Implement contribution prepare/submit-signed + quote routes (tests currently skipped on #784)

[dotunv]

Background

PR #784 quarantined several backend tests that were failing because the routes/features they test are not yet implemented in the current codebase.

Routes to implement

The following routes exist as test stubs in backend/src/routes/contributions.test.js but the actual route handlers are not implemented in backend/src/routes/contributions.js:

Freighter contribution flow

• GET /api/contributions/quote - Path payment quote for conversion
• POST /api/contributions/prepare - Returns unsigned XDR and prepare token for Freighter signing
• POST /api/contributions/submit-signed - Accepts Freighter-signed XDR and submits
• GET /api/contributions/finalization/:txHash - Returns finalization status of a contribution

Refund flow

• POST /api/contributions/:id/refund - Contract-mode contribution refund for failed campaigns

Pagination

• GET /api/contributions/campaign/:campaignId - List contributions for a campaign with pagination

Additional route enhancements

The test stubs also expect these behaviors on POST /api/contributions that may not be fully implemented:

• migration_in_progress check (503 CAMPAIGN_MIGRATION_IN_PROGRESS)
• CAMPAIGN_DISPUTED status check (409)
• max_per_user cap enforcement with advisory lock
• min_contribution / max_contribution validation
• platform_fee_amount in response and metadata

Test response shape mismatch

• embed.test.js: The test POST contribute accepts valid contribution... expects response {success, amount, txHash} but the route returns {id, raised_amount, target_amount}
• nftRewards.test.js: The test POST /api/nft-rewards/claim prevents duplicates... has a stub mismatch with the actual route's database interactions

Related

• PR fix(ci): correct Rust toolchain action and fix npm high-severity vulnerabilities #784 - CI fix that quarantines these tests
• All skipped tests are marked with { skip: 'Route not implemented - see #785' } or similar

Acceptance criteria

• Implement the missing Freighter contribution routes
• Implement the refund route
• Implement the campaign contributions pagination route
• Update POST /api/contributions with missing validation logic
• Fix embed.test.js response shape expectations or route response
• Fix nftRewards.test.js stub to match actual route
• Unskip all quarantined tests and ensure they pass

[xtep103]

Hi there, I’ve carefully reviewed the issue details and I’m confident I can provide a clean, efficient, and maintainable solution.

[Iker2522]

I am applying to take ownership of this issue.
​I will implement the missing contribution endpoints and resolve the test suite quarantines in Savitura / crowdpay.
​I will complete the Freighter contribution workflow in backend/src/routes/contributions.js by adding path payment quote generation (/quote), unsigned XDR preparation (/prepare), signed payload submission (/submit-signed), and transaction status polling (/finalization/:txHash). I will also implement campaign contribution refunds (/:id/refund) and paginated campaign contribution listings.
​Additionally, I will enhance POST /contributions with 503 CAMPAIGN_MIGRATION_IN_PROGRESS checks, dispute validation, advisory-locked max_per_user cap enforcement, fee calculation fields, and payload shape alignment for embed.test.js and nftRewards.test.js.
​I will verify the delivery by unskipping all tests quarantined in #784 and ensuring 100% test coverage pass across contributions.test.js, embed.test.js, and nftRewards.test.js. PR ready in 24–48 hours. Closes #786.