feat: MSW frontend testing, Stellar Horizon webhook verification, AWS KMS signer, and onboarding CLI

[kokobutter-web]

Summary

This Pull Request resolves four core issues in the repository:

1. MSW Frontend Component Unit Testing (Closes [DevOps & Testing] Deploy Mock Service Worker (MSW) for Deterministic Frontend Component Testing #1206)
2. Stellar Horizon Webhook Signature Verification (Closes [Security] Implement Stellar Horizon Webhook Signature Verification #1192)
3. AWS KMS Key Signer Wrapper for Platform Master Keys (Closes [Security] Integrate AWS KMS Key Signer Wrapper for Platform Master Keys #1193)
4. 1-Command Contributor Environment Onboarding CLI (Closes [DevOps & Testing] Build 1-Command Contributor Environment Onboarding CLI (npm run setup) #1207)

---

Detailed Changes Made

1. Deploy Mock Service Worker (MSW) for Frontend Testing (Closes #1206)

• Handlers: Implemented MSW handlers in frontend/src/mocks/handlers.ts for authentication (/api/auth/*), courses (/api/courses/*), and certificates (/api/certificates/*).
• Vitest Setup: Integrated MSW setupServer in frontend/src/test/setup.ts with beforeAll, afterEach, and afterAll server lifecycles.
• Testing: Added deterministic component test suite in frontend/src/components/__tests__/MswComponentTesting.test.tsx covering loading, error (500), empty data, and success states.

2. Stellar Horizon Webhook Signature Verification (Closes #1192)

• Signature Verification: Added verifyStellarWebhookSignature in backend/src/services/webhooks/stellarWebhook.service.ts validating incoming X-Stellar-Signature headers via HMAC-SHA256 with timing-safe comparison.
• Replay Protection: Enforced a strict 5-minute timestamp tolerance window (X-Stellar-Timestamp) to automatically reject replay attacks.
• Idempotency: Implemented transaction hash uniqueness tracking (txHash) to prevent double-crediting balances.
• Routes & Tests: Exposed POST /api/webhooks/stellar returning 401 Unauthorized on forged signatures/expired timestamps and verified via Jest suite in backend/tests/stellar-webhook.test.ts.

3. AWS KMS Key Signer Wrapper (Closes #1193)

• KMS Signer: Implemented KmsStellarSigner in backend/src/blockchain/kmsSigner.ts routing transaction signing requests through AWS KMS kms:Sign API with zero local private key storage in KMS mode.
• Audit Logging: Emits CloudTrail audit log events for every signing operation.
• Software Fallback: Provides seamless local software Keypair signer fallback in development and testing environments (NODE_ENV === 'development' || NODE_ENV === 'test').
• IAM Policy: Exported getKmsIamPolicy() helper for least-privilege IAM configuration.
• Tests: Verified fallback and KMS signing behavior in backend/tests/kms-signer.test.ts.

4. 1-Command Contributor Environment Onboarding CLI (Closes #1207)

• Root Script: Added "setup": "bash scripts/setup.sh" to root package.json.
• Interactive Diagnostics: Enhanced scripts/setup.sh with automated prerequisite checks for Node.js, Rust, Cargo, Docker, and Stellar CLI with terminal installation guidance for missing toolchains.
• Automated Workflow: Automates dependency installation, Prisma client generation, database seeding, and contract compilation.
• Dashboard Banner: Displays formatted ANSI success banner with direct URLs to local frontend and backend servers.

---

Verification & Testing Passed

• Frontend Vitest: pnpm test src/components/__tests__/MswComponentTesting.test.tsx (7/7 tests passed).
• Backend Jest: npx jest tests/stellar-webhook.test.ts tests/kms-signer.test.ts (7/7 tests passed).
• CLI Onboarding: Verified bash scripts/setup.sh runs end-to-end diagnostics and environment configuration clean.

Closes #1206
Closes #1192
Closes #1193
Closes #1207

[vercel]

Someone is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@kokobutter-web Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits