Skip to content

feat(analytics): add search analytics (Closes #245) - #371

Open
Bogunrot wants to merge 38 commits into
Deen-Bridge:mainfrom
Bogunrot:feat/issue-245-search-analytics
Open

feat(analytics): add search analytics (Closes #245)#371
Bogunrot wants to merge 38 commits into
Deen-Bridge:mainfrom
Bogunrot:feat/issue-245-search-analytics

Conversation

@Bogunrot

Copy link
Copy Markdown
Contributor

1. Linked Issue

Closes #245

2. Problem Statement (The Bug)

There is no visibility into what users search for on the platform. The team can't answer basic questions like "what are the top queries?", "how often do searches return nothing?", or "which topics should we create content for?". Zero-result searches in particular are the direct signal for content gaps, and without tracking them they are invisible. This absence is fundamental — there is no data source at all — so it cannot be fixed with a local patch; it requires a logging + aggregation pipeline and admin-facing endpoints.

3. Solution Comparison and Decision

Options considered:

  • Option A — Parse box/nginx-style request logs. Reuses infrastructure but loses structured data (who searched, result counts, which searches were zero-result) and couples analytics to log rotation.
  • Option B — Client-side (frontend) event reporting only. Requires frontend changes and can miss server-side cached/other traffic; loses a single source of truth.
  • Option C (chosen) — Server-side middleware hooked into the real search routes, storing one event per query in Mongo with a TTL, plus admin aggregation endpoints.

Option C is chosen because it is structured, reliable (records every real search served by the API), and lives entirely in the backend — no frontend coordination needed to start capturing data.

4. The Change (Code modifications)

  • searchLogger middleware wired into GET /api/search and GET /api/search/educators. It records the query, type, result count, whether it returned zero results, session/user, and filters. Logging is fire-and-forget (a failed write never fails or slows the search).
  • SearchAnalyticsEvent model with a 90-day TTL and indexes on query/hasResults.
  • Service aggregates top queries by frequency, zero-result searches, a summary, and daily trends — all filterable by date range and type, with pagination.
  • Admin-gated GET /api/analytics/search/{top,zero-results,summary,trends}.

Core logging piece:

export const searchLogger = (req, res, next) => {
  const originalJson = res.json.bind(res);
  res.json = function (body) {
    res.json = originalJson;
    const query = (req.query.q || req.query.query || "").trim();
    if (query) {
      const resultCount = countResults(body);
      logSearchEvent({
        userId: req.user?._id || null,
        query,
        type: req.query.type || "all",
        resultCount,
        hasResults: resultCount > 0,
        // ...
      }).catch((err) => logger.error("Failed to log search event:", err));
    }
    return originalJson(body);
  };
  next();
};
Endpoint Auth Purpose
GET /api/search / GET /api/search/educators public logs each query (wired middleware)
GET /api/analytics/search/top admin top queries by frequency, date/type filtered, paginated
GET /api/analytics/search/zero-results admin zero-result queries (content gaps)
GET /api/analytics/search/summary admin totals + zero-result rate
GET /api/analytics/search/trends admin searches per day over time

5. Compatibility Note (On INTERFACE_VERSION)

This project exposes no INTERFACE_VERSION, and nothing about this feature changes it: the feature is purely additive (new middleware on read routes + new admin endpoints + a new collection). No existing response is modified.

6. Incidental Fixes (Two things the issue called out that also got fixed)

  • Timestamps on every query are guaranteed by the model's timestamps: true (createdAt) so searches can be sliced by date range.
  • Zero-result searches are tracked distinctly (hasResults: false) rather than inferred by counting later, so the /zero-results endpoint and summary rate are exact.

7. Testing (Proving it works)

  • Unit (test/searchAnalytics.test.js): every admin aggregation endpoint returns a { success, data } envelope, handles empty collections, and applies filters.
  • End-to-end (test/searchAnalyticsIntegration.test.js) hits the real paths through app.js with mongodb-memory-server:
    • performs real GET /api/search calls, then asserts events land in Mongo with the query, createdAt timestamp, and correct hasResults/resultCount;
    • a zero-result search is surfaced by GET /api/analytics/search/zero-results;
    • repeated searches are reported by GET /api/analytics/search/top by frequency;
    • the analytics endpoints are guarded (401 anonymous, 403 non-admin).
Suite Result
test/searchAnalytics.test.js ✅ 13/13
test/searchAnalyticsIntegration.test.js ✅ 4/4
test/search.test.js (pre-existing search suite) ✅ 7/7

All green. The coreFlows.test.js suite has a pre-existing spawnSync-import hang (app's hourly trending-hashtag setInterval), unrelated to this change.

8. Additional Notes (Scope)

Scope is search analytics only: new searchAnalyticsController, search-analytics-service, search-analytics-event model, search-logger middleware, routes/analytics/search.js, plus wiring into searchRoutes.js and app.js. No unrelated files changed.

Banx17 and others added 30 commits August 12, 2026 23:57
Deen-Bridge#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.
Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.
PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.
…swords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage
* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (Deen-Bridge#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
…n-Bridge#88) (Deen-Bridge#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes Deen-Bridge#88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
…l bodies (Deen-Bridge#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes Deen-Bridge#95
…s and donations (Deen-Bridge#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes Deen-Bridge#94
…creation gating (Deen-Bridge#92) (Deen-Bridge#102)

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes Deen-Bridge#92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
…ce (Deen-Bridge#91) (Deen-Bridge#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes Deen-Bridge#91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
…Deen-Bridge#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes Deen-Bridge#45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Deen-Bridge#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
* Validate auth and Stellar requests

* Address validation review feedback
* Secure book deletion

* Keep delete response consistent
…reclaim (Deen-Bridge#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.
…oints (Deen-Bridge#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.
…innet switch (Deen-Bridge#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.
…nd caps (Deen-Bridge#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes Deen-Bridge#30
Resolved conflicts:
- src/controllers/authController.js: Keep 2FA controllers from dev
- src/models/AuditLog.js: Keep 2FA audit actions from dev
- src/services/stellar/horizonClient.js: Keep centralized stellar config from dev

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation
* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions
closes Deen-Bridge#168) (Deen-Bridge#276)

Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>
* Merge dev into main (Deen-Bridge#117)

* stellar: validate signed XDR contents before submit; store expectedHa… (Deen-Bridge#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (Deen-Bridge#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (Deen-Bridge#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (Deen-Bridge#88) (Deen-Bridge#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes Deen-Bridge#88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (Deen-Bridge#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes Deen-Bridge#95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (Deen-Bridge#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes Deen-Bridge#94

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) (Deen-Bridge#102)

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes Deen-Bridge#92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (Deen-Bridge#91) (Deen-Bridge#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes Deen-Bridge#91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (Deen-Bridge#45) (Deen-Bridge#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes Deen-Bridge#45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (Deen-Bridge#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (Deen-Bridge#108)

* Improve application test coverage (Deen-Bridge#110)

* Add dependency health checks (Deen-Bridge#112)

* Validate auth and Stellar requests (Deen-Bridge#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (Deen-Bridge#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (Deen-Bridge#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (Deen-Bridge#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (Deen-Bridge#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (Deen-Bridge#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes Deen-Bridge#30

* feat: add managed course categories (Deen-Bridge#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (Deen-Bridge#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* feat(api): serve interactive Swagger UI at /api-docs

- src/config/swagger.js loads root openapi.yaml via js-yaml
- src/routes/api-docs.js mounts swagger-ui-express with
  persistAuthorization for testing protected endpoints
- Deen-Bridge branding via embedded custom CSS
- mounted outside rate limiters alongside /.well-known

---------

Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>
* Merge dev into main (#117)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* refactor(db): Create /mongo folder structure (#280)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

* refactor(db): scaffold /mongo data-layer structure (closes #167)

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* feat(soroban): Implement loyalty points contract (#279)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot …
…een-Bridge#283)

* Merge dev into main (Deen-Bridge#117)

* stellar: validate signed XDR contents before submit; store expectedHa… (Deen-Bridge#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (Deen-Bridge#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (Deen-Bridge#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (Deen-Bridge#88) (Deen-Bridge#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes Deen-Bridge#88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (Deen-Bridge#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes Deen-Bridge#95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (Deen-Bridge#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes Deen-Bridge#94

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) (Deen-Bridge#102)

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes Deen-Bridge#92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (Deen-Bridge#91) (Deen-Bridge#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes Deen-Bridge#91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (Deen-Bridge#45) (Deen-Bridge#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes Deen-Bridge#45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (Deen-Bridge#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (Deen-Bridge#108)

* Improve application test coverage (Deen-Bridge#110)

* Add dependency health checks (Deen-Bridge#112)

* Validate auth and Stellar requests (Deen-Bridge#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (Deen-Bridge#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (Deen-Bridge#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (Deen-Bridge#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (Deen-Bridge#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (Deen-Bridge#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes Deen-Bridge#30

* feat: add managed course categories (Deen-Bridge#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (Deen-Bridge#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* feat(stellar): add loyalty points Soroban contract and service (closes Deen-Bridge#161)

* refactor(db): Create /mongo folder structure (Deen-Bridge#280)

* stellar: validate signed XDR contents before submit; store expectedHa… (Deen-Bridge#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (Deen-Bridge#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (Deen-Bridge#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (Deen-Bridge#88) (Deen-Bridge#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes Deen-Bridge#88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (Deen-Bridge#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes Deen-Bridge#95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (Deen-Bridge#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes Deen-Bridge#94

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) (Deen-Bridge#102)

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes Deen-Bridge#92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (Deen-Bridge#91) (Deen-Bridge#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes Deen-Bridge#91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (Deen-Bridge#45) (Deen-Bridge#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes Deen-Bridge#45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (Deen-Bridge#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (Deen-Bridge#108)

* Improve application test coverage (Deen-Bridge#110)

* Add dependency health checks (Deen-Bridge#112)

* Validate auth and Stellar requests (Deen-Bridge#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (Deen-Bridge#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (Deen-Bridge#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (Deen-Bridge#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (Deen-Bridge#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (Deen-Bridge#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes Deen-Bridge#30

* feat: add managed course categories (Deen-Bridge#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (Deen-Bridge#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

* refactor(db): scaffold /mongo data-layer structure (closes Deen-Bridge#167)

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

---------

Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>
* Merge dev into main (#117)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* refactor(db): Create /mongo folder structure (#280)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

* refactor(db): scaffold /mongo data-layer structure (closes #167)

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* feat(soroban): Implement loyalty points contract (#279)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fa…
mayborn005 and others added 6 commits August 24, 2026 20:08
* Merge dev into main (#117)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* refactor(db): Create /mongo folder structure (#280)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

* refactor(db): scaffold /mongo data-layer structure (closes #167)

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* feat(soroban): Implement loyalty points contract (#279)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot wh…
* Merge dev into main (#117)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* refactor(db): Create /mongo folder structure (#280)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes #30

* feat: add managed course categories (#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

* refactor(db): scaffold /mongo data-layer structure (closes #167)

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* feat(soroban): Implement loyalty points contract (#279)

* stellar: validate signed XDR contents before submit; store expectedHa… (#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89) (#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (#88) (#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes #88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes #95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes #94

* feat(security): implement educator verification pipeline and content-creation gating (#92) (#102)

* feat(security): implement educator verification pipeline and content-creation gating (#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes #92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (#91) (#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes #91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (#45) (#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes #45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (#108)

* Improve application test coverage (#110)

* Add dependency health checks (#112)

* Validate auth and Stellar requests (#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot…
…Bridge#171) (Deen-Bridge#292)

Introduces mongo/repositories/CourseRepository.js extending BaseRepository so
controllers/services stop querying the Course model directly.

Course-specific reads:
- findByEducator / paginateByEducator — courses authored by a user
- findPublished — centralized, paginated public catalogue (single place to
  add a status filter if a draft/published lifecycle is later introduced)
- searchCourses — full-text search over title/description/category with a
  regex fallback for short tokens
- findByCategory — courses by categoryRef

Enrollment queries:
- findEnrolledCourses / paginateEnrolledCourses
- isUserEnrolled, countEnrollments

Offset pagination is provided for every listing via the inherited paginate().
ObjectId inputs are validated up front, raising the repository's typed
RepositoryValidationError (HTTP 400). Adds test/courseRepository.test.js
(17 cases, MongoMemoryServer).
* Merge dev into main (Deen-Bridge#117)

* stellar: validate signed XDR contents before submit; store expectedHa… (Deen-Bridge#51)

* stellar: validate signed XDR contents before submit; store expectedHash/memo; verify on-chain before granting access; add tests

* test: add validateSignedPaymentXdr to stellarService mock (new import in paymentController)

* test: expect expectedHash at payment init (XDR pre-validation stores it there)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89) (Deen-Bridge#99)

* feat(auth): harden authentication against login lockout, breached passwords, and signup abuse (Deen-Bridge#89)

- Add progressive per-account login lockout (failedLoginAttempts + lockUntil) with env-configurable escalating backoff, generic 429 while locked, and AUTH_ACCOUNT_LOCKED audit emission.
- Add HaveIBeenPwned breached-password check (SHA-1 prefix k-anonymity, never transmits the password) at register and password reset; fails open on outage.
- Add per-email throttling on /register and /resend-verification (emailAuthLimiter, survives IP rotation, active in test env) plus a pluggable captcha gate (no-op when unconfigured).
- Add User lockout fields and document new env vars in .env.example.

* fix(auth): address CodeRabbit review on login lockout, HIBP, captcha, and JWT secret (Deen-Bridge#89)

- loginUser: locked accounts now return the same generic 401 'Invalid credentials'
  as a nonexistent account (no enumeration); failed-login counter incremented
  atomically via findByIdAndUpdate \, lock persisted via updateOne
- resetPassword: breached-password check moved to after successful OTP validation
  so unauthenticated callers cannot trigger HIBP lookups
- authController: refuse to start when JWT_SECRET is missing (no hardcoded fallback)
- hibp: request HIBP padding ('Add-Padding: true') and ignore zero-count records
- captcha: configurable CAPTCHA_TIMEOUT_MS (default 5s) passed to the provider call;
  captcha rejection now returns the standard { success, message, data: null } shape
- tests: assert escalating backoff magnitude (120s on 6th failure) and the 24h cap;
  locked-account test expects 401; per-email limiter buckets reset between tests;
  outage test routed through mockHibp so the shared spy is cleaned up; added
  padding-record and cap coverage

* Feat/93 idempotency keys (Deen-Bridge#100)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(payment): add request-level idempotency keys to payment endpoints (Deen-Bridge#93)

* test: complement stellarService mock exports in idempotency test

* test: refine idempotency middleware concurrency lock test (Deen-Bridge#93)

* fix(stellar): export validateSignedPaymentXdr and complement test mock (Deen-Bridge#93)

* fix(stellar): remove duplicate validateSignedPaymentXdr export (Deen-Bridge#93)

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* feat(auth): enforce resource ownership across mutating endpoints (Deen-Bridge#88) (Deen-Bridge#105)

Add a centralized authorization layer that verifies the authenticated
user owns the target resource (or is an admin) before any mutating
handler runs, replacing the ad-hoc inline checks scattered across
controllers.

- add authorizeOwnership + authorizeReviewOwnership middleware
  (src/middlewares/authorize.js); on success the loaded doc is attached
  to req so handlers can reuse it
- apply the guards to book delete, course update, space update/delete,
  and review update/delete on books and courses; review create stays
  purchase-gated
- record ownership denials to the audit log (authz.ownership.denied)
- remove the now-redundant inline ownership checks from the book,
  course, space, and review controllers
- document the resource x action x role matrix (docs/authorization-matrix.md)
  and cover it with an integration test suite (test/ownershipAuthz.test.js)

Closes Deen-Bridge#88

Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>

* fix(security): stop logging OTP codes and verification tokens in email bodies (Deen-Bridge#104)

The NODE_ENV === "test" branch of sendMail logged the full rendered email
body — including the password-reset OTP span and the verification link's
token query param — and pino's redact config cannot censor values baked
into interpolated strings, so the leak bypassed the app-wide redaction.

Remove the body from every log statement (log only recipient, subject, and
template id via structured fields), and give tests a sanctioned in-memory
outbox hook instead of log scraping. sendOtpEmail/sendVerificationEmail/
sendReceiptEmail now return the sendMail result so callers can capture it.

Closes Deen-Bridge#95

* fix(transactions): prevent TTL index from deleting confirmed purchases and donations (Deen-Bridge#103)

The Transaction collection used a blanket TTL index on expiresAt with a
schema default that stamped a 30-minute expiry on every row regardless of
status. Because confirm paths never cleared expiresAt, confirmed on-chain
purchases and donations were permanently reaped ~30 minutes after creation,
deleting the proof of payment and orphaning recorded earnings.

Scope the TTL index to status: "pending" via partialFilterExpression, make
the expiresAt default conditional on status, add a pre-save hook that clears
expiresAt for any terminal state, explicitly unset expiresAt on every
terminal transition (submit, donation, refund, dispute, cancel, job handler,
reconciliation promotion), and add an idempotent migration that rescues
legacy non-pending rows and rebuilds the index.

Closes Deen-Bridge#94

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92) (Deen-Bridge#102)

* feat(security): implement educator verification pipeline and content-creation gating (Deen-Bridge#92)

- Add EducatorVerification model with legal state-machine transitions
  (draft -> pending -> approved/rejected, resubmit from rejected)
- Add verifiedEducator durable flag on User, set atomically on approval
- Add AUDIT_ACTIONS: EDUCATOR_VERIFY_SUBMIT/_RESUBMIT/_APPROVE/_REJECT
  with metadata allowlist entries in auditService
- requireVerifiedEducator middleware (403 for unverified, admin bypass)
- Applicant API: submit/resubmit app, get own app, signed doc URLs,
  signed Cloudinary upload-signature for private credential uploads
- Admin review queue: list+filter pending, view signed docs,
  approve/reject with notes (Mongo transaction for verifiedEducator grant)
- Gate all content-creation routes:
  * POST /api/courses  (courseRoutes.js)
  * POST /api/books    (bookRoutes.js)
  * POST /api/spaces   (spaceRoutes.js — live sessions per issue)
- Wire routes: /api/educator-verification + /api/admin/educator-verification
- Comprehensive test suite in test/educatorVerification.test.js
  (state-machine, middleware gating, submit/resubmit, approve/reject,
  content 403/2xx, both full lifecycles submit->pending->approve and
  reject->resubmit->approve, signed URL security, admin-only gating,
  audit log instrumentation)

Verification Results:
  app.test.js: 22/22 PASS (CI boot + endpoint health)
  auditLog.test.js: 21/21 PASS (append-only, redaction, admin gate)

Closes Deen-Bridge#92

* fix(ci): resolve educator verification pipeline test failures

- Remove redundant catchAsync double-wrap in educator-verification routes
  (controllers are already pre-wrapped; the outer wrap called .catch() on
  undefined, returning 500 for every new endpoint)
- Use MongoMemoryReplSet in educatorVerification.test.js so the approve/reject
  MongoDB transaction can run (standalone MongoMemoryServer cannot)
- Use AuditLog.collection.deleteMany in test cleanup to bypass append-only
  pre-hooks
- Return recordAudit's promise so callers can await durability; await it in
  submitApplication and performReview to eliminate the fire-and-forget
  audit-race in tests
- Fix testAuth.js password overwrite: destructure password out of the
  override spread so the hashed value is not clobbered by plaintext
- Seed bookUpload test user as a verifiedEducator mentor so the new content
  gate lets it through

---------

Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>

* feat(auth): signed service-to-service authentication for the AI service (Deen-Bridge#91) (Deen-Bridge#106)

Give the backend a real machine-to-machine auth channel for the AI
service (dnb-ai) — signed, scoped, rotatable keys instead of a single
static shared secret.

- add requireServiceAuth middleware (src/middlewares/serviceAuth.js):
  HMAC-SHA256 over a canonical method/path/timestamp/body-digest string,
  a ±300s replay window, constant-time signature comparison, per-key
  scope enforcement, and req.service on success
- key store (src/config/serviceKeys.js): multiple active keys keyed by
  kid for zero-downtime rotation; resilient env parsing, never throws
- mount a real internal route GET /api/internal/ai/whoami guarded by the
  guard (scope ai:read-content), plus raw-body capture in app.js
- migrate /admin/jobs off raw !== to a length-guarded timingSafeEqual
- audit denials (service_auth.denied), require AI_SERVICE_KEYS in prod
  (fail-fast), document the signing contract + rotation runbook
- cover the full accept/reject matrix in test/serviceAuth.test.js

Closes Deen-Bridge#91

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(webhooks): signed outbound webhook event system (Deen-Bridge#45) (Deen-Bridge#107)

Add an outbound webhook/event system so external consumers can subscribe
to payment and enrollment lifecycle events over HMAC-signed HTTP
callbacks, with retries, dead-lettering, and redelivery.

- models: WebhookEndpoint (encrypted secret at rest, subscribed events,
  auto-disable counters) and WebhookDelivery (all scheduling state in the
  doc: status, attemptCount, nextAttemptAt indexed)
- webhookService.emitEvent: typed event catalog, per-event id for
  consumer idempotency, strict payload allowlist (no secrets/emails/user
  docs); persists a delivery per subscribed endpoint after the txn
  commits, never blocks or fails the request path, no-ops when the DB is
  unavailable
- signing: X-DeenBridge-Signature v1=hmac-sha256(secret, `${ts}.${body}`)
  over the exact sent bytes; timing-safe verify + 5-min staleness window
- deliveryWorker: atomic findOneAndUpdate claim (no double-send),
  exponential backoff + jitter, dead-letter after max attempts, endpoint
  auto-disable after sustained failures
- management API (/api/webhooks, admin-gated): endpoint CRUD, rotate
  secret, list deliveries, redeliver (atomic $set), and ping
- SSRF guard: https-only in prod, reject loopback/RFC-1918/link-local
- wire emitters into payment (initialized/confirmed/failed/expired),
  enrollment, and wallet connect/disconnect; migrate /admin/jobs to a
  timing-safe token compare
- docs/webhooks.md consumer verifier + full offline test suite

Closes Deen-Bridge#45

Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>

* feat(security): implement TOTP two-factor authentication for admins a… (Deen-Bridge#98)

* feat(stellar): publish Soroban giving-escrow contract id in stellar.toml

Adds env-driven GIVING_ESCROW_CONTRACT (custom, non-SEP-1) so the deployed
On-Chain Giving escrow is discoverable from /.well-known/stellar.toml. Set
GIVING_ESCROW_CONTRACT_ID to enable. Includes test coverage.

* fix(stellar): resolve Horizon endpoints lazily + network-aware default

Horizon client was constructed at import time with a hardcoded testnet
fallback, so a mainnet deploy with HORIZON_URLS unset would silently talk to
testnet Horizon. Now the default is derived from STELLAR_NETWORK and the client
is built lazily on first use (after env is loaded). Explicit HORIZON_URLS still wins.

* feat(auth): authenticated change-password endpoint

PUT /api/auth/change-password (protected): verifies current password,
enforces the password policy, updates the hash, and signs out all other
sessions. Adds the auth.password_change audit action.

* feat(security): implement TOTP two-factor authentication for admins and mentors

- Add TOTP (RFC 6238) lifecycle: secret generation, encrypted storage at rest (AES-256-GCM), otpauth:// URI and QR code generation
- Add 10 single-use bcrypt-hashed recovery codes
- Add two-factor rate-limiting middleware (5 verification attempts per 15-minute window)
- Update login controller to issue step-up mfaToken challenges when 2FA is enabled
- Update authorizeRoles('admin') middleware to enforce 2FA-enabled status and 2FA-verified sessions
- Log audit actions for all 2FA lifecycle events (setup, enable, login challenge, success, failure, disable, recovery code usage)
- Add comprehensive test suite in test/auth2FA.test.js and update existing auth test suites

* ci: update node version to 22 and sync package-lock.json

* ci: pin mongo service to 6.0 and add wait-for-mongodb step

* test: add 2FA enablement and 2FA verified token to admin in refund.test.js

* fix(auth): switch bcrypt imports to pure-JS bcryptjs for cross-platform compatibility

* fix(test): remove duplicate MongoMemoryServer import in refund.test.js

* fix(test): add errorHandler middleware to refund.test.js app

* fix(test): clean up MongoDB connection logic and add afterAll hook in refund.test.js

* fix(test): standardize Mongoose connection lifecycle and add missing afterAll hooks

* fix(test): remove duplicate afterAll hooks and handle Multer 413 response status

* test(refund): explicitly set 2FA enablement and 2FA verified tokens for admin in refund.test.js

* test: ensure admin test helpers include 2FA enablement and 2FA verified JWT claims

* fix(test): add 2FA enablement and 2FA verified tokens for admin in webhooks and educatorVerification tests

---------

Co-authored-by: zeemscript <150973162+zeemscript@users.noreply.github.com>

* Add scholarship escrow contract foundation (Deen-Bridge#108)

* Improve application test coverage (Deen-Bridge#110)

* Add dependency health checks (Deen-Bridge#112)

* Validate auth and Stellar requests (Deen-Bridge#109)

* Validate auth and Stellar requests

* Address validation review feedback

* Secure book deletion authorization (Deen-Bridge#113)

* Secure book deletion

* Keep delete response consistent

* feat(stellar): gift courses/books via claimable balances with expiry reclaim (Deen-Bridge#116)

Adds a gift-a-course/book flow built on Stellar claimable balances so a
buyer can send an item to another user — including one who has not
finished wallet onboarding — without the recipient needing a USDC
trustline. The sender creates an on-ledger USDC balance the recipient
claims when ready, with a sender reclaim-after-expiry predicate so funds
are never stranded. Includes a GiftClaim model (no document-deleting TTL,
so the record survives expiry for reclaim), a claimableBalanceService
(build create/claim transactions with complementary predicates, resolve
the REAL balance id from the create result XDR — not the tx hash — with
a Horizon forClaimant fallback, and validate the signed gift XDR before
any state change), gift routes/controller at /api/stellar/gifts, and
granting item access to the RECIPIENT (never the payer) on claim. Wires
a `{ fallback: "claimable_balance" }` response into the purchase flow
when a creator wallet/trustline is missing. Tests cover predicate
decoding, trustline-free single-signature claiming, claim authorization
before/after expiry, the balance-id-vs-tx-hash distinction, tampered-XDR
rejection, guards mirroring initializePayment, and the recipient access
grant.

* feat(stellar): add idempotency protection to the Stellar payment endpoints (Deen-Bridge#115)

Makes /api/stellar/payment/initialize and /submit safe against
double-clicks, client retries, and concurrent duplicates. Submit is
naturally idempotent per transaction hash: the deterministic hash of
the signed XDR is looked up against confirmed transactions before any
processing, so a replayed submission returns the original success
response without re-granting access, with the unique index on
stellarTxHash as the database-level backstop (an E11000 on the confirm
save is treated as already processed). Initialize no longer piles up
duplicates: a pending checkout for the same user+item returns the
existing record (with its persisted unsigned XDR) instead of creating
a new document, and stale pending records are reaped by the existing
pending-only TTL index. Adds a stricter per-user rate limiter
(paymentLimiter) on the payment routes, keyed on the authenticated
user id with an IPv6-aware IP fallback. Covers duplicate-submit,
duplicate-initialize, the E11000 race, and limiter enforcement with
tests.

* feat(stellar): validate Stellar config at startup and document the mainnet switch (Deen-Bridge#114)

Adds a single source of truth for the Stellar network configuration
(src/config/stellar.js) that resolves the network name, network
passphrase, Horizon URLs, and USDC issuer from STELLAR_NETWORK, and
validates the whole setup fail-fast at boot so a misconfigured
deployment (bad network value, mainnet flag with testnet Horizon or
issuer) fails with an error naming the exact problem instead of at
request time. stellarService.js and horizonClient.js now consume this
module. Adds docs/MAINNET.md covering the env changes, creator
trustlines, and a first-mainnet-transaction smoke checklist, plus unit
tests for resolution and validation across both networks.

* feat(stellar): fee-bump sponsorship with structural whitelist and spend caps (Deen-Bridge#111)

Let the platform pay a user's Stellar network fee by wrapping the user-signed
transaction in a fee-bump signed by a dedicated fee-source account, so a user
holding USDC but ~no XLM can buy a book, buy a course, or donate. Opt-in per
submit via `requestSponsorship: true`; off by default and byte-for-byte
identical when disabled.

Guard rails (server signs on the platform's behalf):
- Structural whitelist (reject-by-default, allow-list of `payment` ops only):
  source, exact op count/order, destinations, amounts (stroops), asset, and
  memo must match the pending Transaction row exactly. Any foreign/extra
  operation — including unknown future types — is rejected.
- Durable spend caps (SponsorshipSpend, keyed by UTC day): per-transaction fee
  ceiling, per-day total, and per-user per-day count.
- Sponsor float pre-check so an underfunded sponsor never marks the user's
  transaction failed.

Fee-bump fee is priced over inner ops + wrapper and clamped to the ceiling
(verified against @stellar/stellar-sdk v16 and asserted in tests). Sponsored
rows record `sponsored`, `sponsorFeeCharged`, and the fee-bump (outer) hash
alongside the inner hash. Sponsorship-specific failures return a distinct
non-fatal 4xx/503 with `retryUnsponsored: true` and never mark the row failed.

- Config: FEE_SPONSOR_* in .env.example + validateEnv (fail-fast at boot when
  enabled with a missing/invalid secret); secret never logged or returned.
- Admin status endpoint GET /api/stellar/payment/sponsorship/status exposes the
  sponsor public key, live float, caps, and today's spend.
- Prometheus counters for approved/rejected sponsorship decisions.
- Docs: docs/fee-sponsorship.md, README, and openapi.yaml.
- Tests: feeSponsorService (whitelist adversarial matrix, fee correctness,
  inner-untouched, caps, secret handling, boot config) and feeSponsorSubmit
  (payment + donation flag-off regression, flag-on sponsorship, cap/whitelist
  rejections that don't fail the row).

Closes Deen-Bridge#30

* feat: add managed course categories (Deen-Bridge#118)

* feat(courses): add managed category taxonomy

* fix(categories): preserve legacy course creation

* feat: add recurring sadaqah pledges (Deen-Bridge#119)

* feat(donations): add recurring sadaqah pledges

* fix(pledges): preserve donation test compatibility

* fix(pledges): ignore non-persisted transactions

---------

Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>

* refactor(db): scaffold /mongo data-layer structure (closes Deen-Bridge#167)

---------

Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>
Co-authored-by: Afeez Tomisin <132703022+Banx17@users.noreply.github.com>
Co-authored-by: Alabi Ibrahim Abimbola <139625252+abimbolaalabi@users.noreply.github.com>
Co-authored-by: Kelechukwu Izuaba <144479895+Kaycee276@users.noreply.github.com>
Co-authored-by: BountySpaghetti <zeemroyals@gmail.com>
Co-authored-by: BountySpaghetti <286941608+BountySpaghetti@users.noreply.github.com>
Co-authored-by: Samuel Ojetunde <samuelojetunde898@gmail.com>
Co-authored-by: abimbolaalabi <abimbolaalabi@users.noreply.github.com>
Co-authored-by: Lspnjr1 <shittulukmanbabatunde@gmail.com>
Co-authored-by: Lspnjr1 <304024794+Lspnjr1@users.noreply.github.com>
Co-authored-by: Alhassan Nuhu Idris <alhassannuhu0@gmail.com>
Co-authored-by: Mantissa <negativemantissa@gmail.com>
Co-authored-by: Ezekiel Akawa <akawaezekiel4@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Mfon <67503972+TS-mfon@users.noreply.github.com>
…een-Bridge#164) (Deen-Bridge#281)

Co-authored-by: Sakariyah Abdulhazeem <150973162+zeemscript@users.noreply.github.com>
…idge#261) (Deen-Bridge#316)

* feat(infra): add Redis Cluster and Sentinel HA configuration (Deen-Bridge#261)

- Add redis/redis.conf for server configuration supporting master-replica replication, hybrid persistence (RDB + AOF), security, and memory eviction
- Add redis/sentinel.conf for Redis Sentinel high availability monitoring and automated failover
- Add ready-to-run Docker Compose setups for Sentinel HA (1 Master + 2 Replicas + 3 Sentinels) and 6-node Redis Cluster (3 Masters + 3 Replicas)
- Add comprehensive redis/README.md detailing HA architecture, replication setup, failover mechanics, client connection configs, testing walkthroughs, and production tuning
- Update src/config/redis.js to support Redis Cluster (createCluster) and resilient reconnection handling
- Update .env.example, src/config/validateEnv.js, and docs/redis.md with cluster and sentinel environment options
- Add test/redis.test.js with unit test coverage

Closes Deen-Bridge#261

* chore: sync package-lock.json with package.json
@drips-wave

drips-wave Bot commented Aug 29, 2026

Copy link
Copy Markdown

@Bogunrot Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@coderabbitai

coderabbitai Bot commented Aug 29, 2026

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 465a37b6-23e5-44be-ba25-56c1e72a9977


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@zeemscript

Copy link
Copy Markdown
Collaborator

@Bogunrot this PR has merge conflicts with the main branch. Please resolve the conflicts (merge main in or rebase) and push the fix so it can be merged. Thanks!

Cyber-Mitch and others added 2 commits August 31, 2026 10:37
…idge#56)

* feat(anchor): SEP-24 non-custodial fiat on/off-ramp for USDC (closes Deen-Bridge#46)

* fix: address SEP-24 anchor review comments (Deen-Bridge#46)

- Make trustline building best-effort in initiateInteractiveFlow
- Clamp/validate pagination params on transaction listing
- Normalize anchor route responses to { success, message, data }
- Add ANCHOR_HTTP_TIMEOUT_MS (10s) to outbound anchor HTTP calls
- Replace hardcoded JWT test secret with per-run random key

* test: fix incomplete cache mock breaking app.js import chain

anchorInteractive.test.js mocked utils/cache.js with only 3 functions,
which replaced the module in Jest's registry for all subsequent imports
of that specifier — including transitive imports from bookRoutes.js,
courseRoutes.js, etc. pulled in via app.js. Spread the real module's
exports into the mock factory, overriding only the functions this suite
fakes.
Track what users search for, surface popular queries, and isolate
zero-result searches so content gaps can drive creation decisions.

- searchLogger middleware wired into the real GET /api/search and
  /api/search/educators routes records every query with a timestamp, the type,
  result count, and whether the search returned zero results (fire-and-forget
  so logging never blocks the response).
- SearchAnalyticsEvent model with a 90-day TTL and query/hasResults indexes.
- Service provides top queries by frequency, zero-result searches, a summary,
  and daily trends, all with date-range and type filters.
- Admin-gated GET /api/analytics/search/{top,zero-results,summary,trends}.
- Tests: unit coverage for the aggregation endpoints plus an end-to-end suite
  that performs real searches through the app and asserts the events land and
  surface via the admin endpoints.

Search, analytics, and integration suites pass (23/23).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(analytics): Add search analytics