Release: develop -> master

.env.example

@@ -141,6 +141,10 @@ EVM_CUSTODY_SEED=
 EVM_WALLETS=
 EVM_DELEGATION_ENABLED=true
 
+# Pimlico Paymaster for EIP-5792 gasless transactions
+# Get your API key from https://dashboard.pimlico.io/
+PIMLICO_API_KEY=
+
 ETH_WALLET_ADDRESS=
 ETH_WALLET_PRIVATE_KEY=xxx
 

.github/codeql/codeql-config.yml

@@ -0,0 +1,6 @@
+name: "DFX API CodeQL Config"
+
+# Exclude infrastructure scripts that intentionally handle sensitive data
+# rpcauth.py is a CLI tool that generates Bitcoin RPC credentials and must output them
+paths-ignore:
+  - infrastructure/scripts/rpcauth.py

.github/workflows/api-dev.yaml

@@ -5,6 +5,9 @@ on:
     branches: [develop]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   AZURE_WEBAPP_NAME: app-dfx-api-dev
   AZURE_WEBAPP_PACKAGE_PATH: '.'
@@ -22,27 +25,31 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
 
       - name: Install packages
         uses: nick-fields/retry@v3
         with:
           timeout_minutes: 10
           max_attempts: 3
           retry_on: error
-          command: |
-            npm ci
+          command: npm ci
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Format check
+        run: npm run format:check
 
       - name: Build code
-        run: |
-          npm run build
+        run: npm run build
 
       - name: Run tests
-        run: |
-          npm run test
+        run: npm run test
 
-      - name: Run linter
-        run: |
-          npm run lint
+      - name: Security audit
+        run: npm audit --audit-level=high
+        continue-on-error: true
 
       - name: Deploy to Azure App Service (DEV)
         uses: azure/webapps-deploy@v3

.github/workflows/api-pr.yaml

@@ -7,6 +7,9 @@ on:
       - develop
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   NODE_VERSION: '20.x'
 
@@ -23,24 +26,28 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
 
       - name: Install packages
         uses: nick-fields/retry@v3
         with:
           timeout_minutes: 10
           max_attempts: 3
           retry_on: error
-          command: |
-            npm ci
+          command: npm ci
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Format check
+        run: npm run format:check
 
       - name: Build code
-        run: |
-          npm run build
+        run: npm run build
 
       - name: Run tests
-        run: |
-          npm run test
+        run: npm run test
 
-      - name: Run linter
-        run: |
-          npm run lint
+      - name: Security audit
+        run: npm audit --audit-level=high
+        continue-on-error: true

.github/workflows/api-prd.yaml

@@ -5,6 +5,9 @@ on:
     branches: [master]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   AZURE_WEBAPP_NAME: app-dfx-api-prd
   AZURE_WEBAPP_PACKAGE_PATH: '.'
@@ -22,27 +25,31 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
 
       - name: Install packages
         uses: nick-fields/retry@v3
         with:
           timeout_minutes: 10
           max_attempts: 3
           retry_on: error
-          command: |
-            npm ci
+          command: npm ci
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Format check
+        run: npm run format:check
 
       - name: Build code
-        run: |
-          npm run build
+        run: npm run build
 
       - name: Run tests
-        run: |
-          npm run test
+        run: npm run test
 
-      - name: Run linter
-        run: |
-          npm run lint
+      - name: Security audit
+        run: npm audit --audit-level=high
+        continue-on-error: true
 
       - name: Deploy to Azure App Service (PRD)
         uses: azure/webapps-deploy@v3

.github/workflows/auto-release-pr.yaml

@@ -0,0 +1,70 @@
+name: Auto Release PR
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: auto-release-pr
+  cancel-in-progress: false
+
+jobs:
+  create-release-pr:
+    name: Create Release PR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch master branch
+        run: git fetch origin master
+
+      - name: Check for existing PR
+        id: check-pr
+        run: |
+          PR_COUNT=$(gh pr list --base master --head develop --state open --json number --jq 'length')
+          echo "pr_exists=$([[ $PR_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
+          echo "::notice::Open PRs from develop to master: $PR_COUNT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check for differences
+        id: check-diff
+        if: steps.check-pr.outputs.pr_exists == 'false'
+        run: |
+          DIFF_COUNT=$(git rev-list --count origin/master..origin/develop)
+          echo "has_changes=$([[ $DIFF_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
+          echo "commit_count=$DIFF_COUNT" >> $GITHUB_OUTPUT
+          echo "::notice::Commits ahead of master: $DIFF_COUNT"
+
+      - name: Create Release PR
+        if: steps.check-pr.outputs.pr_exists == 'false' && steps.check-diff.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMIT_COUNT: ${{ steps.check-diff.outputs.commit_count }}
+        run: |
+          printf '%s\n' \
+            "## Automatic Release PR" \
+            "" \
+            "This PR was automatically created after changes were pushed to develop." \
+            "" \
+            "**Commits:** ${COMMIT_COUNT} new commit(s)" \
+            "" \
+            "### Checklist" \
+            "- [ ] Review all changes" \
+            "- [ ] Verify CI passes" \
+            "- [ ] Approve and merge when ready for production" \
+            > /tmp/pr-body.md
+
+          gh pr create \
+            --base master \
+            --head develop \
+            --title "Release: develop -> master" \
+            --body-file /tmp/pr-body.md

.gitignore

@@ -45,3 +45,4 @@ placeholder.env
 thunder-tests/env
 .claude/settings.local.json
 .api.pid
+CLAUDE.md

eslint.config.js

@@ -24,7 +24,7 @@ module.exports = tseslint.config(
       'no-return-await': 'off',
       'no-console': ['warn'],
       '@typescript-eslint/return-await': ['warn', 'in-try-catch'],
-      '@typescript-eslint/no-floating-promises': 'warn',
+      '@typescript-eslint/no-floating-promises': 'error',
       '@typescript-eslint/explicit-function-return-type': 'off',
       '@typescript-eslint/explicit-module-boundary-types': 'off',
       '@typescript-eslint/no-explicit-any': 'off',

migration/1767291858000-AddSepoliaUSDT.js

@@ -0,0 +1,25 @@
+const { MigrationInterface, QueryRunner } = require("typeorm");
+
+module.exports = class AddSepoliaUSDT1767291858000 {
+    name = 'AddSepoliaUSDT1767291858000'
+
+    async up(queryRunner) {
+        await queryRunner.query(`
+            INSERT INTO "dbo"."asset" (
+                "name", "type", "buyable", "sellable", "chainId", "dexName", "category", "blockchain", "uniqueName", "description",
+                "comingSoon", "decimals", "paymentEnabled", "refundEnabled", "cardBuyable", "cardSellable", "instantBuyable", "instantSellable",
+                "financialType", "ikna", "personalIbanEnabled", "amlRuleFrom", "amlRuleTo", "priceRuleId",
+                "approxPriceUsd", "approxPriceChf", "approxPriceEur"
+            ) VALUES (
+                'USDT', 'Token', 0, 1, '0xaa8e23fb1079ea71e0a56f48a2aa51851d8433d0', 'USDT', 'Public', 'Sepolia', 'Sepolia/USDT', 'Tether',
+                0, 6, 0, 1, 0, 0, 0, 0,
+                'USD', 0, 0, 0, 0, 40,
+                1, 0.78851, 0.849
+            )
+        `);
+    }
+
+    async down(queryRunner) {
+        await queryRunner.query(`DELETE FROM "dbo"."asset" WHERE "uniqueName" = 'Sepolia/USDT'`);
+    }
+}

migration/1767435900000-AddSepoliaREALU.js

@@ -0,0 +1,25 @@
+const { MigrationInterface, QueryRunner } = require("typeorm");
+
+module.exports = class AddSepoliaREALU1767435900000 {
+    name = 'AddSepoliaREALU1767435900000'
+
+    async up(queryRunner) {
+        await queryRunner.query(`
+            INSERT INTO "dbo"."asset" (
+                "name", "type", "buyable", "sellable", "chainId", "dexName", "category", "blockchain", "uniqueName", "description",
+                "comingSoon", "decimals", "paymentEnabled", "refundEnabled", "cardBuyable", "cardSellable", "instantBuyable", "instantSellable",
+                "financialType", "ikna", "personalIbanEnabled", "amlRuleFrom", "amlRuleTo", "priceRuleId",
+                "approxPriceUsd", "approxPriceChf", "approxPriceEur", "sortOrder"
+            ) VALUES (
+                'REALU', 'Token', 0, 0, '0x0add9824820508dd7992cbebb9f13fbe8e45a30f', 'REALU', 'Public', 'Sepolia', 'Sepolia/REALU', 'RealUnit Shares (Testnet)',
+                0, 0, 0, 1, 0, 0, 0, 0,
+                'Other', 0, 0, 0, 0, 61,
+                1.711564371, 1.349572115, 1.453103607, 99
+            )
+        `);
+    }
+
+    async down(queryRunner) {
+        await queryRunner.query(`DELETE FROM "dbo"."asset" WHERE "uniqueName" = 'Sepolia/REALU'`);
+    }
+}

migration/1767611859179-RefactorCreditorDataToJson.js

@@ -0,0 +1,31 @@
+/**
+ * @typedef {import('typeorm').MigrationInterface} MigrationInterface
+ * @typedef {import('typeorm').QueryRunner} QueryRunner
+ */
+
+/**
+ * @class
+ * @implements {MigrationInterface}
+ */
+module.exports = class RefactorCreditorDataToJson1767611859179 {
+    name = 'RefactorCreditorDataToJson1767611859179'
+
+    /**
+     * @param {QueryRunner} queryRunner
+     */
+    async up(queryRunner) {
+        // Add new JSON column to buy_crypto
+        await queryRunner.query(`ALTER TABLE "buy_crypto" ADD "chargebackCreditorData" nvarchar(MAX)`);
+
+        // Add new JSON column to bank_tx_return
+        await queryRunner.query(`ALTER TABLE "bank_tx_return" ADD "chargebackCreditorData" nvarchar(MAX)`);
+    }
+
+    /**
+     * @param {QueryRunner} queryRunner
+     */
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "bank_tx_return" DROP COLUMN "chargebackCreditorData"`);
+        await queryRunner.query(`ALTER TABLE "buy_crypto" DROP COLUMN "chargebackCreditorData"`);
+    }
+}

migration/1767715439412-AddUserDataIsTrustedReferrer.js

@@ -0,0 +1,27 @@
+/**
+ * @typedef {import('typeorm').MigrationInterface} MigrationInterface
+ * @typedef {import('typeorm').QueryRunner} QueryRunner
+ */
+
+/**
+ * @class
+ * @implements {MigrationInterface}
+ */
+module.exports = class AddUserDataIsTrustedReferrer1767715439412 {
+    name = 'AddUserDataIsTrustedReferrer1767715439412'
+
+    /**
+     * @param {QueryRunner} queryRunner
+     */
+    async up(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "user_data" ADD "isTrustedReferrer" bit NOT NULL CONSTRAINT "DF_37c1348125fec15f1c48f62d455" DEFAULT 0`);
+    }
+
+    /**
+     * @param {QueryRunner} queryRunner
+     */
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "user_data" DROP CONSTRAINT "DF_37c1348125fec15f1c48f62d455"`);
+        await queryRunner.query(`ALTER TABLE "user_data" DROP COLUMN "isTrustedReferrer"`);
+    }
+}

migration/seed/asset.csv

@@ -1,4 +1,6 @@
 id,name,type,buyable,sellable,chainId,sellCommand,dexName,category,blockchain,uniqueName,description,comingSoon,sortOrder,approxPriceUsd,ikna,priceRuleId,approxPriceChf,cardBuyable,cardSellable,instantBuyable,instantSellable,financialType,decimals,paymentEnabled,amlRuleFrom,amlRuleTo,approxPriceEur,refundEnabled
+408,REALU,Token,FALSE,FALSE,0x0add9824820508dd7992cbebb9f13fbe8e45a30f,,REALU,Public,Sepolia,Sepolia/REALU,RealUnit Shares (Testnet),FALSE,99,1.711564371,FALSE,61,1.349572115,FALSE,FALSE,FALSE,FALSE,Other,0,FALSE,0,0,1.453103607,TRUE
+407,USDT,Token,FALSE,TRUE,0xaa8e23fb1079ea71e0a56f48a2aa51851d8433d0,,USDT,Public,Sepolia,Sepolia/USDT,Tether,FALSE,,1,FALSE,40,0.78851,FALSE,FALSE,FALSE,FALSE,USD,6,FALSE,0,0,0.849,TRUE
 406,ADA,Coin,TRUE,TRUE,,,ADA,Public,Cardano,Cardano/ADA,Cardano,FALSE,,0.3492050313,FALSE,63,0.2753489034,FALSE,FALSE,FALSE,FALSE,Other,6,FALSE,0,0,0.2964721043,TRUE
 405,EUR,Custody,FALSE,FALSE,,,EUR,Private,Yapeal,Yapeal/EUR,,FALSE,,1.17786809,FALSE,39,0.9287514723,FALSE,FALSE,FALSE,FALSE,EUR,,FALSE,0,0,1,TRUE
 404,CHF,Custody,FALSE,FALSE,,,CHF,Private,Yapeal,Yapeal/CHF,,FALSE,,1.268227427,FALSE,37,1,FALSE,FALSE,FALSE,FALSE,CHF,,FALSE,0,0,1.076714309,TRUE