feat(tests): add invariant tests for stream contract#3
Open
pauljacobb wants to merge 71 commits into
Open
Conversation
- Add invariant_tests.rs with 12 property-based invariant tests - Invariant 1 (funds conservation, 150 cases each): - inv_funds_conserved_after_multiple_withdrawals - inv_funds_conserved_after_top_up - inv_withdrawn_monotonically_increases - Invariant 2 (state transitions, 150 cases each): - inv_new_stream_is_active - inv_pause_resume_transitions (Active→Paused→Active) - inv_cancelled_stream_is_terminal (Cancelled is terminal, claimable=0) - inv_exhausted_stream_funds_conserved - inv_paused_stream_does_not_accrue - Invariant 3 (authorization, 100 cases each): - inv_stream_employer_matches_creator - inv_employer_is_sole_pause_authority - inv_cancel_returns_unearned_to_employer - inv_stream_count_monotonically_increases - Register prop_tests and invariant_tests modules in lib.rs
- Add api/middleware/apm.js: tracks p50/p95/p99 latency per route, error rates (4xx/5xx), and alerts when p99 > 2000ms - Integrate apmMiddleware into server.js (registered after correlationId so traces are linked to correlation IDs in logs) - Expose GET /metrics endpoint returning latency percentiles and error rates - Add api/apm.test.js with 8 unit tests covering all acceptance criteria - Document APM_ALERT_P99_MS and APM_MAX_SAMPLES in .env.example Acceptance criteria met: - Request latency p50/p95/p99 tracked per route - Error rate (4xx/5xx) tracked per route - Alert logged when p99 > 2s (APM_ALERT_P99_MS, default 2000) - Traces linked to logs via existing X-Correlation-ID header
- Add .github/workflows/deploy-testnet.yml: triggers on push to main, uses 'testnet' GitHub environment, deploys both contracts, exposes token_id and stream_id as job outputs, runs stream_count smoke test, writes contract IDs to the job summary. - Update scripts/deploy-testnet.sh: emit token_id/stream_id to GITHUB_OUTPUT when running inside GitHub Actions. - Add docs/runbooks/testnet-rollback.md: step-by-step rollback procedure covering redeploy, reinitialise, consumer update, and fix-forward on main. Closes Vera3289#296
- Add audits/audit-scope.md defining in-scope contracts, risk areas, and acceptance criteria - Add audits/audit-report.md as placeholder for auditor deliverable Closes Vera3289#285
- Prerequisites table with Rust, Stellar CLI, Docker - Copy-paste commands for build, test, local deploy - Full local flow: token + stream deploy, create stream, withdraw - Testnet deployment section using deploy-testnet.sh and init-testnet.sh - Docker alternative for no-install setup - Fixed formatting corruption at end of file
- Add Filebeat config to ship container logs to Elasticsearch - Add Elasticsearch ILM policy with 30-day log retention - Add Kibana dashboard with total events, error count, and log volume panels - Add Kibana alert rule firing on >10 errors in 5 minutes - Add elasticsearch, kibana, and filebeat services to docker-compose.yml
…9#282) - Add ERR_DEPOSIT_TOO_LOW (E020) error constant to types.rs - Validate deposit >= rate_per_second * 60 in validate_create_stream - Add unit tests for boundary: exact, below, and above minimum - Document E020 in docs/api-reference.md Closes Vera3289#282
- cargo test on every PR and push to main - cargo clippy with -D warnings (deny all warnings) - Build WASM contracts via stellar contract build - Fails PR if any step fails (jobs are sequential via needs:) Closes Vera3289#294
- 4 migrations via node-pg-migrate: streams, events, users, notifications - Seed data for development in db/seeds/dev.js - Schema documented in docs/database-schema.md Closes Vera3289#248
- MultisigConfig type: list of admin addresses + threshold - AdminOp enum: Upgrade(hash) | EmergencyPause - PendingAdminOp: stores approvals, expires_at, executed flag - configure_multisig: single admin sets up M-of-N config - multisig_propose: any admin proposes an op (auto-approves) - multisig_approve: each admin approves; executes at threshold - Pending ops expire after 7 days (MULTISIG_OP_TTL) - Unit tests: configure, propose, threshold logic, double-approve, expiry Closes Vera3289#275
- Add useTokenBalance hook to fetch balance from token contract - Display balance next to deposit input in StreamCreationForm - Show 'Insufficient balance' warning when deposit exceeds balance - Refresh balance after successful transaction
- Add OnboardingWizard component with 4-step flow: connect wallet → fund → configure → confirm - Progress indicator with step icons - Back navigation between steps - Skippable; completion persisted in localStorage - Wizard shown on first visit, hidden after first stream created
- Add inline script to index.html to apply theme before first paint, preventing flash of unstyled content on load - useDarkMode hook (App.tsx) already handles: - prefers-color-scheme media query detection - Manual toggle persisted in localStorage - OS-level change listener (when no manual override set) - data-theme attribute applied to <html> for CSS variable switching - CSS already has full [data-theme='dark'] variable overrides for all components
) - docs/security/pentest-plan.md: full pentest plan covering OWASP Top 10, SQL injection, XSS, CSRF, auth bypass, and smart contract specific tests; includes findings log template and pre-launch severity gate - docs/security/zap-automation.yml: OWASP ZAP Automation Framework config for spider + active scan + HTML/SARIF report generation - .github/workflows/pentest.yml: CI workflow running cargo-audit, npm audit, Semgrep OWASP rules, and ZAP baseline scan on schedule and on demand
…yment feat: canary deployment for contract upgrades
…-tests test: add unit tests for batch stream creation
…-tests test: add comprehensive pause/resume unit tests
…n-video-tutorial docs: add video tutorial for end-to-end stream management (closes Vera3289#327)
feat(stream): add M-of-N multi-sig admin support
…grations feat(db): add PostgreSQL schema and migrations
ci: set up GitHub Actions CI pipeline
…sit-validation feat(stream): enforce minimum deposit = rate_per_second * 60
feat Add Python SDK with examples
feat issue 310 322 323 324
feat(logging): set up centralized ELK stack logging (Vera3289#299)
…-withdraw Vera3289#284: SDK - add optional amount param to withdraw for partial withdra…
…metadata-293 Issue Vera3289#293: add stream metadata documentation
…nse-compression Vera3289#268 Add API response compression metrics
…rt-guide docs: add developer quickstart guide (closes Vera3289#320)
test: fuzz claimable calculation invariants (Vera3289#279)
…curity-audit feat: add third-party security audit scope and report (Vera3289#285)
…d-testnet-deployment feat: automated testnet deployment CI/CD pipeline (Vera3289#296)
feat(api): add application performance monitoring
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes Vera3289#291
Summary
Adds
invariant_tests.rswith 12 property-based invariant tests covering all three acceptance criteria.Changes
contracts/stream/src/invariant_tests.rs(new)12 proptest invariants across 3 categories:
Invariant 1 — Funds conservation (150 cases each)
inv_funds_conserved_after_multiple_withdrawals:withdrawn + claimable <= depositafter 2 withdrawalsinv_funds_conserved_after_top_up: funds conserved after top-upinv_withdrawn_monotonically_increases: withdrawn never decreases across 3 withdrawalsInvariant 2 — State transitions (150 cases each)
inv_new_stream_is_active: newly created stream is always Activeinv_pause_resume_transitions: Active→Paused→Active cycle is validinv_cancelled_stream_is_terminal: Cancelled is terminal; claimable = 0inv_exhausted_stream_funds_conserved: funds conserved after full draininv_paused_stream_does_not_accrue: claimable frozen while pausedInvariant 3 — Authorization (100 cases each)
inv_stream_employer_matches_creator: employer/employee fields match creation paramsinv_employer_is_sole_pause_authority: only employer can pause/resumeinv_cancel_returns_unearned_to_employer: cancel pays employee ≤ claimableinv_stream_count_monotonically_increases: stream count only goes upcontracts/stream/src/lib.rsprop_testsandinvariant_testsas#[cfg(test)]modulesTest counts