fix: address critical security issues #326 #327 #328 #329 (#355)

- Issue #326: Changed getPoolAvailableBalance to throw error instead of returning Infinity on RPC failure
  This prevents bypassing liquidity validation when Stellar RPC is down

- Issue #327: Migrated OperatorAuthGuard rate limiting from in-memory Map to Redis
  Rate limit failures now persist across server restarts, making brute-force protection more effective

- Issue #328: Reduced JWT token expiry from 7 days to 1 hour
  Shorter token lifetime reduces the window of unauthorized access if a token is compromised

- Issue #329: Updated startup validation to require at least one of ORACLE_OPERATOR_API_KEY or ADMIN_API_KEY
  Previously only ORACLE_OPERATOR_API_KEY was validated, but the guard falls back to ADMIN_API_KEY

Additional changes:
- Created RedisModule as a global module for Redis client injection
- Updated OperatorAuthGuard.canActivate to be async to support Redis operations

Co-authored-by: presidojay1 <305481097+boluwacodes@users.noreply.github.com>

Author: Smoothjane

src/app.module.ts

@@ -11,6 +11,7 @@ import { StellarModule } from './stellar/stellar.module';
 import { PrismaModule }  from './prisma/prisma.module';
 import { AuthModule }    from './auth/auth.module';
 import { HealthModule }  from './health/health.module';
+import { RedisModule }   from './redis/redis.module';
 
 /**
  * Validate loaded environment configuration at startup.
@@ -73,6 +74,7 @@ function validateConfig(config: Record<string, unknown>) {
         storage: new ThrottlerStorageRedisService(config.get<string>('REDIS_URL') || 'redis://localhost:6379'),
       }),
     }),
+    RedisModule,
     PrismaModule,
     StellarModule,
     AuthModule,

src/auth/jwt.service.ts

@@ -13,15 +13,16 @@ export interface JwtPayload {
 /**
  * JwtService — issues and verifies JWTs tied to Stellar wallet addresses.
  *
- * Tokens are signed with JWT_SECRET from the environment and expire in 7 days.
- * The token payload contains the wallet address, which is used to identify
- * the authenticated user on protected endpoints.
+ * Tokens are signed with JWT_SECRET from the environment and expire in 1 hour.
+ * For a financial application, short-lived tokens reduce the window of
+ * unauthorized access if a token is compromised. Consider implementing
+ * refresh tokens for longer sessions.
  */
 @Injectable()
 export class JwtService {
   private readonly logger = new Logger(JwtService.name);
   private readonly secret: string;
-  private readonly tokenExpiry = "7d";
+  private readonly tokenExpiry = "1h";
 
   constructor(private readonly config: ConfigService) {
     const secret = config.get<string>("JWT_SECRET");
@@ -38,13 +39,13 @@ export class JwtService {
 
   /**
    * Sign a JWT for the given wallet address.
-   * Token expires in 7 days.
+   * Token expires in 1 hour.
    */
   sign(walletAddress: string): string {
     const payload: JwtPayload = { walletAddress };
     const options: jwt.SignOptions = {
       algorithm: 'HS256',
-      expiresIn: '7d',
+      expiresIn: '1h',
     };
     const token = jwt.sign(payload, this.secret, options);
     this.logger.log(`JWT issued for wallet: ${walletAddress}`);
@@ -54,13 +55,13 @@ export class JwtService {
   /**
    * Sign a JWT for the given wallet address with explicit role and admin flag.
    * Useful for issuing tokens to privileged users (e.g. operators, admins).
-   * Token expires in 7 days.
+   * Token expires in 1 hour.
    */
   signWithRole(walletAddress: string, role: string, admin = false): string {
     const payload: JwtPayload = { walletAddress, role, admin };
     const options: jwt.SignOptions = {
       algorithm: 'HS256',
-      expiresIn: '7d',
+      expiresIn: '1h',
     };
     const token = jwt.sign(payload, this.secret, options);
     this.logger.log(`JWT issued for wallet: ${walletAddress} (role=${role})`);

