fix(ci): resolve backend and frontend failures

Author: Shoaib Ansari

backend/package-lock.json

@@ -17,6 +17,7 @@
     "cron-parser": "^4.9.0",
     "dotenv": "^16.4.5",
     "express": "^4.21.0",
+    "express-rate-limit": "^7.4.1",
     "node-cron": "^3.0.3",
     "openai": "^4.67.0",
     "zod": "^3.23.8"

backend/package.json

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { healthRouter } from '../health.js';
-import { Request, Response } from 'express';
+import { Request, Response, Router, RequestHandler } from 'express';
 import { server as stellarServer } from '../../services/stellar.js';
 import { getJobScheduler } from '../../jobs/index.js';
 
@@ -20,6 +20,17 @@ describe('Health Router', () => {
   let resJson: any;
   let resStatus: any;
 
+  const getRouteHandler = (router: Router, path: string): RequestHandler => {
+    const layer = router.stack.find((entry) => entry.route?.path === path);
+    const handler = layer?.route?.stack[0]?.handle;
+
+    if (!handler) {
+      throw new Error(`Route handler not found for ${path}`);
+    }
+
+    return handler;
+  };
+
   beforeEach(() => {
     vi.clearAllMocks();
     resJson = vi.fn();
@@ -32,13 +43,16 @@ describe('Health Router', () => {
 
   describe('GET /health', () => {
     it('returns 200 and healthy status when all dependencies are up', async () => {
-      vi.mocked(stellarServer.root).mockResolvedValue({} as any);
+      const mockedStellarRoot = vi.mocked(
+        (stellarServer as unknown as { root: () => Promise<unknown> }).root
+      );
+
+      mockedStellarRoot.mockResolvedValue({});
       vi.mocked(getJobScheduler).mockReturnValue({} as any);
       process.env.OPENAI_API_KEY = 'test-key';
 
-      // Access the private handler (for testing purposes in vitest)
-      const handler = (healthRouter.stack.find(s => s.route.path === '/health')?.route.stack[0].handle);
-      await handler(mockReq as Request, mockRes as Response);
+      const handler = getRouteHandler(healthRouter, '/health');
+      await handler(mockReq as Request, mockRes as Response, vi.fn());
 
       expect(resStatus).toHaveBeenCalledWith(200);
       expect(resJson).toHaveBeenCalledWith(expect.objectContaining({
@@ -52,13 +66,17 @@ describe('Health Router', () => {
     });
 
     it('returns 200 and degraded status when OpenAI is missing', async () => {
-      vi.mocked(stellarServer.root).mockResolvedValue({} as any);
+      const mockedStellarRoot = vi.mocked(
+        (stellarServer as unknown as { root: () => Promise<unknown> }).root
+      );
+
+      mockedStellarRoot.mockResolvedValue({});
       vi.mocked(getJobScheduler).mockReturnValue({} as any);
       const originalKey = process.env.OPENAI_API_KEY;
       delete process.env.OPENAI_API_KEY;
 
-      const handler = (healthRouter.stack.find(s => s.route.path === '/health')?.route.stack[0].handle);
-      await handler(mockReq as Request, mockRes as Response);
+      const handler = getRouteHandler(healthRouter, '/health');
+      await handler(mockReq as Request, mockRes as Response, vi.fn());
 
       expect(resStatus).toHaveBeenCalledWith(200);
       expect(resJson).toHaveBeenCalledWith(expect.objectContaining({
@@ -74,12 +92,16 @@ describe('Health Router', () => {
     });
 
     it('returns 503 and unhealthy status when Stellar Horizon is down', async () => {
-      vi.mocked(stellarServer.root).mockRejectedValue(new Error('Horizon Down'));
+      const mockedStellarRoot = vi.mocked(
+        (stellarServer as unknown as { root: () => Promise<unknown> }).root
+      );
+
+      mockedStellarRoot.mockRejectedValue(new Error('Horizon Down'));
       vi.mocked(getJobScheduler).mockReturnValue({} as any);
       process.env.OPENAI_API_KEY = 'test-key';
 
-      const handler = (healthRouter.stack.find(s => s.route.path === '/health')?.route.stack[0].handle);
-      await handler(mockReq as Request, mockRes as Response);
+      const handler = getRouteHandler(healthRouter, '/health');
+      await handler(mockReq as Request, mockRes as Response, vi.fn());
 
       expect(resStatus).toHaveBeenCalledWith(503);
       expect(resJson).toHaveBeenCalledWith(expect.objectContaining({
@@ -95,8 +117,8 @@ describe('Health Router', () => {
 
   describe('GET /ready', () => {
     it('returns 200 and ready status', async () => {
-      const handler = (healthRouter.stack.find(s => s.route.path === '/ready')?.route.stack[0].handle);
-      await handler(mockReq as Request, mockRes as Response);
+      const handler = getRouteHandler(healthRouter, '/ready');
+      await handler(mockReq as Request, mockRes as Response, vi.fn());
 
       expect(resStatus).toHaveBeenCalledWith(200);
       expect(resJson).toHaveBeenCalledWith(expect.objectContaining({

backend/src/routes/__tests__/health.test.ts

@@ -1,14 +1,25 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { invoiceRouter } from '../invoice.js';
 import { verificationRouter } from '../verification.js';
-import { Request, Response } from 'express';
+import { Request, Response, Router, RequestHandler } from 'express';
 
 describe('Schema Validation', () => {
   let mockReq: Partial<Request>;
   let mockRes: Partial<Response>;
   let resJson: any;
   let resStatus: any;
 
+  const getNamedRouteHandler = (router: Router, path: string, name: string): RequestHandler => {
+    const routeLayer = router.stack.find((entry) => entry.route?.path === path);
+    const handler = routeLayer?.route?.stack.find((entry) => entry.name === name)?.handle;
+
+    if (!handler) {
+      throw new Error(`Route handler not found for ${path}:${name}`);
+    }
+
+    return handler;
+  };
+
   beforeEach(() => {
     resJson = vi.fn();
     resStatus = vi.fn().mockReturnValue({ json: resJson });
@@ -21,8 +32,8 @@ describe('Schema Validation', () => {
   describe('Invoice Validation', () => {
     it('returns 400 when projectId is missing', async () => {
       mockReq.body = { workDescription: 'Test' };
-      const handler = (invoiceRouter.stack.find(s => s.route?.path === '/generate')?.route.stack.find((s: any) => s.name === 'validateMiddleware')?.handle);
-      
+      const handler = getNamedRouteHandler(invoiceRouter, '/generate', 'validateMiddleware');
+
       await handler(mockReq as Request, mockRes as Response, vi.fn());
 
       expect(resStatus).toHaveBeenCalledWith(400);
@@ -42,8 +53,8 @@ describe('Schema Validation', () => {
         milestoneDescription: 'Test',
         projectId: 'P1'
       };
-      const handler = (verificationRouter.stack.find(s => s.route?.path === '/verify')?.route.stack.find((s: any) => s.name === 'validateMiddleware')?.handle);
-      
+      const handler = getNamedRouteHandler(verificationRouter, '/verify', 'validateMiddleware');
+
       await handler(mockReq as Request, mockRes as Response, vi.fn());
 
       expect(resStatus).toHaveBeenCalledWith(400);
@@ -56,8 +67,12 @@ describe('Schema Validation', () => {
 
     it('returns 400 for empty bulk verification items', async () => {
       mockReq.body = { items: [] };
-      const handler = (verificationRouter.stack.find(s => s.route?.path === '/verify/batch')?.route.stack.find((s: any) => s.name === 'validateMiddleware')?.handle);
-      
+      const handler = getNamedRouteHandler(
+        verificationRouter,
+        '/verify/batch',
+        'validateMiddleware'
+      );
+
       await handler(mockReq as Request, mockRes as Response, vi.fn());
 
       expect(resStatus).toHaveBeenCalledWith(400);

backend/src/routes/__tests__/validation.test.ts

@@ -4,6 +4,12 @@ import { getJobScheduler } from '../jobs/index.js';
 
 export const healthRouter = Router();
 
