[EmperorNexus]

Overview

This PR prevents deletion of streams that still hold unwithdrawn or pending-withdrawal funds, restricts deletion to the sender (or an org owner), converts deletion to a soft delete, and records a stream.delete audit event. Both v1 and v2 delete handlers now share one helper, deleteStream(id, actor, tenant), so the deletability rules and audit trail stay in sync.

Related Issue

Changes

🗑️ Shared delete helper

• [ADD] app/lib/stream-delete.ts
  • Single deleteStream(id, actor, tenant) helper used by both v1 and v2 routes.
  • Deletability matrix:
    • draft → allowed
    • cancelled → allowed
    • withdrawn with withdrawal.state === "succeeded" → allowed
    • ended → 409 FUNDS_PENDING_WITHDRAWAL (never deletable)
    • active / paused → existing 409
  • Ownership check: verified actor must be senderAddress or an org owner, otherwise 403.
  • Tenant mismatch returns 404.
  • Soft delete: sets deletedAt instead of physically removing the row.
  • Idempotent: already-deleted stream returns 204; unknown id returns 404.
  • Invalidates streamCache on soft delete so a stale If-None-Match cannot return 304.

🔌 Route wiring

• [MODIFY] app/api/streams/[id]/route.ts

  • DELETE now delegates to deleteStream instead of the previous active/paused-only guard and direct db.streams.delete(id).
  • GET returns 404 for soft-deleted rows.

• [MODIFY] app/api/v2/streams/[id]/route.ts

  • DELETE delegates to the same deleteStream helper, adding the missing ownership check and audit call.
  • GET returns 404 for soft-deleted rows.

• [MODIFY] app/api/streams/route.ts

  • List excludes deletedAt rows before pagination.

• [MODIFY] app/api/v2/streams/route.ts

  • List excludes deletedAt rows before pagination.

📝 Audit

• [MODIFY] app/lib/audit-log.ts
  • Adds stream.delete to the privileged stream audit events, recorded with a before snapshot of the stream row.

📄 Docs

• [MODIFY] __tests__/openapi-webhooks.test.ts
  • Updated expectations for the delete endpoints on both v1 and v2 to reflect the new status codes and soft-delete behavior.

Verification Results

npm test
npm run lint
npm run build
npm run openapi:check

Acceptance Criteria	Status
One shared delete helper is used by both routes	✅ deleteStream in app/lib/stream-delete.ts
Every test plan row passes	✅ Covered by route tests for v1 and v2
npm test, npm run lint, npm run build and npm run openapi:check pass	✅
Helper coverage is at least 90%	✅

Closes #1733

[greatest0fallt1me]

@EmperorNexus ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• code execution added to config eslint.config.mjs
• malware marker in eslint.config.mjs
• obfuscated content in eslint.config.mjs

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, or code appended to config files), rebase onto the latest main, and force-push.

The PR will be re-scanned automatically and can be merged once it is clean.

[greatest0fallt1me]

@EmperorNexus ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• code execution added to config eslint.config.mjs
• malware marker in eslint.config.mjs
• obfuscated content in eslint.config.mjs

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, or code appended to config files), rebase onto the latest main, and force-push.

The PR will be re-scanned automatically and can be merged once it is clean.

[greatest0fallt1me]

@EmperorNexus ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• malware marker in .gitignore
• malware marker in PR head tree (full-tree scan: .vscode/tasks.json, fonts or payload files)

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, code appended to config files, branch_structure.json, the public/fonts/ bundle, and the temp_auto_push.bat / temp_interactive_push.bat / branch_structure.json lines in .gitignore), rebase onto the latest main, and force-push. Those .gitignore entries and branch_structure.json are created by the malware's auto-push tool, so if they keep reappearing your machine is still infected.

The PR will be re-scanned automatically and can be merged once it is clean.

[greatest0fallt1me]

This PR came from a machine infected with the PolinRider malware. We stripped the malware files, but the code itself also contains corrupted changes (random character mutations / sabotage), so it cannot be merged. Found: an unrelated rewrite of deepArchive in app/lib/audit-log.ts that removes chain re-basing and integrity checks, plus .gitignore entries hiding the auto-push scripts. Please clean your machine first (assume it is compromised: rotate GitHub/npm tokens, SSH keys and wallet keys from a clean device), then open a fresh branch from the latest default branch with only your intended change and make sure CI passes.

[greatest0fallt1me]

@EmperorNexus ⚠️ This PR contains malware and cannot be merged.

Our automated scan matched code from the PolinRider malware campaign, which steals developer credentials (GitHub, npm, wallets) and spreads through infected repositories:

• malware marker in .gitignore

What to do:

1. Your machine is very likely infected. Stop using it for development, and from a clean device rotate your GitHub tokens/SSH keys, npm/registry tokens and any wallet keys, and enable 2FA.
2. Do not open this repo in VS Code/Cursor with workspace trust until it is clean.
3. Remove the malicious files/changes listed above (e.g. .vscode/tasks.json, task.allowAutomaticTasks, fake font files such as public/fonts/fa-solid-500.woff2, dist/setup.js, api.js, code appended to config files, branch_structure.json, the public/fonts/ bundle, and the temp_auto_push.bat / temp_interactive_push.bat / branch_structure.json lines in .gitignore), rebase onto the latest main, and force-push. Those .gitignore entries and branch_structure.json are created by the malware's auto-push tool, so if they keep reappearing your machine is still infected.

The PR will be re-scanned automatically and can be merged once it is clean.