Fix/security audit 300 305

[whisper011]

Summary

This PR closes the security and WS-auth follow-up work for issues #300, #301, #302, and #305.

Issue #300 — Audit key-material redaction in Soroban write paths

• Added a reusable redaction helper for serialized error payloads before they are logged or surfaced.
• Hardened the Soroban-related audit points to avoid exposing raw signing material while preserving useful debug context.
• Added a regression check covering sensitive-key detection in serialization/error payloads.

Issue #301 — Audit CSRF exposure and signed-state requirements

• Documented the endpoint-by-endpoint signature model for mutating actions.
• Enforced signed proof-of-control for solver registration and solver status transitions.
• Added verification for intent accept/fill/cancel operations using the canonical signed messages already used by the API contract.
• Recorded the security decision in the project docs so wildcard-CORS assumptions are explicit and reviewable.

Issue #302 — Verify HSTS and Helmet headers behind a trusted proxy

• Enabled explicit HSTS configuration for HTTPS origins.
• Trusted the first proxy hop so TLS termination behind a load balancer still exposes the correct secure protocol to Helmet.
• Added coverage verifying the presence of Strict-Transport-Security and X-Content-Type-Options: nosniff.
• Updated the project docs to state the verified security-header behavior.

Issue #305 — Implement WebSocket solver authentication

• Added solver-auth:<solver>:<timestamp> message verification on the WS gateway.
• Enforced timestamp freshness and active-registered solver checks before accepting a connection as authenticated.
• Added auth_ok / auth_error response flow consistent with the reference solver bot.
• Added gateway regression tests covering valid and invalid auth flows.

Testing

• npx jest src/soroban/signer.service.spec.ts --runInBand

Notes

• This PR is intentionally scoped to the requested issue fixes and keeps the implementation minimal and focused on the affected code paths.

Related

closes #300
closes #301
closes #302
closes #305

[drips-wave]

@whisper011 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits