Merge pull request #77 from OpenSourceCOntr/fix/portfolio-id-collision

fix: resolve portfolio ID collision risk using NextPortfolioId counte…

Author: ritik4ever

backend/src/api/routes.ts

@@ -1,16 +1,28 @@
-
-import { Router } from 'express'
+import { Router, Request, Response } from 'express'
 import { StellarService } from '../services/stellar.js'
 import { ReflectorService } from '../services/reflector.js'
-import { RebalanceHistoryService } from '../services/rebalanceHistory.js'
-import { RiskManagementService } from '../services/riskManagements.js'
+import { riskManagementService, rebalanceHistoryService } from '../services/serviceContainer.js'
 import { portfolioStorage } from '../services/portfolioStorage.js'
 import { CircuitBreakers } from '../services/circuitBreakers.js'
 import { analyticsService } from '../services/analyticsService.js'
 import { notificationService } from '../services/notificationService.js'
 import { contractEventIndexerService } from '../services/contractEventIndexer.js'
+import { AutoRebalancerService } from '../services/autoRebalancer.js'
 import { logger } from '../utils/logger.js'
 import { idempotencyMiddleware } from '../middleware/idempotency.js'
+import { requireAdmin } from '../middleware/auth.js'
+import { writeRateLimiter } from '../middleware/rateLimit.js'
+import { blockDebugInProduction } from '../middleware/debugGate.js'
+import { getFeatureFlags, getPublicFeatureFlags } from '../config/featureFlags.js'
+import { getQueueMetrics } from '../queue/queueMetrics.js'
+import { getErrorMessage, getErrorObject, parseOptionalBoolean } from '../utils/helpers.js'
+
+const router = Router()
+const stellarService = new StellarService()
+const reflectorService = new ReflectorService()
+const autoRebalancer = new AutoRebalancerService()
+const featureFlags = getFeatureFlags()
+const publicFeatureFlags = getPublicFeatureFlags()
 
 const parseOptionalTimestamp = (value: unknown): string | undefined => {
     if (value === undefined || value === null || value === '') return undefined
@@ -20,17 +32,17 @@ const parseOptionalTimestamp = (value: unknown): string | undefined => {
     return ts.toISOString()
 }
 
-const parseHistorySource = (value: unknown): 'all' | 'offchain' | 'simulated' | 'onchain' => {
-    if (typeof value !== 'string') return 'all'
+const parseHistorySource = (value: unknown): 'offchain' | 'simulated' | 'onchain' | undefined => {
+    if (typeof value !== 'string') return undefined
     const normalized = value.trim().toLowerCase()
     if (normalized === 'offchain') return 'offchain'
     if (normalized === 'simulated') return 'simulated'
     if (normalized === 'onchain') return 'onchain'
-    return 'all'
+    return undefined
 }
 
 
-router.get('/rebalance/history', async (req, res) => {
+router.get('/rebalance/history', async (req: Request, res: Response) => {
     try {
         const portfolioId = req.query.portfolioId as string
         const limit = parseInt(req.query.limit as string) || 50
@@ -77,7 +89,7 @@ router.get('/rebalance/history', async (req, res) => {
 })
 
 // Record new rebalance event
-router.post('/rebalance/history', idempotencyMiddleware, async (req, res) => {
+router.post('/rebalance/history', idempotencyMiddleware, async (req: Request, res: Response) => {
     try {
         const eventData = req.body
 
@@ -102,7 +114,7 @@ router.post('/rebalance/history', idempotencyMiddleware, async (req, res) => {
     }
 })
 
-router.post('/rebalance/history/sync-onchain', requireAdmin, async (req, res) => {
+router.post('/rebalance/history/sync-onchain', requireAdmin, async (req: Request, res: Response) => {
     try {
         const result = await contractEventIndexerService.syncOnce()
         res.json({
@@ -124,7 +136,7 @@ router.post('/rebalance/history/sync-onchain', requireAdmin, async (req, res) =>
 // ================================
 
 // Get risk metrics for a portfolio
-router.get('/risk/metrics/:portfolioId', async (req, res) => {
+router.get('/risk/metrics/:portfolioId', async (req: Request, res: Response) => {
     try {
         const { portfolioId } = req.params
 
@@ -134,7 +146,14 @@ router.get('/risk/metrics/:portfolioId', async (req, res) => {
         const prices = await reflectorService.getCurrentPrices()
 
         // Calculate risk metrics with proper type conversion
-        const allocationsRecord = getPortfolioAllocationsAsRecord(portfolio)
+        const allocationsRecord: Record<string, number> = {}
+        if (Array.isArray(portfolio.allocations)) {
+            portfolio.allocations.forEach((a: any) => {
+                allocationsRecord[a.asset] = a.target
+            })
+        } else {
+            Object.assign(allocationsRecord, portfolio.allocations)
+        }
         const riskMetrics = riskManagementService.analyzePortfolioRisk(allocationsRecord, prices)
         const recommendations = riskManagementService.getRecommendations(riskMetrics, allocationsRecord)
         const circuitBreakers = riskManagementService.getCircuitBreakerStatus()
@@ -164,7 +183,7 @@ router.get('/risk/metrics/:portfolioId', async (req, res) => {
 })
 
 // Check if rebalancing should be allowed based on risk conditions
-router.get('/risk/check/:portfolioId', async (req, res) => {
+router.get('/risk/check/:portfolioId', async (req: Request, res: Response) => {
     try {
         const { portfolioId } = req.params
 
@@ -198,7 +217,7 @@ router.get('/risk/check/:portfolioId', async (req, res) => {
 // ================================
 
 // Get current prices - FIXED to return direct format for frontend
-router.get('/prices', async (req, res) => {
+router.get('/prices', async (req: Request, res: Response) => {
     try {
         console.log('[DEBUG] Fetching prices for frontend...')
         const prices = await reflectorService.getCurrentPrices()
@@ -232,7 +251,7 @@ router.get('/prices', async (req, res) => {
 })
 
 // Enhanced prices endpoint with risk analysis
-router.get('/prices/enhanced', async (req, res) => {
+router.get('/prices/enhanced', async (req: Request, res: Response) => {
     try {
         console.log('[INFO] Fetching enhanced prices with risk analysis')
 
@@ -275,7 +294,7 @@ router.get('/prices/enhanced', async (req, res) => {
 })
 
 // Get detailed market data for specific asset
-router.get('/market/:asset/details', async (req, res) => {
+router.get('/market/:asset/details', async (req: Request, res: Response) => {
     try {
         const asset = req.params.asset.toUpperCase()
         const reflector = new ReflectorService()
@@ -292,7 +311,7 @@ router.get('/market/:asset/details', async (req, res) => {
 })
 
 // Get price charts for frontend
-router.get('/market/:asset/chart', async (req, res) => {
+router.get('/market/:asset/chart', async (req: Request, res: Response) => {
     try {
         const asset = req.params.asset.toUpperCase()
         const days = parseInt(req.query.days as string) || 7
@@ -316,7 +335,7 @@ router.get('/market/:asset/chart', async (req, res) => {
 // AUTO-REBALANCER ROUTES
 // ================================
 
-router.get('/auto-rebalancer/status', async (req, res) => {
+router.get('/auto-rebalancer/status', async (req: Request, res: Response) => {
     try {
         if (!autoRebalancer) {
             return res.json({
@@ -343,7 +362,7 @@ router.get('/auto-rebalancer/status', async (req, res) => {
     }
 })
 
-router.post('/auto-rebalancer/start', requireAdmin, (req, res) => {
+router.post('/auto-rebalancer/start', requireAdmin, (req: Request, res: Response) => {
     try {
         if (!autoRebalancer) {
             return res.status(500).json({
@@ -368,7 +387,7 @@ router.post('/auto-rebalancer/start', requireAdmin, (req, res) => {
     }
 })
 
-router.post('/auto-rebalancer/stop', requireAdmin, (req, res) => {
+router.post('/auto-rebalancer/stop', requireAdmin, (req: Request, res: Response) => {
     try {
         if (!autoRebalancer) {
             return res.status(500).json({
@@ -393,7 +412,7 @@ router.post('/auto-rebalancer/stop', requireAdmin, (req, res) => {
     }
 })
 
-router.post('/auto-rebalancer/force-check', requireAdmin, async (req, res) => {
+router.post('/auto-rebalancer/force-check', requireAdmin, async (req: Request, res: Response) => {
     try {
         if (!autoRebalancer) {
             return res.status(500).json({
@@ -417,7 +436,7 @@ router.post('/auto-rebalancer/force-check', requireAdmin, async (req, res) => {
     }
 })
 
-router.get('/auto-rebalancer/history', requireAdmin, async (req, res) => {
+router.get('/auto-rebalancer/history', requireAdmin, async (req: Request, res: Response) => {
     try {
         const portfolioId = req.query.portfolioId as string
         const limit = parseInt(req.query.limit as string) || 50
@@ -450,7 +469,7 @@ router.get('/auto-rebalancer/history', requireAdmin, async (req, res) => {
 // ================================
 
 // Get comprehensive system status
-router.get('/system/status', async (req, res) => {
+router.get('/system/status', async (req: Request, res: Response) => {
     try {
         const portfolioCount = await portfolioStorage.getPortfolioCount()
         const historyStats = await rebalanceHistoryService.getHistoryStats()
@@ -518,7 +537,7 @@ router.get('/system/status', async (req, res) => {
 // ANALYTICS ROUTES
 // ================================
 
-router.get('/portfolio/:id/analytics', async (req, res) => {
+router.get('/portfolio/:id/analytics', async (req: Request, res: Response) => {
     try {
         const portfolioId = req.params.id
         const days = parseInt(req.query.days as string) || 30
@@ -551,7 +570,7 @@ router.get('/portfolio/:id/analytics', async (req, res) => {
     }
 })
 
-router.get('/portfolio/:id/performance-summary', async (req, res) => {
+router.get('/portfolio/:id/performance-summary', async (req: Request, res: Response) => {
     try {
         const portfolioId = req.params.id
 
@@ -586,7 +605,7 @@ router.get('/portfolio/:id/performance-summary', async (req, res) => {
 // ================================
 
 // Subscribe to notifications
-router.post('/notifications/subscribe', writeRateLimiter, idempotencyMiddleware, async (req, res) => {
+router.post('/notifications/subscribe', writeRateLimiter, idempotencyMiddleware, async (req: Request, res: Response) => {
     try {
         const { userId, emailEnabled, emailAddress, webhookEnabled, webhookUrl, events } = req.body
 
@@ -666,7 +685,7 @@ router.post('/notifications/subscribe', writeRateLimiter, idempotencyMiddleware,
 })
 
 // Get notification preferences
-router.get('/notifications/preferences', async (req, res) => {
+router.get('/notifications/preferences', async (req: Request, res: Response) => {
     try {
         const userId = req.query.userId as string
 
@@ -702,7 +721,7 @@ router.get('/notifications/preferences', async (req, res) => {
 })
 
 // Unsubscribe from notifications
-router.delete('/notifications/unsubscribe', async (req, res) => {
+router.delete('/notifications/unsubscribe', async (req: Request, res: Response) => {
     try {
         const userId = req.query.userId as string
 
@@ -736,7 +755,7 @@ router.delete('/notifications/unsubscribe', async (req, res) => {
 // ================================
 
 // Test notification delivery
-// router.post('/notifications/test', async (req, res) => {
+// router.post('/notifications/test', async (req: Request, res: Response) => {
 //     try {
 //         const { userId, eventType } = req.body
 
@@ -840,7 +859,7 @@ router.delete('/notifications/unsubscribe', async (req, res) => {
 // })
 
 // Test all notification types at once
-// router.post('/notifications/test-all', async (req, res) => {
+// router.post('/notifications/test-all', async (req: Request, res: Response) => {
 //     try {
 //         const { userId } = req.body
 
@@ -931,7 +950,7 @@ router.delete('/notifications/unsubscribe', async (req, res) => {
 // DEBUG ROUTES
 // ================================
 
-router.get('/debug/coingecko-test', blockDebugInProduction, async (req, res) => {
+router.get('/debug/coingecko-test', blockDebugInProduction, async (req: Request, res: Response) => {
     try {
         const apiKey = process.env.COINGECKO_API_KEY
         console.log('[DEBUG] API Key exists:', !!apiKey)
@@ -971,7 +990,7 @@ router.get('/debug/coingecko-test', blockDebugInProduction, async (req, res) =>
     }
 })
 
-router.get('/debug/force-fresh-prices', blockDebugInProduction, async (req, res) => {
+router.get('/debug/force-fresh-prices', blockDebugInProduction, async (req: Request, res: Response) => {
     try {
         console.log('[DEBUG] Clearing cache and forcing fresh prices...')
 
@@ -1000,7 +1019,7 @@ router.get('/debug/force-fresh-prices', blockDebugInProduction, async (req, res)
     }
 })
 
-router.get('/debug/reflector-test', blockDebugInProduction, async (req, res) => {
+router.get('/debug/reflector-test', blockDebugInProduction, async (req: Request, res: Response) => {
     try {
         console.log('[DEBUG] Testing reflector service...')
 
@@ -1027,7 +1046,7 @@ router.get('/debug/reflector-test', blockDebugInProduction, async (req, res) =>
     }
 })
 
-router.get('/debug/env', blockDebugInProduction, async (req, res) => {
+router.get('/debug/env', blockDebugInProduction, async (req: Request, res: Response) => {
     try {
         res.json({
             environment: process.env.NODE_ENV,
@@ -1046,7 +1065,7 @@ router.get('/debug/env', blockDebugInProduction, async (req, res) => {
     }
 })
 
-router.get('/debug/auto-rebalancer-test', blockDebugInProduction, async (req, res) => {
+router.get('/debug/auto-rebalancer-test', blockDebugInProduction, async (req: Request, res: Response) => {
     try {
         if (!autoRebalancer) {
             return res.json({
@@ -1086,7 +1105,7 @@ router.get('/debug/auto-rebalancer-test', blockDebugInProduction, async (req, re
  * Returns BullMQ queue depths and Redis connectivity status.
  * Used for worker health monitoring and alerting (issue #38).
  */
-router.get('/queue/health', async (req, res) => {
+router.get('/queue/health', async (req: Request, res: Response) => {
     try {
         const metrics = await getQueueMetrics()
         const httpStatus = metrics.redisConnected ? 200 : 503

backend/src/utils/helpers.ts

@@ -0,0 +1,20 @@
+export function getErrorMessage(error: unknown): string {
+    if (error instanceof Error) return error.message;
+    return String(error);
+}
+
+export function getErrorObject(error: unknown): Record<string, unknown> {
+    if (error instanceof Error) return { message: error.message, stack: error.stack, name: error.name };
+    return { error: String(error) };
+}
+
+export function parseOptionalBoolean(value: unknown): boolean | undefined {
+    if (value === undefined || value === null) return undefined;
+    if (typeof value === 'boolean') return value;
+    if (typeof value === 'string') {
+        const lower = value.trim().toLowerCase();
+        if (lower === 'true' || lower === '1') return true;
+        if (lower === 'false' || lower === '0') return false;
+    }
+    return undefined;
+}