Secure Wallet Endpoints with JWT Authentication [wallet - service]

[salazarsebas]

🔑 Secure Wallet Endpoints with JWT Authentication 🛠️

📝 Description

Secure wallet-related API endpoints in the Stellar wallet service by applying JWT authentication middleware. This will ensure that only users with valid JWTs, issued after successful WebAuthn authentication, can access sensitive wallet operations such as account creation and management. The implementation will protect the /wallet/* endpoints to enhance the security of the service.

🎯 Objective

Apply the JWT middleware from src/auth/jwt.js to secure the /wallet/* endpoints in services/stellar-wallet/src/routes/wallet.js, with a unit test to verify access control.

🗂 Structure

• Directory: services/stellar-wallet
• Files:
  • src/routes/wallet.js (updated)
  • tests/routes/wallet.test.js (updated)
• Expected structure:

  services/stellar-wallet
  ├── src
  │   ├── index.js
  │   ├── stellar
  │   │   ├── client.js
  │   │   ├── keys.js
  │   │   └── fund.js
  │   ├── db
  │   │   └── kyc.js
  │   ├── routes
  │   │   ├── kyc.js
  │   │   ├── kyc-verify.js
  │   │   ├── kyc-status.js
  │   │   ├── auth-register.js
  │   │   ├── auth-verify.js
  │   │   ├── auth-login.js
  │   │   └── wallet.js
  │   ├── kyc
  │   │   └── validate.js
  │   ├── soroban
  │   │   ├── client.js
  │   │   ├── kyc-contract.rs
  │   │   └── deploy.js
  │   └── auth
  │       ├── webauthn.js
  │       └── jwt.js
  ├── config
  │   └── db.sqlite
  ├── tests
  │   ├── stellar
  │   │   ├── client.test.js
  │   │   ├── keys.test.js
  │   │   └── fund.test.js
  │   ├── db
  │   │   └── kyc.test.js
  │   ├── routes
  │   │   ├── kyc.test.js
  │   │   ├── kyc-verify.test.js
  │   │   ├── kyc-status.test.js
  │   │   ├── auth-register.test.js
  │   │   ├── auth-verify.test.js
  │   │   ├── auth-login.test.js
  │   │   └── wallet.test.js
  │   ├── kyc
  │   │   └── validate.test.js
  │   ├── soroban
  │   │   ├── client.test.js
  │   │   └── deploy.test.js
  │   └── auth
  │       └── jwt.test.js
  ├── package.json
  ├── .env.example
  ├── .eslintrc.json
  ├── .eslintignore
  ├── .prettierrc.json
  ├── .prettierignore
  ├── .gitignore
  

✅ Requirements

• Create a branch named feat/secure-wallet-endpoints for this task.
• Update src/routes/wallet.js to apply the jwtMiddleware from src/auth/jwt.js (Issue 20) to the POST /wallet/create endpoint.
• Ensure the middleware checks for a valid JWT in the Authorization: Bearer <token> header.
• Return HTTP 401 with a JSON error message (e.g., { error: "Unauthorized" }) if the JWT is missing or invalid.
• Return HTTP 403 with a JSON error message (e.g., { error: "Forbidden" }) if the user_id in the JWT does not match the user_id in the request body.
• Update src/index.js to apply jwtMiddleware to all /wallet/* routes for consistency.
• Update the unit test in tests/routes/wallet.test.js to verify:
  • Requests with a valid JWT and matching user_id succeed (HTTP 201 for POST /wallet/create).
  • Requests without a JWT return HTTP 401.
  • Requests with a valid JWT but mismatched user_id return HTTP 403.
• Mock the JWT middleware and SQLite database in the unit test to avoid external dependencies.
• Ensure the code adheres to ESLint and Prettier rules (from Issue 3).
• Commit changes to the feat/secure-wallet-endpoints branch with a message like feat: secure wallet endpoints.
• Verify that the CI pipeline (from Issue 1) passes, with linting and test jobs succeeding.

🏆 Expected Outcomes

• src/routes/wallet.js applies jwtMiddleware to the POST /wallet/create endpoint.
• /wallet/* routes are protected by jwtMiddleware in src/index.js.
• Valid JWTs with matching user_id allow access to the POST /wallet/create endpoint.
• Missing or invalid JWTs return HTTP 401 with a JSON error message.
• Mismatched user_id returns HTTP 403 with a JSON error message.
• Updated unit test in tests/routes/wallet.test.js confirms access control behavior.
• Code passes ESLint and Prettier checks.
• Changes are committed to the feat/secure-wallet-endpoints branch with a descriptive lowercase commit message.
• CI pipeline runs successfully, with linting passing for updated src/routes/wallet.js and tests/routes/wallet.test.js, and the unit test passing.

🔗 References

• jsonwebtoken Node.js Package
• Express Middleware
• Jest Mocking
• ESLint Node.js Rules

📋 Notes

• The jwtMiddleware should extract and validate the JWT from the Authorization: Bearer <token> header.
• The user_id in the JWT payload must match the user_id in the request body to prevent unauthorized access.
• Mocking the JWT middleware and SQLite database in tests ensures reliable CI execution.
• Ensure error messages are consistent with other endpoints (e.g., JSON format { error: "message" }).
• Commit messages must be in lowercase and start with feat, change, fix, chore, or refactor.
• The CI pipeline should validate the updated code, ensuring ESLint passes and the unit test executes successfully.

[akintewe]

Hello good day i am akintewe and i am excited to work on the project .

✍🏼 Background:
I'm a full-stack developer with 4+ years of experience building complex forms and e-commerce systems. I've previously developed inventory management systems for agricultural businesses and am well-versed in handling image processing and state management at scale.

ETA 4 hours

[davedumto]

Hi, my name is David, and I am a fullstack developer skilled in React, Next.js, TypeScript, and Tailwind CSS. For this task, I will:

• Apply jwtMiddleware from src/auth/jwt.js to protect POST /wallet/create in services/stellar-wallet/src/routes/wallet.js, validating Authorization: Bearer <token>.
• Enforce JWT checks in src/index.js for all /wallet/* routes so wallet endpoints are uniformly protected.
• Return 401 { error: "Unauthorized" } for missing/invalid tokens and 403 { error: "Forbidden" } when user_id in the JWT does not match request body.
• Update tests/routes/wallet.test.js to mock the JWT middleware and SQLite DB, and add tests for: valid JWT + matching user_id (201), missing JWT (401), and mismatched user_id (403).
• Create branch feat/secure-wallet-endpoints, commit with feat: secure wallet endpoints, and ensure ESLint/Prettier compliance and passing CI tests.

ETA: 1 day

~ OnlyDust Stellar Fellow

Recommended by OnlyDust for high-quality and dependable contributions.