LabsCrypt · abimbolaalabi · Jul 30, 2026 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
diff --git a/backend/prisma/schema.prisma b/backend/prisma/schema.prisma
@@ -87,5 +87,4 @@ model StreamEvent {
   @@index([transactionHash])
   @@index([createdAt])
   @@index([streamId, timestamp])
-  @@unique([transactionHash, eventType])
 }
diff --git a/backend/src/lib/indexer-state.ts b/backend/src/lib/indexer-state.ts
@@ -7,7 +7,6 @@ export interface IndexerStateRow {
   id: string;
   lastLedger: number;
   lastCursor: string | null;
-  createdAt: Date;
   updatedAt: Date;
 }
 

diff --git a/backend/src/middleware/admin-rate-limiter.middleware.ts b/backend/src/middleware/admin-rate-limiter.middleware.ts
@@ -15,7 +15,7 @@ export const adminRateLimiter = rateLimit({
     // Use x-forwarded-for or remote address as key
     const forwarded = req.headers['x-forwarded-for'];
     if (typeof forwarded === 'string') {
-      return forwarded.split(',')[0].trim();
+      return forwarded.split(',')[0]?.trim() ?? 'unknown';
     }
     return req.ip ?? 'unknown';
   },

diff --git a/backend/src/middleware/auth.ts b/backend/src/middleware/auth.ts
@@ -31,6 +31,9 @@ if (isProduction) {
 
 const JWT_EXPIRY_SECONDS = 3600; // 1 hour max per spec
 
+const JWT_ISSUER = process.env.JWT_ISSUER || 'flowfi-api';
+const JWT_AUDIENCE = process.env.JWT_AUDIENCE || 'flowfi-api';
+
 const STELLAR_NETWORK =
   process.env.STELLAR_NETWORK === 'mainnet'
     ? StellarSdk.Networks.PUBLIC
@@ -130,6 +133,11 @@ export function verifyJwt(token: string): { publicKey: string } | null {
       return null;
     }
 
+    // Verify issuer and audience
+    if (payload.iss !== JWT_ISSUER || payload.aud !== JWT_AUDIENCE) {
+      return null;
+    }
+
     return { publicKey: payload.sub };
   } catch {
     return null;
@@ -205,7 +213,7 @@ export function verifyChallenge(req: Request, res: Response): void {
     challenges.delete(publicKey);
 
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: publicKey, iat: now, exp: now + JWT_EXPIRY_SECONDS });
+    const token = signJwt({ sub: publicKey, iat: now, exp: now + JWT_EXPIRY_SECONDS, iss: JWT_ISSUER, aud: JWT_AUDIENCE });
     res.json({ token, expiresIn: JWT_EXPIRY_SECONDS });
   } catch (err) {
     logger.error('[Auth] verifyChallenge error:', err);

diff --git a/backend/src/routes/health.routes.ts b/backend/src/routes/health.routes.ts
@@ -2,6 +2,8 @@ import { Router, type Request, type Response } from 'express';
 import { prisma } from '../lib/prisma.js';
 import { INDEXER_STATE_ID } from '../lib/indexer-state.js';
 import { sorobanEventWorker } from '../workers/soroban-event-worker.js';
+import { isRedisAvailable } from '../lib/redis.js';
+import { checkRpcHealth } from '../services/sorobanService.js';
 
 const router = Router();
 
@@ -161,7 +163,7 @@ router.get('/', async (_req: Request, res: Response) => {
         status: dbStatus === 'connected' ? 'ok' : 'down',
       },
       indexer: {
-        status: !indexerEnabled ? 'disabled' : indexerDegraded ? 'degraded' : 'ok',
+        status: !indexerEnabled ? 'disabled' : indexerLagDegraded ? 'degraded' : 'ok',
         enabled: indexerEnabled,
         lagSeconds: indexerLag === -1 ? null : indexerLag,
       },

diff --git a/backend/src/services/soroban-indexer.service.ts b/backend/src/services/soroban-indexer.service.ts
@@ -185,8 +185,7 @@ export class SorobanIndexerService {
       const ratePerSecond = this.readString(value, 'rate_per_second', 'ratePerSecond');
       const depositedAmount = this.readString(value, 'deposited_amount', 'depositedAmount');
       const startTimeRaw = value.start_time ?? value.startTime ?? timestamp;
-      const startTime = BigInt(startTimeRaw ?? timestamp);
-      const timestampBigInt = BigInt(timestamp);
+      const startTime = BigInt(String(startTimeRaw ?? timestamp));
 
       if (!sender || !recipient || !tokenAddress || !ratePerSecond || !depositedAmount) return;
 

diff --git a/backend/src/types/auth.types.ts b/backend/src/types/auth.types.ts
@@ -30,4 +30,6 @@ export interface SEP10TokenPayload {
   sub: string; // Stellar public key
   iat: number; // Issued at
   exp: number; // Expiration
+  iss: string; // Issuer
+  aud: string; // Audience
 }
diff --git a/backend/src/workers/soroban-event-worker.ts b/backend/src/workers/soroban-event-worker.ts
@@ -1,9 +1,8 @@
-import { randomUUID } from "crypto";
 import { rpc, xdr, StrKey } from "@stellar/stellar-sdk";
 import { prisma } from "../lib/prisma.js";
 import { INDEXER_STATE_ID, ensureIndexerState } from "../lib/indexer-state.js";
 import { sseService } from "../services/sse.service.js";
-import logger, { requestContext } from "../logger.js";
+import logger from "../logger.js";
 import { Prisma } from "../generated/prisma/index.js";
 import "../lib/stream-id.js";
 
@@ -35,7 +34,7 @@
 * Full value = hi * 2^64 + lo.
 */
 export function decodeI128(val: xdr.ScVal): string {
  const parts = val.i128();
  const hi = BigInt.asIntN(64, BigInt(parts.hi().toString()));
  const lo = BigInt.asUintN(64, BigInt(parts.lo().toString()));
  return ((hi << 64n) | lo).toString();
@@ -113,13 +112,6 @@
   /** Recent attempt outcomes for sliding-window spike detection. */
   private recentOutcomes: { ok: boolean; at: number }[] = [];
 
-  /**
-   * Stable id attached to every log line emitted by the background poll
-   * loop, since these callbacks fire outside of any HTTP request and would
-   * otherwise have no requestContext (and thus no correlation id) at all.
-   */
-  private readonly workerId = `soroban-worker:${randomUUID()}`;
-
   constructor() {
     const rpcUrl =
       process.env.SOROBAN_RPC_URL ?? "https://soroban-testnet.stellar.org";
@@ -1128,7 +1120,7 @@
       // Calculate the duration of this pause interval
       let additionalPausedDuration = 0;
       if (currentStream.pausedAt) {
-        additionalPausedDuration = timestamp - currentStream.pausedAt;
+        additionalPausedDuration = timestamp - Number(currentStream.pausedAt);
       }
 
       const newTotalPausedDuration =

diff --git a/backend/tests/auth-jwt.test.ts b/backend/tests/auth-jwt.test.ts
@@ -16,14 +16,14 @@ describe('JWT helpers', () => {
 
   it('round-trips through verifyJwt', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
 
     expect(verifyJwt(token)).toEqual({ publicKey: 'GTESTPUBLICKEY123' });
   });
 
   it('returns null for a tampered header', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
     const parts = token.split('.') as [string, string, string];
     parts[0] = parts[0].slice(0, -1) + (parts[0].slice(-1) === 'A' ? 'B' : 'A');
 
@@ -32,7 +32,7 @@ describe('JWT helpers', () => {
 
   it('returns null for a tampered body', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
     const parts = token.split('.') as [string, string, string];
     parts[1] = parts[1].slice(0, -1) + (parts[1].slice(-1) === 'A' ? 'B' : 'A');
 
@@ -41,7 +41,7 @@ describe('JWT helpers', () => {
 
   it('returns null for a tampered signature', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'flowfi-api' });
     const parts = token.split('.') as [string, string, string];
     // Replace the signature with invalid data to ensure verification fails
     parts[2] = 'invalid-signature-data-1234567890abcdef';
@@ -51,7 +51,21 @@ describe('JWT helpers', () => {
 
   it('returns null for an expired token', async () => {
     const now = Math.floor(Date.now() / 1000);
-    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now - 3600, exp: now - 1 });
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now - 3600, exp: now - 1, iss: 'flowfi-api', aud: 'flowfi-api' });
+
+    expect(verifyJwt(token)).toBeNull();
+  });
+
+  it('returns null for a token with wrong audience', async () => {
+    const now = Math.floor(Date.now() / 1000);
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'flowfi-api', aud: 'wrong-audience' });
+
+    expect(verifyJwt(token)).toBeNull();
+  });
+
+  it('returns null for a token with wrong issuer', async () => {
+    const now = Math.floor(Date.now() / 1000);
+    const token = signJwt({ sub: 'GTESTPUBLICKEY123', iat: now, exp: now + 3600, iss: 'wrong-issuer', aud: 'flowfi-api' });
 
     expect(verifyJwt(token)).toBeNull();
   });

diff --git a/backend/tests/auth.test.ts b/backend/tests/auth.test.ts
@@ -307,9 +307,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_admin_middleware_rejects_non_admin_token', async () => {
       const nonAdminKeypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: nonAdminKeypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       // Set admin key to something else
@@ -326,9 +330,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_admin_middleware_accepts_admin_token', async () => {
       const adminKeypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: adminKeypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       process.env.ADMIN_PUBLIC_KEY = adminKeypair.publicKey();
@@ -343,9 +351,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_admin_middleware_fails_closed_when_key_unset', async () => {
       const keypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: keypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       // Unset the admin key
@@ -371,9 +383,13 @@ describe('Authentication & Middleware Tests', () => {
 
     it('test_events_endpoint_allows_authenticated_matching_address', async () => {
       const keypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: keypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       const res = await request(app)
@@ -388,9 +404,13 @@ describe('Authentication & Middleware Tests', () => {
     it('test_events_endpoint_rejects_authenticated_mismatched_address', async () => {
       const keypair = makeKeypair();
       const otherKeypair = makeKeypair();
+      const now = Math.floor(Date.now() / 1000);
       const token = signJwt({
         sub: keypair.publicKey(),
-        exp: Math.floor(Date.now() / 1000) + 3600,
+        iat: now,
+        exp: now + 3600,
+        iss: 'flowfi-api',
+        aud: 'flowfi-api',
       });
 
       const res = await request(app)

diff --git a/backend/tests/claimable.service.test.ts b/backend/tests/claimable.service.test.ts
@@ -3,7 +3,7 @@ import { ClaimableAmountService } from '../src/services/claimable.service.js';
 
 function makeStreamState(overrides: Partial<Parameters<ClaimableAmountService['getClaimableAmount']>[0]> = {}) {
   return {
-    streamId: 1,
+    streamId: 1n,
     ratePerSecond: '10',
     depositedAmount: '100',
     withdrawnAmount: '0',
@@ -35,7 +35,7 @@ describe('ClaimableAmountService', () => {
 
     const result = service.getClaimableAmount({
       ...makeStreamState({
-        streamId: 1,
+        streamId: 1n,
         ratePerSecond: '5',
         depositedAmount: '500',
         withdrawnAmount: '100',
@@ -61,7 +61,7 @@ describe('ClaimableAmountService', () => {
 
     const result = service.getClaimableAmount({
       ...makeStreamState({
-        streamId: 2,
+        streamId: 2n,
         depositedAmount: '1000',
         withdrawnAmount: '900',
       }),
@@ -80,7 +80,7 @@ describe('ClaimableAmountService', () => {
 
     const result = service.getClaimableAmount({
       ...makeStreamState({
-        streamId: 3,
+        streamId: 3n,
         withdrawnAmount: '100',
         isActive: false,
       }),
@@ -98,7 +98,7 @@ describe('ClaimableAmountService', () => {
 
     const result = service.getClaimableAmount({
       ...makeStreamState({
-        streamId: 4,
+        streamId: 4n,
         withdrawnAmount: '150',
       }),
     });
@@ -114,7 +114,7 @@ describe('ClaimableAmountService', () => {
     });
 
     const input = makeStreamState({
-      streamId: 5,
+      streamId: 5n,
       ratePerSecond: '7',
       depositedAmount: '700',
     });
@@ -146,7 +146,7 @@ describe('ClaimableAmountService', () => {
     });
 
     const preWithdrawalState = makeStreamState({
-      streamId: 7,
+      streamId: 7n,
       ratePerSecond: '10',
       depositedAmount: '1000',
       withdrawnAmount: '0',
@@ -166,7 +166,7 @@ describe('ClaimableAmountService', () => {
     // and lastUpdateTime are advanced on the stream row, exactly as
     // handleTokensWithdrawn does in soroban-event-worker.ts.
     const postWithdrawalState = makeStreamState({
-      streamId: 7,
+      streamId: 7n,
       ratePerSecond: '10',
       depositedAmount: '1000',
       withdrawnAmount: '400',
@@ -191,7 +191,7 @@ describe('ClaimableAmountService', () => {
 
     const result = service.getClaimableAmount({
       ...makeStreamState({
-        streamId: 6,
+        streamId: 6n,
         ratePerSecond: i128Max,
         depositedAmount: i128Max,
         withdrawnAmount: '42',
@@ -228,7 +228,7 @@ describe('ClaimableAmountService', () => {
 
       const result = service.getClaimableAmount({
         ...makeStreamState({
-          streamId: 10_000 + iteration,
+          streamId: 10_000n + BigInt(iteration),
           ratePerSecond: rate.toString(),
           depositedAmount: deposited.toString(),
           withdrawnAmount: withdrawn.toString(),

diff --git a/backend/tests/eventRace.test.ts b/backend/tests/eventRace.test.ts
@@ -54,7 +54,7 @@ describe('Action Controller vs Worker Event Write Race Guard (Issue #831)', () =
 
   it('withdrawHandler uses upsert on transactionHash_eventType preventing P2002 duplicate crashes when worker processes event first', async () => {
     const mockStream = {
-      streamId: 100,
+      streamId: 100n,
       recipient: 'GRECIPIENT',
       withdrawnAmount: '0',
       depositedAmount: '1000',
@@ -77,7 +77,7 @@ describe('Action Controller vs Worker Event Write Race Guard (Issue #831)', () =
         },
       },
       create: expect.objectContaining({
-        streamId: 100,
+        streamId: 100n,
         eventType: 'WITHDRAWN',
         transactionHash: 'tx_race_123',
       }),

diff --git a/backend/tests/events-wire-format.test.ts b/backend/tests/events-wire-format.test.ts
@@ -91,7 +91,7 @@ describe('event wire format', () => {
 
       expect(decodedKeys).toEqual([...allFields].sort());
 
-      for (const field of HANDLER_READ_FIELDS[eventName]) {
+      for (const field of HANDLER_READ_FIELDS[eventName] ?? []) {
         expect(decoded).toHaveProperty(field);
       }
     },

diff --git a/backend/tests/indexer-state.test.ts b/backend/tests/indexer-state.test.ts
@@ -1,7 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
-const mockFindUnique = vi.fn();
-const mockCreate = vi.fn();
+const { mockFindUnique, mockCreate } = vi.hoisted(() => ({
+  mockFindUnique: vi.fn(),
+  mockCreate: vi.fn(),
+}));
 
 vi.mock('../src/lib/prisma.js', () => ({
   prisma: {