src/auth/operator-auth.guard.ts

@@ -1,8 +1,9 @@
-import { CanActivate, ExecutionContext, Injectable, InternalServerErrorException, UnauthorizedException, HttpException, HttpStatus } from '@nestjs/common';
+import { CanActivate, ExecutionContext, Injectable, InternalServerErrorException, UnauthorizedException, HttpException, HttpStatus, Inject } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { timingSafeEqual } from 'crypto';
 import { JwtService } from './jwt.service';
 import { AuthenticatedRequest } from './authenticated-request';
+import Redis from 'ioredis';
 
 interface FailureRecord {
   count: number;
@@ -11,56 +12,60 @@ interface FailureRecord {
 
 const RATE_LIMIT_WINDOW_MS = 60_000;  // 1 minute
 const RATE_LIMIT_MAX_FAILURES = 5;
+const REDIS_KEY_PREFIX = 'auth:operator:failures:';
 
 @Injectable()
 export class OperatorAuthGuard implements CanActivate {
-  private readonly failureMap = new Map<string, FailureRecord>();
-
   constructor(
     private readonly config: ConfigService,
     private readonly jwtService: JwtService,
+    @Inject('REDIS_CLIENT') private readonly redis: Redis,
   ) {}
 
-  canActivate(context: ExecutionContext): boolean {
+  async canActivate(context: ExecutionContext): Promise<boolean> {
     const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
     const ip = this.getClientIp(request);
 
-    this.checkRateLimit(ip);
+    await this.checkRateLimit(ip);
 
     if (this.hasValidApiKey(request)) {
-      this.resetFailures(ip);
+      await this.resetFailures(ip);
       return true;
     }
 
     const token = this.getOptionalBearerToken(request);
     if (!token) {
-      this.recordFailure(ip);
+      await this.recordFailure(ip);
       throw new UnauthorizedException('Operator API key or admin bearer token required');
     }
 
     try {
       const payload = this.jwtService.verify(token);
       if (payload.admin !== true && payload.role !== 'admin') {
-        this.recordFailure(ip);
+        await this.recordFailure(ip);
         throw new UnauthorizedException('Admin bearer token required');
       }
-      this.resetFailures(ip);
+      await this.resetFailures(ip);
       request.wallet = payload.walletAddress;
       request.user = payload;
       return true;
     } catch (err) {
       if (err instanceof UnauthorizedException) throw err;
-      this.recordFailure(ip);
+      await this.recordFailure(ip);
       throw new UnauthorizedException('Invalid bearer token');
     }
   }
 
-  private checkRateLimit(ip: string): void {
-    const record = this.failureMap.get(ip);
-    if (!record) return;
+  private async checkRateLimit(ip: string): Promise<void> {
+    const key = `${REDIS_KEY_PREFIX}${ip}`;
+    const recordStr = await this.redis.get(key);
+    
+    if (!recordStr) return;
 
+    const record: FailureRecord = JSON.parse(recordStr);
+    
     if (Date.now() > record.resetAt) {
-      this.failureMap.delete(ip);
+      await this.redis.del(key);
       return;
     }
 
@@ -72,19 +77,30 @@ export class OperatorAuthGuard implements CanActivate {
     }
   }
 
-  private recordFailure(ip: string): void {
+  private async recordFailure(ip: string): Promise<void> {
+    const key = `${REDIS_KEY_PREFIX}${ip}`;
     const now = Date.now();
-    const existing = this.failureMap.get(ip);
+    const recordStr = await this.redis.get(key);
 
-    if (!existing || now > existing.resetAt) {
-      this.failureMap.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
+    if (!recordStr) {
+      const newRecord: FailureRecord = { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS };
+      await this.redis.set(key, JSON.stringify(newRecord), 'PX', RATE_LIMIT_WINDOW_MS);
     } else {
-      existing.count += 1;
+      const record: FailureRecord = JSON.parse(recordStr);
+      if (now > record.resetAt) {
+        const newRecord: FailureRecord = { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS };
+        await this.redis.set(key, JSON.stringify(newRecord), 'PX', RATE_LIMIT_WINDOW_MS);
+      } else {
+        record.count += 1;
+        const ttl = record.resetAt - now;
+        await this.redis.set(key, JSON.stringify(record), 'PX', Math.max(ttl, 1000));
+      }
     }
   }
 
-  private resetFailures(ip: string): void {
-    this.failureMap.delete(ip);
+  private async resetFailures(ip: string): Promise<void> {
+    const key = `${REDIS_KEY_PREFIX}${ip}`;
+    await this.redis.del(key);
   }
 
   private getClientIp(request: AuthenticatedRequest): string {

src/main.ts

@@ -52,8 +52,10 @@ async function bootstrap() {
   }
 
   const operatorApiKey = configService.get<string>('ORACLE_OPERATOR_API_KEY');
-  if (!operatorApiKey) {
-    logger.error('Fatal Error: ORACLE_OPERATOR_API_KEY environment variable is required');
+  const adminApiKey = configService.get<string>('ADMIN_API_KEY');
+  
+  if (!operatorApiKey && !adminApiKey) {
+    logger.error('Fatal Error: At least one of ORACLE_OPERATOR_API_KEY or ADMIN_API_KEY environment variables is required');
     process.exit(1);
   }
 

src/policy/policy.service.ts

@@ -144,6 +144,7 @@ export class PolicyService {
    * POLICY_ENGINE_CONTRACT account, which holds the pooled collateral.
    * Returns the balance as a number (in XLM-equivalent units, 7-decimal fixed point).
    * Returns Infinity when the contract is not configured so tests are unaffected.
+   * Throws an error when RPC fails to prevent invalid liquidity validation.
    */
   async getPoolAvailableBalance(): Promise<number> {
     const usdcContract = this.config.get<string>('USDC_CONTRACT');
@@ -159,22 +160,22 @@ export class PolicyService {
       const simResult = await this.stellar.simulateInvoke(usdcContract, 'balance', [engineAddress]);
 
       if (StellarRpc.Api.isSimulationError(simResult)) {
-        this.logger.warn(`Pool balance simulation error: ${simResult.error}`);
-        return Infinity;
+        this.logger.error(`Pool balance simulation error: ${simResult.error}`);
+        throw new Error(`Failed to fetch pool balance: simulation error - ${simResult.error}`);
       }
 
       const raw = (simResult as StellarRpc.Api.SimulateTransactionSuccessResponse).result?.retval;
       if (!raw) {
-        this.logger.warn('Pool balance simulation returned no result');
-        return Infinity;
+        this.logger.error('Pool balance simulation returned no result');
+        throw new Error('Failed to fetch pool balance: no result returned');
       }
 
       const balance = Number(scValToNative(raw));
       this.logger.log(`Pool available balance: ${balance} (7-decimal fixed point)`);
       return balance;
     } catch (err) {
-      this.logger.warn(`Failed to fetch pool balance: ${(err as Error).message}`);
-      return Infinity;
+      this.logger.error(`Failed to fetch pool balance: ${(err as Error).message}`);
+      throw new Error(`Failed to fetch pool balance: ${(err as Error).message}`);
     }
   }
 

src/redis/redis.module.ts

@@ -0,0 +1,22 @@
+import { Module, Global } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import Redis from 'ioredis';
+
+@Global()
+@Module({
+  providers: [
+    {
+      provide: 'REDIS_CLIENT',
+      useFactory: (configService: ConfigService) => {
+        const redisUrl = configService.get<string>('REDIS_URL');
+        if (!redisUrl) {
+          throw new Error('REDIS_URL environment variable is required');
+        }
+        return new Redis(redisUrl);
+      },
+      inject: [ConfigService],
+    },
+  ],
+  exports: ['REDIS_CLIENT'],
+})
+export class RedisModule {}