fix: resolve security issues #800 #803 #804 #806#946
Merged
RUKAYAT-CODER merged 3 commits intoJul 6, 2026
Merged
Conversation
…rinafcode#806 rinafcode#800 - EncryptionService: replace SHA-256 with scrypt KDF - Use crypto.scryptSync(secret, salt, 32) for AES-256 key derivation - Require ENCRYPTION_SALT env var at startup (fails fast if missing) - Add ENCRYPTION_SALT to .env.example with generation instructions - Add unit tests verifying scrypt is used (not SHA-256) rinafcode#803 - AuthService logout: blacklist the current access token - Add jti claim to access token payload in generateTokens() - Update logout(userId, accessToken?) to decode and blacklist the JTI with TTL equal to remaining token lifetime - Update AuthController.logout to extract Bearer token and pass it - Add tests covering JTI blacklisting and graceful fallback rinafcode#804 - GDPR erasure: cascade-delete financial records and active sessions - Wrap erasure in a TypeORM DataSource transaction - Anonymize payments, enrollments, audit_logs, notifications inside tx - Revoke active sessions before transaction (fast path) - Update GdprModule to import TypeOrmModule (provides DataSource) - Add tests: cascade anonymization, NotFoundException, idempotency rinafcode#806 - FraudDetectionService: configurable thresholds + behavioral signals - Introduce FraudSignalProvider interface for pluggable signal sources - IpRateSignalProvider, NewDeviceSignalProvider, LargeTransactionSignalProvider - VelocitySignalProvider: flag users exceeding N purchases/hour - GeoAnomalySignalProvider: flag purchase country != registration country - All thresholds configurable via ConfigService env vars (FRAUD_*) - Unit tests for each provider independently + aggregate service Closes rinafcode#800, Closes rinafcode#803, Closes rinafcode#804, Closes rinafcode#806
Contributor
|
kindly resolve conflict |
Contributor
|
Great job so far There are just two blockers — the workflow is failing and merge conflict. Could you take a look and fix it so all checks pass? Happy to review again once that’s done. |
|
@JudeDaniel6 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Contributor
Author
|
Thanks Ma i have resolve the conflict |
- Merge duplicate @nestjs/typeorm import in gdpr.service.ts (no-duplicate-imports) - Apply prettier formatting in auth.service.spec.ts - Apply prettier formatting in fraud-detection.service.ts No behavior changes; formatting and import de-duplication only.
Contributor
|
Thank you for contributing to the project |
Contributor
Author
|
Thank you ma for giving me the opportunity too ma
…On Mon, 6 Jul 2026, 11:04 am Rukayat Zakariyau, ***@***.***> wrote:
Merged #946 <#946>
into main.
—
Reply to this email directly, view it on GitHub
<#946?email_source=notifications&email_token=CFSWT5ZNCEEQKUXGXU32VED5DN2RHA5CNFSNUABQM5UWIORPF5TWS5BNNB2WEL2JONZXKZKFOZSW45CON52GSZTJMNQXI2LPNYXTENZWGAYTANZRG44TBJTSMVQXG33OU5WWK3TUNFXW5JLFOZSW45FMMZXW65DFOJPWG3DJMNVQ#event-27601071790>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/CFSWT544X2RGCPSBWZR7YID5DN2RHAVCNFSNUABFKJSXA33TNF2G64TZHM4TKOJXG4ZTCMBSHNEXG43VMU5TINZWHE4TQNRQHA22C5QC>
.
Triage notifications, keep track of coding agent tasks and review pull
requests on the go with GitHub Mobile for iOS
<https://github.com/notifications/mobile/ios/CFSWT52WIUFC4BQUZJB4T7D5DN2RHA5CNFSNUABQM5UWIORPF5TWS5BNNB2WEL2JONZXKZKFOZSW45CON52GSZTJMNQXI2LPNYXTENZWGAYTANZRG44TBJTSMVQXG33OU5WWK3TUNFXW5JLFOZSW45FKMZXW65DFOJPWS33T>
and Android
<https://github.com/notifications/mobile/android/CFSWT572CCKMS76LHSD2MY35DN2RHA5CNFSNUABQM5UWIORPF5TWS5BNNB2WEL2JONZXKZKFOZSW45CON52GSZTJMNQXI2LPNYXTENZWGAYTANZRG44TBJTSMVQXG33OU5WWK3TUNFXW5JLFOZSW45FOMZXW65DFOJPWC3TEOJXWSZA>.
Download it today!
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all four open security issues assigned to @JudeDaniel6.
#800 — EncryptionService uses SHA-256 instead of a proper KDF
Problem: Key derivation via
crypto.createHash('sha256')has no work factor, making brute-force trivial.Fix:
crypto.scryptSync(secret, salt, 32, { N: 16384, r: 8, p: 1 })ENCRYPTION_SALTenv var (startup fails fast if absent)#803 — AuthService logout does not blacklist the current access token
Problem:
logout()only nulls the refresh token; the access token stays valid until natural expiry.Fix:
jticlaim to access token ingenerateTokens()logout(userId, accessToken?)to decode the token, extractjti, and calltokenBlacklistService.addToBlacklist(jti, remainingTtlMs)AuthController.logoutto extract the Bearer token and pass it to the service#804 — GDPR erasure does not cascade-delete financial records and active sessions
Problem:
eraseUserData()only nulls profile fields, leaving orphaned payments/enrollments/audit logs and usable sessions.Fix:
DataSource.transaction()payments,enrollment,audit_logs, andnotificationstables inside the transactionGdprModuleupdated to importTypeOrmModule(providesDataSource)#806 — FraudDetectionService has hardcoded thresholds and no behavioral signals
Problem: Three hardcoded threshold checks are trivially bypassed; no velocity or geo signals.
Fix:
FraudSignalProviderinterface for pluggable signal sourcesIpRateSignalProvider,NewDeviceSignalProvider,LargeTransactionSignalProvider— existing logic, now configurable viaConfigServiceVelocitySignalProvider— flags users exceedingFRAUD_MAX_PURCHASES_PER_HOUR(configurable)GeoAnomalySignalProvider— flags when purchase country differs from registration countryFRAUD_IP_RATE_THRESHOLD,FRAUD_NEW_DEVICE_AMOUNT_THRESHOLD,FRAUD_LARGE_TX_THRESHOLD,FRAUD_MAX_PURCHASES_PER_HOUR)Testing
All 4 target test suites pass (37 new/updated tests):
encryption.service.spec.ts— 6 tests ✅auth.service.spec.ts— 10 tests ✅gdpr.service.spec.ts— 5 tests ✅fraud-detection.service.spec.ts— 16 tests ✅Closes #800
Closes #803
Closes #804
Closes #806