fix: Portfolio creation accepts arbitrary strings as userAddress — no Stellar address validation

[grantfox-oss]

Problem

In backend/src/api/validation.ts, createPortfolioSchema validates userAddress only as z.string().min(1). The codebase already has a working stellarAddressSchema (using the Stellar SDK's StrKey.isValidEd25519PublicKey) in the same file, but createPortfolioSchema does not use it.

This means any caller can create portfolios under arbitrary identifiers, which pollutes the database with unlinked records and could cause collisions if two different users happen to use the same string.

Proposed Fix

1. Use existing stellarAddressSchema

Change the userAddress field in createPortfolioSchema from z.string().min(1) to stellarAddressSchema.

2. Handle demo mode

The frontend falls back to "demo-user" when no wallet is connected. Options:

• Add a separate demoAddress field for demo mode and validate userAddress only when in non-demo mode
• Or require wallet connection before portfolio creation

3. Add validation tests

Test that invalid addresses are rejected and valid G... addresses are accepted.

Files to modify

• backend/src/api/validation.ts — update createPortfolioSchema
• backend/src/api/routes.ts — update POST /portfolio handler if needed
• frontend/src/components/PortfolioSetup.tsx — send actual publicKey instead of "demo-user"
• backend/src/api/__tests__/routes.test.ts — add validation tests

Acceptance Criteria

• userAddress field uses stellarAddressSchema instead of z.string().min(1)
• Frontend sends actual Stellar address instead of "demo-user" fallback
• Test: POST /portfolio with userAddress: "not-a-valid-key" returns 400
• Test: POST /portfolio with valid G... address returns 201
• API documentation updated to reflect userAddress validation

Affected Area

Backend and Frontend

[waterWang]

I would like to work on this issue. Will update createPortfolioSchema to use stellarAddressSchema, handle demo mode, and add validation tests.

[waterWang]

I have submitted PR #72 to address this issue. Changes:

1. Changed createPortfolioSchema.userAddress from z.string().min(1) to z.union([stellarAddressSchema, z.literal("demo-user")])
2. Frontend already sends publicKey when wallet is connected, falls back to "demo-user" for demo mode
3. Added validation tests (valid G... address, demo-user, invalid address rejection)