fix: resolve issues #752, #751, #750, and #749

[Miss-shelby]

Summary of Changes

This Pull Request addresses and resolves the following 4 issues:

1. Issue #752 — Validate Oracle reading numeric value is finite

• Added @IsFiniteNumber() custom validation decorator in src/oracle/dto/oracle-reading.dto.ts that explicitly rejects NaN, Infinity, and -Infinity.
• Added OracleReadingDto with validation ensuring numeric values are finite numbers and returning clear validation errors.
• Applied validation to OracleFeedRequestDto latitude and longitude coordinates.
• Added comprehensive unit tests in src/oracle/dto/oracle-reading.dto.spec.ts (34 tests passing).
• Closes [bug] Oracle reading DTO does not validate numeric value is finite #752

2. Issue #751 — Handle webhook delivery redirects to different domains

• Updated src/common/events/webhooks.service.ts HTTP dispatch to set redirect: 'manual'.
• Validates redirect target domain against the original origin. If a redirect attempts to navigate to a different domain (or opaqueredirect cross-origin), the redirect is blocked and logged as a security violation to prevent leaking signed payloads.
• Added test coverage in src/common/events/webhooks.service.spec.ts testing 301, 302, 307, and 308 cross-domain and same-domain redirects.
• Closes [bug] Webhook delivery does not handle redirects to different domains #751

3. Issue #750 — Redact database connection string in connection failure logs

• Updated src/prisma/prisma.service.ts with getHostAndDatabaseFromUrl() and sanitizeConnectionError() to redact connection URLs (protocol://***:***@host/db).
• Error messages and retry logs only display [target: host/database], completely omitting credentials, passwords, and sensitive query parameters.
• Added test coverage in src/prisma/prisma.service.spec.ts verifying error logs and exceptions never expose credentials.
• Closes [security] Database connection string logged in error messages on connection failure #750

4. Issue #749 — Implement cursor-based pagination for claims

• Implemented cursor-based (keyset) pagination in src/claims/claims.service.ts using Prisma cursor: { id: cursor }, skip: 1, take: limit + 1.
• Updated src/claims/claims.controller.ts with query parameter @Query('cursor') on getClaimsByWalletQuery and getClaimHistory.
• Updated PaginatedResponseDto with nextCursor and hasMore fields.
• Maintained 100% backward compatibility for clients using traditional offset page and limit.
• Added benchmark comparison and pagination contract documentation in docs/CLAIMS_PAGINATION.md.
• Added unit tests and benchmark test in src/claims/claims.pagination.spec.ts and src/claims/claims.controller.spec.ts.
• Closes [perf] Claims pagination uses offset which degrades on large tables #749

---

Closing Keywords

• Closes [bug] Oracle reading DTO does not validate numeric value is finite #752
• Closes [bug] Webhook delivery does not handle redirects to different domains #751
• Closes [security] Database connection string logged in error messages on connection failure #750
• Closes [perf] Claims pagination uses offset which degrades on large tables #749

[drips-wave]

@Miss-shelby Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits