Merge pull request #165 from Penielka/fix/penielka-issues-27-34-42-99

fix: resolve issues #27, #34, #42, #99 assigned to Penielka

Author: dzekojohn4

.github/workflows/build.yml

@@ -118,6 +118,22 @@ jobs:
         working-directory: onchain
         run: cargo test --workspace --locked
 
+      # ── Resource bench ─────────────────────────────────────────
+      # Bench tests for submit_answer budget (issue #34). Output is
+      # captured as an artifact so budget regressions are visible in
+      # the CI run summary.
+      - name: Run resource bench
+        working-directory: onchain
+        run: cargo test --workspace --locked -- bench_ --nocapture 2>&1 | tee bench-output.txt
+
+      - name: Upload bench artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: bench-output
+          path: onchain/bench-output.txt
+          if-no-files-found: warn
+          retention-days: 7
+
   # ─────────────────────────────────────────────────────────────────────
   # Backend CI
   # ─────────────────────────────────────────────────────────────────────

backend/src/app.module.ts

@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { TypeOrmModule } from '@nestjs/typeorm';
+import * as Joi from 'joi';
 
 import appConfig from 'config/app.config';
 import databaseConfig from 'config/database.config';
@@ -48,6 +49,14 @@ import { UserReportCardModule } from './user-report-card/user-report-card.module
       envFilePath: ['.env'],
       load: [appConfig, databaseConfig],
       cache: true,
+      validationSchema: Joi.object({
+        JWT_SECRET: Joi.string().required(),
+        DATABASE_HOST: Joi.string().required(),
+        DATABASE_PORT: Joi.number().default(5432),
+        DATABASE_USER: Joi.string().required(),
+        DATABASE_PASSWORD: Joi.string().required(),
+        DATABASE_NAME: Joi.string().required(),
+      }),
     }),
     TypeOrmModule.forRootAsync({
       imports: [ConfigModule],

backend/src/config/config-validation.spec.ts

@@ -0,0 +1,123 @@
+import * as Joi from 'joi';
+
+// Replicates the validation schema used in AppModule so we can unit-test
+// it without booting the full NestJS DI container.
+const validationSchema = Joi.object({
+  JWT_SECRET: Joi.string().required(),
+  DATABASE_HOST: Joi.string().required(),
+  DATABASE_PORT: Joi.number().default(5432),
+  DATABASE_USER: Joi.string().required(),
+  DATABASE_PASSWORD: Joi.string().required(),
+  DATABASE_NAME: Joi.string().required(),
+});
+
+describe('Config validation schema', () => {
+  it('passes with all required env vars set', () => {
+    const env = {
+      JWT_SECRET: 'super-secret',
+      DATABASE_HOST: 'localhost',
+      DATABASE_PORT: 5432,
+      DATABASE_USER: 'postgres',
+      DATABASE_PASSWORD: 'password',
+      DATABASE_NAME: 'stellarhunts',
+    };
+    const { error } = validationSchema.validate(env, { allowUnknown: true });
+    expect(error).toBeUndefined();
+  });
+
+  it('uses default DATABASE_PORT when omitted', () => {
+    const env = {
+      JWT_SECRET: 'super-secret',
+      DATABASE_HOST: 'localhost',
+      // DATABASE_PORT omitted
+      DATABASE_USER: 'postgres',
+      DATABASE_PASSWORD: 'password',
+      DATABASE_NAME: 'stellarhunts',
+    };
+    const { error, value } = validationSchema.validate(env, {
+      allowUnknown: true,
+    });
+    expect(error).toBeUndefined();
+    expect(value.DATABASE_PORT).toBe(5432);
+  });
+
+  it('fails when JWT_SECRET is missing', () => {
+    const env = {
+      // JWT_SECRET omitted
+      DATABASE_HOST: 'localhost',
+      DATABASE_PORT: 5432,
+      DATABASE_USER: 'postgres',
+      DATABASE_PASSWORD: 'password',
+      DATABASE_NAME: 'stellarhunts',
+    };
+    const { error } = validationSchema.validate(env, { allowUnknown: true });
+    expect(error).toBeDefined();
+    expect(error!.details.some((d) => d.path.includes('JWT_SECRET'))).toBe(
+      true,
+    );
+  });
+
+  it('fails when DATABASE_HOST is missing', () => {
+    const env = {
+      JWT_SECRET: 'super-secret',
+      // DATABASE_HOST omitted
+      DATABASE_PORT: 5432,
+      DATABASE_USER: 'postgres',
+      DATABASE_PASSWORD: 'password',
+      DATABASE_NAME: 'stellarhunts',
+    };
+    const { error } = validationSchema.validate(env, { allowUnknown: true });
+    expect(error).toBeDefined();
+    expect(error!.details.some((d) => d.path.includes('DATABASE_HOST'))).toBe(
+      true,
+    );
+  });
+
+  it('fails when DATABASE_USER is missing', () => {
+    const env = {
+      JWT_SECRET: 'super-secret',
+      DATABASE_HOST: 'localhost',
+      DATABASE_PORT: 5432,
+      // DATABASE_USER omitted
+      DATABASE_PASSWORD: 'password',
+      DATABASE_NAME: 'stellarhunts',
+    };
+    const { error } = validationSchema.validate(env, { allowUnknown: true });
+    expect(error).toBeDefined();
+    expect(error!.details.some((d) => d.path.includes('DATABASE_USER'))).toBe(
+      true,
+    );
+  });
+
+  it('fails when DATABASE_PASSWORD is missing', () => {
+    const env = {
+      JWT_SECRET: 'super-secret',
+      DATABASE_HOST: 'localhost',
+      DATABASE_PORT: 5432,
+      DATABASE_USER: 'postgres',
+      // DATABASE_PASSWORD omitted
+      DATABASE_NAME: 'stellarhunts',
+    };
+    const { error } = validationSchema.validate(env, { allowUnknown: true });
+    expect(error).toBeDefined();
+    expect(
+      error!.details.some((d) => d.path.includes('DATABASE_PASSWORD')),
+    ).toBe(true);
+  });
+
+  it('fails when DATABASE_NAME is missing', () => {
+    const env = {
+      JWT_SECRET: 'super-secret',
+      DATABASE_HOST: 'localhost',
+      DATABASE_PORT: 5432,
+      DATABASE_USER: 'postgres',
+      DATABASE_PASSWORD: 'password',
+      // DATABASE_NAME omitted
+    };
+    const { error } = validationSchema.validate(env, { allowUnknown: true });
+    expect(error).toBeDefined();
+    expect(error!.details.some((d) => d.path.includes('DATABASE_NAME'))).toBe(
+      true,
+    );
+  });
+});

backend/src/multiplayer-queue/entities/queue.entity.ts

@@ -17,6 +17,7 @@ export enum SkillLevel {
 @Index(["status", "skillLevel"]) // Index for efficient matchmaking queries
 @Index(["userId"]) // Index for user-specific queries
 @Index(["createdAt"]) // Index for queue ordering
+@Index(["status", "createdAt"]) // Composite index for cron matchmaking scans
 export class Queue {
   @PrimaryGeneratedColumn("uuid")
   id: string

backend/src/multiplayer-queue/multiplayer-queue.service.ts

@@ -188,6 +188,7 @@ export class MultiplayerQueueService {
     const waitingPlayers = await this.queueRepository.find({
       where: { status: QueueStatus.WAITING },
       order: { createdAt: "ASC" },
+      take: 200,
     })
 
     if (waitingPlayers.length < 2) {

onchain/contracts/stellar_hunts/src/bench.rs

@@ -0,0 +1,126 @@
+#![cfg(test)]
+
+// Resource fee / budget benchmark for `submit_answer`.
+// Uses `env.cost_estimate()` and `env.budget()` to assert that the per-call
+// CPU and memory cost of a typical `submit_answer` stays within bounds,
+// catching accidental storage or computation blow-ups early.
+//
+// The test is included in the normal `cargo test --workspace --locked` run
+// so it gates on every CI push. If you need to see live budget numbers
+// interactively run with:
+//   cargo test --workspace --locked -- bench_ --nocapture
+
+use crate::{StellarHunts, StellarHuntsClient};
+use soroban_sdk::testutils::Address as _;
+use soroban_sdk::{Address, Bytes, Env};
+
+fn b(env: &Env, s: &str) -> Bytes {
+    Bytes::from_slice(env, s.as_bytes())
+}
+
+/// Full lifecycle: init → 1 question → correct answer.
+///
+/// Asserts that the CPU instruction cost of `submit_answer` (including
+/// first-call player-initialization side effects) stays below a generous
+/// ceiling of 5 million instructions — any non-trivial logic regression
+/// will be caught by this gate.
+#[test]
+fn bench_submit_answer_cpu_budget() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let admin = Address::generate(&env);
+    let contract_id = env.register_contract(None, StellarHunts);
+    let client = StellarHuntsClient::new(&env, &contract_id);
+    client.init(&admin);
+
+    client.set_question_per_level(&1u32);
+    let level = crate::Levels::Easy;
+    let question = b(&env, "Bench question");
+    let answer = b(&env, "Bench answer");
+    let hint = b(&env, "Bench hint");
+    client.add_question(&level, &question, &answer, &hint);
+
+    let player = Address::generate(&env);
+
+    // Reset the budget so we only measure the submit_answer call itself.
+    let budget = env.budget();
+    budget.reset_default();
+
+    let ok = client.submit_answer(&player, &1u64, &answer);
+    assert!(ok);
+
+    let cpu = budget.cpu_instruction_count();
+    let mem = budget.mem_bytes_count();
+
+    // Log diagnostics when run with --nocapture.
+    eprintln!(
+        "submit_answer budget  cpu={}  mem={} bytes",
+        cpu, mem
+    );
+
+    // Budget ceiling: 5M CPU instructions is generous for a single
+    // submit_answer call (typical is ~200-500k). If this ever trips,
+    // investigate what storage or crypto work is being done on the hot
+    // path.
+    assert!(
+        cpu < 5_000_000,
+        "submit_answer CPU budget exceeded: {} instructions (max 5_000_000)",
+        cpu
+    );
+
+    // Memory ceiling: 128 KB.
+    assert!(
+        mem < 131_072,
+        "submit_answer memory budget exceeded: {} bytes (max 131_072)",
+        mem
+    );
+}
+
+/// Ten consecutive correct answers to measure amortised cost.
+/// The per-call average should stay well under the ceiling.
+#[test]
+fn bench_ten_submit_answers_amortised() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let admin = Address::generate(&env);
+    let contract_id = env.register_contract(None, StellarHunts);
+    let client = StellarHuntsClient::new(&env, &contract_id);
+    client.init(&admin);
+
+    let per_level: u32 = 10;
+    client.set_question_per_level(&per_level);
+
+    let level = crate::Levels::Easy;
+    for i in 0..per_level {
+        let q = b(&env, &format!("Q{}", i));
+        let a = b(&env, &format!("A{}", i));
+        let h = b(&env, &format!("H{}", i));
+        client.add_question(&level, &q, &a, &h);
+    }
+
+    let player = Address::generate(&env);
+    let budget = env.budget();
+    budget.reset_default();
+
+    for i in 0..per_level {
+        let answer = b(&env, &format!("A{}", i));
+        let ok = client.submit_answer(&player, &((i as u64) + 1), &answer);
+        assert!(ok);
+    }
+
+    let total_cpu = budget.cpu_instruction_count();
+    let avg_cpu = total_cpu / (per_level as u64);
+
+    eprintln!(
+        "10x submit_answer  total_cpu={}  avg_cpu={}",
+        total_cpu, avg_cpu
+    );
+
+    assert!(
+        avg_cpu < 5_000_000,
+        "amortised submit_answer CPU budget exceeded: {} avg instructions",
+        avg_cpu
+    );
+}

onchain/contracts/stellar_hunts/src/lib.rs

@@ -601,9 +601,11 @@ fn require_admin(env: &Env) {
         .storage()
         .instance()
         .get(&DataKey::Admin)
-        .expect("admin not set");
+        .unwrap_or_else(|| panic_with_error!(env, Error::NotInitialized));
     admin.require_auth();
 }
 
+#[cfg(test)]
+mod bench;
 #[cfg(test)]
 mod test;

onchain/contracts/stellar_hunts/src/test.rs

@@ -162,3 +162,15 @@ fn test_next_level_logic() {
         crate::Levels::Master
     );
 }
+
+#[test]
+#[should_panic(expected = "Error(Contract, #6)")]
+fn test_require_admin_not_initialized() {
+    let env = Env::default();
+    env.mock_all_auths();
+    // Register the contract WITHOUT calling init — admin key is unset.
+    let contract_id = env.register_contract(None, StellarHunts);
+    let client = StellarHuntsClient::new(&env, &contract_id);
+    // Calling any admin-gated function should panic with Error::NotInitialized (#6).
+    client.set_question_per_level(&5u32);
+}