feat(validation): add Stellar public key format validation in agent r…

[Stanley-Owoh]

Add Missing Input Validation for Stellar Public Key Format in Agent Registration

Problem

Malformed Stellar Ed25519 public keys were accepted by both the agent registration endpoint and the task creation endpoint. The stellarPublicKey field in the registration schema only checked that the value was a string, and the walletpublickey request header in task creation was used without any validation.

Solution

Added robust validation for Stellar public keys using the regex /^G[A-Z2-7]{55}$/, which enforces that keys start with G, are exactly 56 characters, and contain only valid Base32 characters (A-Z, 2-7).

Changes

backend/src/api/routes/agents.ts

• Added STELLAR_PUBLIC_KEY_REGEX constant
• Updated stellarPublicKey in RegisterAgentSchema to use .regex() validation with error message
• Updated pricingXLM to use .positive() validation

backend/src/api/routes/tasks.ts

• Added STELLAR_PUBLIC_KEY_REGEX constant
• Added validation for the walletpublickey header in the POST /api/tasks route — returns HTTP 400 with "Invalid Stellar public key format" if the header is missing or invalid

backend/tests/agents.test.ts

• Added "Stellar public key validation" test suite covering:
  • Invalid key missing G prefix → 400
  • Invalid key shorter than 56 characters → 400
  • Negative pricingXLM → 400
  • Zero pricingXLM → 400
  • Valid Stellar public key → 201
  • Invalid walletpublickey header on task creation → 400
  • Missing walletpublickey header on task creation → 400

Acceptance Criteria

• Stellar public key validation regex implemented
• stellarPublicKey uses .regex() validation in the registration schema
• pricingXLM must be positive
• walletpublickey is validated before task creation
• Invalid or missing public keys return HTTP 400 with a clear error message
• Unit/integration tests cover all required validation scenarios
• Existing functionality remains unchanged for valid requests
• No unrelated code changes or refactors introduced

Closes #151

[vercel]

@Stanley-Owoh is attempting to deploy a commit to the Jaja's projects Team on Vercel.

A member of the Team first needs to authorize it.

[devJaja]

Solid Implementation @Stanley-Owoh
Quick one please, fix the CI/backend and the CI/Fullstack E2E Integration checks