feat(validation): add Stellar public key format validation in agent r…

backend/src/api/routes/agents.ts

@@ -9,12 +9,16 @@ export interface AgentsRouterOptions {
   db?: AgentDb;
 }
 
+const STELLAR_PUBLIC_KEY_REGEX = /^G[A-Z2-7]{55}$/;
+
 const RegisterAgentSchema = z.object({
   agentId: z.string(),
   capabilities: z.array(z.string()),
-  pricingXLM: z.number(),
+  pricingXLM: z.number().positive("Price must be positive"),
   endpoint: z.string().url(),
-  stellarPublicKey: z.string()
+  stellarPublicKey: z
+    .string()
+    .regex(STELLAR_PUBLIC_KEY_REGEX, "Invalid Stellar public key format"),
 });
 
 const DEFAULT_HEALTH_TIMEOUT_MS = 3_000;

backend/tests/agents.test.ts

@@ -2,6 +2,7 @@ import express from "express";
 import type { AddressInfo } from "net";
 import request from "supertest";
 import { createAgentsRouter } from "../src/api/routes/agents";
+import { createTasksRouter } from "../src/api/routes/tasks";
 import { AgentRecord, createAgentDb } from "../src/db/agents";
 import Database from "better-sqlite3";
 
@@ -126,3 +127,108 @@ describe("Agents API route", () => {
     expect(response.body).toEqual({ error: "Agent not found" });
   });
 });
+
+describe("Stellar public key validation", () => {
+  const VALID_KEY = "GCEZWKCA5VLDNRLN3RPRJMRZOX3Z6G5CHCGDG6NXGPTVMLHK4HZ7HHN";
+
+  beforeAll(() => {
+    process.env.SKIP_STELLAR_ACCOUNT_VERIFY = "true";
+  });
+
+  afterAll(() => {
+    delete process.env.SKIP_STELLAR_ACCOUNT_VERIFY;
+  });
+
+  describe("Agent registration", () => {
+    it("returns 400 for key missing the G prefix", async () => {
+      const response = await request(createTestApp()).post("/api/agents/register").send({
+        agentId: "test-agent",
+        capabilities: ["coding"],
+        pricingXLM: 1,
+        endpoint: "http://localhost:3001/health",
+        stellarPublicKey: "AAXXWKCA5VLDNRLN3RPRJMRZOX3Z6G5CHCGDG6NXGPTVMLHK4HZ7HHN",
+      });
+
+      expect(response.status).toBe(400);
+    });
+
+    it("returns 400 for key shorter than 56 characters", async () => {
+      const response = await request(createTestApp()).post("/api/agents/register").send({
+        agentId: "test-agent",
+        capabilities: ["coding"],
+        pricingXLM: 1,
+        endpoint: "http://localhost:3001/health",
+        stellarPublicKey: "GCEZWKCA5VLDNRLN3RPRJMRZOX3Z6G5CHCG",
+      });
+
+      expect(response.status).toBe(400);
+    });
+
+    it("returns 400 for negative pricingXLM", async () => {
+      const response = await request(createTestApp()).post("/api/agents/register").send({
+        agentId: "test-agent",
+        capabilities: ["coding"],
+        pricingXLM: -1,
+        endpoint: "http://localhost:3001/health",
+        stellarPublicKey: VALID_KEY,
+      });
+
+      expect(response.status).toBe(400);
+    });
+
+    it("returns 400 for zero pricingXLM", async () => {
+      const response = await request(createTestApp()).post("/api/agents/register").send({
+        agentId: "test-agent",
+        capabilities: ["coding"],
+        pricingXLM: 0,
+        endpoint: "http://localhost:3001/health",
+        stellarPublicKey: VALID_KEY,
+      });
+
+      expect(response.status).toBe(400);
+    });
+
+    it("returns 201 for valid Stellar public key", async () => {
+      const response = await request(createTestApp()).post("/api/agents/register").send({
+        agentId: "test-agent",
+        capabilities: ["coding"],
+        pricingXLM: 1,
+        endpoint: "http://localhost:3001/health",
+        stellarPublicKey: VALID_KEY,
+      });
+
+      expect(response.status).toBe(201);
+      expect(response.body.stellarPublicKey).toBe(VALID_KEY);
+    });
+  });
+
+  describe("Task creation", () => {
+    function createTaskTestApp() {
+      const app = express();
+      app.use(express.json());
+      const mockDispatch = jest.fn().mockResolvedValue({});
+      const mockReleasePayment = jest.fn().mockResolvedValue(undefined);
+      app.use("/api/tasks", createTasksRouter(mockDispatch, mockReleasePayment));
+      return app;
+    }
+
+    it("returns 400 for invalid walletpublickey header", async () => {
+      const response = await request(createTaskTestApp())
+        .post("/api/tasks")
+        .set("walletpublickey", "INVALID-KEY-123")
+        .send({ prompt: "Do something", maxBudgetXLM: 1 });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe("Invalid Stellar public key format");
+    });
+
+    it("returns 400 when walletpublickey header is missing", async () => {
+      const response = await request(createTaskTestApp())
+        .post("/api/tasks")
+        .send({ prompt: "Do something", maxBudgetXLM: 1 });
+
+      expect(response.status).toBe(400);
+      expect(response.body.error).toBe("Invalid Stellar public key format");
+    });
+  });
+});