolution) + - Root cause + - Impact (users affected, data affected, duration) + - What went well + - What went wrong + - Action items with owners and due dates +2. Update this runbook if any procedure was unclear or missing +3. Add monitoring or alerting to catch the same issue earlier next time +4. Share the postmortem with the team + +--- + +## Useful Links + +- Stellar network status: https://status.stellar.org +- Stellar Expert (testnet): https://stellar.expert/explorer/testnet +- Stellar Expert (mainnet): https://stellar.expert/explorer/mainnet +- Vercel dashboard: https://vercel.com/dashboard +- Supabase dashboard: https://app.supabase.com +- GitHub Actions: https://github.com/AnnabelJoe/solarproof/actions +- Security policy: [SECURITY.md](../../SECURITY.md) diff --git a/docs/runbooks/meter-key-rotation.md b/docs/runbooks/meter-key-rotation.md new file mode 100644 index 0000000..809b63c --- /dev/null +++ b/docs/runbooks/meter-key-rotation.md @@ -0,0 +1,77 @@ +# Runbook: Meter Key Rotation + +Covers rotating the Ed25519 signing key for a meter device — scheduled rotation, suspected compromise, or key loss. + +--- + +## When to Rotate + +- Scheduled rotation (recommended: annually or per security policy) +- Private key suspected compromised or exposed +- Device transferred to a new operator +- Key material lost + +--- + +## Steps + +### 1. Generate a new keypair + +```bash +node scripts/gen-meter-key.mjs +# Writes meter-key-new.json: { private_key_hex, public_key_hex } +``` + +For production devices, generate the keypair on the device itself (HSM/TPM). Never generate a production key on a workstation. + +### 2. Register the new public key + +Insert the new key into the `meters` table with a new UUID, keeping the old record active during the transition: + +```sql +INSERT INTO meters (id, pubkey_hex, cooperative_id, active) +VALUES (gen_random_uuid(), '', '', true); +``` + +Note the new `meter_id` — the device must use this UUID in all future reading submissions. + +### 3. Update the device + +Deploy the new private key and new `meter_id` to the device. For HSM-backed devices, provision the new key into the secure enclave and update the device configuration. + +### 4. Verify the new key works + +Send a test reading using the new key and confirm a `201 Created` response: + +```bash +node scripts/send-reading.mjs \ + --meter-id \ + --kwh 0.001 \ + --key ./meter-key-new.json \ + --api https:// +``` + +### 5. Deactivate the old meter record + +Once the new key is confirmed working, deactivate the old record: + +```sql +UPDATE meters SET active = false WHERE id = ''; +``` + +The old record is retained for audit purposes — do not delete it. + +### 6. Securely destroy the old private key + +- Remove the old key from the device's secure storage +- Delete any copies from workstations, CI secrets, or backups +- Record the rotation in the audit log + +--- + +## Notes + +- The server rejects readings from inactive meter records (`404` response) +- Readings signed with the old key after deactivation will be rejected +- If the key was compromised, deactivate the old record immediately (step 5) before completing the rest of the rotation +- Test rotation in staging before applying to production meters diff --git a/docs/security/pentest-report-2026-07.md b/docs/security/pentest-report-2026-07.md new file mode 100644 index 0000000..4b006fa --- /dev/null +++ b/docs/security/pentest-report-2026-07.md @@ -0,0 +1,36 @@ +# Penetration Test Report — SolarProof Web Application & API + +**Issue:** #342 +**Engagement period:** TBD +**Tester:** TBD +**Status:** Pending engagement + +> **Note:** This file is a placeholder. It will be replaced with the full report once the penetration test engagement is complete. See [pentest-scope.md](./pentest-scope.md) for scope and timeline. + +--- + +## Executive Summary + +_To be completed after engagement._ + +--- + +## Findings + +_To be completed after engagement._ + +| ID | Title | Severity | Status | +|---|---|---|---| +| — | — | — | Pending | + +--- + +## Remediation Status + +_To be completed after retest._ + +--- + +## Retest Summary + +_To be completed after remediation window._ diff --git a/docs/security/pentest-scope.md b/docs/security/pentest-scope.md new file mode 100644 index 0000000..9006a76 --- /dev/null +++ b/docs/security/pentest-scope.md @@ -0,0 +1,86 @@ +# Penetration Test Scope — SolarProof Web Application & API + +**Issue:** #342 +**Status:** Defined — awaiting engagement +**Priority:** High + +--- + +## Scope + +### In Scope + +| Target | Description | +|---|---| +| Web application | `https://solarproof.vercel.app` — all authenticated and public pages | +| REST API | All endpoints under `/api/v1/` | +| Authentication flows | Login, token refresh, logout, session management | +| Public verifier | `GET /api/v1/verify/:certificateId` — unauthenticated endpoint | +| Webhook registration | `POST /api/webhooks` — input validation, HMAC secret handling | +| File upload / input fields | All user-controlled inputs | +| Rate limiting | Verify bypass attempts, brute-force login | + +### Out of Scope + +| Target | Reason | +|---|---| +| Stellar network / Soroban contracts | Separate smart-contract audit track | +| Supabase infrastructure | Managed service; covered by Supabase's own security programme | +| Third-party OAuth providers | Not in use | +| Denial-of-service at network layer | Infrastructure-level; not application-layer | +| Physical meter devices | Hardware security is a separate workstream | + +--- + +## Test Methodology + +Testing must follow **OWASP Testing Guide v4.2** and cover at minimum: + +- **OWASP Top 10 (2021):** A01–A10 +- **OWASP API Security Top 10 (2023):** API1–API10 +- Authentication & session management (OWASP ASVS Level 2) +- Business logic flaws (certificate minting, retirement, bulk operations) +- IDOR on certificate and meter endpoints +- HMAC secret exposure in webhook payloads +- JWT algorithm confusion / weak signing +- Mass assignment / over-posting +- Rate-limit bypass on public endpoints + +--- + +## Tester Requirements + +- Qualified security professional (OSCP, CEH, or equivalent) +- Signed NDA and rules of engagement before testing begins +- Testing performed against **staging environment only** — never production +- All findings reported via the private security advisory channel (see [SECURITY.md](../../SECURITY.md)) + +--- + +## Deliverables + +1. Executive summary (risk rating, key findings) +2. Technical findings report with CVSS scores, reproduction steps, and remediation guidance +3. Retest report after remediation of critical/high findings +4. Final report stored in `/docs/security/pentest-report-YYYY-MM.md` + +--- + +## Timeline + +| Milestone | Target | +|---|---| +| Scope sign-off | 2026-06-15 | +| Engagement start | 2026-07-01 | +| Draft report | 2026-07-21 | +| Remediation window | 2026-07-22 – 2026-08-05 | +| Retest & final report | 2026-08-12 | + +--- + +## References + +- [OWASP Testing Guide v4.2](https://owasp.org/www-project-web-security-testing-guide/) +- [OWASP API Security Top 10](https://owasp.org/www-project-api-security/) +- [SECURITY.md](../../SECURITY.md) +- [THREAT_MODEL.md](../THREAT_MODEL.md) diff --git a/openapi.yaml b/openapi.yaml index 20b9683..607fa6b 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -20,7 +20,10 @@ info: ## Versioning All endpoints are available under `/api/v1/` (canonical) and `/api/` (legacy alias). - The `/api/v1/` prefix is preferred for new integrations. + The `/api/` unversioned routes return a `301 Moved Permanently` redirect to the + `/api/v1/` equivalent. New integrations should use `/api/v1/` directly. + + All responses include an `API-Version: v1` header. ## Rate Limiting @@ -56,6 +59,67 @@ tags: - name: health description: Service health check +paths: + # --------------------------------------------------------------------------- + # v1 canonical paths + # --------------------------------------------------------------------------- + /api/v1/auth/login: + post: + operationId: loginV1 + tags: [auth] + summary: Exchange email and password for JWT tokens (v1) + security: [] + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/LoginRequest' + responses: + '200': + description: Authentication successful + headers: + API-Version: + $ref: '#/components/headers/ApiVersion' + content: + application/json: + schema: + $ref: '#/components/schemas/TokenResponse' + '400': + $ref: '#/components/responses/ValidationError' + '401': + description: Invalid credentials + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + + # --------------------------------------------------------------------------- + # Legacy unversioned paths (301 redirect to v1 equivalents) + # --------------------------------------------------------------------------- + /api/auth/login: + post: + operationId: loginLegacy + tags: [auth] + summary: "[Deprecated] Use /api/v1/auth/login" + deprecated: true + security: [] + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/LoginRequest' + responses: + '301': + description: Permanently redirected to /api/v1/auth/login + headers: + Location: + schema: + type: string + API-Version: + $ref: '#/components/headers/ApiVersion' + paths: /api/auth/login: post: @@ -358,6 +422,82 @@ paths: '404': $ref: '#/components/responses/NotFound' + /api/v1/verify/{certificateId}: + get: + operationId: verifyCertificateV1 + tags: [verify] + summary: Public certificate verification (v1) + description: | + Returns the full chain of custody for a certificate. No authentication required. + + Accepts a certificate UUID, reading hash (64-char hex), or mint transaction hash + as the `certificateId` path parameter. + + Results are cached for 60 seconds. Rate limited to 60 requests per minute per IP. + security: [] + parameters: + - name: certificateId + in: path + required: true + description: Certificate UUID, reading hash (64-char hex), or mint transaction hash + schema: + type: string + example: a1b2c3d4-e5f6-7890-abcd-ef1234567890 + responses: + '200': + description: Full chain of custody + headers: + Cache-Control: + schema: + type: string + example: public, max-age=60, stale-while-revalidate=30 + X-Cache: + schema: + type: string + enum: [HIT, MISS] + content: + application/json: + schema: + $ref: '#/components/schemas/ChainOfCustody' + example: + certificate: + id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 + kwh: 12.5 + issued_at: '2026-01-15T10:30:00Z' + retired: false + retired_at: null + retired_by: null + on_chain: + anchor_tx: abc123def456 + anchor_explorer: https://stellar.expert/explorer/testnet/tx/abc123def456 + mint_tx: def456abc123 + mint_explorer: https://stellar.expert/explorer/testnet/tx/def456abc123 + retirement_tx: null + meter_proof: + meter_id: meter-001 + reading_hash: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890 + signature_hex: aabbccdd... + kwh: 12.5 + timestamp: '2026-01-15T10:00:00Z' + verified: true + '400': + $ref: '#/components/responses/ValidationError' + '404': + $ref: '#/components/responses/NotFound' + '429': + description: Rate limit exceeded + headers: + Retry-After: + schema: + type: integer + description: Seconds to wait before retrying + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + example: + error: Too Many Requests + /api/certificates: get: operationId: listCertificates @@ -643,6 +783,14 @@ components: bearerFormat: JWT description: Supabase JWT obtained from `POST /api/auth/login` + headers: + ApiVersion: + description: Current API version served + schema: + type: string + enum: [v1] + example: v1 + parameters: limit: name: limit diff --git a/package.json b/package.json index 42ffad3..4488835 100644 --- a/package.json +++ b/package.json @@ -21,7 +21,7 @@ "conventional-changelog-conventionalcommits": "^8.0.0", "prettier": "^3.3.3", "semantic-release": "^24.0.0", - "turbo": "^2.9.12", + "turbo": "^2.9.16", "typescript": "^5.6.3" }, "packageManager": "pnpm@10.6.5", diff --git a/packages/stellar/package.json b/packages/stellar/package.json index e484da7..8288caf 100644 --- a/packages/stellar/package.json +++ b/packages/stellar/package.json @@ -10,6 +10,7 @@ "types": "./dist/index.d.ts", "import": "./dist/index.mjs", "require": "./dist/index.js" + } }, "scripts": { diff --git a/packages/stellar/src/__tests__/index.test.ts b/packages/stellar/src/__tests__/index.test.ts index 47f6d79..b1f73d8 100644 --- a/packages/stellar/src/__tests__/index.test.ts +++ b/packages/stellar/src/__tests__/index.test.ts @@ -189,9 +189,9 @@ describe('build_mint_tx (buildTransaction with method="mint")', () => { expect(tx).toBeTruthy() }) - it('encodes fractional kWh correctly (0.1 kWh = 1_000_000 stroops)', async () => { + it('encodes fractional kWh correctly (0.1 kWh = 100 token units)', async () => { const stroops = kwhToStroops(0.1) - expect(stroops).toBe(1_000_000n) + expect(stroops).toBe(100n) }) }) @@ -283,27 +283,35 @@ describe('bytesToScVal', () => { // --------------------------------------------------------------------------- describe('kwhToStroops', () => { - it('converts 1 kWh to 10_000_000 stroops', () => { - expect(kwhToStroops(1)).toBe(10_000_000n) + it('converts 1 kWh to 1_000 token units', () => { + expect(kwhToStroops(1)).toBe(1_000n) }) - it('converts 0.1 kWh to 1_000_000 stroops', () => { - expect(kwhToStroops(0.1)).toBe(1_000_000n) + it('converts 0.1 kWh to 100 token units', () => { + expect(kwhToStroops(0.1)).toBe(100n) }) it('rounds floating-point imprecision correctly', () => { // 0.3 in IEEE 754 is slightly less than 0.3; Math.round prevents truncation. - expect(kwhToStroops(0.3)).toBe(3_000_000n) + expect(kwhToStroops(0.3)).toBe(300n) }) - it('converts 0 kWh to 0 stroops', () => { + it('converts 0 kWh to 0 token units', () => { expect(kwhToStroops(0)).toBe(0n) }) + + it('converts 12.5 kWh to 12_500 token units', () => { + expect(kwhToStroops(12.5)).toBe(12_500n) + }) + + it('converts 0.001 kWh (minimum precision) to 1 token unit', () => { + expect(kwhToStroops(0.001)).toBe(1n) + }) }) describe('stroopsToKwh', () => { - it('converts 10_000_000 stroops to 1 kWh', () => { - expect(stroopsToKwh(10_000_000n)).toBe(1) + it('converts 1_000 token units to 1 kWh', () => { + expect(stroopsToKwh(1_000n)).toBe(1) }) it('round-trips kwhToStroops → stroopsToKwh', () => { diff --git a/packages/stellar/src/index.test.ts b/packages/stellar/src/index.test.ts new file mode 100644 index 0000000..1ed778c --- /dev/null +++ b/packages/stellar/src/index.test.ts @@ -0,0 +1,64 @@ +import { describe, it, expect } from 'vitest' +import { kwhToStroops, stroopsToKwh, NETWORKS, CONTRACT_IDS } from './index' + +describe('kwhToStroops', () => { + it('converts whole kWh', () => { + expect(kwhToStroops(1)).toBe(10_000_000n) + }) + + it('converts fractional kWh', () => { + expect(kwhToStroops(0.5)).toBe(5_000_000n) + }) + + it('converts zero', () => { + expect(kwhToStroops(0)).toBe(0n) + }) + + it('rounds sub-stroop values', () => { + // 1.00000001 kWh rounds to 10_000_000 stroops + expect(kwhToStroops(1.00000001)).toBe(10_000_000n) + }) + + it('handles large values', () => { + expect(kwhToStroops(1000)).toBe(10_000_000_000n) + }) +}) + +describe('stroopsToKwh', () => { + it('converts stroops to kWh', () => { + expect(stroopsToKwh(10_000_000n)).toBe(1) + }) + + it('converts zero', () => { + expect(stroopsToKwh(0n)).toBe(0) + }) + + it('converts fractional result', () => { + expect(stroopsToKwh(5_000_000n)).toBe(0.5) + }) + + it('round-trips with kwhToStroops', () => { + const kwh = 12.5 + expect(stroopsToKwh(kwhToStroops(kwh))).toBe(kwh) + }) +}) + +describe('NETWORKS', () => { + it('has testnet config', () => { + expect(NETWORKS.testnet.rpcUrl).toContain('testnet') + expect(NETWORKS.testnet.networkPassphrase).toBeTruthy() + }) + + it('has mainnet config', () => { + expect(NETWORKS.mainnet.rpcUrl).toContain('mainnet') + expect(NETWORKS.mainnet.networkPassphrase).toBeTruthy() + }) +}) + +describe('CONTRACT_IDS', () => { + it('has testnet contract slots', () => { + expect(CONTRACT_IDS.testnet).toHaveProperty('energy_token') + expect(CONTRACT_IDS.testnet).toHaveProperty('audit_registry') + expect(CONTRACT_IDS.testnet).toHaveProperty('community_governance') + }) +}) diff --git a/packages/stellar/src/index.ts b/packages/stellar/src/index.ts index 2f39740..74f582e 100644 --- a/packages/stellar/src/index.ts +++ b/packages/stellar/src/index.ts @@ -134,27 +134,27 @@ export function bytesToScVal(bytes: Uint8Array): xdr.ScVal { } /** - * Convert kilowatt-hours to token stroops. + * Convert kilowatt-hours to token units (milli-kWh). * - * SolarProof uses a fixed scale of 1 kWh = 10^7 stroops, mirroring the - * Stellar native asset convention (1 XLM = 10^7 stroops). This keeps - * fractional kWh values representable as integers on-chain. + * SolarProof uses a fixed scale of 1 kWh = 10^3 token units, matching the + * SEP-41 `decimals = 3` setting. This allows fractional kWh values down to + * 0.001 kWh to be represented as integers on-chain. * * `Math.round` is applied before converting to `bigint` to avoid floating- - * point truncation errors (e.g. 0.1 kWh → 999999 instead of 1000000). + * point truncation errors (e.g. 0.1 kWh → 99 instead of 100). * * @param kwh - Energy amount in kilowatt-hours (may be fractional). - * @returns Equivalent amount in stroops as a `bigint`. + * @returns Equivalent amount in milli-kWh token units as a `bigint`. */ -export const kwhToStroops = (kwh: number): bigint => BigInt(Math.round(kwh * 1e7)) +export const kwhToStroops = (kwh: number): bigint => BigInt(Math.round(kwh * 1e3)) /** - * Convert token stroops back to kilowatt-hours. + * Convert token units (milli-kWh) back to kilowatt-hours. * - * @param stroops - Amount in stroops as a `bigint`. + * @param stroops - Amount in milli-kWh token units as a `bigint`. * @returns Energy amount in kilowatt-hours. */ -export const stroopsToKwh = (stroops: bigint): number => Number(stroops) / 1e7 +export const stroopsToKwh = (stroops: bigint): number => Number(stroops) / 1e3 /** Build a stellar.expert deep link for a transaction or contract address. */ export function stellarExplorerUrl( diff --git a/packages/stellar/stryker.config.mjs b/packages/stellar/stryker.config.mjs new file mode 100644 index 0000000..e67432e --- /dev/null +++ b/packages/stellar/stryker.config.mjs @@ -0,0 +1,26 @@ +// @ts-check +/** @type {import('@stryker-mutator/api/core').PartialStrykerOptions} */ +const config = { + testRunner: 'vitest', + vitest: { + configFile: 'vitest.config.ts', + }, + mutate: ['src/**/*.ts', '!src/**/*.test.ts'], + coverageAnalysis: 'perTest', + thresholds: { + high: 80, + low: 70, + break: 70, + }, + reporters: ['html', 'clear-text', 'progress', 'json'], + htmlReporter: { + fileName: 'reports/mutation/index.html', + }, + jsonReporter: { + fileName: 'reports/mutation/mutation-report.json', + }, + timeoutMS: 30000, + concurrency: 2, +} + +export default config diff --git a/packages/stellar/vitest.config.ts b/packages/stellar/vitest.config.ts new file mode 100644 index 0000000..4951f07 --- /dev/null +++ b/packages/stellar/vitest.config.ts @@ -0,0 +1,14 @@ +import { defineConfig } from 'vitest/config' + +export default defineConfig({ + test: { + environment: 'node', + include: ['src/**/*.test.ts'], + coverage: { + provider: 'v8', + reporter: ['text', 'json', 'html'], + include: ['src/**/*.ts'], + exclude: ['src/**/*.test.ts'], + }, + }, +}) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d223418..1998572 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -24,8 +24,8 @@ importers: specifier: ^24.0.0 version: 24.2.9(typescript@5.9.3) turbo: - specifier: ^2.9.12 - version: 2.9.14 + specifier: ^2.9.16 + version: 2.9.16 typescript: specifier: ^5.6.3 version: 5.9.3 @@ -37,7 +37,7 @@ importers: version: 2.3.0 '@sentry/nextjs': specifier: ^9.0.0 - version: 9.47.1(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.1))(next@15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(webpack@5.106.2) + version: 9.47.1(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.1))(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.106.2) '@solarproof/stellar': specifier: workspace:* version: link:../../packages/stellar @@ -45,41 +45,44 @@ importers: specifier: ^13.1.0 version: 13.3.0 '@supabase/supabase-js': - specifier: ^2.106.2 - version: 2.106.2 + specifier: ^2.107.0 + version: 2.107.0 '@t3-oss/env-nextjs': specifier: 0.13.11 version: 0.13.11(typescript@5.9.3)(zod@3.25.76) '@tanstack/react-query': specifier: ^5.100.14 - version: 5.100.14(react@19.2.6) + version: 5.100.14(react@19.2.7) '@vercel/analytics': specifier: ^1.4.0 - version: 1.6.1(next@15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6) + version: 1.6.1(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7) '@vercel/speed-insights': specifier: ^1.1.0 - version: 1.3.1(next@15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6) + version: 1.3.1(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7) clsx: specifier: ^2.1.1 version: 2.1.1 lucide-react: specifier: ^0.577.0 - version: 0.577.0(react@19.2.6) + version: 0.577.0(react@19.2.7) next: - specifier: 15.5.18 - version: 15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + specifier: 15.5.19 + version: 15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + next-intl: + specifier: ^4.13.0 + version: 4.13.0(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(typescript@5.9.3) next-themes: specifier: ^0.4.4 - version: 0.4.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + version: 0.4.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7) react: - specifier: ^19.2.6 - version: 19.2.6 + specifier: ^19.2.7 + version: 19.2.7 react-dom: - specifier: ^19.2.6 - version: 19.2.6(react@19.2.6) + specifier: ^19.2.7 + version: 19.2.7(react@19.2.7) recharts: specifier: ^2.14.1 - version: 2.15.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + version: 2.15.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7) tailwind-merge: specifier: ^2.5.5 version: 2.6.1 @@ -95,16 +98,16 @@ importers: version: 1.60.0 '@testing-library/react': specifier: ^16.1.0 - version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.16))(@types/react@19.2.16)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) '@types/node': specifier: ^22.19.19 version: 22.19.19 '@types/react': - specifier: ^19.2.15 - version: 19.2.15 + specifier: ^19.2.16 + version: 19.2.16 '@types/react-dom': specifier: ^19.0.2 - version: 19.2.3(@types/react@19.2.15) + version: 19.2.3(@types/react@19.2.16) '@vitejs/plugin-react': specifier: ^4.3.4 version: 4.7.0(vite@5.4.21(@types/node@22.19.19)(terser@5.48.0)) @@ -115,8 +118,8 @@ importers: specifier: ^9.17.0 version: 9.39.4 eslint-config-next: - specifier: 15.5.18 - version: 15.5.18(eslint@9.39.4)(typescript@5.9.3) + specifier: 15.5.19 + version: 15.5.19(eslint@9.39.4)(typescript@5.9.3) jsdom: specifier: ^25.0.1 version: 25.0.1 @@ -141,7 +144,7 @@ importers: devDependencies: tsup: specifier: ^8.3.5 - version: 8.5.1(postcss@8.5.14)(typescript@5.9.3) + version: 8.5.1(@swc/core@1.15.40)(postcss@8.5.15)(typescript@5.9.3) typescript: specifier: ^5.6.3 version: 5.9.3 @@ -638,6 +641,18 @@ packages: resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} + '@formatjs/fast-memoize@3.1.5': + resolution: {integrity: sha512-KLi3fan6WnCHmigd9pmEEN8Hid0v4wiFBW576M/d07KMWYecf1CvyMI3n34vCmHT4AoVqG2n702kiHbXjzZX2A==} + + '@formatjs/icu-messageformat-parser@3.5.10': + resolution: {integrity: sha512-XeJihYLy1lCe19xfK1KWKG/betBOK2rB0luL8lSkjfvJj0zP+LTJvkC+RKd0jsFI8mWxN71LrarHSrEXE8xxOQ==} + + '@formatjs/icu-skeleton-parser@2.1.9': + resolution: {integrity: sha512-rsxswgHMfU1zUgB2byc08fesf83wLGjFnzLCEtuf00mx2doiqc6pYrf67raI37XqdRcGUviQepk2UKGqpng74Q==} + + '@formatjs/intl-localematcher@0.8.9': + resolution: {integrity: sha512-GmB0F/gYh4Hdl4rLWjgDsgT+x4pB54fkJeRh8kAZ4XFzKeCK8dGs+SBJWXO42QZtOUni+IDWKNuCw6wiL4lTvw==} + '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} engines: {node: '>=18.18.0'} @@ -828,56 +843,56 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 - '@next/env@15.5.18': - resolution: {integrity: sha512-hAV85Ckd9QR6RvH04MEKwsfLTksvFpO47j9xwtoIuvuPnlwecpSi+uZTtm8HirVbtlI2Fnz//xpcSTjFdyJk+g==} + '@next/env@15.5.19': + resolution: {integrity: sha512-sWWluFvcv5v3Fxznmf2ZfjyoVQt/64oCnYqS90inQWGzMPK1VjvekPiz3OPHKmFT30EnHrjlbyaHLt3M0vWabw==} - '@next/eslint-plugin-next@15.5.18': - resolution: {integrity: sha512-w4MYq8M26a8PNrfto0JosLf5/3ssln1rsyP96g2DkC8uFVymStM5DLSz5ElxxrPRg2XnTMnFo3kREFlhYvxhWw==} + '@next/eslint-plugin-next@15.5.19': + resolution: {integrity: sha512-Ctwb4qYuMbHN/1oXLlTdMchwG8h8Xzwq+wGZZMgF3o6+uwyBKAI2c96bdOsl+C62PaUD0Jkh+QpNkhUeDlam0Q==} - '@next/swc-darwin-arm64@15.5.18': - resolution: {integrity: sha512-w0WvQf1n+txiwns/9pwIQteCJpZTbxzO2SE0FLcwuD4v0WEh1JPOjdyxWL21XwJsdpx8cFRjyzxzCS/siP7HcQ==} + '@next/swc-darwin-arm64@15.5.19': + resolution: {integrity: sha512-jx9wWlTKueHKPvVOndyr7WuaevWCkuYqsQ8gC0TMPKAVWG3MhcdMrjfo9tvIZNXd0QOUYXXvAcZ325y8Uq7uzg==} engines: {node: '>= 10'} cpu: [arm64] os: [darwin] - '@next/swc-darwin-x64@15.5.18': - resolution: {integrity: sha512-znn71QmDuxm+BOaglihMZfvyySMnNljkVIY5Z2TCssBmm+WqL6c19VhtH5ktFkHa8EZ2bnTUpcNcmNSQsg67og==} + '@next/swc-darwin-x64@15.5.19': + resolution: {integrity: sha512-291KFcsIQ3OenRdiUDFOR6W3wezzH4auENXm1gbm1Bjd4ANMMRgxPrWTUztQN43BnVoVuMnHCrLeECIMwgFKbA==} engines: {node: '>= 10'} cpu: [x64] os: [darwin] - '@next/swc-linux-arm64-gnu@15.5.18': - resolution: {integrity: sha512-yPPe5MNL+igZUa+OsqQJisqSfh6oarIuA1Q0BDxljGJhRQyZeP+WRHh7rs/jZUGMh5aY0YdIjXZG0VohkKkUdw==} + '@next/swc-linux-arm64-gnu@15.5.19': + resolution: {integrity: sha512-WeH+nelQyyMeE2f8FxBRZNrGipya5zHZV2vjzfCOAYyiI6am+NbnWAAldOBFQBB2w0DjJcsvrKqoFT2b7+5YoA==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-arm64-musl@15.5.18': - resolution: {integrity: sha512-glaCczEWIrHsokFZ3pP08U4BpKxwIdnT+txdOM32OBgpL9Yw4aqx8NejmgtZQZOdstQ5f0L3CasIZudzCuD+nw==} + '@next/swc-linux-arm64-musl@15.5.19': + resolution: {integrity: sha512-5xTOE0lDlDCSSfp+BAif7j17VRRCjWp//ZPZy6NI0QpdrhxtQnsZguSx0xAAZ0c9XZLrLLwCe/XVe5YPrRilKw==} engines: {node: '>= 10'} cpu: [arm64] os: [linux] - '@next/swc-linux-x64-gnu@15.5.18': - resolution: {integrity: sha512-oUfg2EgJmU3R0OCOWiokGFUTvZiPfXtriXiuF3YNxRoROCdgvTedHIzYoeKH34gsZxS/V7mHbfq2hpAHwhH1/A==} + '@next/swc-linux-x64-gnu@15.5.19': + resolution: {integrity: sha512-LTxRmMgqqMv05Had879W00Fm53quiJd3Zuz8h1JSNJ3nGSlbZ/7Tjs1tKyScgN3Au3t3MyPsjPlq60fMmSHLsg==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-linux-x64-musl@15.5.18': - resolution: {integrity: sha512-JLxSP3KTd9iu/bvUMQxH7RJo9xKSHf55/6RPE4a6FTSZygGn7uvZbCej0AHXydwkggQGSD9UddSjwv6Xz5ESfA==} + '@next/swc-linux-x64-musl@15.5.19': + resolution: {integrity: sha512-eoNQSpA5PQfB9wBO4RA47MTDXWz1fizy9Y3Z6e4DetYIF3dvjuu8sj7aIGn/bFCU6lnFzTK34NtCaffP4NsQ7Q==} engines: {node: '>= 10'} cpu: [x64] os: [linux] - '@next/swc-win32-arm64-msvc@15.5.18': - resolution: {integrity: sha512-ir1v7enP52K2HNz3tQQvwF+x7VNxBk1ciiZ18WBPvxf4C59IqdfmHPJYK3vH7rSxpuCVw/8C712wTXNAtEp+NA==} + '@next/swc-win32-arm64-msvc@15.5.19': + resolution: {integrity: sha512-6UNt2dFuCHOe446sm/Kp69nUe8/wIhnh9bm6Xcqw4qEWCOppLMOvhTBVgvM7invVUNr4SPpP6NOQsACtn2IN9Q==} engines: {node: '>= 10'} cpu: [arm64] os: [win32] - '@next/swc-win32-x64-msvc@15.5.18': - resolution: {integrity: sha512-LIu5me6QTANCd25E7I5uIEfvgQ06RK7tvHAbYo3zCb3VpxQEPvMcSpd87NwUABDT6MbGPdEGR5VRiK4PPTJhQg==} + '@next/swc-win32-x64-msvc@15.5.19': + resolution: {integrity: sha512-PhmojAHyqMne56HBLGu9dhDnHPuFmEjrXSQMM/nW0J6j849lk3ESrVtqNJcCk8CKOV7brpTTbaYAjwKPzKM69w==} engines: {node: '>= 10'} cpu: [x64] os: [win32] @@ -1143,6 +1158,88 @@ packages: peerDependencies: '@opentelemetry/api': ^1.1.0 + '@parcel/watcher-android-arm64@2.5.6': + resolution: {integrity: sha512-YQxSS34tPF/6ZG7r/Ih9xy+kP/WwediEUsqmtf0cuCV5TPPKw/PQHRhueUo6JdeFJaqV3pyjm0GdYjZotbRt/A==} + engines: {node: '>= 10.0.0'} + cpu: [arm64] + os: [android] + + '@parcel/watcher-darwin-arm64@2.5.6': + resolution: {integrity: sha512-Z2ZdrnwyXvvvdtRHLmM4knydIdU9adO3D4n/0cVipF3rRiwP+3/sfzpAwA/qKFL6i1ModaabkU7IbpeMBgiVEA==} + engines: {node: '>= 10.0.0'} + cpu: [arm64] + os: [darwin] + + '@parcel/watcher-darwin-x64@2.5.6': + resolution: {integrity: sha512-HgvOf3W9dhithcwOWX9uDZyn1lW9R+7tPZ4sug+NGrGIo4Rk1hAXLEbcH1TQSqxts0NYXXlOWqVpvS1SFS4fRg==} + engines: {node: '>= 10.0.0'} + cpu: [x64] + os: [darwin] + + '@parcel/watcher-freebsd-x64@2.5.6': + resolution: {integrity: sha512-vJVi8yd/qzJxEKHkeemh7w3YAn6RJCtYlE4HPMoVnCpIXEzSrxErBW5SJBgKLbXU3WdIpkjBTeUNtyBVn8TRng==} + engines: {node: '>= 10.0.0'} + cpu: [x64] + os: [freebsd] + + '@parcel/watcher-linux-arm-glibc@2.5.6': + resolution: {integrity: sha512-9JiYfB6h6BgV50CCfasfLf/uvOcJskMSwcdH1PHH9rvS1IrNy8zad6IUVPVUfmXr+u+Km9IxcfMLzgdOudz9EQ==} + engines: {node: '>= 10.0.0'} + cpu: [arm] + os: [linux] + + '@parcel/watcher-linux-arm-musl@2.5.6': + resolution: {integrity: sha512-Ve3gUCG57nuUUSyjBq/MAM0CzArtuIOxsBdQ+ftz6ho8n7s1i9E1Nmk/xmP323r2YL0SONs1EuwqBp2u1k5fxg==} + engines: {node: '>= 10.0.0'} + cpu: [arm] + os: [linux] + + '@parcel/watcher-linux-arm64-glibc@2.5.6': + resolution: {integrity: sha512-f2g/DT3NhGPdBmMWYoxixqYr3v/UXcmLOYy16Bx0TM20Tchduwr4EaCbmxh1321TABqPGDpS8D/ggOTaljijOA==} + engines: {node: '>= 10.0.0'} + cpu: [arm64] + os: [linux] + + '@parcel/watcher-linux-arm64-musl@2.5.6': + resolution: {integrity: sha512-qb6naMDGlbCwdhLj6hgoVKJl2odL34z2sqkC7Z6kzir8b5W65WYDpLB6R06KabvZdgoHI/zxke4b3zR0wAbDTA==} + engines: {node: '>= 10.0.0'} + cpu: [arm64] + os: [linux] + + '@parcel/watcher-linux-x64-glibc@2.5.6': + resolution: {integrity: sha512-kbT5wvNQlx7NaGjzPFu8nVIW1rWqV780O7ZtkjuWaPUgpv2NMFpjYERVi0UYj1msZNyCzGlaCWEtzc+exjMGbQ==} + engines: {node: '>= 10.0.0'} + cpu: [x64] + os: [linux] + + '@parcel/watcher-linux-x64-musl@2.5.6': + resolution: {integrity: sha512-1JRFeC+h7RdXwldHzTsmdtYR/Ku8SylLgTU/reMuqdVD7CtLwf0VR1FqeprZ0eHQkO0vqsbvFLXUmYm/uNKJBg==} + engines: {node: '>= 10.0.0'} + cpu: [x64] + os: [linux] + + '@parcel/watcher-win32-arm64@2.5.6': + resolution: {integrity: sha512-3ukyebjc6eGlw9yRt678DxVF7rjXatWiHvTXqphZLvo7aC5NdEgFufVwjFfY51ijYEWpXbqF5jtrK275z52D4Q==} + engines: {node: '>= 10.0.0'} + cpu: [arm64] + os: [win32] + + '@parcel/watcher-win32-ia32@2.5.6': + resolution: {integrity: sha512-k35yLp1ZMwwee3Ez/pxBi5cf4AoBKYXj00CZ80jUz5h8prpiaQsiRPKQMxoLstNuqe2vR4RNPEAEcjEFzhEz/g==} + engines: {node: '>= 10.0.0'} + cpu: [ia32] + os: [win32] + + '@parcel/watcher-win32-x64@2.5.6': + resolution: {integrity: sha512-hbQlYcCq5dlAX9Qx+kFb0FHue6vbjlf0FrNzSKdYK2APUf7tGfGxQCk2ihEREmbR6ZMc0MVAD5RIX/41gpUzTw==} + engines: {node: '>= 10.0.0'} + cpu: [x64] + os: [win32] + + '@parcel/watcher@2.5.6': + resolution: {integrity: sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ==} + engines: {node: '>= 10.0.0'} + '@pkgjs/parseargs@0.11.0': resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==} engines: {node: '>=14'} @@ -1321,6 +1418,9 @@ packages: '@rushstack/eslint-patch@1.16.1': resolution: {integrity: sha512-TvZbIpeKqGQQ7X0zSCvPH9riMSFQFSggnfBjFZ1mEoILW+UuXCKwOoPcgjMwiUtRqFZ8jWhPJc4um14vC6I4ag==} + '@schummar/icu-type-parser@1.21.5': + resolution: {integrity: sha512-bXHSaW5jRTmke9Vd0h5P7BtWZG9Znqb8gSDxZnxaGSJnGwPLDPfS+3g0BKzeWqzgZPsIVZkM7m2tbo18cm5HBw==} + '@sec-ant/readable-stream@0.4.1': resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==} @@ -1523,36 +1623,123 @@ packages: resolution: {integrity: sha512-8+GHcZLp+mdin8gSjcgfb/Lb6sSMYRX6Nf/0LcSJxvjLQR0XHpjGzOiRbYb2jSXo51EnA6kAV5j+4Pzh5OUKUg==} engines: {node: '>=18.0.0'} - '@supabase/auth-js@2.106.2': - resolution: {integrity: sha512-VcAjUErkHkhC5Jaf+g/G1qbkQrFh8edaCdHa7pxJmHUjkWKjT7UnYCtPA89XV0N0GIYRkEqJZw5V62CtOxTmBQ==} + '@supabase/auth-js@2.107.0': + resolution: {integrity: sha512-XA7x+WIeIvuC3GTZ2ey67QcBbGw4n+o5B7M+dMm9KT1lL3wX1B52DfEWW00WuPt/LnniJLLIn1WIm9YPtuxzKQ==} engines: {node: '>=20.0.0'} - '@supabase/functions-js@2.106.2': - resolution: {integrity: sha512-oRnr0QrL8H+zTO1YyQ1QjiHZU/957jvubbxSJTUm2XLAgzoGGV9Tahfyd+uvLsBLRVmXLtpU3oyCjdQIvkGMOA==} + '@supabase/functions-js@2.107.0': + resolution: {integrity: sha512-iMtRUmEj1KOgQd/a3MR4hnBlPnZc62DW8+z8aPpnzbxWkexEZUVL2fSgvvp15gqFg1V55e2yMGqgK+yhSQxp5w==} engines: {node: '>=20.0.0'} '@supabase/phoenix@0.4.2': resolution: {integrity: sha512-YSAGnmDAfuleFCVt3CeurQZAhxRfXWeZIIkwp7NhYzQ1UwW6ePSnzsFAiUm/mbCkfoCf70QQHKW/K6RKh52a4A==} - '@supabase/postgrest-js@2.106.2': - resolution: {integrity: sha512-tDOzyPgp9pIRMR2x6C9+uDSJrnXSzxLtt3d7nC+Lrsy3jnJDHYfdQC/xcRyhJE/TOBJ0heSqRKR3UmejDjZxsw==} + '@supabase/postgrest-js@2.107.0': + resolution: {integrity: sha512-7ARs47/tyIjX7T0Ive20d4NY8zQYXsP5/P07jJWxffSIM2gpnSnGRnL/Fe15GPbdjsW2sTYeckHcyaoKbM6yWQ==} engines: {node: '>=20.0.0'} - '@supabase/realtime-js@2.106.2': - resolution: {integrity: sha512-LdRGT7DNhyZkPjubUv5bSdAZ0jSEX8wTHvx7htj7+K59TOZRvz4TuQK7tL2RWxyIZVeFMRluL04SzWS61rKnUA==} + '@supabase/realtime-js@2.107.0': + resolution: {integrity: sha512-cF2KYdR3JIn9YlWGeluY9S0G+otqTdL6hB8GzpatlEIY6fZudCcyFo6Dc3+X9tjeb+x9XcIyNAk9qhNAknjH1A==} engines: {node: '>=20.0.0'} - '@supabase/storage-js@2.106.2': - resolution: {integrity: sha512-xgKCSYuev1YarV+iVqr+zlfgSyremnJtn8T0NCT8L4XmMv1CLtESc0Q6kNp8+mKWdX/8ND0nzm7OMKx08kwNAw==} + '@supabase/storage-js@2.107.0': + resolution: {integrity: sha512-/X8OOVwKBn8aVKuHAGOz2yLA0d2OauqhVuy4mNtN+o7wttHOgx1/j+pqOzlsjmhOHrYykF6AJNZhs3gKZzcMUw==} engines: {node: '>=20.0.0'} - '@supabase/supabase-js@2.106.2': - resolution: {integrity: sha512-2/RZ/1fmJx/MRSEDG2Xk8+J4JVk5clM9V0uSI6kUTrcS32KA89DtqI5RUOC9r6mzY3WBC9qexLjssIHjbLyVJA==} + '@supabase/supabase-js@2.107.0': + resolution: {integrity: sha512-ChKzdlWVweMUUhr0U79JhMmgm1haS/C5JquaiCDr70JaGARRtjjoY9rkIheXWybXxTSNzRiQs3Sk8IAg1HS3ZA==} engines: {node: '>=20.0.0'} + '@swc/core-darwin-arm64@1.15.40': + resolution: {integrity: sha512-PaYyclfmQ++77D8ityYvmmVzHv9aG8ROwt2GfG6/ccloy4Hgf80qtOnzb9VYvPsUT7Ty1uhuDRhv3XYpf62qhQ==} + engines: {node: '>=10'} + cpu: [arm64] + os: [darwin] + + '@swc/core-darwin-x64@1.15.40': + resolution: {integrity: sha512-HbbPzvfLBUXjIB1Ezks+//lNUjmLjfyd63XSwprJgrZaXYdm70kohXPJUWdqKZozolFxbPaO+xtBaiUp6BoueA==} + engines: {node: '>=10'} + cpu: [x64] + os: [darwin] + + '@swc/core-linux-arm-gnueabihf@1.15.40': + resolution: {integrity: sha512-SlRZsCjOCPR2LvFs0Ri/Xrx/5o5TCt8vl4gW6mX1hEZOG0a625RxzRHpHdAQNGykmAN/7IeaFAJG+QnNmxlHcA==} + engines: {node: '>=10'} + cpu: [arm] + os: [linux] + + '@swc/core-linux-arm64-gnu@1.15.40': + resolution: {integrity: sha512-Q8byxJt2fh8CR3EUX6snBpy47AoBVm+In/+Z3rjDHMjC38ZvR9/gtUUNCT0tfrn4EdVsO8/QPi59nxrxvqxvBQ==} + engines: {node: '>=10'} + cpu: [arm64] + os: [linux] + + '@swc/core-linux-arm64-musl@1.15.40': + resolution: {integrity: sha512-4z0MgHU+7M0pZDqBN1El7mFXDI1SBwinfcUkAyA4v8QrhOIUOZltySt2aStQLZGrdXVXM4Y4ylfiTC04ED+MoQ==} + engines: {node: '>=10'} + cpu: [arm64] + os: [linux] + + '@swc/core-linux-ppc64-gnu@1.15.40': + resolution: {integrity: sha512-fLI4iUgeSZu0eRWUXwe6YzPFx9gHbFiPkl8Rp3mJfP8OpNR3nTQCGPvHdDh9xniW7mVvgMY4ni7A4VzqI1KrpA==} + engines: {node: '>=10'} + cpu: [ppc64] + os: [linux] + + '@swc/core-linux-s390x-gnu@1.15.40': + resolution: {integrity: sha512-YqeKMAb7d4nQSGMJQ454IlaCENpzcDqhvBE9+CPfdnYpnUXxd+BSrB6Xk0YjW8UyoEhUj4p6quATCxbsp6J3jg==} + engines: {node: '>=10'} + cpu: [s390x] + os: [linux] + + '@swc/core-linux-x64-gnu@1.15.40': + resolution: {integrity: sha512-7HOuS1iGcme/j/TuL1TfmmLGiMQrjv/GmjyZeydl00FKPtpGXEldwqfI56xgd1YzrzoB2svWjxbGGyQ0TEASxg==} + engines: {node: '>=10'} + cpu: [x64] + os: [linux] + + '@swc/core-linux-x64-musl@1.15.40': + resolution: {integrity: sha512-h4kZYHc7dpc9P9u4brRJaS8Pl7tPVHAeiLSzw7T5RfIJgAoSdaCMKzI/2Uay9gFhaw8uyCDl0L5q37r0EpAfIA==} + engines: {node: '>=10'} + cpu: [x64] + os: [linux] + + '@swc/core-win32-arm64-msvc@1.15.40': + resolution: {integrity: sha512-+mQgKZXSj6mV38Zh05QaxSjUDmGP/R2JWlXZTDLSPkDzHU6p3GxN9eeSf5dfyDVU86946fmCvSzyl/ucImx8+A==} + engines: {node: '>=10'} + cpu: [arm64] + os: [win32] + + '@swc/core-win32-ia32-msvc@1.15.40': + resolution: {integrity: sha512-yvwdPLGd25mcj/mNatjNQ0lZujtQD6psH3v9PNmMb+fSzjbNG8KIDxjFWrcV+fsFVLOkyOmdJsFmX7NAFjVyPw==} + engines: {node: '>=10'} + cpu: [ia32] + os: [win32] + + '@swc/core-win32-x64-msvc@1.15.40': + resolution: {integrity: sha512-OXtKsLU1bVtInzzDEAY2sYiF/rl4tvAnLLLpuMp3HzAOQZ5A+i69AKDhA1YLQTaMAqO3vzyYNVAYVRMPtSYD4w==} + engines: {node: '>=10'} + cpu: [x64] + os: [win32] + + '@swc/core@1.15.40': + resolution: {integrity: sha512-2kwzJikRvgtNAG7MwVZY2vEzZjTxKIq5jXOihuSV/8U+Hej8Va22t65aKnJZs3P+NwojZvR8Mf8kyM7O+V8sQg==} + engines: {node: '>=10'} + peerDependencies: + '@swc/helpers': '>=0.5.17' + peerDependenciesMeta: + '@swc/helpers': + optional: true + + '@swc/counter@0.1.3': + resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==} + '@swc/helpers@0.5.15': resolution: {integrity: sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==} + '@swc/types@0.1.26': + resolution: {integrity: sha512-lyMwd7WGgG79RS7EERZV3T8wMdmPq3xwyg+1nmAM64kIhx5yl+juO2PYIHb7vTiPgPCj8LYjsNV2T5wiQHUEaw==} + '@t3-oss/env-core@0.13.11': resolution: {integrity: sha512-sM7GYY+KL7H/Hl0BE0inWfk3nRHZOLhmVn7sHGxaZt9FAR6KqREXAE+6TqKfiavfXmpRxO/OZ2QgKRd+oiBYRQ==} peerDependencies: @@ -1587,11 +1774,11 @@ packages: zod: optional: true - '@tanstack/query-core@5.100.14': - resolution: {integrity: sha512-5X41dGpxgeaHISCRW2oYwcSycZeULZzAunaudXT9ov1KOTj9xwt0CH6hbwqP1/z74ZWF7rYFnDpyYH07XFcZew==} + '@tanstack/query-core@5.101.0': + resolution: {integrity: sha512-cQetA74EB+seWySv1TTKr828TnP0u39m6LykwDXIo84SNortpDkp30TMEjkqtYCNP9c40uT/iwl6MLiufEt0Ow==} - '@tanstack/react-query@5.100.14': - resolution: {integrity: sha512-oOr6aRdSFEwWhzxEkD/9ZcItM3+LjBSkeVmadWKwUssAHTsqd/7bOjWrX4AbvEkoEhgAxzN0Xk6H/aYzXiYBAw==} + '@tanstack/react-query@5.101.0': + resolution: {integrity: sha512-rLlJXSpkqfizLWgkR5+eLeIk0MvTx/meEIR7LRjxic+qxiQP8zVjq7BqQkiCMNLQBlLfuOLqqr6KO5GtrDlmSg==} peerDependencies: react: ^18 || ^19 @@ -1614,33 +1801,33 @@ packages: '@types/react-dom': optional: true - '@turbo/darwin-64@2.9.14': - resolution: {integrity: sha512-t7QiPflaEyBE4oayeZtSmu4mEfjgIrcNlNNl1z1dmIVPqEdtA7+CfTf8d7KXsOGPh6aNgWjKxyvQg9uGfDQF+A==} + '@turbo/darwin-64@2.9.16': + resolution: {integrity: sha512-jLjApWTSNd7JZ5JaLYfelW1ytnGQOvB7ivl+2RD1xQvJTbi8I9gBjzcga7tDZVPyaxpl10YTfJt3BrYXR18KDw==} cpu: [x64] os: [darwin] - '@turbo/darwin-arm64@2.9.14': - resolution: {integrity: sha512-d23147mC9BsCPA9mJ0h/ubcpbRgcJBXbcG3+Vq7YLhjz3IXuvQsJ1UXH8f4MD76ZjJ4m/E4aRdJV+MW88CDfbw==} + '@turbo/darwin-arm64@2.9.16': + resolution: {integrity: sha512-YPgrn+5HIGzrx0O2a631SV4MBQUe4W/DafMFUuBVgaU32PW9/OTT0ehviF0QSxTXuRJlHvW2eUTemddF5/spmw==} cpu: [arm64] os: [darwin] - '@turbo/linux-64@2.9.14': - resolution: {integrity: sha512-P3ZKB5tuUDdDQWuAsACGUR1qv9W7BNWxdxqVJ0kZNuNNPRaVYTPPikLcp79+GiEcW3npsR+KyP38lnQiBc5aSA==} + '@turbo/linux-64@2.9.16': + resolution: {integrity: sha512-vAEf1H6l26lTpl9FJ/peQo1NUB8RC0sbEJJz5mPcUhHA2bPDup2x3CZPgo/bH8S4cUcBLm4FN3UHd5iUO2RAew==} cpu: [x64] os: [linux] - '@turbo/linux-arm64@2.9.14': - resolution: {integrity: sha512-ZRTlzcUMrrPv9ZuDzRF9n60Ym13bKeG9jDB8WjxyLhWNzV+AJQN+zdpIk3NJYf2zQsGUm1mNar2P0elRzLw25g==} + '@turbo/linux-arm64@2.9.16': + resolution: {integrity: sha512-xDBLR2PZg4BrQOchfG6svgpv5FCNJ2TOtT2psLdEJcdKo1BH+pnPs9Xj6pvUjgfkHbuvBOfeE4R6tvxMoQKDHQ==} cpu: [arm64] os: [linux] - '@turbo/windows-64@2.9.14': - resolution: {integrity: sha512-exanwN6sIduZwykYeiTQj8kCmOhazP5WOz3bvXMcYtjhL6Z3iRWLewKrXCBq0bqwSP3iBMb/AerRCnHI4lx46A==} + '@turbo/windows-64@2.9.16': + resolution: {integrity: sha512-NBAJnaUiGdgkSzQwUIdOvkCkcpTSu58G/sBGa0mvBtzfvFOOgrQwepKOOQ8cp6sWM6OcKDNFj2p1dsZA1OWjPg==} cpu: [x64] os: [win32] - '@turbo/windows-arm64@2.9.14': - resolution: {integrity: sha512-fVdCsnmYoKICsycbWuuGp6Jvi51/3G/UluFWuAUCvR8PIW5IJkAk5BM9UF8PSm0Q2IphWHFZjYEgjHsh3B9y/g==} + '@turbo/windows-arm64@2.9.16': + resolution: {integrity: sha512-Y7SJppD0Z8wjO3Ec0ZGd9KQ4Yv0BMnA8CIowj5Vp+OEVsosXDG2weK6/t1RRLfJmc2Ozrnd6y4DOgQys+mn3WQ==} cpu: [arm64] os: [win32] @@ -1730,8 +1917,8 @@ packages: peerDependencies: '@types/react': ^19.2.0 - '@types/react@19.2.15': - resolution: {integrity: sha512-eRwcGNHve+E8qtEQSSRl6urh+rFop4v8gm6O8rGv25CodbvFdLjA1vVQ1KkiFE0w0UPOnb8tDiFKL5lp0rtY5Q==} + '@types/react@19.2.16': + resolution: {integrity: sha512-esJiCAnl0kfpNdE69f3So4WJUXy95dLZydX0KwK46riIHDzHM7O9Vtf9xCHW0PXIqvgqNrswl522kA/5yx+F4w==} '@types/shimmer@1.2.0': resolution: {integrity: sha512-UE7oxhQLLd9gub6JKIAhDq06T0F6FnztwMNRvYgjeQSBeMc1ZG/tA47EwfduvkuQS8apbkM/lpLpWsaCeYsXVg==} @@ -1739,162 +1926,172 @@ packages: '@types/tedious@4.0.14': resolution: {integrity: sha512-KHPsfX/FoVbUGbyYvk1q9MMQHLPeRZhRJZdO45Q4YjvFkv4hMNghCWTvy7rdKessBsmtz4euWCWAB6/tVpI1Iw==} - '@typescript-eslint/eslint-plugin@8.59.4': - resolution: {integrity: sha512-PegsU+XfyJJNjd4+u/k6f9yTyp0lEXXiPopUNobZcIAUJFGICFLN+sP0Rb3JehVmiij1Ph0dFGYqODoRo/2+6A==} + '@typescript-eslint/eslint-plugin@8.60.1': + resolution: {integrity: sha512-JQ4S5GB0tfjO8BuJ4fcX+HodkzJjYBV+7OJ+wLygaX7OGQ7FudyHL4NSCA6ob+w3Yn+5MkKIozOwQhXeM7opVg==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: - '@typescript-eslint/parser': ^8.59.4 + '@typescript-eslint/parser': ^8.60.1 eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/parser@8.59.4': - resolution: {integrity: sha512-zORHqO/tuhxY1zWuTvMUqddRxpiFJ72xVfcNoWpqdLjs6lfPbuQBJuW4pk+49/uBMy7Ssr4bzgjiKmmDB1UbZQ==} + '@typescript-eslint/parser@8.60.1': + resolution: {integrity: sha512-A0M6ua6H252bVjPvvtSgl2QA4+ET9S5Mtkb2GDyTxIhH/C4qDItT7RQNO5PhMC6NXGYXOR9dIalcDDgBKT7oFA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/project-service@8.59.4': - resolution: {integrity: sha512-Ly00Vu4oAacfDeHp2Zg85ioNG6l8HG+tN1D7J+xTHSxu9y0awYKJ2zH1rFBn8ZSfuGK+7FxK3Cgl3uAz0aZZLg==} + '@typescript-eslint/project-service@8.60.1': + resolution: {integrity: sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/scope-manager@8.59.4': - resolution: {integrity: sha512-mUeR/3H1WrTAddJrwut8OoPjfauaztMQmRwV5fQTUyNVJCLiUXXe4lGEyYIL2oFDpP7UtgbGJXCt72wT0z2S3Q==} + '@typescript-eslint/scope-manager@8.60.1': + resolution: {integrity: sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@typescript-eslint/tsconfig-utils@8.59.4': - resolution: {integrity: sha512-DLCpnKgD4alVxTBSKulK+gU1KCqOgUXfDRDXh2mZgzokQKa/70ax93I2uVO3m/LLvIAtWZIFoiifudmIqAxpMA==} + '@typescript-eslint/tsconfig-utils@8.60.1': + resolution: {integrity: sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/type-utils@8.59.4': - resolution: {integrity: sha512-uonTuPAAKr9XaBGqJ3LjYTh72zy5DyGesljO9gtmk/eFW0W1fRHjnwVYKB35Lm8d5Q5CluEW3gPHjTvZTmgrfA==} + '@typescript-eslint/type-utils@8.60.1': + resolution: {integrity: sha512-sdwTrpjosW7ANQYJ39ZBF1ZyEMEGVB2UsikrserVM/30a/F1dTLnu9bGxEdosugyu5caigjLrR2qiD11asjI1A==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/types@8.59.4': - resolution: {integrity: sha512-F1o7WJcCq+bc8dwcO/YsSEOudAH8RDtaOhM6wcAQhcUsFhnWQl81JKy48q1hoxAU0qrzM89+31GYh1515Zde3Q==} + '@typescript-eslint/types@8.60.1': + resolution: {integrity: sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@typescript-eslint/typescript-estree@8.59.4': - resolution: {integrity: sha512-F+RuOmcDXo4+TPdfd/TCLS3m2nw8gE9XXyZLrA3JBfaA5tz9TtdkyD3YJFmPxulyc2cKbEok/CvFE3MgSLWnag==} + '@typescript-eslint/typescript-estree@8.60.1': + resolution: {integrity: sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/utils@8.59.4': - resolution: {integrity: sha512-cYXeNAUsG4lJo5dbc1FcKm+JwIWrj1/UpTORsC6tGMjEZ81DYcvIr9/ueikhMa/Y/gDQYGp+YX9/xQrXje5BJw==} + '@typescript-eslint/utils@8.60.1': + resolution: {integrity: sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} peerDependencies: eslint: ^8.57.0 || ^9.0.0 || ^10.0.0 typescript: '>=4.8.4 <6.1.0' - '@typescript-eslint/visitor-keys@8.59.4': - resolution: {integrity: sha512-U3gxVaDVnuZKhSspW/MzMxE1kq7zOdc072FcSNoqA1I9p8HyKbBFfEHoWckBAMgNMph4MamwS5iTVzFmrnt8TQ==} + '@typescript-eslint/visitor-keys@8.60.1': + resolution: {integrity: sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@unrs/resolver-binding-android-arm-eabi@1.12.1': - resolution: {integrity: sha512-diBxYrhKMJWZiQMFDgKVRDV4zSRyRTR6PBg+0p6/7zAWP6fqUfl0Be0RKvjLhzfRT0Ye5TCAP04gg4rZHSTvnA==} + '@unrs/resolver-binding-android-arm-eabi@1.12.2': + resolution: {integrity: sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==} cpu: [arm] os: [android] - '@unrs/resolver-binding-android-arm64@1.12.1': - resolution: {integrity: sha512-7VQXkWRrq3zFmL1byHilfy8YjCGxf9dKMYbLIGzR6ujAu4+FB3YD8IkesmpgB9vpiitYjMPs/Dk5Sh/P9aoHLQ==} + '@unrs/resolver-binding-android-arm64@1.12.2': + resolution: {integrity: sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==} cpu: [arm64] os: [android] - '@unrs/resolver-binding-darwin-arm64@1.12.1': - resolution: {integrity: sha512-SJbHelGnb7hZVLCEWSkbTOpmTC63ZUweZEIPNtRD1D+UkDqYHFynwGUTG1WAjQTdTTaiJ4xab3z5Vk334WeqbA==} + '@unrs/resolver-binding-darwin-arm64@1.12.2': + resolution: {integrity: sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==} cpu: [arm64] os: [darwin] - '@unrs/resolver-binding-darwin-x64@1.12.1': - resolution: {integrity: sha512-sCCTeB7e2L49YhjPK7IkPfWfCR+NHSfbCbDOy3LqyfkrBpK9qXRRyS1ImCHqEE1LMJxmVN5bAvioI/zTFu48xw==} + '@unrs/resolver-binding-darwin-x64@1.12.2': + resolution: {integrity: sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==} cpu: [x64] os: [darwin] - '@unrs/resolver-binding-freebsd-x64@1.12.1': - resolution: {integrity: sha512-rsKJJykPydB+lA/mdeMSYqsQpdRTAjhJiwdQ+jdihPDpbN1h7PaNAo6Fz8PxqWtKd+YC3uGjjW+m+1iPwRwJuA==} + '@unrs/resolver-binding-freebsd-x64@1.12.2': + resolution: {integrity: sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==} cpu: [x64] os: [freebsd] - '@unrs/resolver-binding-linux-arm-gnueabihf@1.12.1': - resolution: {integrity: sha512-D6Al5C6j9RdqjGI7Hqa/iVbh09xOEIyZScG60OJGRF0fvf9cy2FdSHG6qLG9Osv8aYe+syWId+PLRwR43soVkA==} + '@unrs/resolver-binding-linux-arm-gnueabihf@1.12.2': + resolution: {integrity: sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==} cpu: [arm] os: [linux] - '@unrs/resolver-binding-linux-arm-musleabihf@1.12.1': - resolution: {integrity: sha512-9+yQ/cnoapQ1G+HS6nXQ+4GZ/qKpieZuZxO8GWGJ+F2/1WC5eRzIU2BYUgT029A/y7n3qb0whuT6vvMzB9Zd0g==} + '@unrs/resolver-binding-linux-arm-musleabihf@1.12.2': + resolution: {integrity: sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==} cpu: [arm] os: [linux] - '@unrs/resolver-binding-linux-arm64-gnu@1.12.1': - resolution: {integrity: sha512-OY/REy8lJgrkZgUpiwhClBvSDLSJNxkvqV7il6I1iNBQFyIEZRpOm1ttV8iMjpcPN2Dl7kjGd7CoKoJUebn6Jw==} + '@unrs/resolver-binding-linux-arm64-gnu@1.12.2': + resolution: {integrity: sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==} cpu: [arm64] os: [linux] - '@unrs/resolver-binding-linux-arm64-musl@1.12.1': - resolution: {integrity: sha512-C0nRwuMNgiGU8M5ym7eFe1qOo4oJtZ4TH6g+qAMWIR0hXgMjMs0bsggIv7Sbeia1GI8ZQHzQwrhBEawFiHQIPQ==} + '@unrs/resolver-binding-linux-arm64-musl@1.12.2': + resolution: {integrity: sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==} cpu: [arm64] os: [linux] - '@unrs/resolver-binding-linux-ppc64-gnu@1.12.1': - resolution: {integrity: sha512-1GrdTqRuLZMsLa9d6T1BM6WTPGMZxkDKLR4SSzWaUtWpBuOVb33DIShXadhDYrTRESEm7pRN8m7SOM2m8pPT8w==} + '@unrs/resolver-binding-linux-loong64-gnu@1.12.2': + resolution: {integrity: sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==} + cpu: [loong64] + os: [linux] + + '@unrs/resolver-binding-linux-loong64-musl@1.12.2': + resolution: {integrity: sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==} + cpu: [loong64] + os: [linux] + + '@unrs/resolver-binding-linux-ppc64-gnu@1.12.2': + resolution: {integrity: sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==} cpu: [ppc64] os: [linux] - '@unrs/resolver-binding-linux-riscv64-gnu@1.12.1': - resolution: {integrity: sha512-q9gc8/37+8jGc8RJahXtonvxgbUisjOHCaiDXrg4Nv8+pk9iKv97drJ61crkZJEms+bIr7lLc54SlZ08qVY9nA==} + '@unrs/resolver-binding-linux-riscv64-gnu@1.12.2': + resolution: {integrity: sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==} cpu: [riscv64] os: [linux] - '@unrs/resolver-binding-linux-riscv64-musl@1.12.1': - resolution: {integrity: sha512-kLFS/MfGFpeYUrnnsUnmZAxwXMPHZOIPHNp3d4zHnx7/etyX2SSQQ1Kj/Ycaxy4V5dN16YoXpnhrwANjywiJCg==} + '@unrs/resolver-binding-linux-riscv64-musl@1.12.2': + resolution: {integrity: sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==} cpu: [riscv64] os: [linux] - '@unrs/resolver-binding-linux-s390x-gnu@1.12.1': - resolution: {integrity: sha512-vKlW4XOJUrpvMBgbIg97t6UEBsFsxGZS5Khi47XkNzC5T1obPhEYWfaGGv9oAe6xXzXib9xaH64CQV8AXN9GiA==} + '@unrs/resolver-binding-linux-s390x-gnu@1.12.2': + resolution: {integrity: sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==} cpu: [s390x] os: [linux] - '@unrs/resolver-binding-linux-x64-gnu@1.12.1': - resolution: {integrity: sha512-e9gRaBDEraJLdeScpwBA+WqaJDXnmlHPC7aZTAp9N4BYiEs8BvDfjgeqSVygrc3NZbeMfiKygevINZ9QP271wA==} + '@unrs/resolver-binding-linux-x64-gnu@1.12.2': + resolution: {integrity: sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==} cpu: [x64] os: [linux] - '@unrs/resolver-binding-linux-x64-musl@1.12.1': - resolution: {integrity: sha512-Z7813xEacoT+WRBm1O0wgIkXRgVyTctaRPkKx7T+WgeAfGzMfgWCxhRjAAJh/2LMDPlSXOnapr3vwI1TgDEtTA==} + '@unrs/resolver-binding-linux-x64-musl@1.12.2': + resolution: {integrity: sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==} cpu: [x64] os: [linux] - '@unrs/resolver-binding-openharmony-arm64@1.12.1': - resolution: {integrity: sha512-GN5YjvnL5nGd5twW4KHWre6iOzLVsIgZwBin3jTT1Pef2Q3l0WgMYA5uo908wL+gsxSFzFXuxkO+AjpsLoOaYw==} + '@unrs/resolver-binding-openharmony-arm64@1.12.2': + resolution: {integrity: sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==} cpu: [arm64] os: [openharmony] - '@unrs/resolver-binding-wasm32-wasi@1.12.1': - resolution: {integrity: sha512-Gue4obXW5E2223qBWqW05S9m1uPcBIEu8cJWs3YqzVVf+h6lNRofgJlhGNxmuqu+C/fSlqaW4T1JHFZdoOgGGQ==} + '@unrs/resolver-binding-wasm32-wasi@1.12.2': + resolution: {integrity: sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==} engines: {node: '>=14.0.0'} cpu: [wasm32] - '@unrs/resolver-binding-win32-arm64-msvc@1.12.1': - resolution: {integrity: sha512-z09l7yiDIOLDTFkW+TEroFjidYAM6JriPqMMpXpM7/EnEe6tehrJZrghlvvPyI/W4JGWAJVDaOs4rl+snJlHwg==} + '@unrs/resolver-binding-win32-arm64-msvc@1.12.2': + resolution: {integrity: sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==} cpu: [arm64] os: [win32] - '@unrs/resolver-binding-win32-ia32-msvc@1.12.1': - resolution: {integrity: sha512-RZ9vu5nw+Lgf91LJIZXFx6OrbId+EN2x0HzpAdm0C9oywiPw5x7LBs4uNboZ2Taozo8SiX/7vEDWWyIpKqktgA==} + '@unrs/resolver-binding-win32-ia32-msvc@1.12.2': + resolution: {integrity: sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==} cpu: [ia32] os: [win32] - '@unrs/resolver-binding-win32-x64-msvc@1.12.1': - resolution: {integrity: sha512-rXHMTryD4YT8wuGDhV8UevKiD02/wUrdKLyokgNQQf/AcO6BCUEkQu5WGQ9i41bA4tlSfKo02WmAcAgxuP6izA==} + '@unrs/resolver-binding-win32-x64-msvc@1.12.2': + resolution: {integrity: sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==} cpu: [x64] os: [win32] @@ -2203,6 +2400,10 @@ packages: resolution: {integrity: sha512-KunSNx+TVpkAw/6ULfhnx+HWRecjqZGTOyquAoWHYLRSdK1tB5Ihce1ZW+UY3fj33bYAFWPu7W/GRSmmrCGuxA==} engines: {node: '>=4'} + axe-core@4.12.0: + resolution: {integrity: sha512-FTavr/7Ba0IptwGOPxnQvdyW2tAsdLBMTBXz7rKH6xJ2skpyxpBxyHkDdBs4lf69yRqYpkqCdfhnwS8YULGOmg==} + engines: {node: '>=4'} + axios@1.16.1: resolution: {integrity: sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==} @@ -2653,8 +2854,8 @@ packages: emojilib@2.4.0: resolution: {integrity: sha512-5U0rVMU5Y2n2+ykNLQqMoqklN9ICBT/KsvC1Gz6vqHbz2AXXGkG+Pm5rMWk/8Vjrr/mY9985Hi8DYzn1F09Nyw==} - enhanced-resolve@5.22.0: - resolution: {integrity: sha512-xYcDWrpELkFzz9SpZ3PlI6Eu6eD93Yf0WLDRxikGhWJ3MAir2SNZTIVCVZqZ/NUyx8AdMc2gT9C0gPiw18kG+A==} + enhanced-resolve@5.22.1: + resolution: {integrity: sha512-6QEuw3zoX1SJQc7b87aBXke/no+mG2bTBgw29gWMQonLmpEkWoCAVkl+M49e48AZlWzxiDzDZzYdp6kobcyLww==} engines: {node: '>=10.13.0'} entities@6.0.1: @@ -2702,6 +2903,10 @@ packages: resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==} engines: {node: '>= 0.4'} + es-object-atoms@1.1.2: + resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==} + engines: {node: '>= 0.4'} + es-set-tostringtag@2.1.0: resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==} engines: {node: '>= 0.4'} @@ -2740,8 +2945,8 @@ packages: resolution: {integrity: sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==} engines: {node: '>=12'} - eslint-config-next@15.5.18: - resolution: {integrity: sha512-HuoJU6uUPD00eyiud78IBnT4HLhztFj2V+ild2Uon5ZUrYZKe0Olu2QRD99e9IgL4/H1eg5Onka3BsfRW2U0Xw==} + eslint-config-next@15.5.19: + resolution: {integrity: sha512-UZwkuhBCNxVZfo93MSHRDOVNWXooJJGcAUyTAVIp0+9QFhH4SqJxWY0s6Mk9C2kMi777HPMn3dseOrZshWpG9Q==} peerDependencies: eslint: ^7.23.0 || ^8.0.0 || ^9.0.0 typescript: '>=3.3.1' @@ -2765,8 +2970,8 @@ packages: eslint-plugin-import-x: optional: true - eslint-module-utils@2.12.1: - resolution: {integrity: sha512-L8jSWTze7K2mTg0vos/RuLRS5soomksDPoJLXIslC7c8Wmut3bx7CPpJijDcBZtxQ5lrbUdM+s0OlNbz0DCDNw==} + eslint-module-utils@2.13.0: + resolution: {integrity: sha512-bLohSkT6469rRs8czj0tLTD8vaeIS/whvPRJVjDr7IuoTT1k5DYDERlNycjDj/HkOlvQdYurmfZ/g3fG5bgeLQ==} engines: {node: '>=4'} peerDependencies: '@typescript-eslint/parser': '*' @@ -3153,6 +3358,10 @@ packages: resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==} engines: {node: '>= 0.4'} + hasown@2.0.4: + resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==} + engines: {node: '>= 0.4'} + highlight.js@10.7.3: resolution: {integrity: sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==} @@ -3210,6 +3419,9 @@ packages: resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==} engines: {node: '>=0.10.0'} + icu-minify@4.13.0: + resolution: {integrity: sha512-SIFMeUHZJjzS5RvIGvybKvWoHjDm9cGVEs2EpJ8PmywOdJLWyblPm7TdPLLoUtkJtwQD7iGhl2WMptZ+N0on+w==} + ieee754@1.2.1: resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==} @@ -3265,6 +3477,9 @@ packages: resolution: {integrity: sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==} engines: {node: '>=12'} + intl-messageformat@11.2.7: + resolution: {integrity: sha512-+q6Ktg119nULZEpZ8YTuGOst9MyEzFtjD63FTGBlN1mLz0Z/MOUYDIvnpVKwq17eezIEh+cfJIebfJoCetpiNw==} + is-array-buffer@3.0.5: resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==} engines: {node: '>= 0.4'} @@ -3730,20 +3945,37 @@ packages: natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} + negotiator@1.0.0: + resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==} + engines: {node: '>= 0.6'} + neo-async@2.6.2: resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==} nerf-dart@1.0.0: resolution: {integrity: sha512-EZSPZB70jiVsivaBLYDCyntd5eH8NTSMOn3rB+HxwdmKThGELLdYv8qVIMWvZEFy9w8ZZpW9h9OB32l1rGtj7g==} + next-intl-swc-plugin-extractor@4.13.0: + resolution: {integrity: sha512-6S/fJI0KXvLCL8nhBo9P8eGaJPzmwJBTCzX0NaUIj0VyU8U89d//T+vjMLdNIXl5MlLaYH7B9MbAjb8Mvu+tqQ==} + + next-intl@4.13.0: + resolution: {integrity: sha512-OvNq2v5XLx4EkQOsAhVE9g+6zdb83XHusADCXXtIW4LILYnjEVaeINdr1lkVWKSjzwNUiMSlH5N4K0OQTRiv6A==} + peerDependencies: + next: ^12.0.0 || ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 + react: ^16.8.0 || ^17.0.0 || ^18.0.0 || >=19.0.0-rc <19.0.0 || ^19.0.0 + typescript: '*' + peerDependenciesMeta: + typescript: + optional: true + next-themes@0.4.6: resolution: {integrity: sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA==} peerDependencies: react: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc react-dom: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc - next@15.5.18: - resolution: {integrity: sha512-eKL8zUJkX9Y5lE+RX/2YJoItVdGlIscyVyboeD9wSpp0PaGqjoA4tTpT2qPqz9ax+5IzGESyLSeZ/RCwbSZ2uQ==} + next@15.5.19: + resolution: {integrity: sha512-xNOW6tYshGX1/Oi3F8uuk4gpDeWsSUE/1Z0G5uUMekIxaQ0xc03UXd9II0VQHYMWviMeA0OHpJFAKsHf8bTYVg==} engines: {node: ^18.18.0 || ^19.8.0 || >= 20.0.0} hasBin: true peerDependencies: @@ -3763,6 +3995,9 @@ packages: sass: optional: true + node-addon-api@7.1.1: + resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==} + node-emoji@2.2.0: resolution: {integrity: sha512-Z3lTE9pLaJF47NyMhd4ww1yFTAP8YhYI8SleJiHzM46Fgpm5cnNzSl9XfzFNqbaz+VlJrIj3fXQ4DeN1Rjm6cw==} engines: {node: '>=18'} @@ -4099,6 +4334,9 @@ packages: engines: {node: '>=18'} hasBin: true + po-parser@2.1.1: + resolution: {integrity: sha512-ECF4zHLbUItpUgE3OTtLKlPjeBN+fKEczj2zYjDfCGOzicNs0GK3Vg2IoAYwx7LH/XYw43fZQP6xnZ4TkNxSLQ==} + possible-typed-array-names@1.1.0: resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==} engines: {node: '>= 0.4'} @@ -4125,8 +4363,8 @@ packages: resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==} engines: {node: ^10 || ^12 || >=14} - postcss@8.5.14: - resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==} + postcss@8.5.15: + resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} engines: {node: ^10 || ^12 || >=14} postgres-array@2.0.0: @@ -4251,10 +4489,10 @@ packages: resolution: {integrity: sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==} hasBin: true - react-dom@19.2.6: - resolution: {integrity: sha512-0prMI+hvBbPjsWnxDLxlCGyM8PN6UuWjEUCYmZhO67xIV9Xasa/r/vDnq+Xyq4Lo27g8QSbO5YzARu0D1Sps3g==} + react-dom@19.2.7: + resolution: {integrity: sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==} peerDependencies: - react: ^19.2.6 + react: ^19.2.7 react-is@16.13.1: resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==} @@ -4281,8 +4519,8 @@ packages: react: '>=16.6.0' react-dom: '>=16.6.0' - react@19.2.6: - resolution: {integrity: sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==} + react@19.2.7: + resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==} engines: {node: '>=0.10.0'} read-package-up@11.0.0: @@ -4436,6 +4674,11 @@ packages: engines: {node: '>=10'} hasBin: true + semver@7.8.1: + resolution: {integrity: sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==} + engines: {node: '>=10'} + hasBin: true + set-function-length@1.2.2: resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==} engines: {node: '>= 0.4'} @@ -4687,8 +4930,8 @@ packages: resolution: {integrity: sha512-d79HhZya5Djd7am0q+W4RTsSU+D/aJzM+4Y4AGJGuGlgM2L6sx5ZvOYTmZjqPhrDrV6xJTtRSm1JCLj6V6LHLQ==} engines: {node: '>=14.16'} - terser-webpack-plugin@5.6.0: - resolution: {integrity: sha512-Eum+5ajkaOhf5KbM26osvv21kLD7BaGqQ1UA4Ami4arYwylmGUQTgHFpHDdmJod1q4QXa66p0to/FBKID+J1vA==} + terser-webpack-plugin@5.6.1: + resolution: {integrity: sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ==} engines: {node: '>= 10.13.0'} peerDependencies: '@minify-html/node': '*' @@ -4766,6 +5009,10 @@ packages: resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==} engines: {node: '>=12.0.0'} + tinyglobby@0.2.17: + resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==} + engines: {node: '>=12.0.0'} + tinypool@1.1.1: resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==} engines: {node: ^18.0.0 || >=20.0.0} @@ -4849,8 +5096,8 @@ packages: typescript: optional: true - turbo@2.9.14: - resolution: {integrity: sha512-BQqXRr4UoWI3UPFrtznCLykYHxwxWh53iCB57x092jPMjIlW1wnm3N895g5irpiXmnxUhREBB0n6+y8BHhs4nw==} + turbo@2.9.16: + resolution: {integrity: sha512-NqgRQy6j6dPYcdSdv0q1g9QsZg7SWg87RERM8otw/1AtKU2yTFVClOM7cbwKzOonZr/Ek1blTBucw64L9H0Bwg==} hasBin: true tweetnacl@1.0.3: @@ -4888,8 +5135,8 @@ packages: resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==} engines: {node: '>= 0.4'} - typed-array-length@1.0.7: - resolution: {integrity: sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg==} + typed-array-length@1.0.8: + resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==} engines: {node: '>= 0.4'} typescript@5.9.3: @@ -4938,8 +5185,8 @@ packages: unplugin@1.0.1: resolution: {integrity: sha512-aqrHaVBWW1JVKBHmGo33T5TxeL0qWzfvjWokObHA9bYmN7eNDkwOxmLjhioHl9878qDFMAaT51XNroRyuz7WxA==} - unrs-resolver@1.12.1: - resolution: {integrity: sha512-LmOTmcBbFqxu1rzubnqHT6EZeqDYpenlGYwyFhHj7oc1HdyZE+0cLQ+s9SDSK+KKQQKuoJhUbzHQ89Ubwg2Oxg==} + unrs-resolver@1.12.2: + resolution: {integrity: sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==} update-browserslist-db@1.2.3: resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} @@ -4957,6 +5204,11 @@ packages: resolution: {integrity: sha512-n2huDr9h9yzd6exQVnH/jU5mr+Pfx08LRXXZhkLLetAMESRj+anQsTAh940iMrIetKAmry9coFuZQ2jY8/p3WA==} engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0} + use-intl@4.13.0: + resolution: {integrity: sha512-fAFDrWaASxlhXOipcOyb5VDD+YONqj6+8O8EcG/J7RBoOUF3A8YahRWLN+mBxYMrlMQB8N6Voqk5X+YC+HSL0A==} + peerDependencies: + react: ^17.0.0 || ^18.0.0 || >=19.0.0-rc <19.0.0 || ^19.0.0 + util-deprecate@1.0.2: resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==} @@ -5099,8 +5351,8 @@ packages: resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==} engines: {node: '>= 0.4'} - which-typed-array@1.1.20: - resolution: {integrity: sha512-LYfpUkmqwl0h9A2HL09Mms427Q1RZWuOHsukfVcKRq9q95iQxdw0ix1JQrqbcDR9PH1QDwf5Qo8OZb5lksZ8Xg==} + which-typed-array@1.1.21: + resolution: {integrity: sha512-zbRA8cVm6io/d5W8uIe2hblzN76/Wm3v/yiythQvr+dpBWeqhPSWIDNj4zOyHi4zKbMK6DN34Xsr9jPHJERAEw==} engines: {node: '>= 0.4'} which@2.0.2: @@ -5563,6 +5815,18 @@ snapshots: '@eslint/core': 0.17.0 levn: 0.4.1 + '@formatjs/fast-memoize@3.1.5': {} + + '@formatjs/icu-messageformat-parser@3.5.10': + dependencies: + '@formatjs/icu-skeleton-parser': 2.1.9 + + '@formatjs/icu-skeleton-parser@2.1.9': {} + + '@formatjs/intl-localematcher@0.8.9': + dependencies: + '@formatjs/fast-memoize': 3.1.5 + '@humanfs/core@0.19.2': dependencies: '@humanfs/types': 0.15.0 @@ -5718,34 +5982,34 @@ snapshots: '@tybys/wasm-util': 0.10.2 optional: true - '@next/env@15.5.18': {} + '@next/env@15.5.19': {} - '@next/eslint-plugin-next@15.5.18': + '@next/eslint-plugin-next@15.5.19': dependencies: fast-glob: 3.3.1 - '@next/swc-darwin-arm64@15.5.18': + '@next/swc-darwin-arm64@15.5.19': optional: true - '@next/swc-darwin-x64@15.5.18': + '@next/swc-darwin-x64@15.5.19': optional: true - '@next/swc-linux-arm64-gnu@15.5.18': + '@next/swc-linux-arm64-gnu@15.5.19': optional: true - '@next/swc-linux-arm64-musl@15.5.18': + '@next/swc-linux-arm64-musl@15.5.19': optional: true - '@next/swc-linux-x64-gnu@15.5.18': + '@next/swc-linux-x64-gnu@15.5.19': optional: true - '@next/swc-linux-x64-musl@15.5.18': + '@next/swc-linux-x64-musl@15.5.19': optional: true - '@next/swc-win32-arm64-msvc@15.5.18': + '@next/swc-win32-arm64-msvc@15.5.19': optional: true - '@next/swc-win32-x64-msvc@15.5.18': + '@next/swc-win32-x64-msvc@15.5.19': optional: true '@noble/ed25519@2.3.0': {} @@ -5919,7 +6183,7 @@ snapshots: '@opentelemetry/instrumentation': 0.57.2(@opentelemetry/api@1.9.1) '@opentelemetry/semantic-conventions': 1.28.0 forwarded-parse: 2.1.2 - semver: 7.8.0 + semver: 7.8.1 transitivePeerDependencies: - supports-color @@ -6044,7 +6308,7 @@ snapshots: '@types/shimmer': 1.2.0 import-in-the-middle: 1.15.0 require-in-the-middle: 7.5.2 - semver: 7.8.0 + semver: 7.8.1 shimmer: 1.2.1 transitivePeerDependencies: - supports-color @@ -6073,6 +6337,66 @@ snapshots: '@opentelemetry/api': 1.9.1 '@opentelemetry/core': 1.30.1(@opentelemetry/api@1.9.1) + '@parcel/watcher-android-arm64@2.5.6': + optional: true + + '@parcel/watcher-darwin-arm64@2.5.6': + optional: true + + '@parcel/watcher-darwin-x64@2.5.6': + optional: true + + '@parcel/watcher-freebsd-x64@2.5.6': + optional: true + + '@parcel/watcher-linux-arm-glibc@2.5.6': + optional: true + + '@parcel/watcher-linux-arm-musl@2.5.6': + optional: true + + '@parcel/watcher-linux-arm64-glibc@2.5.6': + optional: true + + '@parcel/watcher-linux-arm64-musl@2.5.6': + optional: true + + '@parcel/watcher-linux-x64-glibc@2.5.6': + optional: true + + '@parcel/watcher-linux-x64-musl@2.5.6': + optional: true + + '@parcel/watcher-win32-arm64@2.5.6': + optional: true + + '@parcel/watcher-win32-ia32@2.5.6': + optional: true + + '@parcel/watcher-win32-x64@2.5.6': + optional: true + + '@parcel/watcher@2.5.6': + dependencies: + detect-libc: 2.1.2 + is-glob: 4.0.3 + node-addon-api: 7.1.1 + picomatch: 4.0.4 + optionalDependencies: + '@parcel/watcher-android-arm64': 2.5.6 + '@parcel/watcher-darwin-arm64': 2.5.6 + '@parcel/watcher-darwin-x64': 2.5.6 + '@parcel/watcher-freebsd-x64': 2.5.6 + '@parcel/watcher-linux-arm-glibc': 2.5.6 + '@parcel/watcher-linux-arm-musl': 2.5.6 + '@parcel/watcher-linux-arm64-glibc': 2.5.6 + '@parcel/watcher-linux-arm64-musl': 2.5.6 + '@parcel/watcher-linux-x64-glibc': 2.5.6 + '@parcel/watcher-linux-x64-musl': 2.5.6 + '@parcel/watcher-win32-arm64': 2.5.6 + '@parcel/watcher-win32-ia32': 2.5.6 + '@parcel/watcher-win32-x64': 2.5.6 + '@pkgjs/parseargs@0.11.0': optional: true @@ -6200,6 +6524,8 @@ snapshots: '@rushstack/eslint-patch@1.16.1': {} + '@schummar/icu-type-parser@1.21.5': {} + '@sec-ant/readable-stream@0.4.1': {} '@semantic-release/changelog@6.0.3(semantic-release@24.2.9(typescript@5.9.3))': @@ -6383,7 +6709,7 @@ snapshots: '@sentry/core@9.47.1': {} - '@sentry/nextjs@9.47.1(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.1))(next@15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(webpack@5.106.2)': + '@sentry/nextjs@9.47.1(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.1))(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.106.2)': dependencies: '@opentelemetry/api': 1.9.1 '@opentelemetry/semantic-conventions': 1.41.1 @@ -6392,11 +6718,11 @@ snapshots: '@sentry/core': 9.47.1 '@sentry/node': 9.47.1 '@sentry/opentelemetry': 9.47.1(@opentelemetry/api@1.9.1)(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1) - '@sentry/react': 9.47.1(react@19.2.6) + '@sentry/react': 9.47.1(react@19.2.7) '@sentry/vercel-edge': 9.47.1(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.1)) '@sentry/webpack-plugin': 3.6.1(webpack@5.106.2) chalk: 3.0.0 - next: 15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + next: 15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) resolve: 1.22.8 rollup: 4.60.4 stacktrace-parser: 0.1.11 @@ -6471,12 +6797,12 @@ snapshots: '@opentelemetry/semantic-conventions': 1.41.1 '@sentry/core': 9.47.1 - '@sentry/react@9.47.1(react@19.2.6)': + '@sentry/react@9.47.1(react@19.2.7)': dependencies: '@sentry/browser': 9.47.1 '@sentry/core': 9.47.1 hoist-non-react-statics: 3.3.2 - react: 19.2.6 + react: 19.2.7 '@sentry/vercel-edge@9.47.1(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.1))': dependencies: @@ -6536,42 +6862,102 @@ snapshots: - debug - supports-color - '@supabase/auth-js@2.106.2': + '@supabase/auth-js@2.107.0': dependencies: tslib: 2.8.1 - '@supabase/functions-js@2.106.2': + '@supabase/functions-js@2.107.0': dependencies: tslib: 2.8.1 '@supabase/phoenix@0.4.2': {} - '@supabase/postgrest-js@2.106.2': + '@supabase/postgrest-js@2.107.0': dependencies: tslib: 2.8.1 - '@supabase/realtime-js@2.106.2': + '@supabase/realtime-js@2.107.0': dependencies: '@supabase/phoenix': 0.4.2 tslib: 2.8.1 - '@supabase/storage-js@2.106.2': + '@supabase/storage-js@2.107.0': dependencies: iceberg-js: 0.8.1 tslib: 2.8.1 - '@supabase/supabase-js@2.106.2': + '@supabase/supabase-js@2.107.0': dependencies: - '@supabase/auth-js': 2.106.2 - '@supabase/functions-js': 2.106.2 - '@supabase/postgrest-js': 2.106.2 - '@supabase/realtime-js': 2.106.2 - '@supabase/storage-js': 2.106.2 + '@supabase/auth-js': 2.107.0 + '@supabase/functions-js': 2.107.0 + '@supabase/postgrest-js': 2.107.0 + '@supabase/realtime-js': 2.107.0 + '@supabase/storage-js': 2.107.0 + + '@swc/core-darwin-arm64@1.15.40': + optional: true + + '@swc/core-darwin-x64@1.15.40': + optional: true + + '@swc/core-linux-arm-gnueabihf@1.15.40': + optional: true + + '@swc/core-linux-arm64-gnu@1.15.40': + optional: true + + '@swc/core-linux-arm64-musl@1.15.40': + optional: true + + '@swc/core-linux-ppc64-gnu@1.15.40': + optional: true + + '@swc/core-linux-s390x-gnu@1.15.40': + optional: true + + '@swc/core-linux-x64-gnu@1.15.40': + optional: true + + '@swc/core-linux-x64-musl@1.15.40': + optional: true + + '@swc/core-win32-arm64-msvc@1.15.40': + optional: true + + '@swc/core-win32-ia32-msvc@1.15.40': + optional: true + + '@swc/core-win32-x64-msvc@1.15.40': + optional: true + + '@swc/core@1.15.40': + dependencies: + '@swc/counter': 0.1.3 + '@swc/types': 0.1.26 + optionalDependencies: + '@swc/core-darwin-arm64': 1.15.40 + '@swc/core-darwin-x64': 1.15.40 + '@swc/core-linux-arm-gnueabihf': 1.15.40 + '@swc/core-linux-arm64-gnu': 1.15.40 + '@swc/core-linux-arm64-musl': 1.15.40 + '@swc/core-linux-ppc64-gnu': 1.15.40 + '@swc/core-linux-s390x-gnu': 1.15.40 + '@swc/core-linux-x64-gnu': 1.15.40 + '@swc/core-linux-x64-musl': 1.15.40 + '@swc/core-win32-arm64-msvc': 1.15.40 + '@swc/core-win32-ia32-msvc': 1.15.40 + '@swc/core-win32-x64-msvc': 1.15.40 + + '@swc/counter@0.1.3': {} '@swc/helpers@0.5.15': dependencies: tslib: 2.8.1 + '@swc/types@0.1.26': + dependencies: + '@swc/counter': 0.1.3 + '@t3-oss/env-core@0.13.11(typescript@5.9.3)(zod@3.25.76)': optionalDependencies: typescript: 5.9.3 @@ -6584,12 +6970,12 @@ snapshots: typescript: 5.9.3 zod: 3.25.76 - '@tanstack/query-core@5.100.14': {} + '@tanstack/query-core@5.101.0': {} - '@tanstack/react-query@5.100.14(react@19.2.6)': + '@tanstack/react-query@5.100.14(react@19.2.7)': dependencies: '@tanstack/query-core': 5.100.14 - react: 19.2.6 + react: 19.2.7 '@testing-library/dom@10.4.1': dependencies: @@ -6602,32 +6988,32 @@ snapshots: picocolors: 1.1.1 pretty-format: 27.5.1 - '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.15))(@types/react@19.2.15)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)': + '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.16))(@types/react@19.2.16)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)': dependencies: '@babel/runtime': 7.29.2 '@testing-library/dom': 10.4.1 - react: 19.2.6 - react-dom: 19.2.6(react@19.2.6) + react: 19.2.7 + react-dom: 19.2.7(react@19.2.7) optionalDependencies: - '@types/react': 19.2.15 - '@types/react-dom': 19.2.3(@types/react@19.2.15) + '@types/react': 19.2.16 + '@types/react-dom': 19.2.3(@types/react@19.2.16) - '@turbo/darwin-64@2.9.14': + '@turbo/darwin-64@2.9.16': optional: true - '@turbo/darwin-arm64@2.9.14': + '@turbo/darwin-arm64@2.9.16': optional: true - '@turbo/linux-64@2.9.14': + '@turbo/linux-64@2.9.16': optional: true - '@turbo/linux-arm64@2.9.14': + '@turbo/linux-arm64@2.9.16': optional: true - '@turbo/windows-64@2.9.14': + '@turbo/windows-64@2.9.16': optional: true - '@turbo/windows-arm64@2.9.14': + '@turbo/windows-arm64@2.9.16': optional: true '@tybys/wasm-util@0.10.2': @@ -6724,11 +7110,11 @@ snapshots: pg-protocol: 1.14.0 pg-types: 2.2.0 - '@types/react-dom@19.2.3(@types/react@19.2.15)': + '@types/react-dom@19.2.3(@types/react@19.2.16)': dependencies: - '@types/react': 19.2.15 + '@types/react': 19.2.16 - '@types/react@19.2.15': + '@types/react@19.2.16': dependencies: csstype: 3.2.3 @@ -6738,14 +7124,14 @@ snapshots: dependencies: '@types/node': 22.19.19 - '@typescript-eslint/eslint-plugin@8.59.4(@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4)(typescript@5.9.3)': + '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4)(typescript@5.9.3)': dependencies: '@eslint-community/regexpp': 4.12.2 - '@typescript-eslint/parser': 8.59.4(eslint@9.39.4)(typescript@5.9.3) - '@typescript-eslint/scope-manager': 8.59.4 - '@typescript-eslint/type-utils': 8.59.4(eslint@9.39.4)(typescript@5.9.3) - '@typescript-eslint/utils': 8.59.4(eslint@9.39.4)(typescript@5.9.3) - '@typescript-eslint/visitor-keys': 8.59.4 + '@typescript-eslint/parser': 8.60.1(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/scope-manager': 8.60.1 + '@typescript-eslint/type-utils': 8.60.1(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/utils': 8.60.1(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/visitor-keys': 8.60.1 eslint: 9.39.4 ignore: 7.0.5 natural-compare: 1.4.0 @@ -6754,41 +7140,41 @@ snapshots: transitivePeerDependencies: - supports-color - '@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3)': + '@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3)': dependencies: - '@typescript-eslint/scope-manager': 8.59.4 - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/typescript-estree': 8.59.4(typescript@5.9.3) - '@typescript-eslint/visitor-keys': 8.59.4 + '@typescript-eslint/scope-manager': 8.60.1 + '@typescript-eslint/types': 8.60.1 + '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3) + '@typescript-eslint/visitor-keys': 8.60.1 debug: 4.4.3 eslint: 9.39.4 typescript: 5.9.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/project-service@8.59.4(typescript@5.9.3)': + '@typescript-eslint/project-service@8.60.1(typescript@5.9.3)': dependencies: - '@typescript-eslint/tsconfig-utils': 8.59.4(typescript@5.9.3) - '@typescript-eslint/types': 8.59.4 + '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@5.9.3) + '@typescript-eslint/types': 8.60.1 debug: 4.4.3 typescript: 5.9.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/scope-manager@8.59.4': + '@typescript-eslint/scope-manager@8.60.1': dependencies: - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/visitor-keys': 8.59.4 + '@typescript-eslint/types': 8.60.1 + '@typescript-eslint/visitor-keys': 8.60.1 - '@typescript-eslint/tsconfig-utils@8.59.4(typescript@5.9.3)': + '@typescript-eslint/tsconfig-utils@8.60.1(typescript@5.9.3)': dependencies: typescript: 5.9.3 - '@typescript-eslint/type-utils@8.59.4(eslint@9.39.4)(typescript@5.9.3)': + '@typescript-eslint/type-utils@8.60.1(eslint@9.39.4)(typescript@5.9.3)': dependencies: - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/typescript-estree': 8.59.4(typescript@5.9.3) - '@typescript-eslint/utils': 8.59.4(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/types': 8.60.1 + '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3) + '@typescript-eslint/utils': 8.60.1(eslint@9.39.4)(typescript@5.9.3) debug: 4.4.3 eslint: 9.39.4 ts-api-utils: 2.5.0(typescript@5.9.3) @@ -6796,112 +7182,118 @@ snapshots: transitivePeerDependencies: - supports-color - '@typescript-eslint/types@8.59.4': {} + '@typescript-eslint/types@8.60.1': {} - '@typescript-eslint/typescript-estree@8.59.4(typescript@5.9.3)': + '@typescript-eslint/typescript-estree@8.60.1(typescript@5.9.3)': dependencies: - '@typescript-eslint/project-service': 8.59.4(typescript@5.9.3) - '@typescript-eslint/tsconfig-utils': 8.59.4(typescript@5.9.3) - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/visitor-keys': 8.59.4 + '@typescript-eslint/project-service': 8.60.1(typescript@5.9.3) + '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@5.9.3) + '@typescript-eslint/types': 8.60.1 + '@typescript-eslint/visitor-keys': 8.60.1 debug: 4.4.3 minimatch: 10.2.5 - semver: 7.8.0 - tinyglobby: 0.2.16 + semver: 7.8.1 + tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@5.9.3) typescript: 5.9.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/utils@8.59.4(eslint@9.39.4)(typescript@5.9.3)': + '@typescript-eslint/utils@8.60.1(eslint@9.39.4)(typescript@5.9.3)': dependencies: '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4) - '@typescript-eslint/scope-manager': 8.59.4 - '@typescript-eslint/types': 8.59.4 - '@typescript-eslint/typescript-estree': 8.59.4(typescript@5.9.3) + '@typescript-eslint/scope-manager': 8.60.1 + '@typescript-eslint/types': 8.60.1 + '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3) eslint: 9.39.4 typescript: 5.9.3 transitivePeerDependencies: - supports-color - '@typescript-eslint/visitor-keys@8.59.4': + '@typescript-eslint/visitor-keys@8.60.1': dependencies: - '@typescript-eslint/types': 8.59.4 + '@typescript-eslint/types': 8.60.1 eslint-visitor-keys: 5.0.1 - '@unrs/resolver-binding-android-arm-eabi@1.12.1': + '@unrs/resolver-binding-android-arm-eabi@1.12.2': + optional: true + + '@unrs/resolver-binding-android-arm64@1.12.2': + optional: true + + '@unrs/resolver-binding-darwin-arm64@1.12.2': optional: true - '@unrs/resolver-binding-android-arm64@1.12.1': + '@unrs/resolver-binding-darwin-x64@1.12.2': optional: true - '@unrs/resolver-binding-darwin-arm64@1.12.1': + '@unrs/resolver-binding-freebsd-x64@1.12.2': optional: true - '@unrs/resolver-binding-darwin-x64@1.12.1': + '@unrs/resolver-binding-linux-arm-gnueabihf@1.12.2': optional: true - '@unrs/resolver-binding-freebsd-x64@1.12.1': + '@unrs/resolver-binding-linux-arm-musleabihf@1.12.2': optional: true - '@unrs/resolver-binding-linux-arm-gnueabihf@1.12.1': + '@unrs/resolver-binding-linux-arm64-gnu@1.12.2': optional: true - '@unrs/resolver-binding-linux-arm-musleabihf@1.12.1': + '@unrs/resolver-binding-linux-arm64-musl@1.12.2': optional: true - '@unrs/resolver-binding-linux-arm64-gnu@1.12.1': + '@unrs/resolver-binding-linux-loong64-gnu@1.12.2': optional: true - '@unrs/resolver-binding-linux-arm64-musl@1.12.1': + '@unrs/resolver-binding-linux-loong64-musl@1.12.2': optional: true - '@unrs/resolver-binding-linux-ppc64-gnu@1.12.1': + '@unrs/resolver-binding-linux-ppc64-gnu@1.12.2': optional: true - '@unrs/resolver-binding-linux-riscv64-gnu@1.12.1': + '@unrs/resolver-binding-linux-riscv64-gnu@1.12.2': optional: true - '@unrs/resolver-binding-linux-riscv64-musl@1.12.1': + '@unrs/resolver-binding-linux-riscv64-musl@1.12.2': optional: true - '@unrs/resolver-binding-linux-s390x-gnu@1.12.1': + '@unrs/resolver-binding-linux-s390x-gnu@1.12.2': optional: true - '@unrs/resolver-binding-linux-x64-gnu@1.12.1': + '@unrs/resolver-binding-linux-x64-gnu@1.12.2': optional: true - '@unrs/resolver-binding-linux-x64-musl@1.12.1': + '@unrs/resolver-binding-linux-x64-musl@1.12.2': optional: true - '@unrs/resolver-binding-openharmony-arm64@1.12.1': + '@unrs/resolver-binding-openharmony-arm64@1.12.2': optional: true - '@unrs/resolver-binding-wasm32-wasi@1.12.1': + '@unrs/resolver-binding-wasm32-wasi@1.12.2': dependencies: '@emnapi/core': 1.10.0 '@emnapi/runtime': 1.10.0 '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0) optional: true - '@unrs/resolver-binding-win32-arm64-msvc@1.12.1': + '@unrs/resolver-binding-win32-arm64-msvc@1.12.2': optional: true - '@unrs/resolver-binding-win32-ia32-msvc@1.12.1': + '@unrs/resolver-binding-win32-ia32-msvc@1.12.2': optional: true - '@unrs/resolver-binding-win32-x64-msvc@1.12.1': + '@unrs/resolver-binding-win32-x64-msvc@1.12.2': optional: true - '@vercel/analytics@1.6.1(next@15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)': + '@vercel/analytics@1.6.1(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)': optionalDependencies: - next: 15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) - react: 19.2.6 + next: 15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + react: 19.2.7 - '@vercel/speed-insights@1.3.1(next@15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)': + '@vercel/speed-insights@1.3.1(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)': optionalDependencies: - next: 15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6) - react: 19.2.6 + next: 15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + react: 19.2.7 '@vitejs/plugin-react@4.7.0(vite@5.4.21(@types/node@22.19.19)(terser@5.48.0))': dependencies: @@ -7158,7 +7550,7 @@ snapshots: call-bound: 1.0.4 define-properties: 1.2.1 es-abstract: 1.24.2 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 get-intrinsic: 1.3.0 is-string: 1.1.1 math-intrinsics: 1.1.0 @@ -7169,7 +7561,7 @@ snapshots: define-properties: 1.2.1 es-abstract: 1.24.2 es-errors: 1.3.0 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 es-shim-unscopables: 1.1.0 array.prototype.findlastindex@1.2.6: @@ -7179,7 +7571,7 @@ snapshots: define-properties: 1.2.1 es-abstract: 1.24.2 es-errors: 1.3.0 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 es-shim-unscopables: 1.1.0 array.prototype.flat@1.3.3: @@ -7228,6 +7620,8 @@ snapshots: axe-core@4.11.4: {} + axe-core@4.12.0: {} + axios@1.16.1: dependencies: follow-redirects: 1.16.0 @@ -7473,7 +7867,7 @@ snapshots: conventional-commits-filter: 5.0.0 handlebars: 4.7.9 meow: 13.2.0 - semver: 7.8.0 + semver: 7.8.1 conventional-commits-filter@5.0.0: {} @@ -7611,8 +8005,7 @@ snapshots: dequal@2.0.3: {} - detect-libc@2.1.2: - optional: true + detect-libc@2.1.2: {} dir-glob@3.0.1: dependencies: @@ -7655,7 +8048,7 @@ snapshots: emojilib@2.4.0: {} - enhanced-resolve@5.22.0: + enhanced-resolve@5.22.1: dependencies: graceful-fs: 4.2.11 tapable: 2.3.3 @@ -7687,7 +8080,7 @@ snapshots: data-view-byte-offset: 1.0.1 es-define-property: 1.0.1 es-errors: 1.3.0 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 es-set-tostringtag: 2.1.0 es-to-primitive: 1.3.0 function.prototype.name: 1.1.8 @@ -7699,7 +8092,7 @@ snapshots: has-property-descriptors: 1.0.2 has-proto: 1.2.0 has-symbols: 1.1.0 - hasown: 2.0.3 + hasown: 2.0.4 internal-slot: 1.1.0 is-array-buffer: 3.0.5 is-callable: 1.2.7 @@ -7728,9 +8121,9 @@ snapshots: typed-array-buffer: 1.0.3 typed-array-byte-length: 1.0.3 typed-array-byte-offset: 1.0.4 - typed-array-length: 1.0.7 + typed-array-length: 1.0.8 unbox-primitive: 1.1.0 - which-typed-array: 1.1.20 + which-typed-array: 1.1.21 es-define-property@1.0.1: {} @@ -7763,6 +8156,10 @@ snapshots: dependencies: es-errors: 1.3.0 + es-object-atoms@1.1.2: + dependencies: + es-errors: 1.3.0 + es-set-tostringtag@2.1.0: dependencies: es-errors: 1.3.0 @@ -7772,7 +8169,7 @@ snapshots: es-shim-unscopables@1.1.0: dependencies: - hasown: 2.0.3 + hasown: 2.0.4 es-to-primitive@1.3.0: dependencies: @@ -7843,16 +8240,16 @@ snapshots: escape-string-regexp@5.0.0: {} - eslint-config-next@15.5.18(eslint@9.39.4)(typescript@5.9.3): + eslint-config-next@15.5.19(eslint@9.39.4)(typescript@5.9.3): dependencies: - '@next/eslint-plugin-next': 15.5.18 + '@next/eslint-plugin-next': 15.5.19 '@rushstack/eslint-patch': 1.16.1 - '@typescript-eslint/eslint-plugin': 8.59.4(@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4)(typescript@5.9.3) - '@typescript-eslint/parser': 8.59.4(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3))(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/parser': 8.60.1(eslint@9.39.4)(typescript@5.9.3) eslint: 9.39.4 eslint-import-resolver-node: 0.3.10 eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.4) - eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4) + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4) eslint-plugin-jsx-a11y: 6.10.2(eslint@9.39.4) eslint-plugin-react: 7.37.5(eslint@9.39.4) eslint-plugin-react-hooks: 5.2.0(eslint@9.39.4) @@ -7879,25 +8276,25 @@ snapshots: get-tsconfig: 4.14.0 is-bun-module: 2.0.0 stable-hash: 0.0.5 - tinyglobby: 0.2.16 - unrs-resolver: 1.12.1 + tinyglobby: 0.2.17 + unrs-resolver: 1.12.2 optionalDependencies: - eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4) + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4) transitivePeerDependencies: - supports-color - eslint-module-utils@2.12.1(@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4): + eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4): dependencies: debug: 3.2.7 optionalDependencies: - '@typescript-eslint/parser': 8.59.4(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/parser': 8.60.1(eslint@9.39.4)(typescript@5.9.3) eslint: 9.39.4 eslint-import-resolver-node: 0.3.10 eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.4) transitivePeerDependencies: - supports-color - eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4): + eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4): dependencies: '@rtsao/scc': 1.1.0 array-includes: 3.1.9 @@ -7908,8 +8305,8 @@ snapshots: doctrine: 2.1.0 eslint: 9.39.4 eslint-import-resolver-node: 0.3.10 - eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.59.4(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4) - hasown: 2.0.3 + eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.4) + hasown: 2.0.4 is-core-module: 2.16.2 is-glob: 4.0.3 minimatch: 3.1.5 @@ -7920,7 +8317,7 @@ snapshots: string.prototype.trimend: 1.0.9 tsconfig-paths: 3.15.0 optionalDependencies: - '@typescript-eslint/parser': 8.59.4(eslint@9.39.4)(typescript@5.9.3) + '@typescript-eslint/parser': 8.60.1(eslint@9.39.4)(typescript@5.9.3) transitivePeerDependencies: - eslint-import-resolver-typescript - eslint-import-resolver-webpack @@ -7932,12 +8329,12 @@ snapshots: array-includes: 3.1.9 array.prototype.flatmap: 1.3.3 ast-types-flow: 0.0.8 - axe-core: 4.11.4 + axe-core: 4.12.0 axobject-query: 4.1.0 damerau-levenshtein: 1.0.8 emoji-regex: 9.2.2 eslint: 9.39.4 - hasown: 2.0.3 + hasown: 2.0.4 jsx-ast-utils: 3.3.5 language-tags: 1.0.9 minimatch: 3.1.5 @@ -7959,7 +8356,7 @@ snapshots: es-iterator-helpers: 1.3.2 eslint: 9.39.4 estraverse: 5.3.0 - hasown: 2.0.3 + hasown: 2.0.4 jsx-ast-utils: 3.3.5 minimatch: 3.1.5 object.entries: 1.1.9 @@ -8221,7 +8618,7 @@ snapshots: call-bound: 1.0.4 define-properties: 1.2.1 functions-have-names: 1.2.3 - hasown: 2.0.3 + hasown: 2.0.4 is-callable: 1.2.7 functions-have-names@1.2.3: {} @@ -8242,13 +8639,13 @@ snapshots: get-proto: 1.0.1 gopd: 1.2.0 has-symbols: 1.1.0 - hasown: 2.0.3 + hasown: 2.0.4 math-intrinsics: 1.1.0 get-proto@1.0.1: dependencies: dunder-proto: 1.0.1 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 get-stream@6.0.1: {} @@ -8350,6 +8747,10 @@ snapshots: dependencies: function-bind: 1.1.2 + hasown@2.0.4: + dependencies: + function-bind: 1.1.2 + highlight.js@10.7.3: {} hoist-non-react-statics@3.3.2: @@ -8405,6 +8806,10 @@ snapshots: dependencies: safer-buffer: 2.1.2 + icu-minify@4.13.0: + dependencies: + '@formatjs/icu-messageformat-parser': 3.5.10 + ieee754@1.2.1: {} ignore@5.3.2: {} @@ -8447,11 +8852,16 @@ snapshots: internal-slot@1.1.0: dependencies: es-errors: 1.3.0 - hasown: 2.0.3 + hasown: 2.0.4 side-channel: 1.1.0 internmap@2.0.3: {} + intl-messageformat@11.2.7: + dependencies: + '@formatjs/fast-memoize': 3.1.5 + '@formatjs/icu-messageformat-parser': 3.5.10 + is-array-buffer@3.0.5: dependencies: call-bind: 1.0.9 @@ -8483,13 +8893,13 @@ snapshots: is-bun-module@2.0.0: dependencies: - semver: 7.8.0 + semver: 7.8.1 is-callable@1.2.7: {} is-core-module@2.16.2: dependencies: - hasown: 2.0.3 + hasown: 2.0.4 is-data-view@1.0.2: dependencies: @@ -8548,7 +8958,7 @@ snapshots: call-bound: 1.0.4 gopd: 1.2.0 has-tostringtag: 1.0.2 - hasown: 2.0.3 + hasown: 2.0.4 is-retry-allowed@3.0.0: {} @@ -8577,7 +8987,7 @@ snapshots: is-typed-array@1.1.15: dependencies: - which-typed-array: 1.1.20 + which-typed-array: 1.1.21 is-unicode-supported@2.1.0: {} @@ -8630,7 +9040,7 @@ snapshots: iterator.prototype@1.1.5: dependencies: define-data-property: 1.1.4 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 get-intrinsic: 1.3.0 get-proto: 1.0.1 has-symbols: 1.1.0 @@ -8788,9 +9198,9 @@ snapshots: dependencies: yallist: 3.1.1 - lucide-react@0.577.0(react@19.2.6): + lucide-react@0.577.0(react@19.2.7): dependencies: - react: 19.2.6 + react: 19.2.7 lz-string@1.5.0: {} @@ -8903,33 +9313,54 @@ snapshots: natural-compare@1.4.0: {} + negotiator@1.0.0: {} + neo-async@2.6.2: {} nerf-dart@1.0.0: {} - next-themes@0.4.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6): + next-intl-swc-plugin-extractor@4.13.0: {} + + next-intl@4.13.0(next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(typescript@5.9.3): dependencies: - react: 19.2.6 - react-dom: 19.2.6(react@19.2.6) + '@formatjs/intl-localematcher': 0.8.9 + '@parcel/watcher': 2.5.6 + '@swc/core': 1.15.40 + icu-minify: 4.13.0 + negotiator: 1.0.0 + next: 15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) + next-intl-swc-plugin-extractor: 4.13.0 + po-parser: 2.1.1 + react: 19.2.7 + use-intl: 4.13.0(react@19.2.7) + optionalDependencies: + typescript: 5.9.3 + transitivePeerDependencies: + - '@swc/helpers' + + next-themes@0.4.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7): + dependencies: + react: 19.2.7 + react-dom: 19.2.7(react@19.2.7) - next@15.5.18(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6): + next@15.5.19(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7): dependencies: - '@next/env': 15.5.18 + '@next/env': 15.5.19 '@swc/helpers': 0.5.15 caniuse-lite: 1.0.30001793 postcss: 8.4.31 - react: 19.2.6 - react-dom: 19.2.6(react@19.2.6) - styled-jsx: 5.1.6(@babel/core@7.29.0)(react@19.2.6) + react: 19.2.7 + react-dom: 19.2.7(react@19.2.7) + styled-jsx: 5.1.6(@babel/core@7.29.0)(react@19.2.7) optionalDependencies: - '@next/swc-darwin-arm64': 15.5.18 - '@next/swc-darwin-x64': 15.5.18 - '@next/swc-linux-arm64-gnu': 15.5.18 - '@next/swc-linux-arm64-musl': 15.5.18 - '@next/swc-linux-x64-gnu': 15.5.18 - '@next/swc-linux-x64-musl': 15.5.18 - '@next/swc-win32-arm64-msvc': 15.5.18 - '@next/swc-win32-x64-msvc': 15.5.18 + '@next/swc-darwin-arm64': 15.5.19 + '@next/swc-darwin-x64': 15.5.19 + '@next/swc-linux-arm64-gnu': 15.5.19 + '@next/swc-linux-arm64-musl': 15.5.19 + '@next/swc-linux-x64-gnu': 15.5.19 + '@next/swc-linux-x64-musl': 15.5.19 + '@next/swc-win32-arm64-msvc': 15.5.19 + '@next/swc-win32-x64-msvc': 15.5.19 '@opentelemetry/api': 1.9.1 '@playwright/test': 1.60.0 sharp: 0.34.5 @@ -8937,6 +9368,8 @@ snapshots: - '@babel/core' - babel-plugin-macros + node-addon-api@7.1.1: {} + node-emoji@2.2.0: dependencies: '@sindresorhus/is': 4.6.0 @@ -8960,7 +9393,7 @@ snapshots: normalize-package-data@6.0.2: dependencies: hosted-git-info: 7.0.2 - semver: 7.8.0 + semver: 7.8.1 validate-npm-package-license: 3.0.4 normalize-path@3.0.0: {} @@ -8995,7 +9428,7 @@ snapshots: call-bind: 1.0.9 call-bound: 1.0.4 define-properties: 1.2.1 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 has-symbols: 1.1.0 object-keys: 1.1.1 @@ -9004,14 +9437,14 @@ snapshots: call-bind: 1.0.9 call-bound: 1.0.4 define-properties: 1.2.1 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 object.fromentries@2.0.8: dependencies: call-bind: 1.0.9 define-properties: 1.2.1 es-abstract: 1.24.2 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 object.groupby@1.0.3: dependencies: @@ -9024,7 +9457,7 @@ snapshots: call-bind: 1.0.9 call-bound: 1.0.4 define-properties: 1.2.1 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 onetime@5.1.2: dependencies: @@ -9187,13 +9620,15 @@ snapshots: optionalDependencies: fsevents: 2.3.2 + po-parser@2.1.1: {} + possible-typed-array-names@1.1.0: {} - postcss-load-config@6.0.1(postcss@8.5.14): + postcss-load-config@6.0.1(postcss@8.5.15): dependencies: lilconfig: 3.1.3 optionalDependencies: - postcss: 8.5.14 + postcss: 8.5.15 postcss@8.4.31: dependencies: @@ -9201,7 +9636,7 @@ snapshots: picocolors: 1.1.1 source-map-js: 1.2.1 - postcss@8.5.14: + postcss@8.5.15: dependencies: nanoid: 3.3.12 picocolors: 1.1.1 @@ -9266,9 +9701,9 @@ snapshots: minimist: 1.2.8 strip-json-comments: 2.0.1 - react-dom@19.2.6(react@19.2.6): + react-dom@19.2.7(react@19.2.7): dependencies: - react: 19.2.6 + react: 19.2.7 scheduler: 0.27.0 react-is@16.13.1: {} @@ -9279,24 +9714,24 @@ snapshots: react-refresh@0.17.0: {} - react-smooth@4.0.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6): + react-smooth@4.0.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7): dependencies: fast-equals: 5.4.0 prop-types: 15.8.1 - react: 19.2.6 - react-dom: 19.2.6(react@19.2.6) - react-transition-group: 4.4.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + react: 19.2.7 + react-dom: 19.2.7(react@19.2.7) + react-transition-group: 4.4.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7) - react-transition-group@4.4.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6): + react-transition-group@4.4.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7): dependencies: '@babel/runtime': 7.29.2 dom-helpers: 5.2.1 loose-envify: 1.4.0 prop-types: 15.8.1 - react: 19.2.6 - react-dom: 19.2.6(react@19.2.6) + react: 19.2.7 + react-dom: 19.2.7(react@19.2.7) - react@19.2.6: {} + react@19.2.7: {} read-package-up@11.0.0: dependencies: @@ -9332,15 +9767,15 @@ snapshots: dependencies: decimal.js-light: 2.5.1 - recharts@2.15.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6): + recharts@2.15.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7): dependencies: clsx: 2.1.1 eventemitter3: 4.0.7 lodash: 4.18.1 - react: 19.2.6 - react-dom: 19.2.6(react@19.2.6) + react: 19.2.7 + react-dom: 19.2.7(react@19.2.7) react-is: 18.3.1 - react-smooth: 4.0.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6) + react-smooth: 4.0.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7) recharts-scale: 0.4.5 tiny-invariant: 1.3.3 victory-vendor: 36.9.2 @@ -9351,7 +9786,7 @@ snapshots: define-properties: 1.2.1 es-abstract: 1.24.2 es-errors: 1.3.0 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 get-intrinsic: 1.3.0 get-proto: 1.0.1 which-builtin-type: 1.2.1 @@ -9533,6 +9968,8 @@ snapshots: semver@7.8.0: {} + semver@7.8.1: {} + set-function-length@1.2.2: dependencies: define-data-property: 1.1.4 @@ -9553,7 +9990,7 @@ snapshots: dependencies: dunder-proto: 1.0.1 es-errors: 1.3.0 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 sha.js@2.4.12: dependencies: @@ -9565,7 +10002,7 @@ snapshots: dependencies: '@img/colour': 1.1.0 detect-libc: 2.1.2 - semver: 7.8.0 + semver: 7.8.1 optionalDependencies: '@img/sharp-darwin-arm64': 0.34.5 '@img/sharp-darwin-x64': 0.34.5 @@ -9728,7 +10165,7 @@ snapshots: define-properties: 1.2.1 es-abstract: 1.24.2 es-errors: 1.3.0 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 get-intrinsic: 1.3.0 gopd: 1.2.0 has-symbols: 1.1.0 @@ -9749,7 +10186,7 @@ snapshots: define-data-property: 1.1.4 define-properties: 1.2.1 es-abstract: 1.24.2 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 has-property-descriptors: 1.0.2 string.prototype.trimend@1.0.9: @@ -9757,13 +10194,13 @@ snapshots: call-bind: 1.0.9 call-bound: 1.0.4 define-properties: 1.2.1 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 string.prototype.trimstart@1.0.8: dependencies: call-bind: 1.0.9 define-properties: 1.2.1 - es-object-atoms: 1.1.1 + es-object-atoms: 1.1.2 string_decoder@1.1.1: dependencies: @@ -9789,10 +10226,10 @@ snapshots: strip-json-comments@3.1.1: {} - styled-jsx@5.1.6(@babel/core@7.29.0)(react@19.2.6): + styled-jsx@5.1.6(@babel/core@7.29.0)(react@19.2.7): dependencies: client-only: 0.0.1 - react: 19.2.6 + react: 19.2.7 optionalDependencies: '@babel/core': 7.29.0 @@ -9848,7 +10285,7 @@ snapshots: type-fest: 2.19.0 unique-string: 3.0.0 - terser-webpack-plugin@5.6.0(webpack@5.106.2): + terser-webpack-plugin@5.6.1(webpack@5.106.2): dependencies: '@jridgewell/trace-mapping': 0.3.31 jest-worker: 27.5.1 @@ -9897,6 +10334,11 @@ snapshots: fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 + tinyglobby@0.2.17: + dependencies: + fdir: 6.5.0(picomatch@4.0.4) + picomatch: 4.0.4 + tinypool@1.1.1: {} tinyrainbow@1.2.0: {} @@ -9950,7 +10392,7 @@ snapshots: tslib@2.8.1: {} - tsup@8.5.1(postcss@8.5.14)(typescript@5.9.3): + tsup@8.5.1(@swc/core@1.15.40)(postcss@8.5.15)(typescript@5.9.3): dependencies: bundle-require: 5.1.0(esbuild@0.27.7) cac: 6.7.14 @@ -9961,7 +10403,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(postcss@8.5.14) + postcss-load-config: 6.0.1(postcss@8.5.15) resolve-from: 5.0.0 rollup: 4.60.4 source-map: 0.7.6 @@ -9970,7 +10412,8 @@ snapshots: tinyglobby: 0.2.16 tree-kill: 1.2.2 optionalDependencies: - postcss: 8.5.14 + '@swc/core': 1.15.40 + postcss: 8.5.15 typescript: 5.9.3 transitivePeerDependencies: - jiti @@ -9978,14 +10421,14 @@ snapshots: - tsx - yaml - turbo@2.9.14: + turbo@2.9.16: optionalDependencies: - '@turbo/darwin-64': 2.9.14 - '@turbo/darwin-arm64': 2.9.14 - '@turbo/linux-64': 2.9.14 - '@turbo/linux-arm64': 2.9.14 - '@turbo/windows-64': 2.9.14 - '@turbo/windows-arm64': 2.9.14 + '@turbo/darwin-64': 2.9.16 + '@turbo/darwin-arm64': 2.9.16 + '@turbo/linux-64': 2.9.16 + '@turbo/linux-arm64': 2.9.16 + '@turbo/windows-64': 2.9.16 + '@turbo/windows-arm64': 2.9.16 tweetnacl@1.0.3: {} @@ -10025,7 +10468,7 @@ snapshots: is-typed-array: 1.1.15 reflect.getprototypeof: 1.0.10 - typed-array-length@1.0.7: + typed-array-length@1.0.8: dependencies: call-bind: 1.0.9 for-each: 0.3.5 @@ -10071,30 +10514,32 @@ snapshots: webpack-sources: 3.4.1 webpack-virtual-modules: 0.5.0 - unrs-resolver@1.12.1: + unrs-resolver@1.12.2: dependencies: napi-postinstall: 0.3.4 optionalDependencies: - '@unrs/resolver-binding-android-arm-eabi': 1.12.1 - '@unrs/resolver-binding-android-arm64': 1.12.1 - '@unrs/resolver-binding-darwin-arm64': 1.12.1 - '@unrs/resolver-binding-darwin-x64': 1.12.1 - '@unrs/resolver-binding-freebsd-x64': 1.12.1 - '@unrs/resolver-binding-linux-arm-gnueabihf': 1.12.1 - '@unrs/resolver-binding-linux-arm-musleabihf': 1.12.1 - '@unrs/resolver-binding-linux-arm64-gnu': 1.12.1 - '@unrs/resolver-binding-linux-arm64-musl': 1.12.1 - '@unrs/resolver-binding-linux-ppc64-gnu': 1.12.1 - '@unrs/resolver-binding-linux-riscv64-gnu': 1.12.1 - '@unrs/resolver-binding-linux-riscv64-musl': 1.12.1 - '@unrs/resolver-binding-linux-s390x-gnu': 1.12.1 - '@unrs/resolver-binding-linux-x64-gnu': 1.12.1 - '@unrs/resolver-binding-linux-x64-musl': 1.12.1 - '@unrs/resolver-binding-openharmony-arm64': 1.12.1 - '@unrs/resolver-binding-wasm32-wasi': 1.12.1 - '@unrs/resolver-binding-win32-arm64-msvc': 1.12.1 - '@unrs/resolver-binding-win32-ia32-msvc': 1.12.1 - '@unrs/resolver-binding-win32-x64-msvc': 1.12.1 + '@unrs/resolver-binding-android-arm-eabi': 1.12.2 + '@unrs/resolver-binding-android-arm64': 1.12.2 + '@unrs/resolver-binding-darwin-arm64': 1.12.2 + '@unrs/resolver-binding-darwin-x64': 1.12.2 + '@unrs/resolver-binding-freebsd-x64': 1.12.2 + '@unrs/resolver-binding-linux-arm-gnueabihf': 1.12.2 + '@unrs/resolver-binding-linux-arm-musleabihf': 1.12.2 + '@unrs/resolver-binding-linux-arm64-gnu': 1.12.2 + '@unrs/resolver-binding-linux-arm64-musl': 1.12.2 + '@unrs/resolver-binding-linux-loong64-gnu': 1.12.2 + '@unrs/resolver-binding-linux-loong64-musl': 1.12.2 + '@unrs/resolver-binding-linux-ppc64-gnu': 1.12.2 + '@unrs/resolver-binding-linux-riscv64-gnu': 1.12.2 + '@unrs/resolver-binding-linux-riscv64-musl': 1.12.2 + '@unrs/resolver-binding-linux-s390x-gnu': 1.12.2 + '@unrs/resolver-binding-linux-x64-gnu': 1.12.2 + '@unrs/resolver-binding-linux-x64-musl': 1.12.2 + '@unrs/resolver-binding-openharmony-arm64': 1.12.2 + '@unrs/resolver-binding-wasm32-wasi': 1.12.2 + '@unrs/resolver-binding-win32-arm64-msvc': 1.12.2 + '@unrs/resolver-binding-win32-ia32-msvc': 1.12.2 + '@unrs/resolver-binding-win32-x64-msvc': 1.12.2 update-browserslist-db@1.2.3(browserslist@4.28.2): dependencies: @@ -10110,6 +10555,14 @@ snapshots: url-join@5.0.0: {} + use-intl@4.13.0(react@19.2.7): + dependencies: + '@formatjs/fast-memoize': 3.1.5 + '@schummar/icu-type-parser': 1.21.5 + icu-minify: 4.13.0 + intl-messageformat: 11.2.7 + react: 19.2.7 + util-deprecate@1.0.2: {} uuid@9.0.1: {} @@ -10157,7 +10610,7 @@ snapshots: vite@5.4.21(@types/node@22.19.19)(terser@5.48.0): dependencies: esbuild: 0.21.5 - postcss: 8.5.14 + postcss: 8.5.15 rollup: 4.60.4 optionalDependencies: '@types/node': 22.19.19 @@ -10233,7 +10686,7 @@ snapshots: acorn-import-phases: 1.0.4(acorn@8.16.0) browserslist: 4.28.2 chrome-trace-event: 1.0.4 - enhanced-resolve: 5.22.0 + enhanced-resolve: 5.22.1 es-module-lexer: 2.1.0 eslint-scope: 5.1.1 events: 3.3.0 @@ -10244,7 +10697,7 @@ snapshots: neo-async: 2.6.2 schema-utils: 4.3.3 tapable: 2.3.3 - terser-webpack-plugin: 5.6.0(webpack@5.106.2) + terser-webpack-plugin: 5.6.1(webpack@5.106.2) watchpack: 2.5.1 webpack-sources: 3.5.0 transitivePeerDependencies: @@ -10299,7 +10752,7 @@ snapshots: isarray: 2.0.5 which-boxed-primitive: 1.1.1 which-collection: 1.0.2 - which-typed-array: 1.1.20 + which-typed-array: 1.1.21 which-collection@1.0.2: dependencies: @@ -10308,7 +10761,7 @@ snapshots: is-weakmap: 2.0.2 is-weakset: 2.0.4 - which-typed-array@1.1.20: + which-typed-array@1.1.21: dependencies: available-typed-arrays: 1.0.7 call-bind: 1.0.9 diff --git a/scripts/e2e-meter-reading-flow.mjs b/scripts/e2e-meter-reading-flow.mjs index 65773a9..401f9e3 100644 --- a/scripts/e2e-meter-reading-flow.mjs +++ b/scripts/e2e-meter-reading-flow.mjs @@ -112,7 +112,7 @@ async function main() { const recipientKeypair = Keypair.random() const meterId = randomUUID() const cooperativeId = randomUUID() - const kwh = 5.0 + const kwh = 6.0 const timestamp = Math.floor(Date.now() / 1000) const meterPubkeyHex = Buffer.from(meterKeypair.rawPublicKey()).toString('hex') diff --git a/scripts/send-reading-pkcs11.mjs b/scripts/send-reading-pkcs11.mjs new file mode 100644 index 0000000..23961e3 --- /dev/null +++ b/scripts/send-reading-pkcs11.mjs @@ -0,0 +1,114 @@ +#!/usr/bin/env node +/** + * scripts/send-reading-pkcs11.mjs + * + * Reference implementation for sending a signed reading using a Hardware HSM (via PKCS#11). + * Specifically tested with YubiKey 5 Series. + * + * Prerequisites: + * 1. Install pkcs11js: `pnpm add pkcs11js` (or npm install) + * 2. Install YKCS11 middleware (see docs/HSM_INTEGRATION.md) + * + * Usage: + * export PKCS11_LIB="/usr/lib/x86_64-linux-gnu/libykcs11.so" + * export PKCS11_PIN="123456" + * node scripts/send-reading-pkcs11.mjs \ + * --meter-id \ + * --kwh 12.5 \ + * --api http://localhost:3000 + */ + +import { createHash } from 'crypto'; +import pkcs11js from 'pkcs11js'; + +const args = process.argv.slice(2); +const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : null }; + +const meterId = get('--meter-id') ?? 'test-meter-id'; +const kwh = parseFloat(get('--kwh') ?? '10'); +const api = get('--api') ?? 'http://localhost:3000'; + +const PKCS11_LIB = process.env.PKCS11_LIB; +const PIN = process.env.PKCS11_PIN; + +if (!PKCS11_LIB || !PIN) { + console.error('Error: PKCS11_LIB and PKCS11_PIN environment variables must be set.'); + process.exit(1); +} + +// --- 1. Compute Canonical Reading Hash --- +const timestamp = Math.floor(Date.now() / 1000); +const kwhStroops = BigInt(Math.round(kwh * 1e7)); + +const meterBytes = Buffer.from(meterId, 'utf8'); +const kwhBuf = Buffer.alloc(8); kwhBuf.writeBigInt64LE(kwhStroops); +const tsBuf = Buffer.alloc(8); tsBuf.writeBigInt64LE(BigInt(timestamp)); +const readingHash = createHash('sha256').update(meterBytes).update(kwhBuf).update(tsBuf).digest(); + +console.log('Reading hash:', readingHash.toString('hex')); + +// --- 2. Sign with Hardware HSM --- +let signatureHex; + +try { + const pkcs11 = new pkcs11js.PKCS11(); + pkcs11.load(PKCS11_LIB); + pkcs11.C_Initialize(); + + // Find slot with YubiKey + const slots = pkcs11.C_GetSlotList(true); + if (slots.length === 0) throw new Error('No PKCS#11 slots found'); + const slot = slots[0]; + + const session = pkcs11.C_OpenSession(slot, pkcs11js.CKF_SERIAL_SESSION | pkcs11js.CKF_RW_SESSION); + pkcs11.C_Login(session, pkcs11js.CKU_USER, PIN); + + // Find the Ed25519 private key + // YubiKey PIV Slot 9c maps to CKA_ID = 02 + pkcs11.C_FindObjectsInit(session, [ + { type: pkcs11js.CKA_CLASS, value: pkcs11js.CKO_PRIVATE_KEY }, + { type: pkcs11js.CKA_ID, value: Buffer.from([0x02]) } + ]); + const keyHandle = pkcs11.C_FindObjects(session, 1)[0]; + pkcs11.C_FindObjectsFinal(session); + + if (!keyHandle) throw new Error('Private key handle not found in slot 9c (ID 02)'); + + // Sign using EdDSA mechanism + pkcs11.C_SignInit(session, { mechanism: pkcs11js.CKM_EDDSA }, keyHandle); + const signature = pkcs11.C_Sign(session, readingHash, Buffer.alloc(64)); + + signatureHex = signature.toString('hex'); + console.log('HSM Signature generated successfully.'); + + pkcs11.C_Logout(session); + pkcs11.C_CloseSession(session); + pkcs11.C_Finalize(); +} catch (err) { + console.error('HSM Signing Error:', err.message); + process.exit(1); +} + +// --- 3. Submit to API --- +const body = { + meter_id: meterId, + kwh, + timestamp, + signature_hex: signatureHex, + nonce: `hsm-${meterId}-${timestamp}-${Math.floor(Math.random() * 1000000)}`, +}; + +console.log('Sending reading to API:', { meterId, kwh, timestamp }); + +try { + const res = await fetch(`${api}/api/readings`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(body), + }); + + const data = await res.json(); + console.log(res.ok ? '✓ Success:' : '✗ Error:', data); +} catch (err) { + console.error('API Error:', err.message); +} diff --git a/scripts/send-reading.mjs b/scripts/send-reading.mjs index 025ff50..f53857e 100644 --- a/scripts/send-reading.mjs +++ b/scripts/send-reading.mjs @@ -47,6 +47,7 @@ const body = { kwh, timestamp, signature_hex: signature.toString('hex'), + nonce: `sim-${meterId}-${timestamp}-${Math.floor(Math.random() * 1000000)}`, } console.log('Sending reading:', { meterId, kwh, timestamp }) diff --git a/supabase/config.toml b/supabase/config.toml index b1f8b20..61f0703 100644 --- a/supabase/config.toml +++ b/supabase/config.toml @@ -23,5 +23,10 @@ file_size_limit = "50MiB" [auth] site_url = "http://localhost:3000" -jwt_expiry = 3600 +# Access token expires after 15 minutes (900 s) +jwt_expiry = 900 +# Refresh token rotation — old token is invalidated on every refresh +refresh_token_rotation_enabled = true +# Reuse interval (seconds): tolerate clock skew / network retries +security_refresh_token_reuse_interval = 10 enable_signup = true diff --git a/supabase/migrations/20240101000005_certificate_retirement.sql b/supabase/migrations/20240101000005_certificate_retirement.sql new file mode 100644 index 0000000..19cc85d --- /dev/null +++ b/supabase/migrations/20240101000005_certificate_retirement.sql @@ -0,0 +1,16 @@ +-- Migration 005: certificate retirement enhancements +-- Adds retire_tx_hash to certificates and a retirement_events audit table + +alter table certificates + add column if not exists retire_tx_hash text; + +create table if not exists retirement_events ( + id uuid primary key default gen_random_uuid(), + certificate_id uuid not null references certificates(id) on delete cascade, + beneficiary text not null, + retire_tx_hash text not null, + kwh numeric(12,4) not null, + retired_at timestamptz not null default now() +); + +create index if not exists retirement_events_certificate_id_idx on retirement_events(certificate_id); diff --git a/supabase/migrations/20260428000009_perf_indexes.sql b/supabase/migrations/20260428000009_perf_indexes.sql new file mode 100644 index 0000000..e8be0ae --- /dev/null +++ b/supabase/migrations/20260428000009_perf_indexes.sql @@ -0,0 +1,10 @@ +-- Migration 009: performance indexes for filtered queries + +create index if not exists readings_meter_id_timestamp_idx + on readings(meter_id, timestamp); + +create index if not exists certificates_status_created_at_idx + on certificates(status, created_at); + +create index if not exists audit_anchors_tx_hash_idx + on audit_anchors(tx_hash); diff --git a/supabase/migrations/20260530000009_meter_revocation.sql b/supabase/migrations/20260530000009_meter_revocation.sql new file mode 100644 index 0000000..5648c61 --- /dev/null +++ b/supabase/migrations/20260530000009_meter_revocation.sql @@ -0,0 +1,14 @@ +-- Migration 009: meter key revocation +-- Adds fields to track revocation of compromised meter keys. + +ALTER TABLE meters +ADD COLUMN revoked_at timestamptz, +ADD COLUMN revocation_reason text; + +-- Index for performance when checking active meters +CREATE INDEX idx_meters_active_revoked ON meters (id) WHERE active = true AND revoked_at IS NULL; + +-- Update existing audit_action enum if it exists (Supabase/Postgres) +-- Note: In Supabase, we often use text for action, but let's check if it's an enum. +-- Based on apps/web/src/lib/audit.ts, it seems to be handled in application logic, +-- but the database table might have a check constraint or just text. diff --git a/supabase/migrations/20260531000003_rls_policies.sql b/supabase/migrations/20260531000003_rls_policies.sql new file mode 100644 index 0000000..b3fc60c --- /dev/null +++ b/supabase/migrations/20260531000003_rls_policies.sql @@ -0,0 +1,68 @@ +-- Migration 003: Row Level Security for multi-tenant isolation +-- Users carry their cooperative_id in JWT app_metadata. +-- The service role key (used by the API) bypasses RLS automatically. + +-- Helper: extract cooperative_id from the current user's JWT app_metadata +create or replace function auth.cooperative_id() returns uuid + language sql stable + as $$ + select nullif( + auth.jwt() -> 'app_metadata' ->> 'cooperative_id', + '' + )::uuid + $$; + +-- Helper: resolve cooperative_id for a reading via its meter +create or replace function auth.reading_cooperative_id(reading_id uuid) returns uuid + language sql stable + as $$ + select m.cooperative_id + from readings r + join meters m on m.id = r.meter_id + where r.id = reading_id + $$; + +-- ── cooperatives ──────────────────────────────────────────────────────────── +alter table cooperatives enable row level security; + +-- Members see only their own cooperative +create policy "members_select_own_cooperative" on cooperatives + for select using (id = auth.cooperative_id()); + +-- Admins (role = 'admin') can do anything +create policy "admin_all_cooperatives" on cooperatives + for all using (auth.jwt() ->> 'role' = 'admin'); + +-- ── meters ────────────────────────────────────────────────────────────────── +alter table meters enable row level security; + +create policy "members_select_own_meters" on meters + for select using (cooperative_id = auth.cooperative_id()); + +create policy "admin_all_meters" on meters + for all using (auth.jwt() ->> 'role' = 'admin'); + +-- ── readings ───────────────────────────────────────────────────────────────── +alter table readings enable row level security; + +-- Readings belong to a cooperative via their meter +create policy "members_select_own_readings" on readings + for select using ( + exists ( + select 1 from meters m + where m.id = readings.meter_id + and m.cooperative_id = auth.cooperative_id() + ) + ); + +create policy "admin_all_readings" on readings + for all using (auth.jwt() ->> 'role' = 'admin'); + +-- ── certificates ───────────────────────────────────────────────────────────── +alter table certificates enable row level security; + +create policy "members_select_own_certificates" on certificates + for select using (cooperative_id = auth.cooperative_id()); + +create policy "admin_all_certificates" on certificates + for all using (auth.jwt() ->> 'role' = 'admin'); diff --git a/supabase/migrations/20260601000000_create_audit_logs.sql b/supabase/migrations/20260601000000_create_audit_logs.sql new file mode 100644 index 0000000..d6de0a4 --- /dev/null +++ b/supabase/migrations/20260601000000_create_audit_logs.sql @@ -0,0 +1,27 @@ +-- audit_logs: append-only audit trail for sensitive operations +-- Retention: minimum 2 years (enforced via Supabase retention policy or pg_cron) + +create table if not exists public.audit_logs ( + id uuid primary key default gen_random_uuid(), + timestamp timestamptz not null default now(), + actor text not null, + action text not null, + resource text not null, + resource_id text, + ip text, + metadata jsonb +); + +-- Append-only: revoke UPDATE and DELETE from all roles +revoke update on public.audit_logs from anon, authenticated, service_role; +revoke delete on public.audit_logs from anon, authenticated, service_role; + +-- Only service_role may insert +revoke insert on public.audit_logs from anon, authenticated; +grant insert on public.audit_logs to service_role; +grant select on public.audit_logs to service_role; + +-- Index for time-range queries +create index if not exists audit_logs_timestamp_idx on public.audit_logs (timestamp desc); +create index if not exists audit_logs_actor_idx on public.audit_logs (actor); +create index if not exists audit_logs_action_idx on public.audit_logs (action); diff --git a/supabase/migrations/20260601000009_multi_meter_support.sql b/supabase/migrations/20260601000009_multi_meter_support.sql new file mode 100644 index 0000000..6b0acb4 --- /dev/null +++ b/supabase/migrations/20260601000009_multi_meter_support.sql @@ -0,0 +1,10 @@ +-- Migration: multi-meter support (grouping and labeling) +-- Closes #138 + +alter table meters + add column if not exists meter_group text, + add column if not exists tags text[] default '{}'; + +-- Index for tags to allow efficient filtering if needed later +create index if not exists idx_meters_tags on meters using gin (tags); +create index if not exists idx_meters_group on meters (meter_group); diff --git a/supabase/migrations/20260601000009_operator_suspended.sql b/supabase/migrations/20260601000009_operator_suspended.sql new file mode 100644 index 0000000..1d7d372 --- /dev/null +++ b/supabase/migrations/20260601000009_operator_suspended.sql @@ -0,0 +1,2 @@ +-- Migration 009: add suspended flag to cooperatives for admin management +alter table cooperatives add column suspended boolean not null default false; diff --git a/supabase/migrations/20260601000009_revoked_tokens.sql b/supabase/migrations/20260601000009_revoked_tokens.sql new file mode 100644 index 0000000..6677a65 --- /dev/null +++ b/supabase/migrations/20260601000009_revoked_tokens.sql @@ -0,0 +1,22 @@ +-- Token revocation list +-- Stores JTI (JWT ID) of revoked access tokens so compromised tokens can be +-- rejected before their 15-minute expiry window closes. +create table if not exists public.revoked_tokens ( + jti text primary key, + revoked_at timestamptz not null default now(), + -- Automatically purge rows after the max access-token lifetime (15 min) + expires_at timestamptz not null +); + +-- Index for fast lookup on every authenticated request +create index if not exists revoked_tokens_expires_at_idx on public.revoked_tokens (expires_at); + +-- RLS: only service-role can insert/delete; no row is readable by end users +alter table public.revoked_tokens enable row level security; + +create policy "service role only" on public.revoked_tokens + using (false); -- deny all; service role bypasses RLS + +-- Scheduled cleanup: remove expired entries (run via pg_cron or Supabase scheduled functions) +-- Example: select cron.schedule('purge-revoked-tokens', '*/15 * * * *', +-- $$delete from public.revoked_tokens where expires_at < now()$$); diff --git a/supabase/migrations/20260602000009_meter_api_keys.sql b/supabase/migrations/20260602000009_meter_api_keys.sql new file mode 100644 index 0000000..06e80f9 --- /dev/null +++ b/supabase/migrations/20260602000009_meter_api_keys.sql @@ -0,0 +1,21 @@ +-- Migration 009: API keys for meter device authentication (#131) +-- +-- Each meter is issued a unique random API key on registration. +-- The key is validated by the readings endpoint before Ed25519 signature check. +-- Keys can be rotated (new key generated) without changing the Ed25519 keypair. +-- Revoking a key (setting it NULL) immediately rejects submissions from that meter. + +alter table meters + add column api_key text unique; + +-- Backfill existing meters with generated keys +update meters + set api_key = 'mk_' || encode(gen_random_bytes(32), 'hex') + where api_key is null; + +-- Enforce NOT NULL going forward +alter table meters + alter column api_key set not null; + +comment on column meters.api_key is + 'API key issued to the meter device. Validated before Ed25519 signature check. Rotate via PATCH /api/meters/{id}/rotate-key. Set to empty string to revoke.'; diff --git a/supabase/migrations/20260602000010_public_verify_rls.sql b/supabase/migrations/20260602000010_public_verify_rls.sql new file mode 100644 index 0000000..c4fce97 --- /dev/null +++ b/supabase/migrations/20260602000010_public_verify_rls.sql @@ -0,0 +1,18 @@ +-- Migration 010: Public read access for the certificate verifier (#134) +-- +-- The public /api/verify endpoint allows anyone (no auth) to look up a +-- certificate by ID, reading_hash, or mint_tx_hash. Since we are switching +-- that endpoint from the service-role key to the anon key, we need explicit +-- RLS policies granting anonymous SELECT on the relevant tables. +-- +-- Only SELECT is allowed; INSERT/UPDATE/DELETE remain operator-only. + +create policy "public: read certificates for verify" + on certificates for select + to anon + using (true); + +create policy "public: read readings for verify" + on readings for select + to anon + using (true); diff --git a/supabase/migrations/rollbacks/20260428000009_perf_indexes.down.sql b/supabase/migrations/rollbacks/20260428000009_perf_indexes.down.sql new file mode 100644 index 0000000..748445e --- /dev/null +++ b/supabase/migrations/rollbacks/20260428000009_perf_indexes.down.sql @@ -0,0 +1,3 @@ +drop index if exists readings_meter_id_timestamp_idx; +drop index if exists certificates_status_created_at_idx; +drop index if exists audit_anchors_tx_hash_idx; diff --git a/supabase/migrations/rollbacks/20260601000009_revoked_tokens.down.sql b/supabase/migrations/rollbacks/20260601000009_revoked_tokens.down.sql new file mode 100644 index 0000000..4c3a1be --- /dev/null +++ b/supabase/migrations/rollbacks/20260601000009_revoked_tokens.down.sql @@ -0,0 +1 @@ +drop table if exists public.revoked_tokens; diff --git a/supabase/migrations/rollbacks/20260602000009_meter_api_keys.down.sql b/supabase/migrations/rollbacks/20260602000009_meter_api_keys.down.sql new file mode 100644 index 0000000..fe52952 --- /dev/null +++ b/supabase/migrations/rollbacks/20260602000009_meter_api_keys.down.sql @@ -0,0 +1 @@ +alter table meters drop column if exists api_key; diff --git a/supabase/migrations/rollbacks/20260602000010_public_verify_rls.down.sql b/supabase/migrations/rollbacks/20260602000010_public_verify_rls.down.sql new file mode 100644 index 0000000..ab467d6 --- /dev/null +++ b/supabase/migrations/rollbacks/20260602000010_public_verify_rls.down.sql @@ -0,0 +1,2 @@ +drop policy if exists "public: read certificates for verify" on certificates; +drop policy if exists "public: read readings for verify" on readings; diff --git a/supabase/tests/rls_policies.sql b/supabase/tests/rls_policies.sql new file mode 100644 index 0000000..4eb66eb --- /dev/null +++ b/supabase/tests/rls_policies.sql @@ -0,0 +1,97 @@ +-- RLS Policy Tests for issue #274 +-- Run in Supabase SQL editor or via psql. +-- Uses set_config to simulate JWT claims without a real auth session. +-- +-- Seed UUIDs (from seed.sql): +-- cooperative A: 00000000-0000-0000-0000-000000000001 +-- cooperative B: 00000000-0000-0000-0000-000000000002 (created below) +-- meter A: 00000000-0000-0000-0000-000000000010 + +-- ── Setup: second cooperative + meter for isolation tests ──────────────────── +insert into cooperatives (id, name, admin_address) values + ('00000000-0000-0000-0000-000000000002', 'Other Cooperative', + 'GOTHER1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX') + on conflict (id) do nothing; + +insert into meters (id, cooperative_id, serial_number, pubkey_hex) values + ('00000000-0000-0000-0000-000000000020', + '00000000-0000-0000-0000-000000000002', + 'METER-002', + '0000000000000000000000000000000000000000000000000000000000000001') + on conflict (id) do nothing; + +-- ── Helper: simulate a JWT for a cooperative member ────────────────────────── +-- Usage: call set_claim('') then run your query. +create or replace function tests.set_claim(coop_id text, role text default 'authenticated') + returns void language plpgsql as $$ + begin + perform set_config( + 'request.jwt.claims', + json_build_object( + 'sub', 'test-user', + 'role', role, + 'app_metadata', json_build_object('cooperative_id', coop_id) + )::text, + true -- local to transaction + ); + end; +$$; + +-- ── Test 1: member of coop A sees only coop A's cooperative row ────────────── +do $$ +declare + cnt int; +begin + perform tests.set_claim('00000000-0000-0000-0000-000000000001'); + select count(*) into cnt from cooperatives; + assert cnt = 1, format('Test 1 FAIL: expected 1 cooperative, got %s', cnt); + raise notice 'Test 1 PASS: member sees only own cooperative'; +end $$; + +-- ── Test 2: member of coop A sees only coop A's meters ────────────────────── +do $$ +declare + cnt int; +begin + perform tests.set_claim('00000000-0000-0000-0000-000000000001'); + select count(*) into cnt from meters; + assert cnt = 1, format('Test 2 FAIL: expected 1 meter, got %s', cnt); + raise notice 'Test 2 PASS: member sees only own meters'; +end $$; + +-- ── Test 3: member of coop A cannot see coop B's meters ───────────────────── +do $$ +declare + cnt int; +begin + perform tests.set_claim('00000000-0000-0000-0000-000000000001'); + select count(*) into cnt from meters + where cooperative_id = '00000000-0000-0000-0000-000000000002'; + assert cnt = 0, format('Test 3 FAIL: expected 0 cross-tenant meters, got %s', cnt); + raise notice 'Test 3 PASS: member cannot see other cooperative meters'; +end $$; + +-- ── Test 4: admin role sees all cooperatives ───────────────────────────────── +do $$ +declare + cnt int; +begin + perform tests.set_claim('00000000-0000-0000-0000-000000000001', 'admin'); + select count(*) into cnt from cooperatives; + assert cnt >= 2, format('Test 4 FAIL: admin expected >= 2 cooperatives, got %s', cnt); + raise notice 'Test 4 PASS: admin sees all cooperatives'; +end $$; + +-- ── Test 5: admin role sees all meters ─────────────────────────────────────── +do $$ +declare + cnt int; +begin + perform tests.set_claim('00000000-0000-0000-0000-000000000001', 'admin'); + select count(*) into cnt from meters; + assert cnt >= 2, format('Test 5 FAIL: admin expected >= 2 meters, got %s', cnt); + raise notice 'Test 5 PASS: admin sees all meters'; +end $$; + +-- ── Cleanup ────────────────────────────────────────────────────────────────── +drop function if exists tests.set_claim(text, text); diff --git a/turbo.json b/turbo.json index 8a533ca..b537bb0 100644 --- a/turbo.json +++ b/turbo.json @@ -11,10 +11,14 @@ "inputs": ["$TURBO_DEFAULT$", ".env*"], "outputs": [".next/**", "!.next/cache/**", "dist/**"] }, - "dev": { "cache": false, "persistent": true }, + "dev": { "cache": false "persistent": true}, "lint": { "dependsOn": ["^lint"] }, "type-check": { "dependsOn": ["^type-check"] }, - "test": { "cache": false }, + "test": { + "dependsOn": ["^build"], + "inputs": ["$TURBO_DEFAULT$"], + "outputs": ["coverage/**"] + }, "clean": { "cache": false } } }