feat: complete issues #586, #580, #561, and #549 - #657
Merged
ONEONUORA merged 2 commits intoJul 27, 2026
Conversation
…Fracverse#549 Fracverse#586 [mobileapp] - Secure Store Privy Session Tokens - Rewrite mobileapp/src/services/api.ts to use expo-secure-store for Privy JWT tokens - Add setSessionToken/getSessionToken/clearSessionToken keychain wrappers - Create apiFetch wrapper that attaches Bearer token and handles 401 by clearing session - Register optional onSessionExpired callback for logout/navigation Fracverse#580 [mobileapp] - Biometric Verification Overlay - Implement authenticateWithBiometrics() in biometric.tsx using expo-local-authentication - Support hasHardwareAsync, isEnrolledAsync, authenticateAsync with graceful passcode fallback - Gate payment submission in transfer.tsx (step 3) behind biometric/passcode authentication - Block transfer unless biometric authentication returns success Fracverse#561 [backend] - Session Refresh & Auth Middleware - Create backend/src/api/auth_middleware.rs with AuthTokenCache (5min TTL, lazy eviction) - Implement auth_middleware function that validates Bearer JWT and caches result - Attach AuthenticatedUser extension to request for downstream handlers - Update main.rs to spawn cache sweep background task and wire protected_routes() - Wrap feed/social/bridge/yield routes with auth middleware Fracverse#549 [backend] - Unsigned Transaction XDR Generator - Add POST /api/yield/build/deposit and /api/yield/build/withdraw endpoints - Accept user_account, amount, vault_contract_address parameters - Build Soroban ManageData transaction envelope encoding vault operations - Call simulateTransaction RPC for realistic fee estimation - Return { unsigned_xdr, estimated_fee_stroops, sequence_sentinel } for client signing - Add address validation helpers and comprehensive unit tests
|
@Dami24-hub Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements end-to-end authentication security, biometric transaction authorization on mobile, and on-chain yield vault transaction generation on the backend across issues #586, #580, #561, and #549.
Closes #586
Closes #580
Closes #561
Closes #549
Detailed Changes
Mobile Application (
mobileapp)expo-secure-storewithinmobileapp/src/services/api.tsto manage Privy access tokens and session state in Keychain/SecureStore.mobileapp/app/biometric.tsxusingexpo-local-authentication.mobileapp/app/transfer.tsxprior to dispatching payout requests.Backend Services (
backend)backend/src/main.rsandbackend/src/api/mod.rsto validate Privy JWT headers.POSTendpoints for vault deposits and withdrawals inbackend/src/api/yield.rs.Technical Scope & Files Changed
mobileapp/src/services/api.tsmobileapp/app/biometric.tsxmobileapp/app/transfer.tsxbackend/src/main.rsbackend/src/api/mod.rsbackend/src/api/yield.rsVerification Plan
expo-secure-storecorrectly reads/writes tokens on iOS Keychain and Android Keystore.401 Unauthorizedresponses)./yield/depositand/yield/withdrawreturn valid base64 XDR payloads that successfully parse in the Stellar Laboratory/RPC inspector.