Add stream POST negative tests

.github/dependabot.yml

@@ -2,6 +2,12 @@ version: 2
 
 updates:
   # ── npm: root workspace ────────────────────────────────────────────────────
+  # flowfi is a single npm workspace (frontend + backend hoisted into one root
+  # package-lock.json). Dependabot must update from the workspace root so the
+  # root lockfile CI runs `npm ci` against stays in sync. Per-directory entries
+  # for /frontend and /backend only touched their package.json without updating
+  # the root lockfile, so every PR they opened failed `npm ci` with
+  # "lock file's X does not satisfy Y". One root entry covers all workspaces.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
@@ -14,32 +20,6 @@ updates:
           - "minor"
           - "patch"
 
-  # ── npm: frontend ──────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/frontend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
-  # ── npm: backend ───────────────────────────────────────────────────────────
-  - package-ecosystem: "npm"
-    directory: "/backend"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    groups:
-      minor-and-patch:
-        update-types:
-          - "minor"
-          - "patch"
-
   # ── Cargo: contracts ───────────────────────────────────────────────────────
   - package-ecosystem: "cargo"
     directory: "/contracts"

.github/workflows/ci.yml

@@ -42,17 +42,6 @@ jobs:
         run: npm run test:coverage
         working-directory: frontend
 
-      - name: Upload frontend coverage to Codecov
-        uses: codecov/codecov-action@v5
-        with:
-          files: frontend/coverage/lcov.info
-          flags: frontend
-          name: frontend-coverage
-          fail_ci_if_error: false
-          verbose: true
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
       - name: Build
         run: npm run build
         working-directory: frontend

backend/.env.example

@@ -1,6 +1,16 @@
 # Database
 DATABASE_URL="postgresql://user:password@localhost:5433/flowfi?schema=public"
 
+# PostgreSQL pool settings
+# Maximum database connections per backend process (default: 10)
+PG_POOL_MAX=10
+# How long an idle connection stays open before being closed (milliseconds, default: 30000)
+PG_IDLE_TIMEOUT_MS=30000
+# How long to wait when establishing a new database connection (milliseconds, default: 5000)
+PG_CONNECTION_TIMEOUT_MS=5000
+# Maximum time a PostgreSQL statement may run before cancellation (milliseconds, default: 30000)
+PG_STATEMENT_TIMEOUT_MS=30000
+
 # Server
 PORT=3001
 NODE_ENV=development

backend/Dockerfile

@@ -6,6 +6,7 @@ COPY package*.json ./
 RUN npm install
 
 COPY tsconfig.json ./
+COPY prisma.config.ts ./
 COPY src ./src
 COPY prisma ./prisma
 
@@ -21,8 +22,10 @@ COPY package*.json ./
 RUN npm install --omit=dev
 
 COPY --from=builder /app/dist ./dist
-COPY --from=builder /app/src/generated ./src/generated
+COPY --from=builder /app/src/generated ./dist/generated
+COPY --from=builder /app/prisma ./prisma
+COPY --from=builder /app/prisma.config.ts ./prisma.config.ts
 
 EXPOSE 3001
 
-CMD ["npm", "start"]
+CMD ["npm", "start"]

backend/package.json

@@ -32,7 +32,6 @@
     "express-rate-limit": "^8.5.2",
     "ioredis": "^5.11.1",
     "pg": "^8.21.0",
-    "stellar-sdk": "^13.3.0",
     "swagger-jsdoc": "^6.3.0",
     "swagger-ui-express": "^5.0.1",
     "winston": "^3.11.0",

backend/prisma/migrations/20260630000000_add_stream_token_address_index/migration.sql

@@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "Stream_tokenAddress_idx" ON "Stream"("tokenAddress");

backend/prisma/schema.prisma

@@ -51,6 +51,7 @@ model Stream {
 
   @@index([sender])
   @@index([recipient])
+  @@index([tokenAddress])
   @@index([streamId])
   @@index([isActive])
   @@index([isPaused])

backend/prisma/seed.ts

@@ -1,9 +1,8 @@
-import pg from 'pg';
 import { PrismaPg } from '@prisma/adapter-pg';
 import { PrismaClient } from '../src/generated/prisma/index.js';
+import { createPgPool } from '../src/lib/pg-pool.js';
 
-const connectionString = process.env.DATABASE_URL;
-const pool = new pg.Pool({ connectionString });
+const pool = createPgPool();
 const adapter = new PrismaPg(pool);
 const prisma = new PrismaClient({ adapter });
 

backend/src/app.ts

@@ -1,26 +1,33 @@
-import express, { type Request, type Response, type NextFunction } from 'express';
-import cors from 'cors';
-import swaggerUi from 'swagger-ui-express';
-import { swaggerSpec } from './config/swagger.js';
-import { apiVersionMiddleware, type VersionedRequest } from './middleware/api-version.middleware.js';
-import { sandboxMiddleware } from './middleware/sandbox.middleware.js';
-import { globalRateLimiter } from './middleware/rate-limiter.middleware.js';
-import { requestIdMiddleware } from './middleware/requestId.js';
-import v1Routes from './routes/v1/index.js';
-
-import healthRoutes from './routes/health.routes.js';
+import express, {
+  type Request,
+  type Response,
+  type NextFunction,
+} from "express";
+import cors from "cors";
+import swaggerUi from "swagger-ui-express";
+import { swaggerSpec } from "./config/swagger.js";
+import {
+  apiVersionMiddleware,
+  type VersionedRequest,
+} from "./middleware/api-version.middleware.js";
+import { sandboxMiddleware } from "./middleware/sandbox.middleware.js";
+import { globalRateLimiter } from "./middleware/rate-limiter.middleware.js";
+import { requestIdMiddleware } from "./middleware/requestId.js";
+import v1Routes from "./routes/v1/index.js";
+
+import healthRoutes from "./routes/health.routes.js";
 
 const app = express();
-const isProduction = process.env.NODE_ENV === 'production';
-const rawCors = process.env.CORS_ALLOWED_ORIGINS ?? '';
+const isProduction = process.env.NODE_ENV === "production";
+const rawCors = process.env.CORS_ALLOWED_ORIGINS ?? "";
 const allowedOrigins = rawCors
-    .split(',')
-    .map((origin) => origin.trim())
-    .filter(Boolean);
+  .split(",")
+  .map((origin) => origin.trim())
+  .filter(Boolean);
 
 // Default in development to only localhost:3000 (frontend dev server)
 if (!process.env.CORS_ALLOWED_ORIGINS && !isProduction) {
-    allowedOrigins.push('http://localhost:3000');
+  allowedOrigins.push("http://localhost:3000");
 }
 
 // Apply global rate limiter first
@@ -29,52 +36,60 @@ app.use(globalRateLimiter);
 // Request ID tracing
 app.use(requestIdMiddleware);
 
-app.disable('x-powered-by');
+app.disable("x-powered-by");
 
 // Helmet-equivalent core headers without external dependency.
 // Strict CSP applied globally; the /api-docs route overrides it below for Swagger UI.
 app.use((req: Request, res: Response, next: NextFunction) => {
-    res.setHeader('X-Content-Type-Options', 'nosniff');
-    res.setHeader('X-Frame-Options', 'DENY');
-    res.setHeader('Referrer-Policy', 'no-referrer');
-    res.setHeader('X-DNS-Prefetch-Control', 'off');
-    res.setHeader('X-Download-Options', 'noopen');
-    res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');
-    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
-    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
-    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
-    if (process.env.NODE_ENV === 'production') {
-        res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-    }
-    next();
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-Frame-Options", "DENY");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  res.setHeader("X-DNS-Prefetch-Control", "off");
+  res.setHeader("X-Download-Options", "noopen");
+  res.setHeader("X-Permitted-Cross-Domain-Policies", "none");
+  res.setHeader(
+    "Content-Security-Policy",
+    "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'",
+  );
+  res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+  res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
+  if (process.env.NODE_ENV === "production") {
+    res.setHeader(
+      "Strict-Transport-Security",
+      "max-age=31536000; includeSubDomains",
+    );
+  }
+  next();
 });
 
-app.use(cors({
+app.use(
+  cors({
     origin(origin, callback) {
-        // Allow non-browser clients (no Origin header)
-        if (!origin) {
-            callback(null, true);
-            return;
-        }
-
-        if (allowedOrigins.includes(origin)) {
-            callback(null, true);
-            return;
-        }
-
-        // Not allowed
-        callback(new Error('CORS origin not allowed'));
+      // Allow non-browser clients (no Origin header)
+      if (!origin) {
+        callback(null, true);
+        return;
+      }
+
+      if (allowedOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+
+      // Not allowed
+      callback(new Error("CORS origin not allowed"));
     },
     credentials: true,
-}));
+  }),
+);
 
 // Convert CORS errors into 403 responses so callers get a clear status code
 app.use((err: unknown, req: Request, res: Response, next: NextFunction) => {
-    if (err instanceof Error && err.message === 'CORS origin not allowed') {
-        res.status(403).json({ error: 'CORS origin not allowed' });
-        return;
-    }
-    next(err);
+  if (err instanceof Error && err.message === "CORS origin not allowed") {
+    res.status(403).json({ error: "CORS origin not allowed" });
+    return;
+  }
+  next(err);
 });
 app.use(express.json());
 
@@ -83,18 +98,26 @@ app.use(sandboxMiddleware);
 
 // Swagger UI setup
 // Override CSP for /api-docs only: Swagger UI requires inline scripts/styles.
-app.use('/api-docs', (req: Request, res: Response, next: NextFunction) => {
-    res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'");
+app.use(
+  "/api-docs",
+  (req: Request, res: Response, next: NextFunction) => {
+    res.setHeader(
+      "Content-Security-Policy",
+      "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'",
+    );
     next();
-}, swaggerUi.serve, swaggerUi.setup(swaggerSpec, {
-    customCss: '.swagger-ui .topbar { display: none }',
-    customSiteTitle: 'FlowFi API Documentation',
-}));
+  },
+  swaggerUi.serve,
+  swaggerUi.setup(swaggerSpec, {
+    customCss: ".swagger-ui .topbar { display: none }",
+    customSiteTitle: "FlowFi API Documentation",
+  }),
+);
 
 // Serve raw OpenAPI spec as JSON
-app.get('/api-docs.json', (req: Request, res: Response) => {
-    res.setHeader('Content-Type', 'application/json');
-    res.send(swaggerSpec);
+app.get("/api-docs.json", (req: Request, res: Response) => {
+  res.setHeader("Content-Type", "application/json");
+  res.send(swaggerSpec);
 });
 
 // API Versioning
@@ -105,16 +128,16 @@ app.use(apiVersionMiddleware);
 // After versioning middleware, /v1/streams becomes /streams, so we mount v1Routes at root
 // But only handle requests that had a version prefix (apiVersion is set)
 app.use((req: Request, res: Response, next: NextFunction) => {
-    const versionedReq = req as VersionedRequest;
-    if (versionedReq.apiVersion) {
-        // This was a versioned request, route to v1 handlers
-        return v1Routes(req, res, next);
-    }
-    return next(); // Not versioned, continue to deprecated handlers
+  const versionedReq = req as VersionedRequest;
+  if (versionedReq.apiVersion) {
+    // This was a versioned request, route to v1 handlers
+    return v1Routes(req, res, next);
+  }
+  return next(); // Not versioned, continue to deprecated handlers
 });
 
 // Health check routes
-app.use('/health', healthRoutes);
+app.use("/health", healthRoutes);
 
 /**
  * @openapi
@@ -128,11 +151,11 @@ app.use('/health', healthRoutes);
  *       200:
  *         description: API is running successfully
  */
-app.get('/', (req: Request, res: Response) => {
-    res.send('FlowFi Backend is running');
+app.get("/", (req: Request, res: Response) => {
+  res.send("FlowFi Backend is running");
 });
 
-import { errorHandler } from './middleware/error.middleware.js';
+import { errorHandler } from "./middleware/error.middleware.js";
 
 app.use(errorHandler);