D bluemoon role based

[D-Bluemoon]

Closes #247

Description

This PR resolves critical production security vulnerabilities by introducing a fully structured Role-Based Access Control (RBAC) layer. It moves the backend from a purely JWT-authenticated environment to a granular, role-scoped security architecture. All administrative, maintainer-only, and sponsor-privileged actions are now explicitly guarded.🛠️

Key Changes

Core Security Infrastructure:

Created roles.decorator.ts to assign access permissions seamlessly via meta-tagging (@roles()).

Implemented a unified RolesGuard to parse route metadata, intercept incoming payloads, validate session profiles, and block unauthorized users with strict 403 Forbidden exceptions.

Registered RolesGuard as a universal controller bouncer inside app.module.ts via the APP_GUARD provider context.

Controller Level Lockdown:

Bounties Module: Secured create, fund, refund, and added brand new approve and reject route checkpoints strictly scoped to UserRole.MAINTAINER and UserRole.SPONSOR.

Milestones Module: Integrated create, fund, addIssue, resolveIssue, and introduced the missing allocateBudget endpoint under strict maintainer access criteria.

Escrow Module: Encapsulated release and refund operations inside a fresh, secure routing layer matching native state validation parameters.

Maintenance Pool Module:

Created a dedicated controller scaffold locking the assign-funds execution loop to verified system maintainers.

Workspace Optimization:

Adjusted global tsconfig.json mappings to resolve strict property initialization compile warnings across TypeORM entity structures.

Patched third-party type extraction lint loops (@IsUUID()) and balanced dangling braces inside the core bounties.service.ts data layout.

Closes #245

Pull Request Summary:

Implement Multi-Tier Rate Limiting on Critical Endpoints

Description

This PR resolves high-priority security vulnerabilities by introducing a comprehensive, granular rate-limiting layer across authentication, high-value mutations, and resource-heavy query routes. Using @nestjs/throttler, these changes protect the backend infrastructure from OAuth brute-force enumeration, idempotency key exhaustion, distributed denial-of-service (DoS) vectors, and Soroban RPC/database thread pool starvation.

Key Changes

• Global Multi-Tier Rate Limiting Framework (app.module.ts):
• Replaced the legacy single-tier rate limiter with a structured, cascading layout containing three global throttle profiles:
  • short: Bounded at 3 requests per 1 second to disrupt automated burst flooding.
    • medium: Bounded at 20 requests per 1 minute to balance normal interactivity against rapid script cycling.
    • long: Bounded at 100 requests per 1 hour as an overall client threshold safeguard.
  • High-Value Mutation Hardening (Strict 1 req/sec):
• Applied targeted @Throttle({ short: { limit: 1, ttl: 1000 } }) overrides on business-critical routes to close conflict loops on identical database inputs and avoid RPC quota consumption:
  • BountiesController: Covered fund, claim, and refund mutations.
    • MilestonesController: Covered the core fund endpoint.
    • EscrowController: Secured releaseEscrow and refundEscrow paths.
    • MaintenancePoolController: Protected the financial assign-funds execution pipeline.
  • Authentication & Resource Exhaustion Defense:
• AuthController: Hardened OAuth routes with strict parameters—throttling initiation (/github) to mitigate loop flooding and callback logic (/github/callback) to 20 requests per minute to thwart state-parameter brute-forcing.
  • GithubController: Rate-limited repository synchronization entry points to mitigate external credential flooding and memory leaks.
  • BountiesController & MilestonesController: Wrapped public data queries (list()) inside long-term 1000 requests per hour safety caps to prevent large-dataset processing abuse.
• Workspace Synchronization Config:
• Patched tsconfig.json configurations with cross-version parsing variables (ignoreDeprecations: "5.0") to guarantee compiling compatibility and support automated incremental development watchers.

Closes #244

Title

fix: resolve compilation errors and secure github token storage

Description

This PR resolves critical TypeScript compilation issues across multiple application core layer services and addresses the open security vulnerability regarding plaintext GitHub OAuth token storage.

Key Implementations

1. Security & Token Encryption

• Implemented application-level envelope cryptography using an AES-256-GCM cipher pipeline.
• Integrated a custom TypeORM data value transformer layer to handle automatic database encryption-on-save and decryption-on-load patterns for sensitive GitHub variables.
• Scrambled and hardened accessToken and refreshToken storage parameters.

2. Source Code & Structural Repair

• GithubAccount Entity: Fixed mapping payloads to explicitly declare login, githubId, avatarUrl, profileUrl, and structural relational linkages.
• EscrowService: Cleaned up duplicated, overlapping dependency metadata definitions and resolved parameter signature arrays mapping constraints for Stellar Soroban contract execution hooks.
• MilestonesService & Controller: Remapped interface structural footprints, eliminated dangling functional stubs, and balanced class braces.
• Main.ts & AuthModule: Explicitly typed logging layers to adhere strictly to raw string configuration types and cast external JWT options arrays.

Verification Status

• Compilation Status: Global schema checks run completely clean without compilation blockers (npx tsc --noEmit returns zero functional layout errors).
• Runtime Orchestration: Boot sequences pass global dependency initialization checks smoothly.

Closes #246

Description

1. Parametrized Input Parameters: Refactored dynamic inputs inside .where() and other conditional clauses to use TypeORM's bound parameters (e.g., using :variableName object notation) instead of template literals or direct string concatenation.
2. Implemented Dynamic Allowlists: Added strict arrays/validation logic to sanitize parameters that cannot be native query parameters (such as orderBy fields or direction parameters), restricting inputs to a hardcoded list of safe strings.
3. Audited Query Construction: Swept the service file to replace unsafe raw SQL configurations with structured TypeORM Query Builder API equivalents to eliminate exploitation vectors.

Verification Plan

• Checked that local unit/integration tests run successfully against the updated repository.
• Manually verified that payload strings (e.g., ' OR '1'='1) are properly sanitized and handled safely as literal strings by the query parser.

[vercel]

@D-Bluemoon is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@D-Bluemoon Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits