fix: bound chat storage (#655), decimal-safe wallet amounts (#657), raw-body webhook verification (#662), payments constructor integrity (#665)

[NickiM84]

Closes #655, closes #657, closes #662, closes #665.

Resolves all four issues assigned to @NickiM84 in the Stellar Wave program, in one PR.

#665 (BA-097) — Fix payment service dependency and constructor integrity

• Removed duplicate imports and the malformed constructor fragment in payments.service.ts (the file did not compile).
• DatabaseService is the single required collaborator; IContractAdapter and ConfigService are injected once as optional collaborators, with declared properties (defaultTimeoutMs, webhookMaxRetries, etc.) and safe defaults.
• Removed duplicated getRedemptionHistory / getAllCoupons methods.
• Added payments.service.spec.ts covering construction with required and optional collaborators, webhook processing outcomes, and transaction-history pagination.

#662 (BA-094) — Validate payment webhook signatures against the raw body

• Enabled rawBody: true in main.ts so req.rawBody (Buffer) is available.
• POST /payments/webhook now verifies the HMAC-SHA256 signature over the raw request bytes via SecurityService.verifyWebhookSignatureRaw (timing-safe) before any JSON parsing; invalid signatures throw 401 and never reach processPaymentWebhookEvent, so they can never mutate state.
• PaymentsModule now imports SecurityModule and MonitoringModule so the controller's collaborators resolve.
• Also fixed two boot-crashing typos in main.ts (useStaticCassets → useStaticAssets, PUTP → PUT) so the app can actually start.

#657 (BA-089) — Use decimal-safe amount arithmetic

• wallet.service.ts now performs all transfers/fees/reconciliation in integer minor units (scale 1e-5, matching the existing 5-decimal display).
• parseFloat and float arithmetic removed; inputs with more than 5 decimals are rounded half-up; precision and rounding rules documented in the file header.
• Added wallet.service.spec.ts verifying drift-free addition (0.1 + 0.2 = 0.30000), fee accounting, half-up rounding, insufficient-balance rejection, and exact reconciliation differences.

#655 (BA-087) — Bound chat room and message storage

• ChatService now delegates storage to IChatRepository/InMemoryChatRepository, which enforces maxRooms, maxMessagesPerRoom, retention TTLs (roomTtlMs, messageTtlMs) with lazy pruning and oldest-first eviction.
• findMessagesByRoom / findAllRooms are paginated (limit + opaque cursor, newest-first for rooms); the controller passes query params through.
• Authorization: posting a message or code snippet requires the room to exist and the sender to be a participant; reading requires the room to exist.
• Fixed the mangled merge in chat.service.ts (broken cleanupIncompleteMessages/missing brace) that prevented compilation.
• Extended chat.service.spec.ts with pagination, bounded-storage/eviction, retention, and authorization coverage.

Verification

• tsc --noEmit is clean for all touched files (remaining errors are pre-existing in unrelated modules owned by other issues).
• Jest: all suites for chat, wallet, payments, and security pass (35 tests); full-suite comparison against the base shows zero newly failing suites.

[drips-wave]

@NickiM84 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits