Create new production release

.github/workflows/ci.yml

@@ -34,9 +34,8 @@ jobs:
       - name: Build 
         run: bun run build
 
+      - name: 🧪 Biome check
+        run: bun run verify
+
       - name: ✏️ Typecheck
         run: bun run typecheck
-
-#      We currently do not run the linter as we have too many issues.
-#      - name: 🧪 Lint
-#        run: bun run lint

apps/api/package.json

@@ -10,7 +10,7 @@
     "@polkadot/keyring": "catalog:",
     "@polkadot/util": "catalog:",
     "@polkadot/util-crypto": "catalog:",
-    "@scure/bip39": "^1.5.4",
+    "@scure/bip39": "catalog:",
     "@supabase/supabase-js": "catalog:",
     "@types/multer": "^2.1.0",
     "@vortexfi/shared": "workspace:*",

apps/api/src/api/controllers/alfredpay.controller.ts

@@ -26,6 +26,18 @@ import logger from "../../config/logger";
 import AlfredPayCustomer from "../../models/alfredPayCustomer.model";
 
 export class AlfredpayController {
+  private static getRequiredUserId(req: Request): string {
+    if (!req.userId) {
+      throw new Error("Authenticated user id not available");
+    }
+
+    return req.userId;
+  }
+
+  private static getErrorMessage(error: unknown): string {
+    return error instanceof Error ? error.message : String(error);
+  }
+
   private static mapKycStatus(status: AlfredpayKycStatus): AlfredPayStatus | null {
     switch (status) {
       case AlfredpayKycStatus.IN_REVIEW:
@@ -61,7 +73,7 @@ export class AlfredpayController {
   static async alfredpayStatus(req: Request, res: Response) {
     try {
       const { country } = req.query as unknown as AlfredpayStatusRequest;
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         order: [["updatedAt", "DESC"]],
@@ -107,7 +119,7 @@ export class AlfredpayController {
 
         // If the upstream API returns 404 (KYC submission not found), the local status is stale.
         // Reset to Consulted so the frontend re-triggers the KYC flow.
-        const errorMessage = ((error as any)?.message || (error as any)?.toString() || "").toLowerCase();
+        const errorMessage = AlfredpayController.getErrorMessage(error).toLowerCase();
         if (errorMessage.includes("404") || errorMessage.includes("not found")) {
           if (alfredPayCustomer.status === AlfredPayStatus.Success) {
             logger.info("Resetting stale AlfredPay status to Consulted due to upstream 404");
@@ -132,7 +144,7 @@ export class AlfredpayController {
   static async createIndividualCustomer(req: Request, res: Response) {
     try {
       const { country } = req.body as AlfredpayCreateCustomerRequest;
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
       const userEmail = req.userEmail;
 
       if (!userEmail) {
@@ -187,7 +199,7 @@ export class AlfredpayController {
   static async getKycRedirectLink(req: Request, res: Response) {
     try {
       const { country } = req.query as unknown as AlfredpayGetKycRedirectLinkRequest;
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         where: { country: country as AlfredPayCountry, userId }
@@ -211,7 +223,7 @@ export class AlfredpayController {
             return res.status(400).json({ error: `KYC is in status ${statusRes.status}` });
           }
         }
-      } catch (e) {
+      } catch {
         logger.info("No previous KYC submission found or error fetching it, proceeding.");
       }
 
@@ -228,7 +240,7 @@ export class AlfredpayController {
   static async kycRedirectOpened(req: Request, res: Response) {
     try {
       const { country, type } = req.body as unknown as { country: string; type?: AlfredpayCustomerType };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
       const selectedType = type || AlfredpayCustomerType.INDIVIDUAL;
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
@@ -252,7 +264,7 @@ export class AlfredpayController {
   static async kycRedirectFinished(req: Request, res: Response) {
     try {
       const { country, type } = req.body as unknown as { country: string; type?: AlfredpayCustomerType };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
       const selectedType = type || AlfredpayCustomerType.INDIVIDUAL;
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
@@ -276,7 +288,7 @@ export class AlfredpayController {
   static async getKycStatus(req: Request, res: Response) {
     try {
       const { country, type } = req.query as unknown as { country: string; type?: AlfredpayCustomerType };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
       const selectedType = type || AlfredpayCustomerType.INDIVIDUAL;
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
@@ -303,7 +315,9 @@ export class AlfredpayController {
         ? await alfredpayService.getKybStatus(alfredPayCustomer.alfredPayId, lastSubmission.submissionId)
         : await alfredpayService.getKycStatus(alfredPayCustomer.alfredPayId, lastSubmission.submissionId);
 
-      const newStatus = AlfredpayController.mapKycStatus(statusResponse.status);
+      const newStatus = isBusiness
+        ? AlfredpayController.mapKybStatus(statusResponse.status)
+        : AlfredpayController.mapKycStatus(statusResponse.status);
       const updateData: Partial<AlfredPayCustomer> = {};
 
       if (newStatus && newStatus !== alfredPayCustomer.status) {
@@ -336,7 +350,7 @@ export class AlfredpayController {
   static async retryKyc(req: Request, res: Response) {
     try {
       const { country, type } = req.body as { country: string; type?: AlfredpayCustomerType };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
       const selectedType = type || AlfredpayCustomerType.INDIVIDUAL;
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
@@ -392,7 +406,7 @@ export class AlfredpayController {
   static async createBusinessCustomer(req: Request, res: Response) {
     try {
       const { country } = req.body as { country: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
       const userEmail = req.userEmail;
 
       if (!userEmail) {
@@ -448,7 +462,7 @@ export class AlfredpayController {
   static async getKybRedirectLink(req: Request, res: Response) {
     try {
       const { country } = req.query as unknown as AlfredpayGetKycRedirectLinkRequest;
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         where: { country: country as AlfredPayCountry, type: AlfredpayCustomerType.BUSINESS, userId }
@@ -472,7 +486,7 @@ export class AlfredpayController {
             return res.status(400).json({ error: `KYB is in status ${statusRes.status}` });
           }
         }
-      } catch (e) {
+      } catch {
         logger.info("No previous KYB submission found or error fetching it, proceeding.");
       }
 
@@ -488,7 +502,7 @@ export class AlfredpayController {
   static async submitKycInformation(req: Request, res: Response) {
     try {
       const { country, ...kycData } = req.body as SubmitKycInformationRequest;
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         where: { country: country as AlfredPayCountry, type: AlfredpayCustomerType.INDIVIDUAL, userId }
@@ -526,7 +540,7 @@ export class AlfredpayController {
   static async submitKycFile(req: Request, res: Response) {
     try {
       const { country, submissionId, fileType } = req.body as { country: string; submissionId: string; fileType: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       if (!req.file) {
         return res.status(400).json({ error: "No file uploaded" });
@@ -560,7 +574,7 @@ export class AlfredpayController {
   static async sendKycSubmission(req: Request, res: Response) {
     try {
       const { country, submissionId } = req.body as { country: string; submissionId: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         where: { country: country as AlfredPayCountry, type: AlfredpayCustomerType.INDIVIDUAL, userId }
@@ -584,7 +598,7 @@ export class AlfredpayController {
   static async submitKybInformation(req: Request, res: Response) {
     try {
       const { country, ...kybData } = req.body as SubmitKybInformationRequest & { country: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         where: { country: country as AlfredPayCountry, type: AlfredpayCustomerType.BUSINESS, userId }
@@ -622,7 +636,7 @@ export class AlfredpayController {
   static async findKybCustomerAndBusiness(req: Request, res: Response) {
     try {
       const { country } = req.query as { country: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         where: { country: country as AlfredPayCountry, type: AlfredpayCustomerType.BUSINESS, userId }
@@ -650,7 +664,7 @@ export class AlfredpayController {
   static async submitKybFile(req: Request, res: Response) {
     try {
       const { country, submissionId, fileType } = req.body as { country: string; submissionId: string; fileType: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       if (!req.file) {
         return res.status(400).json({ error: "No file uploaded" });
@@ -689,7 +703,7 @@ export class AlfredpayController {
         relatedPersonId: string;
         fileType: string;
       };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       if (!req.file) {
         return res.status(400).json({ error: "No file uploaded" });
@@ -729,7 +743,7 @@ export class AlfredpayController {
   static async sendKybSubmission(req: Request, res: Response) {
     try {
       const { country, submissionId } = req.body as { country: string; submissionId: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         where: { country: country as AlfredPayCountry, type: AlfredpayCustomerType.BUSINESS, userId }
@@ -774,7 +788,7 @@ export class AlfredpayController {
         documentNumber,
         isExternal = false
       } = req.body as AlfredpayAddFiatAccountRequest;
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         order: [["updatedAt", "DESC"]],
@@ -860,7 +874,7 @@ export class AlfredpayController {
   static async listFiatAccounts(req: Request, res: Response) {
     try {
       const { country } = req.query as { country: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         order: [["updatedAt", "DESC"]],
@@ -885,7 +899,7 @@ export class AlfredpayController {
     try {
       const { fiatAccountId } = req.params as { fiatAccountId: string };
       const { country } = req.query as { country: string };
-      const userId = req.userId!;
+      const userId = AlfredpayController.getRequiredUserId(req);
 
       const alfredPayCustomer = await AlfredPayCustomer.findOne({
         order: [["updatedAt", "DESC"]],

apps/api/src/api/controllers/metrics.controller.ts

@@ -13,10 +13,6 @@ export interface VolumeRow {
   total_usd: number;
 }
 
-export interface MonthlyVolume extends VolumeRow {
-  month: string;
-}
-
 export interface ChainVolume {
   chain: string;
   buy_usd: number;
@@ -80,9 +76,10 @@ function getAnonSupabaseClient() {
   return supabaseAnonClient;
 }
 
-function isAuthOrPermissionError(error: any): boolean {
-  const rawCode = error?.code ?? "";
-  const rawMessage = error?.message ?? "";
+function isAuthOrPermissionError(error: unknown): boolean {
+  const errorRecord = error && typeof error === "object" ? (error as Record<string, unknown>) : {};
+  const rawCode = errorRecord.code ?? "";
+  const rawMessage = errorRecord.message ?? "";
   const errorCode = String(rawCode).toLowerCase();
   const errorMessage = String(rawMessage).toLowerCase();
 
@@ -100,7 +97,7 @@ function isAuthOrPermissionError(error: any): boolean {
   return hasAuthOrPermissionText || has401 || has403;
 }
 
-async function rpcWithFallback<T extends any[], P extends Record<string, unknown>>(fn: string, params: P): Promise<T> {
+async function rpcWithFallback<T extends unknown[], P extends Record<string, unknown>>(fn: string, params: P): Promise<T> {
   const hasServiceKey = !!config.supabase.serviceRoleKey;
   const hasAnonKey = !!config.supabase.anonKey;
 
@@ -164,10 +161,15 @@ async function rpcWithFallback<T extends any[], P extends Record<string, unknown
   throw fallbackResult.error;
 }
 
-const zeroVolume = (key: string, keyName: "day" | "month"): any => ({
-  [keyName]: key,
-  chains: []
-});
+function zeroVolume(key: string, keyName: "day"): DailyVolume;
+function zeroVolume(key: string, keyName: "month"): MonthlyVolume;
+function zeroVolume(key: string, keyName: "day" | "month"): DailyVolume | MonthlyVolume {
+  return keyName === "day" ? { chains: [], day: key } : { chains: [], month: key };
+}
+
+function getErrorStack(error: unknown): string | undefined {
+  return error instanceof Error ? error.stack : undefined;
+}
 
 async function getMonthlyVolumes(): Promise<MonthlyVolume[]> {
   const cacheKey = "monthly";
@@ -198,9 +200,9 @@ async function getMonthlyVolumes(): Promise<MonthlyVolume[]> {
 
     cache.set(cacheKey, volumes, CACHE_TTL_SECONDS);
     return volumes;
-  } catch (error: any) {
+  } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
-    logger.error("Could not calculate monthly volumes", { error: errorMessage, stack: error?.stack });
+    logger.error("Could not calculate monthly volumes", { error: errorMessage, stack: getErrorStack(error) });
     throw new Error("Could not calculate monthly volumes: " + errorMessage);
   }
 }
@@ -229,9 +231,9 @@ async function getDailyVolumes(startDate: string, endDate: string): Promise<Dail
     }
 
     return volumes;
-  } catch (error: any) {
+  } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
-    logger.error("Could not calculate daily volumes", { error: errorMessage, stack: error?.stack });
+    logger.error("Could not calculate daily volumes", { error: errorMessage, stack: getErrorStack(error) });
     throw new Error("Could not calculate daily volumes: " + errorMessage);
   }
 }
@@ -244,10 +246,10 @@ function aggregateWeekly(daily: DailyVolume[]): WeeklyVolume[] {
     const startDay = chunk[0].day;
     const endDay = chunk[chunk.length - 1].day;
 
-    const chainTotals = new Map<string, any>();
+    const chainTotals = new Map<string, ChainVolume>();
 
     chunk.forEach(day => {
-      day.chains.forEach((c: any) => {
+      day.chains.forEach(c => {
         const existing = chainTotals.get(c.chain) || { buy_usd: 0, chain: c.chain, sell_usd: 0, total_usd: 0 };
         existing.buy_usd += c.buy_usd;
         existing.sell_usd += c.sell_usd;

apps/api/src/api/middlewares/auth.ts

@@ -4,9 +4,10 @@ import logger from "../../config/logger";
 import { validateSignatureAndGetMemo } from "../services/siwe.service";
 
 declare global {
+  // biome-ignore lint/style/noNamespace: Express request augmentation follows the existing backend pattern.
   namespace Express {
     interface Request {
-      derivedMemo: string | null;
+      derivedMemo?: string | null;
     }
   }
 }

apps/api/src/api/middlewares/supabaseAuth.ts

@@ -3,6 +3,7 @@ import logger from "../../config/logger";
 import { SupabaseAuthService } from "../services/auth";
 
 declare global {
+  // biome-ignore lint/style/noNamespace: Express request augmentation follows the existing backend pattern.
   namespace Express {
     interface Request {
       userId?: string;

apps/api/src/api/routes/v1/quote.route.ts

@@ -96,6 +96,9 @@ router
  * @apiSuccess (Created 201) {String}  partnerFeeUsd     Partner fee in USD
  * @apiSuccess (Created 201) {String}  totalFeeUsd       Total fee in USD
  * @apiSuccess (Created 201) {String}  processingFeeUsd  Processing fee (anchor + vortex) in USD
+ * @apiSuccess (Created 201) {String}  [discountFiat]   Quote-time discount benefit in feeCurrency
+ * @apiSuccess (Created 201) {String}  [discountUsd]    Quote-time discount benefit in USD
+ * @apiSuccess (Created 201) {String}  [discountCurrency] Currency used for discount display
  * @apiSuccess (Created 201) {String}  paymentMethod     Payment method used for the quote
  * @apiSuccess (Created 201) {Date}    expiresAt         Expiration date
  *