+type HorizonHealthServer = {
+  root: () => Promise<unknown>;
+};
+
+const horizonHealthServer = stellarServer as unknown as HorizonHealthServer;
+
 /**
  * @openapi
  * /health:
@@ -26,10 +32,12 @@ healthRouter.get('/health', async (_req: Request, res: Response) => {
 
   try {
     // 1. Stellar Horizon Check (with timeout)
-    const stellarCheck = stellarServer.root()
+    const stellarCheck = horizonHealthServer
+      .root()
       .then(() => true)
-      .catch((err) => {
-        console.warn('Stellar health check failed:', err.message);
+      .catch((err: unknown) => {
+        const message = err instanceof Error ? err.message : String(err);
+        console.warn('Stellar health check failed:', message);
         return false;
       });
 

backend/src/routes/health.ts

@@ -1,6 +1,21 @@
 import OpenAI from 'openai';
 
-const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
+let openaiClient: OpenAI | null = null;
+
+const getOpenAIClient = () => {
+  const apiKey = process.env.OPENAI_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      'The OPENAI_API_KEY environment variable is missing or empty; provide it to generate invoices.'
+    );
+  }
+
+  if (!openaiClient) {
+    openaiClient = new OpenAI({ apiKey });
+  }
+
+  return openaiClient;
+};
 
 interface InvoiceRequest {
   projectId: string;
@@ -28,7 +43,7 @@ interface Invoice {
 export async function generateInvoice(request: InvoiceRequest): Promise<Invoice> {
   const id = `inv_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
 
-  const completion = await openai.chat.completions.create({
+  const completion = await getOpenAIClient().chat.completions.create({
     model: 'gpt-4o-mini',
     messages: [
       {

backend/src/services/invoice.ts

@@ -8,6 +8,16 @@ const HORIZON_URL =
 
 export const server = new StellarSdk.Horizon.Server(HORIZON_URL);
 
+export class ValidationError extends Error {
+  statusCode: number;
+
+  constructor(message: string, statusCode = 400) {
+    super(message);
+    this.name = 'ValidationError';
+    this.statusCode = statusCode;
+  }
+}
+
 export function isValidStellarAddress(address: string) {
   if (!address?.trim()) {
     return false;
@@ -24,6 +34,30 @@ export function isValidTransactionHash(hash: string) {
   return /^[A-Fa-f0-9]{64}$/.test(hash);
 }
 
+export function validateStellarAddress(address: string): string {
+  if (!address?.trim()) {
+    throw new ValidationError('Stellar address must not be empty');
+  }
+
+  if (!isValidStellarAddress(address)) {
+    throw new ValidationError('Invalid Stellar address');
+  }
+
+  return address;
+}
+
+export function validateTransactionHash(hash: string): string {
+  if (!hash?.trim()) {
+    throw new ValidationError('Transaction hash must not be empty');
+  }
+
+  if (!isValidTransactionHash(hash)) {
+    throw new ValidationError('Invalid transaction hash');
+  }
+
+  return hash;
+}
+
 export async function getAccountInfo(address: string) {
   const account = await server.loadAccount(address);
   return {

backend/src/services/stellar.ts

@@ -98,12 +98,14 @@ export const useAgenticPay = () => {
         });
 
         const formattedProjects: Project[] = projectsData
-            ? projectsData.map((result: { status: string; result: unknown }) => {
-                if (result.status === 'success' && result.result) {
-                    return formatProjectData(result.result as RawProjectData);
-                }
-                return null;
-            }).filter((p): p is Project => p !== null)
+            ? projectsData
+                .map((result) => {
+                    if (result.status === 'success' && result.result) {
+                        return formatProjectData(result.result as RawProjectData);
+                    }
+                    return null;
+                })
+                .filter((project): project is Project => project !== null)
             : [];
 
         return { projects: formattedProjects, loading: loadingClient || loadingFreelancer || loadingDetails };
@@ -118,7 +120,11 @@ export const useAgenticPay = () => {
             query: { enabled: !!projectId }
         });
 
-        return { project: data ? formatProjectData(data) : null, loading: isLoading, refetch };
+        return {
+            project: data ? formatProjectData(data as RawProjectData) : null,
+            loading: isLoading,
+            refetch,
+        };
     };