feat(backend): wire top-up stream endpoint to Soroban contract (#415)

[cybermax4200]

Closes #415

Changes

backend/src/services/sorobanService.ts

• Add topUpStream(streamId, amount, callerAddress) — builds, simulates,
  signs with KEEPER_SECRET_KEY, submits top_up_stream contract call,
  returns txHash

backend/src/controllers/stream.controller.ts

• Add topUpStreamHandler
  • Zod validates amount as positive integer string (XLM stroops) → 400 on failure
  • Requires authenticated user (authMiddleware) → 401 if missing
  • Enforces sender-only guard → 403 for non-sender
  • Calls topUpStream(); updates depositedAmount + lastUpdateTime in DB on success

backend/src/routes/v1/stream.routes.ts

• Register POST /:streamId/top-up behind authMiddleware
• OpenAPI JSDoc annotation included

backend/tests/integration/top-up.test.ts

• 6 tests: 200 happy path, 400 missing amount, 400 float/invalid amount,
  404 stream not found, 403 wrong caller, DB update assertion

Env var required

KEEPER_SECRET_KEY — Stellar secret key used to sign the contract transaction

[ogazboiz]

hey, main was failing CI from broken auth imports + frontend parse errors. fixed and pushed to main now. please rebase to pick up the fixes:

git fetch upstream
git rebase upstream/main
git push --force-with-lease

if there's a conflict, resolve it locally and we'll review once CI is green.

[cybermax4200]

hey, main was failing CI from broken auth imports + frontend parse errors. fixed and pushed to main now. please rebase to pick up the fixes:

git fetch upstream
git rebase upstream/main
git push --force-with-lease

if there's a conflict, resolve it locally and we'll review once CI is green.

The CI is now green

[ogazboiz]

hey, since main now has #444 merged (the cancel stream endpoint), your branch is showing stale modifications to backend/src/controllers/stream/cancel.ts and backend/src/services/sorobanService.ts that overlap with main's current state.

please rebase again to drop those:

git fetch upstream
git rebase upstream/main
# during rebase, when conflicts appear in cancel.ts or sorobanService.ts:
git checkout upstream/main -- backend/src/controllers/stream/cancel.ts backend/src/services/sorobanService.ts
git add backend/src/controllers/stream/cancel.ts backend/src/services/sorobanService.ts
git rebase --continue
git push --force-with-lease

after that, your diff should only show the actual feature for this PR and we can merge.

[cybermax4200]

hey, since main now has #444 merged (the cancel stream endpoint), your branch is showing stale modifications to backend/src/controllers/stream/cancel.ts and backend/src/services/sorobanService.ts that overlap with main's current state.

please rebase again to drop those:

git fetch upstream
git rebase upstream/main
# during rebase, when conflicts appear in cancel.ts or sorobanService.ts:
git checkout upstream/main -- backend/src/controllers/stream/cancel.ts backend/src/services/sorobanService.ts
git add backend/src/controllers/stream/cancel.ts backend/src/services/sorobanService.ts
git rebase --continue
git push --force-with-lease

after that, your diff should only show the actual feature for this PR and we can merge.

I have dropped our copy of cancel.ts and sorobanService cancel logic in favour of main's version. The branch now only adds the top-up endpoint. CI is now green, please merge

[ogazboiz]

hey, main CI is fully green now. there were several real TypeScript and test issues from #444's merge that have all been fixed. please rebase one more time:

git fetch upstream
git rebase upstream/main
git push --force-with-lease

your PR's diff should be much cleaner after this rebase since main now has the canonical versions of cancel.ts, sorobanService.ts, and the withdraw test.

[ogazboiz]

hey @cybermax4200, the top-up endpoint implementation looks solid:

• Zod validation on body
• Sender-only authorization check
• Updates depositedAmount in DB
• Returns txHash properly

but there's a lot of scope creep in this PR — the title is "wire top-up stream endpoint" but it also includes:

1. backend/cp — empty stray file being deleted. fine to keep but confirms there was build noise.
2. backend/src/controllers/user.controller.ts — adds pagination to getUserEvents. nice improvement but unrelated to top-up.
3. backend/src/middleware/stream-rate-limiter.middleware.ts — removes ipKeyGenerator import. unrelated.
4. frontend/src/components/NotificationDropdown.tsx — frontend change in a backend PR.
5. backend/tests/claimable.service.test.ts and backend/tests/stream.test.ts — modifications to existing tests.

would you split out the unrelated changes (user.controller pagination, NotificationDropdown, rate limiter) into separate PRs? this PR should ideally only contain:

• top-up endpoint implementation
• top-up integration tests
• the route wiring in stream.routes.ts

once the diff is scoped to just top-up, this is good to merge. the actual top-up code is fine.

[cybermax4200]

hey @cybermax4200, the top-up endpoint implementation looks solid:

• Zod validation on body
• Sender-only authorization check
• Updates depositedAmount in DB
• Returns txHash properly

but there's a lot of scope creep in this PR — the title is "wire top-up stream endpoint" but it also includes:

1. backend/cp — empty stray file being deleted. fine to keep but confirms there was build noise.
2. backend/src/controllers/user.controller.ts — adds pagination to getUserEvents. nice improvement but unrelated to top-up.
3. backend/src/middleware/stream-rate-limiter.middleware.ts — removes ipKeyGenerator import. unrelated.
4. frontend/src/components/NotificationDropdown.tsx — frontend change in a backend PR.
5. backend/tests/claimable.service.test.ts and backend/tests/stream.test.ts — modifications to existing tests.

would you split out the unrelated changes (user.controller pagination, NotificationDropdown, rate limiter) into separate PRs? this PR should ideally only contain:

• top-up endpoint implementation
• top-up integration tests
• the route wiring in stream.routes.ts

once the diff is scoped to just top-up, this is good to merge. the actual top-up code is fine.

it has been taken care of

[ogazboiz]

hey @cybermax4200, scope is much tighter now. top-up handler, top-up service function, route wiring, integration tests — exactly what closes #415. the small leftover changes (rate limiter import cleanup, comment fixes) are tiny and harmless. all CI green. merging!

if you want to keep contributing or follow up on open issues, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0

[cybermax4200]

Thank you for the issues, I believe we will work more closely next wave