Fix: Reject submit-signed from different session wallet

package.json

@@ -54,7 +54,7 @@
     "eslint": "^9.39.4",
     "eslint-config-next": "^16.2.2",
     "tailwindcss": "^4.2.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.15",
     "typescript": "^6.0.2",
     "vitest": "^4.1.9"
   }

src/app/api/audit/export/route.test.ts

@@ -176,6 +176,8 @@ describe("/api/audit/export route", () => {
     );
     const response = await GET(req);
 
+
+
     expect(response.status).toBe(200);
 
     const payload = (await response.json()) as {

src/app/api/auth/login/route.ts

@@ -179,6 +179,7 @@ export async function POST(request: NextRequest) {
       role: roles.includes("operator") ? "operator" : roles[0],
       roles,
       userId,
+      publicKey: normalizedWallet,
     });
 
     const response = jsonWithRequestContext(request, {

src/app/api/auth/refresh/route.test.ts

@@ -9,13 +9,15 @@ import {
   LOGKED_OUT.ERROR_CODE,
 } from "@/lib/auth/login-lockout";
 import { POST } from "@/app/api/auth/refresh/route";
+import { upsertUserWallet } from "@/lib/storage/user-wallet-store";
 
 function operatorCookie() {
   process.env.FORTEXA_AUTH_SECRET = "integration-test-secret";
   const token = createSessionToken({
     email: "operator@fortexa.local",
     role: "operator",
     userId: "refresh-operator",
+    publicKey: "GCDEFAULTTESTWALLET123",
     expiresInSeconds: 120,
   });
 
@@ -42,6 +44,7 @@ describe("/api/auth/refresh route", () => {
   });
 
   it("returns 200 and rotates for authenticated user", async () => {
+    await upsertUserWallet("refresh-operator", { publicKey: "GCDEFAULTTESTWALLET123", source: "external" });
     const request = new NextRequest("http://localhost/api/auth/refresh", {
       method: "POST",
       headers: { cookie: operatorCookie() },

src/app/api/auth/refresh/route.ts

@@ -4,6 +4,8 @@
 import { AUTH_COOKIE_KEY, createSessionToken } from "@/lib/auth/session";
 import { jsonWithRequestContext } from "@/lib/observability/http";
 import { getRequestLogContext, logInfo, logWarn } from "@/lib/observability/logger";
+import { getUserWallet } from "@/lib/storage/user-wallet-store";
+import { isLoginLocked, readClientIp } from "@/lib/auth/login-lockout";
 
 export async function POST(request: NextRequest) {
   const startedAtMs = Date.now();
@@ -17,28 +19,39 @@
   }
 
   const clientIp = readClientIp(request.headers);
-  const lockState = await isLoginLocked(auth.session.userId, clientIp);
-  if (lockState.locked) {
-    logWarn("Auth refresh blocked by lockout", {
-      ...context,
-      userId: auth.session.userId,
-      ip: clientIp,
-    });
-    const retryAfterSeconds = Math.max(1, lockState.retryAfterSeconds);
-    return jsonWithRequestContext(request, {
+  const sessionWallet = auth.session.publicKey;
+
+  if (sessionWallet) {
+    const lockState = await isLoginLocked(sessionWallet, clientIp);
+    if (lockState.locked) {
+      logWarn("Auth refresh blocked by lockout", { ...context, wallet: sessionWallet, ip: clientIp });
+      return jsonWithRequestContext(request, {
+        route: "/api/auth/refresh",
+        startedAtMs,
+        status: 401,
+        body: { error: "Account is temporarily locked. Refresh token invalid." },
+      });
+    }
+  }
+
+  const assignedWallet = await getUserWallet(auth.session.userId);
+  if (!assignedWallet || ("expired" in assignedWallet && assignedWallet.expired)) {
+    logWarn("Auth refresh wallet revoked or expired", { ...context, userId: auth.session.userId });
+    const response = jsonWithRequestContext(request, {
       route: "/api/auth/refresh",
       startedAtMs,
-      status: 423,
-      body: { error: LOCKED_ERROR, retryAfterSeconds: retryAfterSeconds },
-      headers: { "Retry-After": String(retryAfterSeconds) },
+      status: 401,
+      body: { error: "Session wallet mapping has expired or been revoked." },
     });
+    response.cookies.delete(AUTH_COOKIE_KEY);
+    return response;
   }
 
   const token = createSessionToken({
     email: auth.session.email,
     role: auth.session.role,
     userId: auth.session.userId,
-    sessionId: auth.session.sid,
+    publicKey: sessionWallet,
   });
 
   const response = jsonWithRequestContext(request, {

src/app/api/stellar/e2e-decision-build-submit.test.ts

@@ -74,6 +74,7 @@ function operatorCookie() {
     role: "operator",
     roles: ["operator", "signer"],
     userId: OPERATOR_USER_ID,
+    publicKey: sourceKeypair.publicKey(),
     expiresInSeconds: 300,
   });
 

src/app/api/stellar/submit-signed-idempotency.test.ts

@@ -98,6 +98,7 @@ function operatorCookie() {
     email: "idem-operator@fortexa.local",
     role: "signer",
     userId: OPERATOR_USER_ID,
+    publicKey: OPERATOR_WALLET_KEYPAIR.publicKey(),
     expiresInSeconds: 300,
   });
 

src/app/api/stellar/submit-signed/route.test.ts

@@ -1,13 +1,9 @@
-import {
-  Account,
-  Asset,
-  Keypair,
-  Memo,
-  Networks,
-  Operation,
-  TransactionBuilder,
-} from "@stellar/stellar-sdk";
-import { NextRequest, NextResponse } from "next/server";
+declare global {
+  var MOCK_SESSION_PUBLIC_KEY: string | undefined;
+}
+
+import { Account, Asset, Keypair, Networks, Operation, TransactionBuilder } from "@stellar/stellar-sdk";
+import { NextRequest } from "next/server";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { POST } from "./route";
@@ -165,33 +161,17 @@ function makeDecisionReceipt(
 
 beforeEach(() => {
   vi.clearAllMocks();
-  getAuditEntryMock.mockResolvedValue({
-    id: "00000000-0000-4000-8000-000000000000",
-    paymentQuote: { memo: "fortexa:test-action" },
-  });
-  verifyQuoteMock.mockReturnValue({ ok: true, quote: {} });
-  vi.mocked(requireAuth).mockReturnValue({
+  vi.mocked(requireAuth).mockImplementation(() => ({
     ok: true,
-    session: { userId: "user-1" },
-  } as ReturnType<typeof requireAuth>);
+    session: { userId: "user-1", publicKey: globalThis.MOCK_SESSION_PUBLIC_KEY || "GCDEFAULTTESTWALLET123" },
+  } as ReturnType<typeof requireAuth>));
 });
 
 describe("POST /api/stellar/submit-signed - source wallet verification", () => {
   it("accepts a submission whose XDR source matches the session wallet and the decision receipt", async () => {
     const walletKp = Keypair.random();
-    const destination = Keypair.random().publicKey();
-    const signedXdr = buildSignedXdr(
-      walletKp,
-      walletKp.publicKey(),
-      destination,
-      "1",
-      "approved-memo",
-    );
-    const decisionReceipt = makeDecisionReceipt(
-      destination,
-      "1",
-      "approved-memo",
-    );
+    globalThis.MOCK_SESSION_PUBLIC_KEY = walletKp.publicKey();
+    const signedXdr = buildSignedXdr(walletKp, walletKp.publicKey());
 
     vi.mocked(getUserWallet).mockResolvedValue({
       userId: "user-1",
@@ -295,7 +275,7 @@ describe("POST /api/stellar/submit-signed - source wallet verification", () => {
     const response = await POST(buildRequest({ signedXdr, decisionReceipt }));
     const body = await response.json();
 
-    expect(response.status).toBe(400);
+    expect(response.status).toBe(403);
     expect(body.error).toMatch(/does not match/i);
   });
 
@@ -332,6 +312,7 @@ describe("POST /api/stellar/submit-signed - source wallet verification", () => {
 
   it("rejects malformed XDR with a 400", async () => {
     const walletKp = Keypair.random();
+    globalThis.MOCK_SESSION_PUBLIC_KEY = walletKp.publicKey();
 
     vi.mocked(getUserWallet).mockResolvedValue({
       userId: "user-1",