fix: Redis health check in /health + sanctions screening for payout addresses

backend/src/index.js

@@ -34,6 +34,7 @@ import { getRateTierLimits, DEFAULT_RATE_TIER } from './config/rateTiers.js';
 import { createDal } from './dal/index.js';
 import { createJobRunner } from './jobs/jobRunner.js';
 import { WebhookService, WEBHOOK_EVENTS } from './services/webhookService.js';
+import { createSanctionsService } from './services/sanctionsService.js';
 import {
   campaignCreateSchema,
   campaignUpdateSchema,
@@ -397,6 +398,11 @@ export async function createApp(options = {}) {
     notificationPreferencesRepo: notificationPreferencesRepository,
     webPushService,
   });
+
+  // Sanctions/blocklist screening for payout addresses — closes #955.
+  // Provider is configurable via SANCTIONS_PROVIDER env var (default: "local").
+  // Add blocked addresses via SANCTIONS_BLOCKLIST (comma-separated Stellar addresses).
+  const sanctionsService = createSanctionsService({ logger: log });
   const shortCacheTtlMs = normalizePositiveInteger(
     /** @type {any} */ (options.shortCacheTtlMs) ?? process.env.SHORT_CACHE_TTL_MS,
     DEFAULT_SHORT_CACHE_TTL_MS,
@@ -845,12 +851,29 @@ export async function createApp(options = {}) {
     const rpcUrl = rpcPool.getHealthyRpcUrl();
     const rpc = rpcHealthCache.payload ?? (await checkSorobanRpcHealth({ rpcUrl, fetchImpl }));
 
+    // Redis health — closes #858: surface Redis connectivity in /health so
+    // operators can detect a Redis outage before rate-limit correctness degrades.
+    let redisHealth = { status: 'disabled' };
+    if (usageRedisClient) {
+      try {
+        const pong = await usageRedisClient.ping();
+        redisHealth = { status: pong === 'PONG' ? 'ok' : 'degraded' };
+      } catch {
+        redisHealth = { status: 'error' };
+      }
+    }
+
+    const isOk =
+      /** @type {any} */ (rpc).status === 'ok' &&
+      (redisHealth.status === 'ok' || redisHealth.status === 'disabled');
+
     return {
-      status: /** @type {any} */ (rpc).status === 'ok' ? 'ok' : 'degraded',
+      status: isOk ? 'ok' : 'degraded',
       service: 'trivela-api',
       timestamp: new Date().toISOString(),
       rpc,
       rpcPool: rpcPool.getStatus(),
+      redis: redisHealth,
     };
   }
 
@@ -2719,6 +2742,36 @@ export async function createApp(options = {}) {
       }
     });
 
+    // Sanctions screening — closes #955
+    // POST /api/v1/sanctions/screen  { address: string }
+    // Screen a Stellar address against the configured blocklist before settlement.
+    // Returns { blocked: boolean, reason?: string, provider: string }.
+    // Blocked addresses are also written to the audit log.
+    app.post(`${prefix}/sanctions/screen`, rateLimiter, async (req, res) => {
+      const address = req.body?.address;
+      if (typeof address !== 'string' || !address.trim()) {
+        return res.status(400).json({
+          error: 'address is required',
+          code: 'VALIDATION_ERROR',
+        });
+      }
+      try {
+        const result = await sanctionsService.screen(address.trim(), { logger: log });
+        if (result.blocked) {
+          recordAuditEntry(req, {
+            action: 'block',
+            entity: 'sanctions',
+            entityId: address.trim(),
+            diff: { reason: result.reason, provider: result.provider },
+          });
+        }
+        return res.status(result.blocked ? 403 : 200).json(result);
+      } catch (err) {
+        log.error({ err }, 'sanctions: screen error');
+        return res.status(500).json({ error: 'Sanctions check failed', code: 'INTERNAL_ERROR' });
+      }
+    });
+
     // Referral routes (Issue #350)
     app.post(`${prefix}/campaigns/:id/referrals`, rateLimiter, (req, res) => {
       const campaign = campaignRepository.getById(req.params.id);

backend/src/services/sanctionsService.js

@@ -0,0 +1,103 @@
+/**
+ * Sanctions / blocklist screening for payout addresses — closes #955.
+ *
+ * Provider is selected via SANCTIONS_PROVIDER env var:
+ *   "local"  (default) — comma-separated blocklist in SANCTIONS_BLOCKLIST env var
+ *   "env"    — alias for "local"
+ *
+ * Additional providers (OFAC SDN API, etc.) can be plugged in by extending
+ * createProvider() below without touching the public API.
+ */
+
+/** @typedef {{ blocked: boolean; reason?: string; provider: string }} ScreenResult */
+
+const STELLAR_ADDRESS_RE = /^G[A-Z2-7]{55}$/;
+
+/** @param {string} value */
+function isStellarAddress(value) {
+  return STELLAR_ADDRESS_RE.test(value.trim());
+}
+
+/**
+ * Parse a comma-separated list of blocked addresses from an env string.
+ * @param {string | undefined} raw
+ * @returns {Set<string>}
+ */
+function parseBlocklist(raw) {
+  if (!raw) return new Set();
+  return new Set(
+    String(raw)
+      .split(',')
+      .map((a) => a.trim().toUpperCase())
+      .filter(Boolean),
+  );
+}
+
+/**
+ * @param {Set<string>} blocklist
+ * @returns {{ screen: (address: string) => Promise<ScreenResult> }}
+ */
+function createLocalProvider(blocklist) {
+  return {
+    async screen(address) {
+      const normalized = address.trim().toUpperCase();
+      if (blocklist.has(normalized)) {
+        return { blocked: true, reason: 'address on local blocklist', provider: 'local' };
+      }
+      return { blocked: false, provider: 'local' };
+    },
+  };
+}
+
+/**
+ * Build a sanctions provider from environment / options.
+ * @param {{ provider?: string; blocklist?: string }} opts
+ */
+function createProvider(opts) {
+  const providerName = (opts.provider ?? process.env.SANCTIONS_PROVIDER ?? 'local').toLowerCase();
+  const blocklistRaw = opts.blocklist ?? process.env.SANCTIONS_BLOCKLIST;
+
+  if (providerName === 'local' || providerName === 'env') {
+    return createLocalProvider(parseBlocklist(blocklistRaw));
+  }
+
+  throw new Error(
+    `Unknown SANCTIONS_PROVIDER "${providerName}". Supported: "local". ` +
+      'Set SANCTIONS_PROVIDER=local or leave unset.',
+  );
+}
+
+/**
+ * @param {{ provider?: string; blocklist?: string; logger?: { warn: Function } }} [opts]
+ */
+export function createSanctionsService(opts = {}) {
+  const provider = createProvider(opts);
+
+  return {
+    /**
+     * Screen a Stellar address before payout/settlement.
+     * @param {string} address
+     * @param {{ logger?: { warn: Function } }} [context]
+     * @returns {Promise<ScreenResult>}
+     */
+    async screen(address, context = {}) {
+      if (!isStellarAddress(address)) {
+        return { blocked: false, provider: 'local', reason: 'not a Stellar address — skipped' };
+      }
+
+      const result = await provider.screen(address);
+
+      if (result.blocked) {
+        const logger = context.logger ?? opts.logger;
+        if (logger) {
+          logger.warn(
+            { address: address.slice(0, 8) + '…', reason: result.reason, provider: result.provider },
+            'sanctions: payout address blocked',
+          );
+        }
+      }
+
+      return result;
+    },
+  };
+}