Skip to content

fix: validate userAddress as Stellar public key in createPortfolioSchema (Closes #63) - #72

Open
waterWang wants to merge 1 commit into
grantFoxin:mainfrom
waterWang:fix/portfolio-useraddress-validation
Open

fix: validate userAddress as Stellar public key in createPortfolioSchema (Closes #63)#72
waterWang wants to merge 1 commit into
grantFoxin:mainfrom
waterWang:fix/portfolio-useraddress-validation

Conversation

@waterWang

@waterWang waterWang commented Aug 24, 2026

Copy link
Copy Markdown

Summary

Closes #63 — validates userAddress as a Stellar ed25519 public key in createPortfolioSchema.

Changes

Backend validation

  • backend/src/api/validation.ts: Changed createPortfolioSchema.userAddress from z.string().min(1) to z.union([stellarAddressSchema, z.literal("demo-user")])
    • Real Stellar G... addresses are strictly validated via SDK's StrKey.isValidEd25519PublicKey
    • The special literal "demo-user" is accepted for demo mode (no wallet connected)
  • backend/src/api/routes.ts: Updated comment to reflect new validation

Tests

  • backend/src/test/validation.test.ts: Added 3 new tests (valid Stellar address, demo-user acceptance, arbitrary string rejection)
  • backend/src/test/api.integration.test.ts: Added 3 integration tests (demo-user, invalid address -> 400, valid G... -> 201). All existing tests updated to use real Stellar keys.

Test Results

120/133 tests pass. 10 pre-existing failures are environment issues (CoinGecko 503, rate-limit, unrelated to this change).

…ema (Closes grantFoxin#63)

- Change createPortfolioSchema.userAddress from z.string().min(1) to
  z.union([stellarAddressSchema, z.literal('demo-user')]) so valid Stellar
  G... addresses are strictly validated while demo mode still works.
- Update routes.ts comment to reflect the new validation.
- Update validation.test.ts and api.integration.test.ts to use real
  Stellar keys generated via Keypair.random().publicKey().
- Add tests: demo-user acceptance, invalid address rejection.
- 120/133 tests pass (10 failures are pre-existing environment issues:
  CoinGecko 503/rate-limit, unrelated to this change).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix: Portfolio creation accepts arbitrary strings as userAddress — no Stellar address validation

1 participant