[ACOB-DEV]

Description

Implements critical security, consistency, and concurrency improvements across wallet-service:

1. Adds a permanent regression test pinning the deterministic contract ID derivation for passkey accounts.
2. Gates POST /wallet/policy/update on verifying referenced contracts against verification-service, rejecting unverified targets and failing closed when verification-service is unreachable.
3. Implements optimistic concurrency control (OCC) on POST /wallet/signer/manage to prevent race conditions during simultaneous signer additions/removals.
4. Adds actor-based filtering (passkey, device, policy) to GET /wallet/audit-logs, rejecting invalid actors with 400.

Closes #519
Closes #513
Closes #512
Closes #509

Changes proposed

What were you told to do?

• Issue [hard] services/wallet-service/src/derivation.ts - add a regression test pinning the deterministic address for a fixed passkey across stellar-sdk upgrades #519: Pin the derived wallet contract ID against a hardcoded constant in a regression test to prevent silent address drift.
• Issue [easy] POST /wallet/policy/update - reject a policy update that references a contract id with no verification record #513: Check referenced contract IDs in POST /wallet/policy/update against verification-service before accepting updates, failing with 400 on unverified contracts and 503 if verification-service is unreachable.
• Issue [medium] GET /wallet/audit-logs - add actor-based filtering (passkey vs device signer vs policy) #512: Add an actor query parameter to GET /wallet/audit-logs supporting passkey, device, and policy, filtering results accordingly, returning all if omitted, and returning 400 on invalid actor values.
• Issue [hard] POST /wallet/signer/manage - add a concurrency guard against two simultaneous signer-set mutations racing #509: Add optimistic concurrency control via sequence/version on POST /wallet/signer/manage, rejecting conflicting concurrent mutations with 409 Conflict and documenting the client retry contract.

What did I do?

Wallet Derivation Regression Test (#519)

• Added dedicated unit test suite in services/wallet-service/src/derivation.test.ts asserting deterministic derivation for standard test key ID against the pinned contract ID CA3TKZ44U5KVK7WHIIXVZ6WXVPNACXRQGKJL65L3I62QJRQF33BDSABY.

Policy Verification Gate (#513)

• Updated POST /wallet/policy/update in services/wallet-service/src/server.ts to inspect referenced contract IDs (in body or rules).
• Integrated verification check against verification-service endpoint /verification/:contractId/status and verificationClient dependency seam.
• Added strict handling: returns 400 unverified_contract if unverified, and 503 verification_service_unavailable if verification-service is unreachable.
• Added comprehensive unit tests in services/wallet-service/src/server.test.ts.

Signer Set OCC Concurrency Guard (#509)

• Added version/sequence tracking per wallet in services/wallet-service/src/server.ts.
• Gated POST /wallet/signer/manage against optimistic concurrency version checks.
• Returns 409 Conflict with signer_version_conflict error and current version when expected version does not match.
• Documented client retry protocol in route comments and error payload.
• Added unit tests covering sequential mutations, conflict detection, and retry workflows in server.test.ts.

Audit Logs Actor Filtering (#512)

• Added actor query parameter parsing and validation (passkey, device, policy) on GET /wallet/audit-logs.
• Implemented filtering matching explicit actor metadata or inferring from sensitive action type categories.
• Returns 400 invalid_actor for invalid values; preserves full audit trail output when omitted.
• Added unit tests covering all actor filters and invalid filter rejection.

Check List (Check all the applicable boxes)

• My code follows the code style of this project.
• This PR does not contain plagiarized content.
• The title and description of the PR is clear and explains the approach.
• I am making a pull request against the main branch (left side).
• My commit messages styles matches our requested structure.
• The implementation was reviewed and confirmed to work as intended.
• I am only making changes to files I was requested to.

Screenshots / Validation Evidence

• Prettier formatted touched files cleanly.
• Unit test coverage implemented in derivation.test.ts and server.test.ts testing happy paths, unverified contract rejection, unreachable verification service, concurrency conflicts, and actor query filtering.

[drips-wave]

@ACOB-DEV Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

Someone is attempting to deploy a commit to the david's projects Team on Vercel.

A member of the Team first needs to authorize it.