🛡️ Sentinel: [HIGH] Enable Rate Limiting & Fix Dependency Mismatch

.jules/sentinel.md

@@ -0,0 +1,9 @@
+## 2026-01-14 - Dependency Version Mismatch blocking Testing/Startup
+**Vulnerability:** Application crashed on startup/test due to `@fastify/jwt` v10 incompatibility with `fastify` v4 (requires v5).
+**Learning:** `npm install` without lockfile or with loose versions can pull incompatible major versions if plugins break semver or update requirements faster than core.
+**Prevention:** Pin dependencies strictly or ensure peer dependencies are checked. Use `pnpm` workspace strictness.
+
+## 2026-01-14 - Rate Limiting Disabled in Production Code
+**Vulnerability:** Rate limiting middleware was commented out in `app.ts`.
+**Learning:** Security features should not be commented out for "development". They should be conditionally configured or enabled with looser limits.
+**Prevention:** Use environment variables to control enablement or limits, never comment out code.

backend/jest.config.js

@@ -0,0 +1,15 @@
+/** @type {import('ts-jest').JestConfigWithTsJest} */
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+  moduleNameMapper: {
+    '^@/(.*)$': '<rootDir>/src/$1',
+    '^@modules/(.*)$': '<rootDir>/src/modules/$1',
+    '^@shared/(.*)$': '<rootDir>/src/shared/$1',
+    '^@config/(.*)$': '<rootDir>/src/config/$1',
+    '^@types/(.*)$': '<rootDir>/src/types/$1'
+  },
+  rootDir: '.',
+  testMatch: ['**/__tests__/**/*.test.ts'],
+  setupFilesAfterEnv: ['<rootDir>/jest.setup.js'],
+};

backend/jest.setup.js

@@ -0,0 +1,20 @@
+// Global setup for Jest tests
+process.env.NODE_ENV = 'test';
+process.env.DATABASE_URL = 'postgresql://test:test@localhost:5432/launchpad_test';
+process.env.JWT_SECRET = 'test-secret-min-32-chars-length-required-for-production';
+process.env.LUNES_RPC_URL = 'http://localhost:9944';
+process.env.CONTRACT_ADDRESS = '0x0000000000000000000000000000000000000000';
+process.env.PRIVATE_KEY = '0x0000000000000000000000000000000000000000000000000000000000000000';
+
+const mockLogger = {
+  info: jest.fn(),
+  error: jest.fn(),
+  warn: jest.fn(),
+  debug: jest.fn(),
+  auth: jest.fn(),
+};
+
+jest.mock('./src/shared/logger', () => ({
+  logger: mockLogger,
+  Logger: mockLogger,
+}));

backend/package.json

@@ -38,7 +38,7 @@
   "dependencies": {
     "@fastify/cors": "^8.4.0",
     "@fastify/helmet": "^11.1.1",
-    "@fastify/jwt": "^10.0.0",
+    "@fastify/jwt": "^8.0.0",
     "@fastify/multipart": "^8.0.0",
     "@fastify/rate-limit": "^9.0.1",
     "@fastify/swagger": "^8.12.0",

backend/src/__tests__/rate_limit.test.ts

@@ -0,0 +1,50 @@
+import { app } from '../app';
+
+// Mock envConfig before importing app (jest.mock is hoisted automatically)
+jest.mock('../config/env.config', () => {
+  const actual = jest.requireActual('../config/env.config');
+  return {
+    envConfig: {
+      ...actual.envConfig,
+      RATE_LIMIT_MAX_REQUESTS: 2,
+      RATE_LIMIT_WINDOW_MS: 60000, // 1 minute
+      NODE_ENV: 'test',
+    },
+  };
+});
+
+describe('Rate Limiting Security', () => {
+  beforeAll(async () => {
+    await app.initialize();
+  });
+
+  afterAll(async () => {
+    await app.stop();
+  });
+
+  it('should enforce rate limits', async () => {
+    // Request 1: Allowed
+    const res1 = await app.server.inject({
+      method: 'GET',
+      url: '/health',
+    });
+    expect(res1.statusCode).toBe(200);
+
+    // Request 2: Allowed
+    const res2 = await app.server.inject({
+      method: 'GET',
+      url: '/health',
+    });
+    expect(res2.statusCode).toBe(200);
+
+    // Request 3: Blocked (Limit is 2)
+    const res3 = await app.server.inject({
+      method: 'GET',
+      url: '/health',
+    });
+
+    expect(res3.statusCode).toBe(429);
+    const body = JSON.parse(res3.body);
+    expect(body.error.message).toMatch(/Rate limit exceeded/i);
+  });
+});

backend/src/app.ts

@@ -38,7 +38,7 @@ class App {
     this.setupErrorHandling();
   }
 
-  private async initialize(): Promise<void> {
+  public async initialize(): Promise<void> {
     await this.setupMiddlewares();
     await this.setupRoutes();
   }
@@ -64,17 +64,11 @@ class App {
       },
     });
 
-    // Rate Limiting - DESABILITADO PARA DESENVOLVIMENTO
-    // await this.server.register(rateLimit, {
-    //   max: envConfig.RATE_LIMIT_MAX_REQUESTS,
-    //   timeWindow: envConfig.RATE_LIMIT_WINDOW_MS,
-    //   errorResponseBuilder: (request, context) => ({
-    //     code: 429,
-    //     error: 'Rate Limit Exceeded',
-    //     message: `Muitas tentativas. Tente novamente em ${Math.round(context.ttl / 1000)} segundos.`,
-    //     expiresIn: context.ttl,
-    //   }),
-    // });
+    // Rate Limiting
+    await this.server.register(rateLimit, {
+      max: envConfig.RATE_LIMIT_MAX_REQUESTS,
+      timeWindow: envConfig.RATE_LIMIT_WINDOW_MS,
+    });
 
     // Swagger Documentation
     if (envConfig.ENABLE_SWAGGER) {