fix(core): complete project audit remediation for auth, financial integrity, and performance (!28) · Merge Requests · ThinhNC / finwise-miniapp-be

fix(core): complete project audit remediation for auth, financial integrity, and performance

Summary of Changes - Backend

This PR implements comprehensive audit remediations covering financial integrity, authentication hardening, N+1 query elimination, route validation, database indexing, and static analysis cleanup.

Financial Integrity & Security (P0 & P1)

Enforced Wallet Balance Immutability: Removed balance from updateWalletSchema and UpdateWalletDto. Wallet balances can now only be mutated via Transaction (Income/Expense) or Transfer operations within serializable transactions.
Dual-Channel Token Delivery: Updated /auth/login and /auth/refresh endpoints to return accessToken and refreshToken directly in the JSON response payload alongside HTTP-only cookies to support mobile WebView / Mini App environments.
Hardened Access Token Lifecycle: Reduced default JWT accessExpiresIn from 24h to 30m and added active user validation (isActive & deletedAt === null) in authMiddleware backed by a 60-second in-memory/Redis cache.

Performance & Database Optimization (P1 & P2)

Eliminated N+1 Aggregate Queries:
- Added BudgetRepository.getBatchSpendingSummaries to calculate spending across all budgets in a single database query.
- Optimized NotificationRepository.findBudgetCandidates to batch-fetch transactions across candidate budgets.
Added Composite Indexes:
- Added @@index([userId, isArchived]) on Wallet.
- Added @@index([status, updatedAt]) on NotificationDelivery.
- Deployed migration 20260819223000_add_composite_indexes.

API Validation & Code Quality (P2 & P3)

UUID Parameter Validation: Added userParamsSchema and sessionParamsSchema to validate :id on admin and session routes, preventing unhandled Prisma P2023 (500) errors.
ESLint & Compiler Hygiene: Updated eslint.config.mjs to support _ prefix for intentionally unused variables/caught errors; normalized Express 4-argument error handler signature (_next). Achieved 0 lint errors, 0 warnings.

## Summary of Changes - Backend
This PR implements comprehensive audit remediations covering financial integrity, authentication hardening, N+1 query elimination, route validation, database indexing, and static analysis cleanup.
### Financial Integrity & Security (P0 & P1)
- **Enforced Wallet Balance Immutability**: Removed `balance` from `updateWalletSchema` and `UpdateWalletDto`. Wallet balances can now only be mutated via `Transaction` (Income/Expense) or `Transfer` operations within serializable transactions.
- **Dual-Channel Token Delivery**: Updated `/auth/login` and `/auth/refresh` endpoints to return `accessToken` and `refreshToken` directly in the JSON response payload alongside HTTP-only cookies to support mobile WebView / Mini App environments.
- **Hardened Access Token Lifecycle**: Reduced default JWT `accessExpiresIn` from `24h` to `30m` and added active user validation (`isActive` & `deletedAt === null`) in `authMiddleware` backed by a 60-second in-memory/Redis cache.
### Performance & Database Optimization (P1 & P2)
- **Eliminated N+1 Aggregate Queries**: 
  - Added `BudgetRepository.getBatchSpendingSummaries` to calculate spending across all budgets in a single database query.
  - Optimized `NotificationRepository.findBudgetCandidates` to batch-fetch transactions across candidate budgets.
- **Added Composite Indexes**:
  - Added `@@index([userId, isArchived])` on `Wallet`.
  - Added `@@index([status, updatedAt])` on `NotificationDelivery`.
  - Deployed migration `20260819223000_add_composite_indexes`.
### API Validation & Code Quality (P2 & P3)
- **UUID Parameter Validation**: Added `userParamsSchema` and `sessionParamsSchema` to validate `:id` on admin and session routes, preventing unhandled Prisma `P2023` (500) errors.
- **ESLint & Compiler Hygiene**: Updated `eslint.config.mjs` to support `_` prefix for intentionally unused variables/caught errors; normalized Express 4-argument error handler signature (`_next`). Achieved **0 lint errors, 0 warnings**.

Edited Aug 19, 2026 by ThinhNC