Fix devDependency misplacement, missing REDIS_URL warning, dropped claim fields, and redundant wallet param (#361)

* fix(#342): move @types/jsonwebtoken to devDependencies

Type definitions are only needed at compile time; listing them as a
production dependency bloats the deployed node_modules for no
runtime benefit.

* fix(#343): warn at startup when REDIS_URL is unset

validateConfig checked JWT_SECRET, DATABASE_URL, STELLAR_RPC_URL, and
KEEPER_SECRET_KEY but said nothing about REDIS_URL, so the
ThrottlerModule's fallback to redis://localhost:6379 was silent and
easy to miss in a real deployment that meant to point at a shared
Redis instance. Not made a hard requirement since the localhost
fallback is legitimate for local dev -- just logged.

* fix(#344): include txHash and createdAt in claim API responses

Both columns exist on the Claim model, but ClaimSummary (the actual
mapped shape returned by getClaim/getClaimsByWallet) dropped both,
so an already-issued payout's on-chain transaction hash was
unrecoverable from the API despite being stored in the DB. Added
both fields to ClaimSummary, the two service mapping functions, and
ClaimResponseDto (createdAt was missing there too).

* fix(#345): remove redundant wallet query param from GET /policies/me

The wallet query parameter was only ever compared against the JWT's
wallet address for authorization -- the JWT wallet was what actually
got used to fetch policies. Removed the parameter entirely; the
endpoint now always operates on the authenticated wallet, with a
BadRequestException if the JWT carries none. Updated the controller
spec's call sites and dropped the now-meaningless
"another wallet" mismatch test.

---------

Co-authored-by: presidoclintonbased-alt <presidoclintonbased-alt@users.noreply.github.com>

Author: presidoclintonbased-alt

package-lock.json

@@ -28,7 +28,6 @@
     "ioredis": "^5.4.0",
     "@prisma/client": "^6.0.0",
     "@stellar/stellar-sdk": "^13.0.0",
-    "@types/jsonwebtoken": "^9.0.10",
     "axios": "^1.7.0",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.0",
@@ -42,6 +41,7 @@
     "@nestjs/testing": "^11.0.0",
     "@types/express": "^5.0.0",
     "@types/jest": "^29.5.12",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^22.0.0",
     "jest": "^29.7.0",
     "prisma": "^6.0.0",

package.json

@@ -1,4 +1,4 @@
-import { Module } from '@nestjs/common';
+import { Logger, Module } from '@nestjs/common';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { ScheduleModule } from '@nestjs/schedule';
 import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';
@@ -19,6 +19,15 @@ import { RedisModule }   from './redis/redis.module';
  */
 function validateConfig(config: Record<string, unknown>) {
   const errors: string[] = [];
+  const logger = new Logger('ConfigValidation');
+
+  // #343 — not a hard requirement (a localhost fallback is fine for local
+  // dev), but the ThrottlerModule storage below falls back to it silently,
+  // which is easy to miss in a real deployment that meant to point at a
+  // shared Redis instance.
+  if (!config['REDIS_URL']) {
+    logger.warn('REDIS_URL is not set — falling back to redis://localhost:6379');
+  }
 
   if (!config['JWT_SECRET']) {
     errors.push('JWT_SECRET is required');

src/app.module.ts

@@ -20,6 +20,10 @@ export interface ClaimSummary {
   status:         string;
   submittedAt:    number;
   processedAt:    number | null;
+  // #344 — both columns exist on the Claim model but were dropped when
+  // mapping to this summary shape, so the API response silently lost them.
+  txHash:         string | null;
+  createdAt:      number;
 }
 
 /**
@@ -385,6 +389,8 @@ export class ClaimsService {
       processedAt:    claim.processedAt
         ? Math.floor(claim.processedAt.getTime() / 1000)
         : null,
+      txHash:         claim.txHash,
+      createdAt:      Math.floor(claim.createdAt.getTime() / 1000),
     }));
 
     return {
@@ -412,6 +418,8 @@ export class ClaimsService {
       processedAt:    claim.processedAt
         ? Math.floor(claim.processedAt.getTime() / 1000)
         : null,
+      txHash:         claim.txHash,
+      createdAt:      Math.floor(claim.createdAt.getTime() / 1000),
     };
   }
 }

src/claims/claims.service.ts

@@ -50,4 +50,7 @@ export class ClaimResponseDto {
 
   @ApiProperty({ description: 'Stellar transaction hash for payout', nullable: true })
   txHash: string | null;
+
+  @ApiProperty({ description: 'Claim record creation timestamp (Unix seconds)' })
+  createdAt: number;
 }

src/claims/dto/submit-claim.dto.ts

@@ -56,7 +56,7 @@ describe("PolicyController", () => {
     it("should accept valid page and limit parameters", async () => {
       mockPolicyService.getUserPolicies.mockResolvedValue(mockPoliciesResponse);
 
-      const result = await controller.getMyPolicies(wallet, "2", "50", mockReq);
+      const result = await controller.getMyPolicies("2", "50", mockReq);
 
       expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
         wallet,
@@ -72,7 +72,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "0", "20", mockReq);
+        await controller.getMyPolicies("0", "20", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -86,7 +86,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "-5", "20", mockReq);
+        await controller.getMyPolicies("-5", "20", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -100,7 +100,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "abc", "20", mockReq);
+        await controller.getMyPolicies("abc", "20", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -114,7 +114,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "2.7", "20", mockReq);
+        await controller.getMyPolicies("2.7", "20", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -131,7 +131,7 @@ describe("PolicyController", () => {
           limit: 1,
         });
 
-        await controller.getMyPolicies(wallet, "1", "-5", mockReq);
+        await controller.getMyPolicies("1", "-5", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -145,7 +145,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "1", "0", mockReq);
+        await controller.getMyPolicies("1", "0", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -160,7 +160,7 @@ describe("PolicyController", () => {
           limit: 100,
         });
 
-        await controller.getMyPolicies(wallet, "1", "999999", mockReq);
+        await controller.getMyPolicies("1", "999999", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -175,7 +175,7 @@ describe("PolicyController", () => {
           limit: 100,
         });
 
-        await controller.getMyPolicies(wallet, "1", "500", mockReq);
+        await controller.getMyPolicies("1", "500", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -189,7 +189,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "1", "xyz", mockReq);
+        await controller.getMyPolicies("1", "xyz", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -203,7 +203,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "1", "25.9", mockReq);
+        await controller.getMyPolicies("1", "25.9", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -220,7 +220,6 @@ describe("PolicyController", () => {
         );
 
         await controller.getMyPolicies(
-          wallet,
           undefined as any,
           undefined as any,
           mockReq,
@@ -238,7 +237,7 @@ describe("PolicyController", () => {
           mockPoliciesResponse,
         );
 
-        await controller.getMyPolicies(wallet, "", "", mockReq);
+        await controller.getMyPolicies("", "", mockReq);
 
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
           wallet,
@@ -249,23 +248,14 @@ describe("PolicyController", () => {
     });
 
     describe("wallet authorization", () => {
-      it("should throw ForbiddenException when trying to access another wallet policies", async () => {
-        const otherWallet =
-          "GBACDEFGHIJKLMNOPQRSTUVWXYZ1234567890ABCDEFGHIJKLMNOPQRSTUV";
-
-        await expect(
-          controller.getMyPolicies(otherWallet, "1", "20", mockReq),
-        ).rejects.toThrow(ForbiddenException);
-      });
-
       it("should throw BadRequestException when no wallet is available in request", async () => {
         const reqNoWallet = {
           user: { walletAddress: null },
           wallet: undefined,
         } as AuthenticatedRequest;
 
         await expect(
-          controller.getMyPolicies(wallet, "1", "20", reqNoWallet),
+          controller.getMyPolicies("1", "20", reqNoWallet),
         ).rejects.toThrow(BadRequestException);
       });
     });
@@ -294,7 +284,6 @@ describe("PolicyController", () => {
         mockPolicyService.getUserPolicies.mockResolvedValue(response);
 
         const result = await controller.getMyPolicies(
-          wallet,
           "1",
           "20",
           mockReq,
@@ -315,7 +304,7 @@ describe("PolicyController", () => {
           page: 999999999,
         });
 
-        await controller.getMyPolicies(wallet, "999999999", "1", mockReq);
+        await controller.getMyPolicies("999999999", "1", mockReq);
 
         // Service should still receive the page number and handle it safely
         // (the service would return skip=(page-1)*limit which is safe)
@@ -332,7 +321,7 @@ describe("PolicyController", () => {
           limit: 100,
         });
 
-        await controller.getMyPolicies(wallet, "1", "99999999999999", mockReq);
+        await controller.getMyPolicies("1", "99999999999999", mockReq);
 
         // Should cap at 100
         expect(mockPolicyService.getUserPolicies).toHaveBeenCalledWith(
@@ -350,7 +339,6 @@ describe("PolicyController", () => {
         });
 
         await controller.getMyPolicies(
-          wallet,
           "-999999",
           "999999999999999",
           mockReq,

src/policy/policy.controller.spec.ts

@@ -60,12 +60,11 @@ export class PolicyController {
     return { success: true, data: products };
   }
 
-  /** GET /api/v1/policies/me?wallet=<address>&page=&limit= — get paginated policies for a wallet */
+  /** GET /api/v1/policies/me?page=&limit= — get paginated policies for the authenticated wallet */
   @Get('policies/me')
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
-  @ApiOperation({ summary: 'Get paginated policies for a wallet address' })
-  @ApiQuery({ name: 'wallet', required: true, description: 'Stellar wallet address' })
+  @ApiOperation({ summary: 'Get paginated policies for the authenticated wallet' })
   @ApiQuery({ name: 'page', required: false, description: 'Page number (default 1)', example: 1 })
   @ApiQuery({ name: 'limit', required: false, description: 'Items per page, max 100 (default 20)', example: 20 })
   @ApiResponse({
@@ -83,22 +82,20 @@ export class PolicyController {
     },
   })
   async getMyPolicies(
-    @Query('wallet') wallet: string,
     @Query('page') page: string = '1',
     @Query('limit') limit: string = '20',
     @Req() req: AuthenticatedRequest,
   ) {
+    // #345 — wallet used to come from a client-supplied query param, checked
+    // only for authorization against the JWT wallet; the JWT wallet was
+    // always the one actually used, making the param redundant and confusing.
     const authedWallet = req.user?.walletAddress || req.wallet;
     if (!authedWallet) {
-      throw new BadRequestException('wallet query param required');
-    }
-    const targetWallet = wallet || authedWallet;
-    if (targetWallet !== authedWallet) {
-      throw new ForbiddenException('Cannot fetch policies for another wallet');
+      throw new BadRequestException('Not authenticated');
     }
     const pageNum = Math.max(1, parseInt(page, 10) || 1);
     const limitNum = Math.min(100, Math.max(1, parseInt(limit, 10) || 20));
-    const result = await this.policy.getUserPolicies(targetWallet, pageNum, limitNum);
+    const result = await this.policy.getUserPolicies(authedWallet, pageNum, limitNum);
     return { success: true, ...result };
   }