[affy-exe]

…nd verify endpoints

Adds generic SEP-10 infrastructure (ADR 0005 step 4, issue #77): before a patient or facility wallet can be trusted as payer or payee, the backend must prove the caller controls that Stellar address.

• GET /payments/sep10/challenge?account=G… — authenticated + verified email; full strkey checksum validation; builds a server-signed challenge via @stellar/stellar-sdk WebAuth helpers (Manage Data nonce, 5-minute time bounds, home domain + web_auth_domain) and records the issuance binding (userId, account, nonce, expiresAt).
• POST /payments/sep10/verify — walks the SEP-10 server verification list (structure, sequence 0, server source, time bounds, operation shape, server signature), then client signatures: multisig weight thresholds loaded from Horizon via verifyChallengeTxThreshold, or the spec's master-key rule for unfunded accounts via verifyChallengeTxSigners. Bound to the authenticated user and account; nonce consumed with ONE conditional UPDATE so concurrent replays can't both succeed.
• New Sep10Challenge model (unique nonce, userId, account, expiresAt, consumedAt, createdAt, index on expiresAt) + migration.
• Dedicated SEP10_SIGNING_SECRET config, separate from payer/releaser keys, validated at startup (names vars, never secrets), documented in .env.example.
• Horizon access sits behind an injectable seam, so 15 unit + 18 integration tests cover happy path, replay, concurrency, expiry, wrong signer, multisig thresholds, unfunded accounts, user/account binding and tampering with zero network.

Docs: ARCHITECTURE.md §4.10, ARCHITECTURE_ESSENTIALS.md data-model map, ROADMAP.md Phase 5.5 + changelog, docs/api/README.md endpoint reference.

Closes #77

[drips-wave]

@affy-exe Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@affy-exe fix CI

[afeezorobsco-cyber]

CI is failing on this PR. main itself is green, so the cause is in this branch:

Integration tests fail: tests/integration/access-control.test.mts, the access-control suite that #147 added to main, fails with this branch merged (86 tests skipped after the suite errors). Run npm run test:integration -- access-control locally to see which of your new payment or wallet routes breaks the suite's expectations. Every route that exposes payment data needs to be covered by it.

Please push a fix and CI will re-run. Before pushing, run npm run prisma:generate && npm run typecheck && npm test && npm run test:integration in backend/.

[afeezorobsco-cyber]

@affy-exe

CI fails in tests/integration/access-control.test.mts with Hook timed out in 10000ms (the setup hook didn't finish). That suite has changed on main since this branch was cut, and this PR now conflicts with main too. Please rebase onto the latest main (or merge main into your branch), resolve the conflicts, and push. If it still times out after rebasing, run the suite locally. The new SEP-10 code may be making a network call (e.g. a Horizon/RPC lookup) during app setup.

[afeezorobsco-cyber]

@affy-exe Thanks for the PR. It can't be merged yet. To unblock it:

CI is failing. Here's what broke:

Backend (typecheck + test + build):

prisma generate: P1012 Error validating field `user` in model `Sep10Challenge`: the relation is missing an opposite relation field on model `User` (prisma/schema.prisma:573)

Please fix these errors and run the same steps locally before pushing (npm run typecheck && npm test && npm run build, or cargo test for contracts).

Merge conflicts: this branch conflicts with main. Please rebase onto the latest main (git fetch upstream && git rebase upstream/main), resolve the conflicts (often ROADMAP.md, ARCHITECTURE*.md or prisma/schema.prisma), and force-push.

Push to this same branch and CI will re-run. Once it's green and conflict-free, it'll be reviewed for merge.

[afeezorobsco-cyber]

@affy-exe CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

Error: Prisma schema validation - (get-dmmf wasm)
error: Error validating field `user` in model `Sep10Challenge`: The relation field `user` on model `Sep10Challenge` is missing an opposite relation field on the model `User`. Either run `prisma format` or add it manually.

The new Sep10Challenge.user relation needs a back-relation field on User (e.g. sep10Challenges Sep10Challenge[]). Run npx prisma format in backend/ and commit the result.

[github-actions]

@affy-exe This PR now has merge conflicts with main, most likely because #176 (feat(consultations): close an appointment's consultation exactly once…) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@affy-exe This PR now has merge conflicts with main, most likely because #156 (feat(patients): account deletion with clinical-record retention: anonymise identity, keep the audit trail) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@affy-exe CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

Error: Prisma schema validation - (get-dmmf wasm)
error: Error validating field `user` in model `Sep10Challenge`: The relation field `user` on model `Sep10Challenge` is missing an opposite relation field on the model `User`. Either run `prisma format` or add it manually.

Sep10Challenge.user needs a back-relation field on User (for example sep10Challenges Sep10Challenge[]). Run npx prisma format in backend/ and commit the result.

[github-actions]

@affy-exe This PR now has merge conflicts with main, most likely because #160 (feat(payments): multi-asset intents and patient-signed prepare) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@affy-exe CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

Error: Prisma schema validation - (get-dmmf wasm)
error: Error validating field `user` in model `Sep10Challenge`: The relation field `user` on model `Sep10Challenge` is missing an opposite relation field on the model `User`. Either run `prisma format` or add it manually.

Sep10Challenge.user needs a back-relation on User (for example sep10Challenges Sep10Challenge[]). Each relation needs a back-relation field on the other model. Run npx prisma format in backend/ (it adds them) and commit the result.

[afeezorobsco-cyber]

Reviewed: no malicious code found, CI is green. Merging.