Skip to content

Fix JWT secret rotation, milestone persistence, test paths, and analytics validation - #776

Merged
meshackyaro merged 4 commits into
trustflow-protocol:mainfrom
Big-JoshCode:fix/auth-milestone-analytics-tests
Oct 18, 2026
Merged

meshackyaro merged 4 commits into
trustflow-protocol:mainfrom
Big-JoshCode:fix/auth-milestone-analytics-tests

Conversation

@Big-JoshCode

Copy link
Copy Markdown
Contributor

Summary

  • Support JWT_SECRET_PREVIOUS for graceful secret rotation without invalidating live tokens
  • Fix non-functional milestone approval system by persisting to Redis
  • Correct test assertions that were checking /v1 prefixes never configured in test apps
  • Add input validation to GET /admin/analytics/escrows limit parameter

Changes

#745 JWT Secret Rotation

  • JwtStrategy now verifies tokens against both JWT_SECRET and JWT_SECRET_PREVIOUS
  • Uses getJwtVerificationSecrets() with secretOrPublicKeyProvider for multi-secret support
  • Allows seamless secret rotation during overlap window

#747 Milestone Persistence

  • Added MILESTONE_KEY_PREFIX and milestoneKey() helper method
  • approveMilestone() now persists approved milestones to Redis
  • Follows existing escrow persistence pattern with fallback to in-memory storage

#752 Test Path Corrections

  • Removed /v1 prefixes from idempotency.integration.spec.ts test assertions
  • Removed /v1 prefixes from security-headers.spec.ts test assertions
  • Test apps were never configured with global /v1 path prefix

#746 Analytics Limit Validation

  • GET /admin/analytics/escrows now validates limit parameter
  • Parses as integer with minimum value of 1
  • Returns 400 BadRequestException on invalid input instead of raw Redis errors

Closes #745
Closes #746
Closes #747
Closes #752

0xpreshh and others added 3 commits October 18, 2026 13:33
…nciliation re-fetch

- trustflow-protocol#756: ArweaveArchiveService now actually truncates oversized dispute archives
  instead of only logging a warning; falls back to a minimal stub if still too large
- trustflow-protocol#763: GraphQL escrows query now accepts offset/limit args and returns EscrowPage
  (data, total, offset, limit) matching the REST list pagination contract
- trustflow-protocol#758: Supertest integration tests enable URI versioning on the Nest app so
  /v1/reputation/* routes resolve instead of 404ing
- trustflow-protocol#750: EscrowReconciliationService fetches the full escrow list once and filters
  in-memory, eliminating the O(n) re-fetch loop that called findAll on every batch
…tics validation

- Support JWT_SECRET_PREVIOUS for graceful secret rotation (trustflow-protocol#745)
  JwtStrategy now verifies tokens against both current and previous secrets
  using getJwtVerificationSecrets() with secretOrPublicKeyProvider

- Persist milestone approvals to Redis (trustflow-protocol#747)
  approveMilestone() now saves approved milestones to Redis, fixing non-functional
  milestone approval system. Adds MILESTONE_KEY_PREFIX and milestoneKey() helper.

- Remove /v1 prefixes from test paths (trustflow-protocol#752)
  idempotency.integration.spec.ts and security-headers.spec.ts were asserting
  against /v1-prefixed paths that test apps never configured

- Add limit parameter validation to GET /admin/analytics/escrows (trustflow-protocol#746)
  Validates limit is a positive integer, returns 400 on invalid input instead
  of crashing with raw Redis errors

Closes trustflow-protocol#745
Closes trustflow-protocol#746
Closes trustflow-protocol#747
Closes trustflow-protocol#752
@drips-wave

drips-wave Bot commented Oct 18, 2026

Copy link
Copy Markdown

@Big-JoshCode Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@meshackyaro
meshackyaro merged commit d649c09 into trustflow-protocol:main Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment