fluid-server: dependency scans (#674) and inner tx signer-weight preflight (#686)

[josephchimebuka]

Summary

This PR implements two fluid-server hardening items:

• [Security & Hardening] Integrate Automated Dependency Vulnerability Scanners in CI #674 – Dependency vulnerability scanning in CI: Adds a matrix workflow that runs cargo-audit on the Rust crate and npm audit on fluid-server/wasm-demo, uploads JSON reports as artifacts, and fails builds on high/critical findings.
• [Resilience & Error Handling] Pre-flight Validation of Inner Transaction Signer Weight #686 – Inner transaction signer-weight preflight: Before fee-bumping, the relay fetches the source account from Horizon and verifies inner envelope signature weight meets med_threshold, returning INSUFFICIENT_SIGNATURE_WEIGHT when it does not.

Changes

CI / supply chain (#674)

• .github/workflows/dependency-audit.yml – PR/push matrix (cargo-audit, npm-audit)
• fluid-server/audit.toml – cargo-audit config stub for reviewed advisories
• fluid-server/verification/dependency-scans-integration.txt – verification notes

Resilience (#686)

• fluid-server/src/signer_weight.rs – weight calculation + validation
• fluid-server/src/horizon.rs – fetch_account_auth
• fluid-server/src/main.rs – preflight hook in process_fee_bump_request
• fluid-server/src/mock_horizon.rs – per-account auth overrides for tests
• fluid-server/tests/signer_weight_integration.rs – end-to-end /fee-bump checks
• fluid-server/docs/inner-transaction-signer-weight-validation.md

Test plan

From fluid-server/:

# Signer-weight unit tests
cargo test signer_weight::tests -- --nocapture

# Signer-weight integration (mock Horizon + live server)
cargo test --test signer_weight_integration -- --nocapture

# Dependency scans (local)
cargo install cargo-audit --locked && cargo audit
cd wasm-demo && npm ci && npm audit --audit-level=high

Verified locally:

• cargo test signer_weight::tests – 4 passed
• cargo test --test signer_weight_integration – 1 passed (reject insufficient weight + accept sufficient weight)

Screenshots / terminal output

Reviewer verification files:

• fluid-server/verification/dependency-scans-integration.txt
• fluid-server/verification/inner-transaction-signer-weight.txt

Closes #674
Closes #686

Made with Cursor

[drips-wave]

@josephchimebuka Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits