Merge pull request #732 from NickiM84/fix/nickim84-issues-655-657-662-665

fix: bound chat storage (#655), decimal-safe wallet amounts (#657), raw-body webhook verification (#662), payments constructor integrity (#665)

Author: MaryammAli

BackendAcademy/src/chat/chat.controller.ts

@@ -1,8 +1,9 @@
-import { Controller, Get, Post, Body, Param } from '@nestjs/common';
+import { Controller, Get, Post, Body, Param, Query } from '@nestjs/common';
 import { ChatService } from './chat.service';
 import { CreateMessageDto } from './dto/create-message.dto';
 import { CreateRoomDto } from './dto/create-room.dto';
 import { ShareCodeSnippetDto } from './dto/share-code-snippet.dto';
+import { PageOptions } from './repositories/chat.repository.interface';
 
 @Controller('chat')
 export class ChatController {
@@ -14,8 +15,15 @@ export class ChatController {
   }
 
   @Get('rooms')
-  findAllRooms() {
-    return this.chatService.findAllRooms();
+  findAllRooms(
+    @Query('limit') limit?: string,
+    @Query('cursor') cursor?: string,
+  ) {
+    const options: PageOptions = {
+      limit: limit ? Number(limit) : undefined,
+      cursor,
+    };
+    return this.chatService.findAllRooms(options);
   }
 
   @Get('rooms/:roomId')
@@ -29,8 +37,16 @@ export class ChatController {
   }
 
   @Get('rooms/:roomId/messages')
-  findMessagesByRoom(@Param('roomId') roomId: string) {
-    return this.chatService.findMessagesByRoom(roomId);
+  findMessagesByRoom(
+    @Param('roomId') roomId: string,
+    @Query('limit') limit?: string,
+    @Query('cursor') cursor?: string,
+  ) {
+    const options: PageOptions = {
+      limit: limit ? Number(limit) : undefined,
+      cursor,
+    };
+    return this.chatService.findMessagesByRoom(roomId, options);
   }
 
   @Post('messages/share-code')

BackendAcademy/src/chat/chat.service.spec.ts

@@ -1,9 +1,16 @@
-import { HttpException, HttpStatus } from '@nestjs/common';
+import { ForbiddenException, HttpException, HttpStatus, NotFoundException } from '@nestjs/common';
 import { ChatService } from './chat.service';
 import {
   ChatRateLimiter,
   DEFAULT_CHAT_RATE_LIMIT,
 } from './chat-rate-limit';
+import { InMemoryChatRepository } from './repositories/chat.repository.in-memory';
+
+/** Creates a room and returns its id. */
+function createRoom(service: ChatService, participants: string[], name = 'room-1'): string {
+  const room = service.createRoom({ name, type: 'room', participants });
+  return room.id;
+}
 
 describe('ChatRateLimiter', () => {
   it('allows messages up to the configured limit then blocks', () => {
@@ -43,9 +50,10 @@ describe('ChatRateLimiter', () => {
 describe('ChatService rate limiting', () => {
   it('rejects messages once a session exceeds the limit', () => {
     const service = new ChatService();
+    const roomId = createRoom(service, ['spammer']);
     const send = () =>
       service.createMessage({
-        roomId: 'room-1',
+        roomId,
         senderId: 'spammer',
         content: 'hi',
       });
@@ -66,17 +74,18 @@ describe('ChatService rate limiting', () => {
 
   it('shares the limit across createMessage and shareCodeSnippet', () => {
     const service = new ChatService();
+    const roomId = createRoom(service, ['user-1']);
     for (let i = 0; i < DEFAULT_CHAT_RATE_LIMIT.maxMessages; i++) {
       service.createMessage({
-        roomId: 'room-1',
+        roomId,
         senderId: 'user-1',
         content: 'hi',
       });
     }
 
     expect(() =>
       service.shareCodeSnippet({
-        roomId: 'room-1',
+        roomId,
         senderId: 'user-1',
         content: 'snippet',
         code: 'fn main() {}',
@@ -89,9 +98,10 @@ describe('ChatService rate limiting', () => {
 describe('ChatService code snippet sharing', () => {
   it('creates a shared code snippet message with metadata', () => {
     const service = new ChatService();
+    const roomId = createRoom(service, ['user-1']);
 
     const result = service.shareCodeSnippet({
-      roomId: 'room-1',
+      roomId,
       senderId: 'user-1',
       content: 'Shared a Rust snippet',
       code: 'fn main() { println!("hi"); }',
@@ -100,7 +110,7 @@ describe('ChatService code snippet sharing', () => {
     });
 
     expect(result).toMatchObject({
-      roomId: 'room-1',
+      roomId,
       senderId: 'user-1',
       content: 'Shared a Rust snippet',
       codeSnippet: {
@@ -110,12 +120,177 @@ describe('ChatService code snippet sharing', () => {
       },
     });
 
-    const roomMessages = service.findMessagesByRoom('room-1');
-    expect(roomMessages).toHaveLength(1);
-    expect(roomMessages[0].codeSnippet).toEqual({
+    const roomMessages = service.findMessagesByRoom(roomId);
+    expect(roomMessages.items).toHaveLength(1);
+    expect(roomMessages.items[0].codeSnippet).toEqual({
       code: 'fn main() { println!("hi"); }',
       language: 'rust',
       title: 'Hello World',
     });
   });
 });
+
+describe('ChatService authorization (#655)', () => {
+  it('rejects messages for a room that does not exist', () => {
+    const service = new ChatService();
+    expect(() =>
+      service.createMessage({
+        roomId: 'missing-room',
+        senderId: 'user-1',
+        content: 'hi',
+      }),
+    ).toThrow(NotFoundException);
+  });
+
+  it('rejects messages from a sender who is not a room participant', () => {
+    const service = new ChatService();
+    const roomId = createRoom(service, ['alice']);
+
+    expect(() =>
+      service.createMessage({
+        roomId,
+        senderId: 'mallory',
+        content: 'hi',
+      }),
+    ).toThrow(ForbiddenException);
+  });
+
+  it('rejects code snippets from a sender who is not a room participant', () => {
+    const service = new ChatService();
+    const roomId = createRoom(service, ['alice']);
+
+    expect(() =>
+      service.shareCodeSnippet({
+        roomId,
+        senderId: 'mallory',
+        content: 'snippet',
+        code: 'fn main() {}',
+        language: 'rust',
+      }),
+    ).toThrow(ForbiddenException);
+  });
+
+  it('rejects reading messages for a room that does not exist', () => {
+    const service = new ChatService();
+    expect(() => service.findMessagesByRoom('missing-room')).toThrow(
+      NotFoundException,
+    );
+  });
+
+  it('allows participants to post to a room', () => {
+    const service = new ChatService();
+    const roomId = createRoom(service, ['alice', 'bob']);
+
+    const msg = service.createMessage({
+      roomId,
+      senderId: 'bob',
+      content: 'hello alice',
+    });
+    expect(msg.senderId).toBe('bob');
+  });
+});
+
+describe('ChatService pagination (#655)', () => {
+  it('pages messages with a stable cursor', () => {
+    const service = new ChatService();
+    const roomId = createRoom(service, ['user-1']);
+    for (let i = 0; i < 5; i++) {
+      service.createMessage({ roomId, senderId: 'user-1', content: `msg-${i}` });
+    }
+
+    const page1 = service.findMessagesByRoom(roomId, { limit: 2 });
+    expect(page1.items).toHaveLength(2);
+    expect(page1.nextCursor).toBeDefined();
+
+    const page2 = service.findMessagesByRoom(roomId, {
+      limit: 2,
+      cursor: page1.nextCursor,
+    });
+    expect(page2.items).toHaveLength(2);
+    expect(page2.nextCursor).toBeDefined();
+
+    const page3 = service.findMessagesByRoom(roomId, {
+      limit: 2,
+      cursor: page2.nextCursor,
+    });
+    expect(page3.items).toHaveLength(1);
+    expect(page3.nextCursor).toBeUndefined();
+  });
+
+  it('pages rooms newest first', () => {
+    const service = new ChatService();
+    createRoom(service, ['u1'], 'room-a');
+    createRoom(service, ['u2'], 'room-b');
+    createRoom(service, ['u3'], 'room-c');
+
+    const page1 = service.findAllRooms({ limit: 2 });
+    expect(page1.items).toHaveLength(2);
+    expect(page1.nextCursor).toBeDefined();
+
+    const page2 = service.findAllRooms({ limit: 2, cursor: page1.nextCursor });
+    expect(page2.items).toHaveLength(1);
+    expect(page2.nextCursor).toBeUndefined();
+  });
+});
+
+describe('ChatService bounded storage (#655)', () => {
+  it('evicts the oldest messages once a room exceeds its bound', () => {
+    const repository = new InMemoryChatRepository({
+      maxRooms: 10,
+      maxMessagesPerRoom: 3,
+      roomTtlMs: 60_000,
+      messageTtlMs: 60_000,
+    });
+    const service = new ChatService(undefined, repository);
+    const roomId = createRoom(service, ['user-1']);
+
+    for (let i = 0; i < 5; i++) {
+      service.createMessage({ roomId, senderId: 'user-1', content: `msg-${i}` });
+    }
+
+    const { items } = service.findMessagesByRoom(roomId);
+    expect(items).toHaveLength(3);
+    // Oldest messages were evicted first.
+    expect(items.map((m) => m.content)).toEqual(['msg-2', 'msg-3', 'msg-4']);
+  });
+
+  it('evicts the oldest room (and its messages) once the room bound is exceeded', () => {
+    const repository = new InMemoryChatRepository({
+      maxRooms: 2,
+      maxMessagesPerRoom: 10,
+      roomTtlMs: 60_000,
+      messageTtlMs: 60_000,
+    });
+    const service = new ChatService(undefined, repository);
+
+    const room1 = createRoom(service, ['u1'], 'room-1');
+    service.createMessage({ roomId: room1, senderId: 'u1', content: 'hi' });
+    const room2 = createRoom(service, ['u2'], 'room-2');
+    const room3 = createRoom(service, ['u3'], 'room-3');
+
+    expect(service.findRoomById(room1)).toBeUndefined();
+    expect(service.findRoomById(room2)).toBeDefined();
+    expect(service.findRoomById(room3)).toBeDefined();
+    // Messages of the evicted room are gone too.
+    expect(repository.messageCount).toBe(0);
+  });
+
+  it('prunes messages and rooms past their retention window', () => {
+    const repository = new InMemoryChatRepository({
+      maxRooms: 10,
+      maxMessagesPerRoom: 10,
+      roomTtlMs: 1_000,
+      messageTtlMs: 1_000,
+    });
+    const service = new ChatService(undefined, repository);
+    const roomId = createRoom(service, ['user-1']);
+    service.createMessage({ roomId, senderId: 'user-1', content: 'hi' });
+
+    // A "now" far in the future expires everything.
+    service.pruneExpired(new Date(Date.now() + 60_000));
+
+    expect(repository.messageCount).toBe(0);
+    expect(repository.roomCount).toBe(0);
+    expect(service.findRoomById(roomId)).toBeUndefined();
+  });
+});