feat(backend): add regional wager blocking

.github/workflows/security-audit.yml

@@ -47,7 +47,10 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Run Rust Security Audit Check
-        uses: rustsec/audit-check-action@v2.0.0
+        uses: taiki-e/install-action@v2
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          working-directory: ./contracts/soroban
+          tool: cargo-audit
+
+      - name: Audit Rust dependencies
+        working-directory: ./contracts/soroban
+        run: cargo audit

backend/jest.config.js

@@ -1,5 +1,6 @@
 module.exports = {
   testEnvironment: 'node',
+  setupFiles: ['<rootDir>/tests/setup.js'],
   coverageDirectory: 'coverage',
   collectCoverageFrom: [
     '**/*.js',

backend/middleware/geoBlock.js

@@ -0,0 +1,23 @@
+const blockedCountries = () => new Set(
+  String(process.env.BLOCKED_COUNTRIES || '')
+    .split(',').map((country) => country.trim().toUpperCase()).filter(Boolean),
+);
+
+function clientIp(req) {
+  const forwarded = req.headers['x-forwarded-for'];
+  return String(forwarded || req.headers['cf-connecting-ip'] || req.ip || '').split(',')[0].trim();
+}
+
+function geoBlock(req, res, next) {
+  const country = String(
+    req.headers['cf-ipcountry'] || req.headers['x-vercel-ip-country'] || req.headers['x-country-code'] || '',
+  ).toUpperCase();
+  if (country && blockedCountries().has(country)) {
+    return res.status(451).json({ error: 'This region is not permitted to access wagered gameplay.' });
+  }
+  req.clientIp = clientIp(req);
+  req.clientCountry = country || null;
+  return next();
+}
+
+module.exports = { geoBlock, clientIp };

backend/package.json

@@ -24,11 +24,12 @@
 		"@supabase/supabase-js": "^2.95.3",
 		"axios": "^1.6.0",
 		"cors": "^2.8.5",
-		"helmet": "^8.0.0",
 		"dotenv": "^16.4.5",
 		"express": "^5.2.1",
+		"helmet": "^8.0.0",
 		"jsonwebtoken": "^9.0.3",
 		"pg": "^8.23.0",
+		"prom-client": "^15.1.3",
 		"socket.io": "^4.8.3",
 		"stellar-sdk": "^13.3.0"
 	},

backend/server.js

@@ -18,6 +18,7 @@ const cronService = require("./services/cronService");
 const supabase = require("./config/supabase");
 const logger = require("./utils/logger");
 const { errorHandler, installGlobalHandlers } = require("./middleware/errorHandler");
+const { geoBlock } = require("./middleware/geoBlock");
 const { createRateLimiter } = require("./middleware/rateLimiter");
 const { sanitizeInput } = require("./middleware/sanitizeInput");
 
@@ -67,6 +68,7 @@ app.use(
   }),
 );
 app.use(express.json());
+app.use(geoBlock);
 app.use(createRateLimiter({ windowMs: 60_000, max: 100 }));
 app.use(sanitizeInput);
 
@@ -215,4 +217,4 @@ cronService.start();
 
 server.listen(PORT, "0.0.0.0", () => {
   console.log(`Chesster backend running on port ${PORT}`);
-});
+});

backend/tests/escrowService.horizon.test.js

@@ -2,6 +2,10 @@
  * Tests for Stellar Horizon Transaction Indexer
  */
 
+jest.mock("@stellar/stellar-sdk", () => ({
+  Networks: { TESTNET: "Test SDF Network ; September 2015" },
+}));
+
 const escrowService = require("../services/escrowService");
 
 jest.mock("axios");

backend/tests/healthRoutes.test.js

@@ -4,12 +4,25 @@
 
 const request = require("supertest");
 const express = require("express");
+
+// Keep route tests independent of the SDK's ESM-only transitive hash module.
+jest.mock("@stellar/stellar-sdk", () => ({
+  Networks: { TESTNET: "Test SDF Network ; September 2015" },
+  rpc: { Server: jest.fn(() => ({ getLatestLedger: jest.fn().mockResolvedValue({ sequence: 1 }) })) },
+}));
+
 const healthRoutes = require("../routes/healthRoutes");
 
 describe("Health Check Routes", () => {
   let app;
 
   beforeEach(() => {
+    // Other suites exercise missing configuration and may mutate process.env.
+    // Restore the route test's safe configuration for every test in this file.
+    process.env.SUPABASE_URL = "http://localhost";
+    process.env.SUPABASE_ANON_KEY = "test-anon-key";
+    process.env.SUPABASE_KEY = "test-service-key";
+    process.env.SOROBAN_RPC_URL = "http://localhost";
     app = express();
     app.use(express.json());
     app.use("/api", healthRoutes);

backend/tests/setup.js

@@ -0,0 +1,5 @@
+// Keep tests hermetic: production configuration remains fail-closed, while
+// modules imported by isolated route/service tests get safe placeholders.
+process.env.SUPABASE_URL ||= 'http://localhost';
+process.env.SUPABASE_ANON_KEY ||= 'test-anon-key';
+process.env.SUPABASE_KEY ||= 'test-service-key';