test(config): spec the production-required-config validation

src/config/validate-required-config.spec.ts

@@ -0,0 +1,89 @@
+import {
+  collectConfigIssues,
+  assertRequiredConfig,
+  RequiredConfig,
+  INSECURE_DEFAULT_JWT_SECRET,
+  DEFAULT_LOCAL_DATABASE_URL,
+} from './validate-required-config';
+
+const prodConfig = (over: Partial<RequiredConfig> = {}): RequiredConfig =>
+  ({
+    env: 'production',
+    port: 3000,
+    jwt: { secret: 'a-real-secret' },
+    database: { url: 'postgresql://prod-host/db' },
+    github: {
+      clientId: 'cid',
+      clientSecret: 'csec',
+      webhookSecret: 'whsec',
+    },
+    stellar: {
+      escrowContractId: 'CESCROW',
+      treasurySecret: 'STREAS',
+    },
+    ...over,
+  }) as RequiredConfig;
+
+describe('collectConfigIssues', () => {
+  it('returns no issues for a complete production config', () => {
+    expect(collectConfigIssues(prodConfig())).toEqual([]);
+  });
+
+  it('returns no issues outside production', () => {
+    const dev = prodConfig({
+      env: 'development',
+      jwt: { secret: '' },
+      github: { clientId: '', clientSecret: '', webhookSecret: '' },
+    } as Partial<RequiredConfig>);
+    expect(collectConfigIssues(dev)).toEqual([]);
+  });
+
+  it('flags the insecure default JWT secret', () => {
+    const issues = collectConfigIssues(
+      prodConfig({ jwt: { secret: INSECURE_DEFAULT_JWT_SECRET } } as any),
+    );
+    expect(issues.some((i) => i.key === 'JWT_SECRET')).toBe(true);
+  });
+
+  it('flags a missing/blank JWT secret', () => {
+    const issues = collectConfigIssues(
+      prodConfig({ jwt: { secret: '   ' } } as any),
+    );
+    expect(issues.some((i) => i.key === 'JWT_SECRET')).toBe(true);
+  });
+
+  it('flags the default local DATABASE_URL', () => {
+    const issues = collectConfigIssues(
+      prodConfig({ database: { url: DEFAULT_LOCAL_DATABASE_URL } } as any),
+    );
+    expect(issues.some((i) => i.key === 'DATABASE_URL')).toBe(true);
+  });
+
+  it('flags missing escrow contract + treasury secret', () => {
+    const issues = collectConfigIssues(
+      prodConfig({
+        stellar: { escrowContractId: '', treasurySecret: '' },
+      } as any),
+    );
+    const keys = issues.map((i) => i.key);
+    expect(keys).toContain('ESCROW_CONTRACT_ID');
+    expect(keys).toContain('TREASURY_SECRET');
+  });
+});
+
+describe('assertRequiredConfig', () => {
+  it('does not throw for a valid production config', () => {
+    expect(() => assertRequiredConfig(prodConfig())).not.toThrow();
+  });
+
+  it('throws listing every problem at once', () => {
+    expect(() =>
+      assertRequiredConfig(
+        prodConfig({
+          jwt: { secret: '' },
+          stellar: { escrowContractId: '', treasurySecret: '' },
+        } as any),
+      ),
+    ).toThrow(/Refusing to start/);
+  });
+});

src/escrow/escrow.service.ts

@@ -584,20 +584,14 @@ export class EscrowService {
     recipients: Array<[string, number]>,
     manager?: EntityManager,
   ): Promise<ContractInvocationResult> {
-    return this.invokeOnLockedEscrow(escrow, operation, () =>
-      this.soroban.invoke(
-        'release',
-        // `release(issue_id: u64, recipients)` — u64-typed on-chain (#301).
-        [u64(this.onChainKeyFor(escrow)), recipients],
-        this.contractOpts(escrow),
-      ),
     return this.invokeOnLockedEscrow(
       escrow,
       operation,
       () =>
         this.soroban.invoke(
           'release',
-          [this.onChainKeyFor(escrow), recipients],
+          // `release(issue_id: u64, recipients)` — u64-typed on-chain (#301).
+          [u64(this.onChainKeyFor(escrow)), recipients],
           this.contractOpts(escrow),
         ),
       manager,

src/github/github-webhooks.service.spec.ts

@@ -869,6 +869,9 @@ describe('GithubWebhooksService', () => {
 
       expect(bountiesService.markInReview).not.toHaveBeenCalled();
       expect(bountiesService.markMergedAndRelease).not.toHaveBeenCalled();
+    });
+  });
+
   // #308: a redelivered X-GitHub-Delivery used to hit the unique constraint
   // on webhook_events.deliveryId and escape handleEvent as a 500, so every
   // redelivery of that event failed forever.

src/sponsors/sponsors.controller.ts

@@ -26,25 +26,6 @@ function validatePage(limit?: number, offset?: number) {
     throw new BadRequestException('offset must be >= 0');
   }
   return { limit, offset };
-/**
- * Parse optional limit/offset query params, rejecting NaN, negatives,
- * non-integers, and limits above MAX_PAGE_LIMIT with a 400 (#280).
- */
-function parsePagination(limit?: string, offset?: string) {
-  const parse = (name: string, raw: string | undefined, min: number, max: number) => {
-    if (raw === undefined || raw === '') return undefined;
-    const n = Number(raw);
-    if (!Number.isInteger(n) || n < min || n > max) {
-      throw new BadRequestException(
-        `${name} must be an integer between ${min} and ${max}`,
-      );
-    }
-    return n;
-  };
-  return {
-    limit: parse('limit', limit, 1, MAX_PAGE_LIMIT),
-    offset: parse('offset', offset, 0, Number.MAX_SAFE_INTEGER),
-  };
 }
 
 @ApiTags('sponsors')
@@ -73,7 +54,6 @@ export class SponsorsController {
   ) {
     this.assertOwnsSponsor(user, id);
     return this.sponsorsService.dashboard(id, validatePage(limit, offset));
-    return this.sponsorsService.dashboard(id, parsePagination(limit, offset));
   }
 
   @ApiBearerAuth()
@@ -91,6 +71,5 @@ export class SponsorsController {
       id,
       validatePage(limit, offset),
     );
-    return this.sponsorsService.milestoneProgress(id, parsePagination(limit, offset));
   }
 }