Fix/security and configuration issues (#149)

* Remove ephemeral keypair fallback in stellar service The service previously generated a random keypair when KEEPER_SECRET_KEY was unset, creating an unfunded account that would fail all contract invocations. This made the entire Soroban interaction layer non-functional in that configuration. Changes: - Throw explicit error on startup if KEEPER_SECRET_KEY is missing - Remove Keypair.random() fallback path - Update .env.example with detailed instructions for generating and funding a testnet keypair

* Secure AviationStack API communication The flight delay oracle was transmitting the API key over plain HTTP in the URL query string, exposing it to network intermediaries. Changes: - Switch from http:// to https:// for TLS encryption - Move API key from URL query parameter to Authorization header - Prevents key exposure in URL logs and network traces

* Implement rate limiting with memory-safe throttle guard The API was previously unthrottled, making brute-force attacks and denial-of-service trivial. The ThrottleGuard was defined but never registered, and the in-memory Map leaked entries for IPs that stopped making requests. Changes: - Create ThrottleGuard with 60 requests per minute per IP limit - Add periodic cleanup timer to evict stale entries and prevent unbounded memory growth - Register guard globally in main.ts to protect all routes - Return HTTP 429 with retryAfter header when limit exceeded

---------

Co-authored-by: Developer <developer@remitlend.local>

Author: devmocrea

.env.example

@@ -19,7 +19,16 @@ STELLAR_RPC_URL="https://soroban-testnet.stellar.org"
 STELLAR_NETWORK="testnet"
 
 # Secret key for the keeper account that submits oracle data and triggers claims — REQUIRED
-# Generate with: stellar keys generate keeper --network testnet
+# This account must be funded on the network before the service can submit transactions.
+#
+# To generate and fund a testnet keypair:
+#   1. Generate: stellar keys generate keeper --network testnet
+#   2. Fund the account: Visit https://laboratory.stellar.org/#account-creator
+#      or use: curl "https://friendbot.stellar.org?addr=<PUBLIC_KEY>"
+#   3. Verify balance: stellar account <PUBLIC_KEY> --network testnet
+#
+# The keeper account signs all oracle submissions and claim payouts. Without a valid
+# funded keypair, all Soroban contract invocations will fail with "account not found".
 KEEPER_SECRET_KEY="S..."
 
 # Contract IDs for deployed Soroban contracts (set after deploy_testnet.sh)

src/common/guards/throttle.guard.ts

@@ -0,0 +1,72 @@
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  HttpException,
+  HttpStatus,
+} from '@nestjs/common';
+import { Request } from 'express';
+
+interface RequestWindow {
+  count: number;
+  windowStart: number;
+}
+
+@Injectable()
+export class ThrottleGuard implements CanActivate {
+  private readonly requests = new Map<string, RequestWindow>();
+  private readonly MAX_REQUESTS = 60;
+  private readonly TIME_WINDOW_MS = 60_000;
+
+  constructor() {
+    setInterval(() => {
+      const now = Date.now();
+      for (const [ip, window] of this.requests) {
+        if (now - window.windowStart > this.TIME_WINDOW_MS) {
+          this.requests.delete(ip);
+        }
+      }
+    }, this.TIME_WINDOW_MS).unref();
+  }
+
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<Request>();
+    const ip = this.extractIP(request);
+    const now = Date.now();
+
+    const window = this.requests.get(ip);
+
+    if (!window || now - window.windowStart > this.TIME_WINDOW_MS) {
+      this.requests.set(ip, { count: 1, windowStart: now });
+      return true;
+    }
+
+    if (window.count >= this.MAX_REQUESTS) {
+      const retryAfter = Math.ceil(
+        (window.windowStart + this.TIME_WINDOW_MS - now) / 1000,
+      );
+      throw new HttpException(
+        {
+          statusCode: HttpStatus.TOO_MANY_REQUESTS,
+          message: 'Too many requests. Please try again later.',
+          retryAfter,
+        },
+        HttpStatus.TOO_MANY_REQUESTS,
+        {
+          cause: { retryAfter },
+        },
+      );
+    }
+
+    window.count++;
+    return true;
+  }
+
+  private extractIP(request: Request): string {
+    const forwarded = request.headers['x-forwarded-for'];
+    if (typeof forwarded === 'string') {
+      return forwarded.split(',')[0].trim();
+    }
+    return request.ip ?? request.socket.remoteAddress ?? 'unknown';
+  }
+}

src/main.ts

@@ -4,6 +4,7 @@ import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
 import { AppModule } from './app.module';
 import { GlobalExceptionFilter } from './common/filters/http-exception.filter';
 import { LoggingInterceptor } from './common/interceptors/logging.interceptor';
+import { ThrottleGuard } from './common/guards/throttle.guard';
 import helmet from 'helmet';
 import { ConfigService } from '@nestjs/config';
 
@@ -31,6 +32,9 @@ async function bootstrap() {
   // Global interceptors
   app.useGlobalInterceptors(new LoggingInterceptor());
 
+  // Global guards
+  app.useGlobalGuards(new ThrottleGuard());
+
   // Global validation pipe
   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
 

src/oracle/oracle.service.ts

@@ -256,10 +256,15 @@ export class OracleService {
         "AviationStack API is not configured.",
       );
     }
-    const url = `http://api.aviationstack.com/v1/flights?access_key=${apiKey}&flight_iata=${flightNumber}&flight_date=${date}`;
+    const url = `https://api.aviationstack.com/v1/flights?flight_iata=${flightNumber}&flight_date=${date}`;
     const res = await axios.get<{
       data: Array<{ departure: { delay: number } }>;
-    }>(url, { timeout: 10_000 });
+    }>(url, { 
+      timeout: 10_000,
+      headers: {
+        'Authorization': `Bearer ${apiKey}`
+      }
+    });
     const delay = res.data.data?.[0]?.departure?.delay ?? 0;
 
     const oracleReading: OracleReading = {

src/stellar/stellar.service.ts

@@ -37,8 +37,14 @@ export class StellarService {
       config.get<string>("STELLAR_NETWORK") === "mainnet"
         ? Networks.PUBLIC
         : Networks.TESTNET;
-    const secret = config.get<string>("KEEPER_SECRET_KEY") ?? "";
-    this.keeperKeypair = secret ? Keypair.fromSecret(secret) : Keypair.random();
+    const secret = config.get<string>("KEEPER_SECRET_KEY");
+    if (!secret) {
+      throw new Error(
+        "KEEPER_SECRET_KEY environment variable is required. " +
+        "Generate a testnet keypair with: stellar keys generate keeper --network testnet"
+      );
+    }
+    this.keeperKeypair = Keypair.fromSecret(secret);
   }
 
   /** Simulate a read-only contract invocation and return the result XDR. */