Skip to content

fix(validation): introduce shared stellar address validator for auth, accounts, escrow, and subscriptions (#16) - #74

Open
ghzhost wants to merge 1 commit into
StellarSend:mainfrom
ghzhost:fix/shared-stellar-address-validation-16
Open

fix(validation): introduce shared stellar address validator for auth, accounts, escrow, and subscriptions (#16)#74
ghzhost wants to merge 1 commit into
StellarSend:mainfrom
ghzhost:fix/shared-stellar-address-validation-16

Conversation

@ghzhost

@ghzhost ghzhost commented Sep 3, 2026

Copy link
Copy Markdown

Overview

Fixes #16 by introducing a centralized, checksum-validating validate_stellar_address helper and enforcing it across registration (/api/auth/register), account lookup (/api/accounts/:address), escrow creation, and subscription creation.

Context & Problem

Previously:

  • src/routes/auth.rs::register accepted optional stellar_address and stored it directly without validation.
  • src/routes/accounts.rs had a rudimentary private length+prefix check without checksum verification.
  • src/services/escrow.rs and src/services/subscription.rs checked only non-empty strings for accounts.

Solution

  1. Shared Validator Module (src/validation.rs):
    • Uses stellar_strkey::ed25519::PublicKey::from_string for standard Ed25519 public keys (G...).
    • Uses stellar_strkey::ed25519::Med25519PublicKey::from_string for SEP-23 multiplexed keys (M...).
    • Rejects empty, malformed, or checksum-invalid addresses with structured AppError::Validation.
  2. Consistent Integration:
    • auth::register: Validates req.stellar_address if provided.
    • accounts: Uses validation::validate_stellar_address.
    • escrow::create: Validates depositor_account, beneficiary_account, and optional arbiter_account.
    • subscription::create: Validates payer_account and recipient_account.
  3. Unit Tests:
    • Added unit test suite in src/validation.rs covering valid G keys, invalid checksums, invalid prefixes, and empty inputs.

Closes #16

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Registration accepts unvalidated stellar_address and lacks structured input validation

1 participant