fix(#677): add CSP headers in vite.config.js

.github/workflows/backend-ci.yml

@@ -0,0 +1,86 @@
+name: Backend CI
+
+on:
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - "backend/**"
+      - ".github/workflows/backend-ci.yml"
+
+defaults:
+  run:
+    working-directory: backend
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+
+      - run: npm ci
+      - run: npm run lint
+
+  test:
+    name: Test & Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: swiftremit_test
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+
+      - run: npm ci
+
+      - name: Run migrations
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/swiftremit_test
+        run: psql $DATABASE_URL -f migrations/webhook_schema.sql
+
+      - name: Run tests with coverage
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/swiftremit_test
+          NODE_ENV: test
+        run: npx vitest run --coverage --reporter=verbose
+
+      - name: Upload coverage report artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: backend-coverage
+          path: backend/coverage/
+          retention-days: 7
+
+      - name: Post coverage summary as PR comment
+        if: always() && github.event_name == 'pull_request'
+        uses: davelosert/vitest-coverage-report-action@v2
+        with:
+          json-summary-path: backend/coverage/coverage-summary.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: Backend Coverage

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
           cache-dependency-path: backend/package-lock.json
       - run: npm ci
         working-directory: backend
-      - run: npm run lint || echo "Linter not configured yet"
+      - run: npm run lint
         working-directory: backend
 
   backend-test:
@@ -141,6 +141,21 @@ jobs:
 
 
   # -- Frontend coverage --
+  frontend-lint:
+    name: Frontend lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - run: npm ci
+        working-directory: frontend
+      - run: npm run lint
+        working-directory: frontend
+
   frontend-coverage:
     name: Frontend coverage (vitest >= 95%)
     runs-on: ubuntu-latest
@@ -181,6 +196,7 @@ jobs:
       - backend-test
       - api-lint
       - api-test
+      - frontend-lint
       - frontend-coverage
     if: always()
     steps:

.github/workflows/release.yml

@@ -0,0 +1,112 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: Verify CHANGELOG entry
+        run: |
+          if ! grep -q "## \[${{ steps.version.outputs.VERSION }}\]" CHANGELOG.md; then
+            echo "Error: No CHANGELOG entry found for version ${{ steps.version.outputs.VERSION }}"
+            exit 1
+          fi
+
+      - name: Install SDK dependencies
+        working-directory: sdk
+        run: npm ci
+
+      - name: Build SDK
+        working-directory: sdk
+        run: npm run build
+
+      - name: Update SDK package version
+        working-directory: sdk
+        run: npm version ${{ steps.version.outputs.VERSION }} --no-git-tag-version
+
+      - name: Publish SDK to npm
+        working-directory: sdk
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Generate release notes
+        id: release_notes
+        run: |
+          gh release create ${{ github.ref_name }} \
+            --title "Release ${{ steps.version.outputs.VERSION }}" \
+            --generate-notes \
+            --verify-tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Extract changelog for this version
+        id: changelog
+        run: |
+          VERSION="${{ steps.version.outputs.VERSION }}"
+          CHANGELOG=$(awk "/## \[$VERSION\]/,/## \[/" CHANGELOG.md | sed '$d' | tail -n +2)
+          echo "CHANGELOG<<EOF" >> $GITHUB_OUTPUT
+          echo "$CHANGELOG" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Update release with changelog
+        run: |
+          gh release edit ${{ github.ref_name }} \
+            --notes "${{ steps.changelog.outputs.CHANGELOG }}"
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  build-artifacts:
+    runs-on: ubuntu-latest
+    needs: release
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          target: wasm32-unknown-unknown
+
+      - name: Install Soroban CLI
+        run: |
+          cargo install --locked soroban-cli --features opt
+
+      - name: Build contract
+        run: |
+          cargo build --target wasm32-unknown-unknown --release
+          soroban contract optimize \
+            --wasm target/wasm32-unknown-unknown/release/swiftremit.wasm \
+            --wasm-out swiftremit-optimized.wasm
+
+      - name: Upload contract artifact
+        run: |
+          gh release upload ${{ github.ref_name }} \
+            swiftremit-optimized.wasm \
+            --clobber
+        env:
+          GH_TOKEN: ${{ github.token }}

.gitignore

@@ -15,3 +15,7 @@ backend/node_modules/
 
 .kiro
 .env.testnet.local
+
+# Test artifacts
+test_snapshots/
+proptest-regressions/

CHANGELOG.md

@@ -0,0 +1,57 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+- Dark mode support with CSS custom properties and theme toggle component
+- Correlation ID propagation from API through to webhook delivery
+- CHANGELOG.md following Keep a Changelog format
+- Automated release workflow with GitHub Actions
+
+### Fixed
+- `withdraw_integrator_fees` correctly returns `NoFeesToWithdraw` when balance is zero
+
+## [1.0.0] - 2024-01-15
+
+### Added
+- Escrow-based remittance system with USDC on Stellar/Soroban
+- Agent network registration and management
+- Automated fee collection and withdrawal
+- Lifecycle state management (Pending, Processing, Completed, Cancelled)
+- Role-based access control for all operations
+- Comprehensive event emission for off-chain monitoring
+- Cancellation support with full refund capability
+- Admin controls for platform fee management
+- Daily send limits per currency/country with rolling 24h windows
+- Off-chain proof commitments with optional validation
+- Asset verification via Stellar Expert API and stellar.toml
+- Circuit breaker for emergency pause functionality
+- Rate limiting and abuse protection
+- Webhook system with HMAC signature verification
+- Webhook delivery retry with exponential backoff
+- Dead-letter queue for failed webhook deliveries
+- KYC integration with anchor services
+- FX rate caching and currency conversion API
+- Transaction state machine with enforced transitions
+- Health check endpoints for monitoring
+- OpenAPI documentation
+- Property-based testing for fee calculations
+- Integration tests for contract upgrade scenarios
+- Frontend React application with Stellar wallet integration
+- TypeScript SDK for contract interaction
+- PostgreSQL backend for off-chain data
+- Docker containerization for all services
+- CI/CD pipeline with GitHub Actions
+
+### Security
+- HMAC-SHA256 webhook signature verification
+- XSS sanitization for user inputs
+- Admin audit logging
+- Blacklist functionality for malicious actors
+- Token whitelist for approved assets
+

Cargo.toml

@@ -32,6 +32,21 @@ name = "settlement_storage"
 harness = false
 required-features = ["benchmarks"]
 
+[[bench]]
+name = "fee_calculation"
+harness = false
+required-features = ["benchmarks"]
+
+[[bench]]
+name = "batch_expiry"
+harness = false
+required-features = ["benchmarks"]
+
+[[bench]]
+name = "abuse_protection"
+harness = false
+required-features = ["benchmarks"]
+
 [profile.release]
 opt-level = "z"
 overflow-checks = true

DEPLOYMENT.md

@@ -330,6 +330,59 @@ stellar contract build
 
 ---
 
+## Storage TTL Management
+
+Soroban contracts use two storage tiers with different TTL behaviours:
+
+| Storage type | Scope | Default TTL | Risk if expired |
+|---|---|---|---|
+| **Instance** | Contract-wide config (admin, fee, counters) | ~1 month | Contract becomes unusable |
+| **Persistent** | Per-entity data (remittances, agents, limits) | ~1 month | Individual records lost |
+| **Temporary** | Rate-limit windows, sliding windows | Short (hours) | Resets automatically — acceptable |
+
+### Key audit
+
+| Key | Storage | TTL strategy |
+|---|---|---|
+| `Admin`, `UsdcToken`, `PlatformFeeBps`, `RemittanceCounter`, `AccumulatedFees` | Instance | Extended by `extend_storage_ttl` |
+| `Remittance(id)` | Persistent | Extended by `extend_storage_ttl` for all IDs up to counter |
+| `AgentRegistered(addr)` | Persistent | Extended by `extend_storage_ttl` |
+| `DailyLimit(currency, country)` | Persistent | Extended by `extend_storage_ttl` |
+| `RateLimitEntry(addr)` | Temporary | Self-managed (TTL = window + 1 h) |
+| `SlidingWindowEntry(addr, tag)` | Temporary | Self-managed (TTL = 2 × window) |
+
+### Extending TTLs manually
+
+```bash
+stellar contract invoke \
+  --id $CONTRACT_ID \
+  --source admin \
+  --network testnet \
+  -- \
+  extend_storage_ttl \
+  --caller $ADMIN_ADDRESS \
+  --extend_by_ledgers 518400
+```
+
+`518400` ledgers ≈ 30 days at 5-second ledger time.
+
+### Automated TTL extension (backend scheduler)
+
+The backend scheduler runs `extendContractStorageTtl()` daily at midnight UTC.
+Configure the following environment variables in `backend/.env`:
+
+```env
+CONTRACT_ID=your_contract_id
+SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
+NETWORK_PASSPHRASE=Test SDF Network ; September 2015
+ADMIN_SECRET_KEY=your_admin_secret_key
+```
+
+The job extends TTLs by **518 400 ledgers (~30 days)** each run, providing a
+comfortable buffer before the next scheduled execution.
+
+---
+
 ## Support
 
 - **Documentation**: See README.md files in each directory