fix: webhook secret masking on list, policy list select-only query, a…

src/common/webhooks/dto/webhook.dto.ts

@@ -57,6 +57,12 @@ export class WebhookListItemDto {
 
   @ApiProperty({ description: 'Registration timestamp' })
   createdAt: Date;
+
+  @ApiPropertyOptional({
+    description: 'Masked signing secret (last 4 characters). The full secret is only available at registration time (#782).',
+    example: '****1234',
+  })
+  secretMasked?: string;
 }
 
 export class PolicyStatusChangePayloadDto {

src/common/webhooks/webhooks.controller.spec.ts

@@ -136,15 +136,35 @@ describe('WebhooksController', () => {
       expect(limit).toBeUndefined();
     });
 
-    it('never echoes stored signing secrets', async () => {
+    it('#782 — never echoes the full signing secret in the list response', async () => {
       const { controller } = build();
 
       const result = await controller.list();
 
-      expect(result).toEqual({
-        success: true,
-        data: [expect.not.objectContaining({ secret: expect.anything() })],
-      });
+      expect(result.data[0]).not.toHaveProperty('secret');
+    });
+
+    it('#782 — shows last 4 characters of the secret as a masked hint', async () => {
+      const { controller } = build();
+
+      const result = await controller.list();
+
+      // stored secret is 'topsecret' → last 4 chars are 'cret'
+      expect(result.data[0]).toHaveProperty('secretMasked', '****cret');
+    });
+
+    it('#782 — omits secretMasked entirely when the registration has no secret', async () => {
+      const webhooks = {
+        registerWebhook: jest.fn(),
+        getRegistrations: jest.fn().mockResolvedValue([
+          { id: 'wh-2', url: 'https://example.com/hook', secret: undefined, events: [], isActive: true, createdAt: new Date() },
+        ]),
+      };
+      const controller = new WebhooksController(webhooks as any, {} as any);
+
+      const result = await controller.list();
+
+      expect(result.data[0]).not.toHaveProperty('secretMasked');
     });
   });
 });

src/common/webhooks/webhooks.controller.ts

@@ -88,8 +88,17 @@ export class WebhooksController {
     },
   })
   async list() {
-    // Never echo the HMAC signing secret back to API callers.
+    // #782 — never echo the full HMAC signing secret back to API callers.
+    // Show only the last 4 characters as a hint so the subscriber can tell
+    // they got the right one without exposing it; the full secret is only
+    // ever returned (if at all) at creation time.
     const registrations = await this.webhooks.getRegistrations();
-    return { success: true, data: registrations.map(({ secret: _secret, ...rest }) => rest) };
+    return {
+      success: true,
+      data: registrations.map(({ secret, ...rest }) => ({
+        ...rest,
+        ...(secret ? { secretMasked: `****${secret.slice(-4)}` } : {}),
+      })),
+    };
   }
 }

src/policy/policy.service.spec.ts

@@ -707,11 +707,24 @@ describe("PolicyService.calculatePremium", () => {
       let queryCount = 0;
       mockPrismaService.policy.findMany.mockImplementation(async (args: any) => {
         queryCount++;
-        expect(args.include).toEqual({
+        // #779 — list query now uses select (not include) so it doesn't
+        // eagerly load full relation rows (product, etc.) — only the scalar
+        // fields that PolicySummary maps plus a lightweight claim _count.
+        expect(args.select).toEqual({
+          id: true,
+          productId: true,
+          policyholder: true,
+          coverageXlm: true,
+          premiumPaid: true,
+          oracleKey: true,
+          startTime: true,
+          endTime: true,
+          status: true,
           _count: {
             select: { claims: true },
           },
         });
+        expect(args.include).toBeUndefined();
         return Array.from({ length: 50 }, (_, i) => ({
           id: `policy-${i}`,
           productId: "prod-1",

src/policy/policy.service.ts

@@ -567,10 +567,23 @@ export class PolicyService {
     const take = Math.min(limit, 100);
     const skip = (page - 1) * take;
 
+    // #779 — use select instead of include so the query fetches only the
+    // columns that PolicySummary actually maps, avoiding an eager load of
+    // full relation rows (product, etc.) that the list view never displays.
+    // _count.claims is a lightweight aggregate, not a full relation load.
     const [policies, total] = await this.prisma.$transaction([
       this.prisma.policy.findMany({
         where: { policyholder: address },
-        include: {
+        select: {
+          id: true,
+          productId: true,
+          policyholder: true,
+          coverageXlm: true,
+          premiumPaid: true,
+          oracleKey: true,
+          startTime: true,
+          endTime: true,
+          status: true,
           _count: {
             select: { claims: true },
           },