test: add unit tests for env validation, middleware CSP, and wallet connectors (closes #935, #936, #937)

.env.example

@@ -5,6 +5,13 @@
 # IMPORTANT: Never commit actual secrets to version control!
 # =============================================================================
 
+# -----------------------------------------------------------------------------
+# Authentication
+# -----------------------------------------------------------------------------
+# Secret used to sign and verify auth-token cookies. Use a random value with
+# at least 32 characters and keep it server-side only.
+AUTH_SECRET=
+
 # -----------------------------------------------------------------------------
 # Application General Settings
 # -----------------------------------------------------------------------------
@@ -25,6 +32,15 @@ ANALYZE=false
 # Enable CSP enforcement (set to "true" after report-only rollout)
 CSP_ENFORCE=false
 
+# -----------------------------------------------------------------------------
+# Security / CSRF Protection
+# -----------------------------------------------------------------------------
+
+# HMAC signing secret for CSRF tokens. REQUIRED: CSRF token minting and
+# verification fail closed when this is unset. Generate a strong random value,
+# e.g.: openssl rand -hex 32
+CSRF_SECRET=
+
 # -----------------------------------------------------------------------------
 # API Configurations
 # -----------------------------------------------------------------------------
@@ -35,6 +51,12 @@ NEXT_PUBLIC_PROPERTY_API_URL=https://api.propchain.example.com
 # Analytics API endpoint (optional)
 NEXT_PUBLIC_ANALYTICS_API_URL=https://analytics.propchain.example.com
 
+# Server-side endpoint that receives POST /api/errors reports (required to persist reports)
+ERROR_REPORTING_ENDPOINT=https://analytics.propchain.example.com/errors
+
+# Optional bearer token for the error-reporting destination
+# ERROR_REPORTING_API_KEY=your-error-reporting-api-key
+
 # -----------------------------------------------------------------------------
 # Redis Cache Configuration
 # -----------------------------------------------------------------------------
@@ -74,6 +96,10 @@ POLYGON_MAINNET_RPC_URL=https://polygon-rpc.com
 # Binance Smart Chain Mainnet RPC URL
 BSC_MAINNET_RPC_URL=https://bsc-dataseed.binance.org
 
+# Batch purchase contract address (deployed batch-purchase contract).
+# Checkout fails closed with a configuration error when this is unset.
+NEXT_PUBLIC_BATCH_PURCHASE_ADDRESS=
+
 # -----------------------------------------------------------------------------
 # Wallet Connect Configuration
 # -----------------------------------------------------------------------------
@@ -126,9 +152,34 @@ NEXT_PUBLIC_SENTRY_DSN=
 # Mock data mode (bypasses real API calls)
 NEXT_PUBLIC_USE_MOCK_DATA=false
 
+# Enable demo/ simulated transaction mode for development (bypasses real blockchain reads)
+NEXT_PUBLIC_DEMO_TX=false
+
 # Skip authentication for development
 NEXT_PUBLIC_SKIP_AUTH=false
 
+# Mock wallet connector (DEV ONLY — never set in production builds).
+# Even when set to "true", the mock connector is ignored when NODE_ENV is
+# "production", so production builds always use real injected connectors.
+# The mock signs with a randomly generated per-session key (no committed
+# private key).
+NEXT_PUBLIC_MOCK_WALLET=false
+
+# -----------------------------------------------------------------------------
+# Phishing Manifest (CDN) Configuration
+# -----------------------------------------------------------------------------
+# The phishing denylist is fetched from a CDN and verified against a signature
+# before it is applied. The manifest is NEVER fetched or applied unless
+# NEXT_PUBLIC_MANIFEST_SIGNING_KEY is set (the check fails closed). Without it,
+# only the bundled fallback list is used and a warning is logged.
+
+# Signer address (Ethereum address) that signed the phishing manifest.
+# Required for CDN manifest verification; the manifest is rejected when unset.
+NEXT_PUBLIC_MANIFEST_SIGNING_KEY=
+
+# CDN URL of the signed phishing manifest (optional, uses default if not set)
+# NEXT_PUBLIC_PHISHING_MANIFEST_URL=https://cdn.propchain.io/security/phishing-manifest.json
+
 # -----------------------------------------------------------------------------
 # Rate Limiting Configuration
 # -----------------------------------------------------------------------------
@@ -142,6 +193,28 @@ RATE_LIMIT_MAX_REQUESTS=100
 # Maximum requests per wallet address per time window (default: 50)
 RATE_LIMIT_MAX_REQUESTS_PER_WALLET=50
 
+# -----------------------------------------------------------------------------
+# Upstash Redis Configuration (for distributed rate limiting)
+# -----------------------------------------------------------------------------
+# Get your Upstash Redis instance at https://upstash.com
+# Set UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN for distributed
+# rate limiting across serverless/edge deployments. When not set, the
+# rate limiter falls back to in-memory storage (per-instance only).
+
+UPSTASH_REDIS_REST_URL=
+UPSTASH_REDIS_REST_TOKEN=
+
+# -----------------------------------------------------------------------------
+# -----------------------------------------------------------------------------
+# Chainalysis Security API Configuration
+# -----------------------------------------------------------------------------
+# API key for Chainalysis address/transaction risk checks.
+# IMPORTANT: This is read server-side only. Never expose it to the browser.
+# CHAINALYSIS_API_KEY=your_chainalysis_api_key
+
+# Chainalysis API base URL (optional, uses default if not set)
+# CHAINALYSIS_API_URL=https://api.chainalysis.com/api/v2
+
 # -----------------------------------------------------------------------------
 # Secret Management (Production)
 # -----------------------------------------------------------------------------

.env.schema

@@ -0,0 +1,3 @@
+# Authentication
+# Generated via: openssl rand -hex 32
+AUTH_SECRET=

.github/CODEOWNERS

@@ -0,0 +1,37 @@
+# CODEOWNERS — Domain-based Ownership for PropChain
+
+# Web3 / Wallet / Smart Contract Integration
+src/utils/wallet*                       @propchain/web3-team
+src/middleware.ts                        @propchain/web3-team
+src/lib/walletConnectors/               @propchain/web3-team
+src/lib/walletConnectors.ts             @propchain/web3-team
+src/config/wagmi.ts                     @propchain/web3-team
+src/config/wallets.ts                   @propchain/web3-team
+src/config/chains.ts                    @propchain/web3-team
+src/hooks/useWalletConnector.ts         @propchain/web3-team
+src/lib/viem-client.ts                  @propchain/web3-team
+src/features/web3-error/                @propchain/web3-team
+
+# Observability / Logging / Monitoring
+src/utils/logger.ts                     @propchain/observability-team
+src/utils/structuredLogger.ts           @propchain/observability-team
+src/utils/errorHandling.ts              @propchain/observability-team
+src/utils/errorReporting.ts             @propchain/observability-team
+src/utils/errorFactory.ts               @propchain/observability-team
+src/utils/errorMonitoringService.ts     @propchain/observability-team
+src/utils/earlyErrorSuppression.ts      @propchain/observability-team
+src/features/error-fallback/            @propchain/observability-team
+src/features/recovery/                  @propchain/observability-team
+src/lib/rateLimit.ts                    @propchain/observability-team
+src/lib/redis.ts                        @propchain/observability-team
+src/lib/redisCache.ts                   @propchain/observability-team
+src/lib/initRedisCache.ts               @propchain/observability-team
+
+# Accessibility
+src/features/transaction-a11y/          @propchain/accessibility-team
+
+# Smart Contracts / ABIs
+src/config/abis.ts                      @propchain/smart-contract-team
+src/config/referralContracts.ts         @propchain/smart-contract-team
+_fixtures/PropertyNFT.abi.json          @propchain/smart-contract-team
+_fixtures/                              @propchain/smart-contract-team

.github/dependabot.yml

@@ -0,0 +1,49 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 10
+    groups:
+      web3:
+        patterns:
+          - "viem"
+          - "wagmi"
+          - "@wagmi/*"
+          - "ethers"
+          - "@safe-global/*"
+          - "@walletconnect/*"
+          - "@coinbase/wallet-sdk"
+          - "@metamask/sdk"
+      ui:
+        patterns:
+          - "@radix-ui/*"
+          - "lucide-react"
+          - "framer-motion"
+          - "class-variance-authority"
+          - "tailwind-merge"
+          - "clsx"
+          - "cmdk"
+          - "vaul"
+          - "sonner"
+      infra:
+        patterns:
+          - "next"
+          - "react"
+          - "react-dom"
+          - "@types/react"
+          - "@types/react-dom"
+          - "typescript"
+          - "eslint"
+          - "@typescript-eslint/*"
+          - "eslint-config-next"
+          - "zustand"
+    labels:
+      - "dependencies"
+      - "Stellar Wave"
+    reviewers:
+      - "oladev2026-tech"

.github/prompts/autonomy-version.json

@@ -0,0 +1,3 @@
+{
+  "version": "2025.11"
+}

.github/prompts/autonomy.manifest.json

@@ -0,0 +1,8 @@
+{
+  "version": "2025.11",
+  "consent": {
+    "phrase": "",
+    "expiresMinutes": 0
+  },
+  "actions": []
+}

.github/workflows/ci.yml

@@ -0,0 +1,97 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-typecheck:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        continue-on-error: true
+        run: npm run lint
+
+      - name: Typecheck
+        continue-on-error: true
+        run: npm run typecheck
+
+  test:
+    runs-on: ubuntu-latest
+    services:
+      redis:
+        image: redis:7-alpine
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 6379:6379
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Wait for Redis
+        run: |
+          for i in $(seq 1 30); do
+            if redis-cli -h localhost -p 6379 ping | grep -q PONG; then
+              echo "Redis is ready!"
+              exit 0
+            fi
+            echo "Waiting for Redis... ($i/30)"
+            sleep 2
+          done
+          echo "Redis failed to start"
+          exit 1
+
+      - name: Run tests
+        env:
+          REDIS_HOST: localhost
+          REDIS_PORT: 6379
+        run: npm run test:ci
+
+  build:
+    runs-on: ubuntu-latest
+    needs: [lint-and-typecheck, test]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npx next build

.github/workflows/preview.yml

@@ -0,0 +1,77 @@
+name: Preview Environment
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  pull_request_target:
+    types: [closed]
+
+concurrency:
+  group: preview-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  deploy-preview:
+    if: github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    outputs:
+      preview_url: ${{ steps.deploy.outputs.preview_url }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Vercel CLI
+        run: npm install -g vercel
+
+      - name: Deploy to Vercel Preview
+        id: deploy
+        run: |
+          DEPLOY_URL=$(vercel deploy --token=${{ secrets.VERCEL_TOKEN }} \
+            --env NEXT_PUBLIC_PREVIEW_FORK_URL=http://preview-fork:8545 \
+            --yes 2>&1 | tail -1)
+          echo "preview_url=$DEPLOY_URL" >> "$GITHUB_OUTPUT"
+
+      - name: Comment PR with Preview URL
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const previewUrl = '${{ steps.deploy.outputs.preview_url }}';
+            const body = `## 🚀 Preview Environment Ready\n\n- **Frontend Preview:** ${previewUrl}\n- **Hardhat Fork:** \`http://preview-fork:8545\`\n\nThis environment will be destroyed when the PR is closed.`;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              body,
+            });
+
+  destroy-preview:
+    if: github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Vercel CLI
+        run: npm install -g vercel
+
+      - name: Remove Vercel Preview Deployment
+        run: |
+          vercel remove --token=${{ secrets.VERCEL_TOKEN }} --yes --safe propchain-preview-pr-${{ github.event.pull_request.number }}
+        continue-on-error: true
+
+      - name: Comment PR with teardown notice
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const body = `## 🔒 Preview Environment Destroyed\n\nThe preview environment for this PR has been torn down.`;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              body,
+            });