🛡️ Sentinel: [HIGH] Enable Rate Limiting & Fix Dependency

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2026-01-16 - Dependency Version Mismatch in Fastify Ecosystem
+**Vulnerability:** Application availability risk (DoS) due to dependency incompatibility.
+**Learning:** `package.json` contained `@fastify/jwt` v10 which requires Fastify v5, but Fastify v4 was installed. This caused the application to crash on startup (`FST_ERR_PLUGIN_VERSION_MISMATCH`). The build process (`tsc`) did not catch this as it only checks types.
+**Prevention:** Pin dependencies strictly when working with Fastify plugins, or use `npm audit` and runtime checks in CI to detect startup failures. When upgrading Fastify plugins, always check the required Fastify version.

backend/jest.config.js

@@ -0,0 +1,9 @@
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+  setupFilesAfterEnv: ['<rootDir>/jest.setup.js'],
+  testMatch: ['**/__tests__/**/*.test.ts'],
+  moduleNameMapper: {
+    '^@/(.*)$': '<rootDir>/src/$1',
+  },
+};

backend/jest.setup.js

@@ -0,0 +1,43 @@
+// Set critical env vars for testing
+process.env.NODE_ENV = 'test';
+process.env.JWT_SECRET = 'test-secret-at-least-32-chars-long-for-security';
+process.env.DATABASE_URL = 'postgresql://test:test@localhost:5432/launchpad_test';
+process.env.LUNES_RPC_URL = 'http://localhost:9999'; // Mock
+process.env.CONTRACT_ADDRESS = '0x0000000000000000000000000000000000000000';
+process.env.PRIVATE_KEY = '0x0000000000000000000000000000000000000000000000000000000000000000';
+
+// Mock IORedis
+jest.mock('ioredis', () => {
+  return jest.fn().mockImplementation(() => {
+    return {
+      on: jest.fn(),
+      publish: jest.fn(),
+      set: jest.fn(),
+      get: jest.fn(),
+      del: jest.fn(),
+      quit: jest.fn(),
+      disconnect: jest.fn(),
+    };
+  });
+});
+
+// Mock Logger
+const mockLogger = {
+  info: console.log,
+  error: console.error,
+  warn: console.warn,
+  debug: console.debug,
+  http: console.log,
+  blockchain: console.log,
+  database: console.log,
+  api: console.log,
+  auth: console.log,
+  security: console.log,
+  performance: console.log,
+  audit: console.log,
+};
+
+jest.mock('./src/shared/logger', () => ({
+  logger: mockLogger,
+  Logger: mockLogger, // Logger class with static methods mimics the object
+}));

backend/package.json

@@ -38,7 +38,7 @@
   "dependencies": {
     "@fastify/cors": "^8.4.0",
     "@fastify/helmet": "^11.1.1",
-    "@fastify/jwt": "^10.0.0",
+    "@fastify/jwt": "^8.0.0",
     "@fastify/multipart": "^8.0.0",
     "@fastify/rate-limit": "^9.0.1",
     "@fastify/swagger": "^8.12.0",

backend/src/__tests__/rate_limit.test.ts

@@ -0,0 +1,70 @@
+import 'reflect-metadata';
+import { FastifyInstance } from 'fastify';
+
+// Mock envConfig before importing app
+jest.mock('../config/env.config', () => {
+  const original = jest.requireActual('../config/env.config');
+  return {
+    envConfig: {
+      ...original.envConfig,
+      RATE_LIMIT_MAX_REQUESTS: 2, // Low limit for testing
+      RATE_LIMIT_WINDOW_MS: 1000,
+      NODE_ENV: 'test',
+      CORS_ORIGIN: '*',
+      JWT_SECRET: 'test-secret',
+      JWT_EXPIRES_IN: '1h',
+      ENABLE_SWAGGER: false,
+      PORT: 3000,
+      HOST: 'localhost'
+    }
+  };
+});
+
+import { app } from '../app';
+
+describe('Rate Limiting', () => {
+  let server: FastifyInstance;
+
+  beforeAll(async () => {
+    // Mock server.listen to prevent actual port binding
+    jest.spyOn(app.server, 'listen').mockImplementation(async () => {
+        return 'http://localhost:3000';
+    });
+
+    // Initialize the app (register plugins/routes)
+    await app.start();
+    server = app.server;
+  });
+
+  afterAll(async () => {
+    await app.stop();
+  });
+
+  it('should enforce rate limits', async () => {
+    // Make request 1 - should pass
+    const response1 = await server.inject({
+      method: 'GET',
+      url: '/health'
+    });
+    expect(response1.statusCode).toBe(200);
+
+    // Make request 2 - should pass
+    const response2 = await server.inject({
+      method: 'GET',
+      url: '/health'
+    });
+    expect(response2.statusCode).toBe(200);
+
+    // Make request 3 - should fail with 429
+    const response3 = await server.inject({
+      method: 'GET',
+      url: '/health'
+    });
+    expect(response3.statusCode).toBe(429);
+
+    // Verify error message structure if possible
+    const body = JSON.parse(response3.body);
+    expect(body.error.code).toBe(429);
+    expect(body.error.message).toContain('Muitas tentativas');
+  });
+});

backend/src/app.ts

@@ -64,17 +64,18 @@ class App {
       },
     });
 
-    // Rate Limiting - DESABILITADO PARA DESENVOLVIMENTO
-    // await this.server.register(rateLimit, {
-    //   max: envConfig.RATE_LIMIT_MAX_REQUESTS,
-    //   timeWindow: envConfig.RATE_LIMIT_WINDOW_MS,
-    //   errorResponseBuilder: (request, context) => ({
-    //     code: 429,
-    //     error: 'Rate Limit Exceeded',
-    //     message: `Muitas tentativas. Tente novamente em ${Math.round(context.ttl / 1000)} segundos.`,
-    //     expiresIn: context.ttl,
-    //   }),
-    // });
+    // Rate Limiting
+    await this.server.register(rateLimit, {
+      max: envConfig.RATE_LIMIT_MAX_REQUESTS,
+      timeWindow: envConfig.RATE_LIMIT_WINDOW_MS,
+      errorResponseBuilder: (request, context) => ({
+        statusCode: 429,
+        code: 429,
+        error: 'Rate Limit Exceeded',
+        message: `Muitas tentativas. Tente novamente em ${Math.round(context.ttl / 1000)} segundos.`,
+        expiresIn: context.ttl,
+      }),
+    });
 
     // Swagger Documentation
     if (envConfig.ENABLE_SWAGGER) {