feat: benchmark CI, OWASP scanning, contract auth audit & multi-sig admin ops

.changeset/config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
+  "changelog": ["@changesets/changelog-github", { "repo": "Xaxxoo/SwiftRemit" }],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": [],
+  "privatePackages": { "version": false, "tag": false }
+}

.env.testnet

@@ -0,0 +1,61 @@
+# ============================================================
+# SwiftRemit — Testnet Integration Test Environment Template
+# Issue #394: Full-lifecycle Stellar Testnet integration tests
+# ============================================================
+# Copy to .env.testnet.local and fill in real values.
+# NEVER commit .env.testnet.local or any file containing real secret keys.
+
+# ── Network ──────────────────────────────────────────────────
+NETWORK=testnet
+HORIZON_URL=https://horizon-testnet.stellar.org
+RPC_URL=https://soroban-testnet.stellar.org:443
+FRIENDBOT_URL=https://friendbot.stellar.org
+
+# ── Deployed contract addresses (populated after deploy) ─────
+# Set these after running the testnet deploy script.
+SWIFTREMIT_CONTRACT_ID=
+USDC_TOKEN_ID=
+
+# ── Test account key pairs ────────────────────────────────────
+# WARNING: Use dedicated throwaway testnet accounts only.
+# Fund via Friendbot; never use mainnet keys here.
+TESTNET_ADMIN_SECRET=
+TESTNET_ADMIN_PUBLIC=
+
+TESTNET_AGENT_SECRET=
+TESTNET_AGENT_PUBLIC=
+
+TESTNET_SENDER_SECRET=
+TESTNET_SENDER_PUBLIC=
+
+TESTNET_RECIPIENT_SECRET=
+TESTNET_RECIPIENT_PUBLIC=
+
+# ── Pre-signed transaction XDR envelopes ─────────────────────
+# Generate these with the Stellar CLI before running the lifecycle test:
+#   stellar contract invoke --id $SWIFTREMIT_CONTRACT_ID \
+#     --source $TESTNET_SENDER_SECRET --network testnet \
+#     -- create_remittance ... --build-only | base64
+TESTNET_CREATE_REMITTANCE_XDR=
+TESTNET_CONFIRM_PAYOUT_XDR=
+
+# ── Cleanup / drain ───────────────────────────────────────────
+# Optional: set to drain remaining test tokens back to a faucet after tests.
+TESTNET_FAUCET_PUBLIC=
+TESTNET_DRAIN_XDR=
+
+# ── Transaction settings ──────────────────────────────────────
+# Timeout (seconds) before a submitted transaction is considered expired.
+TRANSACTION_TIMEOUT=30
+# How long (ms) to poll Horizon/RPC for transaction confirmation.
+POLL_INTERVAL_MS=2000
+# Maximum retries when polling for ledger confirmation.
+MAX_POLL_RETRIES=15
+
+# ── Fee configuration ─────────────────────────────────────────
+DEFAULT_FEE_BPS=250
+TRANSACTION_FEE=100000
+
+# ── Test amounts (in stroops / token base units) ─────────────
+# 100 USDC = 100 * 10^7 = 1_000_000_000 stroops
+TEST_REMITTANCE_AMOUNT=1000000000

.github/dependabot.yml

@@ -0,0 +1,87 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /backend
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - security
+    groups:
+      non-critical:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /frontend
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - security
+    groups:
+      non-critical:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /api
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - security
+    groups:
+      non-critical:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /examples
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - security
+
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - security
+    groups:
+      non-critical:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - ci

.github/workflows/backend-ci.yml

@@ -0,0 +1,86 @@
+name: Backend CI
+
+on:
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - "backend/**"
+      - ".github/workflows/backend-ci.yml"
+
+defaults:
+  run:
+    working-directory: backend
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+
+      - run: npm ci
+      - run: npm run lint
+
+  test:
+    name: Test & Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    services:
+      postgres:
+        image: postgres:15-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: swiftremit_test
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+
+      - run: npm ci
+
+      - name: Run migrations
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/swiftremit_test
+        run: psql $DATABASE_URL -f migrations/webhook_schema.sql
+
+      - name: Run tests with coverage
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/swiftremit_test
+          NODE_ENV: test
+        run: npx vitest run --coverage --reporter=verbose
+
+      - name: Upload coverage report artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: backend-coverage
+          path: backend/coverage/
+          retention-days: 7
+
+      - name: Post coverage summary as PR comment
+        if: always() && github.event_name == 'pull_request'
+        uses: davelosert/vitest-coverage-report-action@v2
+        with:
+          json-summary-path: backend/coverage/coverage-summary.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          name: Backend Coverage