fix: idempotency validation and shared store, timeout abort, signed-tx price/owner (#71-#74)

[Valreb001]

Closes #71
Closes #72
Closes #73
Closes #74

Summary

6843db0: fix: validate Idempotency-Key header (#72)

Adds parseIdempotencyKey in the new src/lib/idempotencyKey.ts, which accepts only 1 to 255 characters from [A-Za-z0-9_-] and otherwise throws a 400 VALIDATION_ERROR. POST /resources now parses the header through it before using it as a store key. Unit tests cover valid, empty, over-length and invalid-character keys.

0ec92b9: feat(idempotency): store records in Postgres so replicas share them (#71)

Adds src/lib/idempotencyPgStore.ts, a store backed by a new idempotency_records table (unique key, jsonb record, expiry) with migration 0011_idempotency_records. src/index.ts installs it at boot through useSharedIdempotencyStore, while getIdempotencyStore() still returns the in-memory cache when nothing is installed, so tests keep using memory. The publish route now awaits its store calls. A test shows two store instances sharing one database returning the original result on retry.

a881f98: fix(timeout): abort signal on request timeout and record final idempotency outcome (#73)

The timeout middleware now creates an AbortController per request (exposed via the new src/lib/requestAbort.ts) and aborts it on timeout. POST /resources checks the signal before starting storage or database work and releases the idempotency key if cancelled. Work already underway completes, records its final outcome under the key, and no longer writes to the already-answered response. The behavior is documented in timeout.ts, with a test covering the abort and final record state.

071df0f: fix(resources): take price and new owner from the signed transaction (#74)

Adds src/services/signedTxDecode.ts, which decodes the invoke arguments from the signed XDR. POST /resources/:id/price and POST /resources/:id/ownership now compare the body value with the decoded one and return 400 on mismatch before submitting. On a match, the database row is updated from the decoded values. Tests cover matching and mismatched price and owner.

[vercel]

@Valreb001 is attempting to deploy a commit to the work Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Valreb001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits