[Tekprecious]

…onal shares (#474)

Description

Implements secondary market listing and purchase endpoints for fractional invoice shares, enabling investors to list their holdings for resale and allowing other investors to purchase shares from active listings.

Key Features & Scope:

• POST /secondary-market/listings: Creates resale listings with price and quantity.
  • Validates seller ownership: Checks seller's confirmed investment shares and accounts for active listings to prevent double-listing.
  • Invoice status check: Requires the invoice to be in FUNDED status.
  • Maturity guard: Rejects listings on matured or settled invoices with HTTP 422 (INVOICE_MATURED).
• GET /secondary-market/listings: Retrieves active, unexpired listings per invoice.
  • Supports query filters: invoiceId, sellerWallet, minPrice, maxPrice, sortBy, sortOrder, and pagination (page, limit).
  • Supports optional authentication for public browsing or authenticated user context.
• POST /secondary-market/listings/:id/buy: Processes fraction purchases from active listings.
  • Rejects over-purchases exceeding available listing quantity with HTTP 409 (OVER_PURCHASE).
  • Rejects self-purchases and purchases on expired/inactive listings with HTTP 400.
  • Atomically transfers ownership with payment in a single database transaction:
    • Deducts purchased quantity from seller's confirmed holdings (Investment).
    • Credits purchased quantity to buyer's confirmed holdings (Investment).
    • Updates listing status to SOLD upon full purchase or decrements quantity for partial purchase.
    • Records completed payment transactions (Transaction) for buyer and seller.
• Cancel Listing Endpoints:
  • Supports DELETE /secondary-market/listings/:id and POST /secondary-market/listings/:id/cancel.
  • Enforces listing owner authorization (sellerWallet or sellerId), returning HTTP 403 (FORBIDDEN) for non-owners.
• Route Compatibility:
  • Mounted on /secondary-market, /api/v1/secondary-market, and /api/v1/secondary.

Closes #474
Closes #475

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📝 Documentation update
• 🎨 UI/UX improvement
• ♻️ Code refactoring
• ✅ Test addition or update
• 🔧 Configuration change

Checklist

• All GitHub Actions workflows are green on this PR (required for merge)
• Commit messages follow Conventional Commits (feat:, fix:, chore:, etc.) — enforced by CI
• No secrets, API keys, .env, or credentials committed (see CONTRIBUTING.md)
• My code follows the code style of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Testing

How to Test

1. Run unit and HTTP integration tests for secondary market endpoints:

   npx jest tests/unit/secondary-market.test.ts tests/secondary-market-notifications.test.ts

[drips-wave]

@Tekprecious Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[TS-mfon]

⚠️ Merge Conflict Detected

This PR currently has a merge conflict and cannot be merged until it is resolved.

Please rebase or merge the latest changes from the base branch into your branch and push again.

[TS-mfon]

✅ PR Ready for Review

Due to a recent malware incident affecting our repositories, all PRs are required to pass automated security checks before being reviewed for merging.

This PR has passed all automated checks:

• ✅ Security scan — no malicious code detected
• ✅ No merge conflicts

A maintainer will review and merge this PR shortly.

[TS-mfon]

✅ PR Ready for Review

Due to a recent malware incident affecting our repositories, all PRs are required to pass automated security checks before being reviewed for merging.

This PR has passed all automated checks:

• ✅ Security scan — no malicious code detected
• ✅ No merge conflicts

A maintainer will review and merge this PR shortly.