diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..e59b8c0 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024-2026 Savitura + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index 1122cd1..34d2115 100644 --- a/README.md +++ b/README.md @@ -12,18 +12,22 @@ SaviTools is a standalone product in the [Savitura](https://savitura.com) ecosys ## Tools -| Tool | What it does | Status | -| -------------------------- | ------------------------------------------------------------------------------------- | ----------- | -| **Transaction Inspector** | Decode any tx hash, Stellar address, or raw XDR into a human-readable breakdown | In progress | -| **Wallet Sandbox** | Generate testnet keypairs, fund via Friendbot, send test payments | In progress | -| **Transaction Composer** | Visual builder for multi-operation Stellar transactions; sign and submit without code | In progress | -| **Payment Simulator** | Find path payment routes between assets; preview hops, rates, and fees | In progress | -| **Webhook Tester** | Fire sample CrowdPay / Fluxa webhook payloads at your endpoint; inspect the response | In progress | -| **Ledger Monitor** | Watch a Stellar address or contract for live activity; set threshold alerts | Planned | -| **API Playground** | Interactive request builder for Fluxa and CrowdPay APIs | Planned | -| **Contract Deploy Helper** | Upload and deploy Soroban WASM files to testnet from the browser | Planned | -| **SDK Generator** | Generate copy-paste client code (JS, Python, Go, cURL) from Fluxa/CrowdPay endpoints | Planned | -| **Network Status** | Live Stellar network health: ledger close time, fee tracker, Horizon latency | Planned | +| Tool | What it does | Status | +| ------------------------- | ------------------------------------------------------------------------------------- | ------ | +| **Transaction Inspector** | Decode any tx hash, Stellar address, or raw XDR into a human-readable breakdown | MVP | +| **Wallet Sandbox** | Generate testnet keypairs, fund via Friendbot, send test payments | MVP | +| **Transaction Composer** | Visual builder for multi-operation Stellar transactions; sign and submit without code | MVP | +| **Payment Simulator** | Find path payment routes between assets; preview hops, rates, and fees | MVP | +| **Webhook Tester** | Fire sample CrowdPay / Fluxa webhook payloads at your endpoint; inspect the response | MVP | +| **Ledger Monitor** | Watch a Stellar address or contract for live activity; set threshold alerts | MVP | +| **API Playground** | Interactive request builder for Fluxa and CrowdPay APIs | MVP | +| **Contract Deployer** | Upload and deploy Soroban WASM files to testnet from the browser | MVP | +| **SDK Generator** | Generate copy-paste client code (JS, Python, Go, cURL) from Fluxa/CrowdPay endpoints | Planned | +| **Network Status** | Live Stellar network health: ledger close time, fee tracker, Horizon latency | Planned | +| **Federation & TOML** | Resolve federation addresses, inspect stellar.toml files, check SEP compliance | MVP | +| **Order Book** | Live DEX order book, spread analytics, and liquidity depth chart for any asset pair | MVP | +| **Account Graph** | Visualize signer networks, offers, and payment relationships with a force-directed graph | MVP | +| **Contract Events** | Decode, filter, and replay Soroban contract events from raw ScVal XDR | MVP | --- diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..f4d4925 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,58 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| 0.1.x | :white_check_mark: | + +## Reporting a Vulnerability + +If you discover a security vulnerability in SaviTools, please report it responsibly: + +1. **Do not** open a public GitHub issue for security vulnerabilities. +2. Email security concerns to: **security@savitura.com** +3. Include a detailed description of the vulnerability. +4. If possible, provide steps to reproduce or a proof-of-concept. + +We aim to acknowledge reports within 48 hours and will work with you to understand and address the issue promptly. + +## Security Measures + +SaviTools implements the following security measures: + +### API Protection + +- **CORS**: Restricted origins via `WEB_ORIGIN` environment variable +- **Rate Limiting**: Configurable via `THROTTLE_LIMIT` and `THROTTLE_TTL` +- **Input Validation**: All API inputs are validated using class-validator + +### Webhook Security + +- **HMAC-SHA256 Signing**: Outbound webhooks are signed when `WEBHOOK_SIGNING_SECRET` is configured +- **Timestamp Verification**: Replay protection with configurable time window (default 300s) +- **Signature Header**: `X-SaviTools-Signature` with format `sha256=` + +### Authentication + +- **JWT Tokens**: Secure session management with refresh token rotation +- **Password Hashing**: Argon2 for password storage + +### Network Security + +- **SSRF Protection**: Guards on outbound requests from Playground and Webhook modules +- **TLS**: All external API calls use HTTPS + +## Security-Related Configuration + +| Variable | Description | +| ------------------------- | ---------------------------------------- | +| `WEB_ORIGIN` | Allowed CORS origin | +| `THROTTLE_TTL` | Rate limit window (ms) | +| `THROTTLE_LIMIT` | Max requests per window | +| `WEBHOOK_SIGNING_SECRET` | HMAC key for webhook signatures | +| `JWT_SECRET` | Secret for JWT token signing | + +## Responsible Disclosure + +We appreciate the security research community and will acknowledge researchers who report valid vulnerabilities (with permission) in our release notes. diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile new file mode 100644 index 0000000..a6753f6 --- /dev/null +++ b/apps/api/Dockerfile @@ -0,0 +1,42 @@ +# Stage 1: Build +FROM node:20-alpine AS builder + +WORKDIR /app + +# Copy root package files for monorepo +COPY package.json package-lock.json turbo.json ./ + +# Copy api package files +COPY apps/api/package.json apps/api/ + +# Install all dependencies +RUN npm ci + +# Copy source files +COPY apps/api apps/api + +# Build the API +RUN npm run build --workspace=@savitools/api + +# Stage 2: Production +FROM node:20-alpine AS runner + +WORKDIR /app + +ENV NODE_ENV=production + +# Copy built artifacts and production dependencies +COPY --from=builder /app/apps/api/dist ./dist +COPY --from=builder /app/apps/api/package.json ./ + +# Install production dependencies only +RUN npm install --omit=dev + +# Create non-root user +RUN addgroup --system --gid 1001 nodejs && \ + adduser --system --uid 1001 nestjs +USER nestjs + +EXPOSE 3001 + +CMD ["node", "dist/main.js"] diff --git a/apps/api/src/modules/webhook/webhook.service.ts b/apps/api/src/modules/webhook/webhook.service.ts index 58b1978..0a88336 100644 --- a/apps/api/src/modules/webhook/webhook.service.ts +++ b/apps/api/src/modules/webhook/webhook.service.ts @@ -79,7 +79,7 @@ export class WebhookService { } let responseStatus: number | null = null; - let responseHeaders: Record = {}; + const responseHeaders: Record = {}; let responseBody = ''; let errorMessage: string | undefined; diff --git a/apps/web/src/lib/tools.ts b/apps/web/src/lib/tools.ts index 651dd44..6e4ce9e 100644 --- a/apps/web/src/lib/tools.ts +++ b/apps/web/src/lib/tools.ts @@ -48,7 +48,7 @@ export const tools = [ href: "/monitor", label: "Monitor", description: "Watch addresses and contracts for live ledger activity.", - status: "Planned" as const, + status: "MVP" as const, }, { href: "/inspector/federation",