Merge pull request #475 from stellar/release/3.0.0

Release `3.0.0`
stellar · Nov 26, 2024 · f635986 · f635986
2 parents 6e952c4 + 3d2f713
commit f635986
Show file tree

Hide file tree

Showing 241 changed files with 11,661 additions and 6,647 deletions.
diff --git a/.github/workflows/anchor_platform_integration_check.yml b/.github/workflows/anchor_platform_integration_check.yml
@@ -4,10 +4,6 @@ on:
   push:
     branches:
       - main
-      - develop
-      - "release/**"
-      - "releases/**"
-      - "hotfix/**"
   pull_request:
   workflow_call: # allows this workflow to be called from another workflow
 
@@ -43,7 +39,7 @@ jobs:
           echo 'Anchor-platform is up and running.'
 
       - name: Install NodeJs
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
           node-version: 14
 

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -4,10 +4,6 @@ on:
   push:
     branches:
       - main
-      - develop
-      - "release/**"
-      - "releases/**"
-      - "hotfix/**"
   pull_request:
   workflow_call: # allows this workflow to be called from another workflow
 
@@ -19,14 +15,14 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: 1.22.1
           cache: true
           cache-dependency-path: go.sum
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # version v4.0.0
+        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # version v6.1.1
         with:
           version: v1.56.2 # this is the golangci-lint version
           args: --timeout 5m0s
@@ -74,7 +70,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install NodeJs
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
           node-version: 14
 
@@ -102,7 +98,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: 1.22.1
           cache: true
@@ -141,7 +137,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: 1.22.1
           cache: true

diff --git a/.github/workflows/docker_image_public_release.yml b/.github/workflows/docker_image_public_release.yml
@@ -54,13 +54,13 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2.2.0
+        uses: docker/login-action@v3.3.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push to DockerHub (release prd)
-        uses: docker/build-push-action@v4.1.1
+        uses: docker/build-push-action@v6.9.0
         with:
           push: true
           build-args: |
@@ -80,7 +80,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2.2.0
+        uses: docker/login-action@v3.3.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -95,7 +95,7 @@ jobs:
         run: echo "SHA=$(git rev-parse --short ${{ github.sha }} )" >> $GITHUB_OUTPUT
 
       - name: Build and push to DockerHub (develop branch)
-        uses: docker/build-push-action@v4.1.1
+        uses: docker/build-push-action@v6.9.0
         with:
           push: true
           build-args: |

diff --git a/.github/workflows/e2e_integration_test.yml b/.github/workflows/e2e_integration_test.yml
@@ -4,10 +4,6 @@ on:
   push:
     branches:
       - main
-      - develop
-      - "release/**"
-      - "releases/**"
-      - "hotfix/**"
   pull_request:
   workflow_call: # allows this workflow to be called from another workflow
 
@@ -29,18 +25,36 @@ jobs:
       max-parallel: 1
       matrix:
         platform:
-          - "Stellar"
-          - "Circle"
+          - "Stellar-phone" # Stellar distribution account where receivers are registered with their phone number
+          - "Stellar-phone-wallet" # Stellar distribution account where receivers are registered with their phone number and wallet address
+          - "Stellar-email" # Stellar distribution account where receivers are registered with their email
+          - "Circle-phone" # Circle distribution account where receivers are registered with their email
         include:
-          - platform: "Stellar"
+          - platform: "Stellar-phone"
             environment: "Receiver Registration - E2E Integration Tests (Stellar)"
             DISTRIBUTION_ACCOUNT_TYPE: "DISTRIBUTION_ACCOUNT.STELLAR.ENV"
-          - platform: "Circle"
+            DISBURSEMENT_CSV_FILE_NAME: "disbursement_instructions_phone.csv"
+            REGISTRATION_CONTACT_TYPE: "PHONE_NUMBER"
+          - platform: "Stellar-phone-wallet"
+            environment: "Receiver Registration - E2E Integration Tests (Stellar)"
+            DISTRIBUTION_ACCOUNT_TYPE: "DISTRIBUTION_ACCOUNT.STELLAR.ENV"
+            DISBURSEMENT_CSV_FILE_NAME: "disbursement_instructions_phone_with_wallet.csv"
+            REGISTRATION_CONTACT_TYPE: "PHONE_NUMBER_AND_WALLET_ADDRESS"
+          - platform: "Stellar-email"
+            environment: "Receiver Registration - E2E Integration Tests (Stellar)"
+            DISTRIBUTION_ACCOUNT_TYPE: "DISTRIBUTION_ACCOUNT.STELLAR.ENV"
+            DISBURSEMENT_CSV_FILE_NAME: "disbursement_instructions_email.csv"
+            REGISTRATION_CONTACT_TYPE: "EMAIL"
+          - platform: "Circle-phone"
             environment: "Receiver Registration - E2E Integration Tests (Circle)"
             DISTRIBUTION_ACCOUNT_TYPE: "DISTRIBUTION_ACCOUNT.CIRCLE.DB_VAULT"
+            DISBURSEMENT_CSV_FILE_NAME: "disbursement_instructions_phone.csv"
+            REGISTRATION_CONTACT_TYPE: "PHONE_NUMBER"
     environment: ${{ matrix.environment }}
     env:
       DISTRIBUTION_ACCOUNT_TYPE: ${{ matrix.DISTRIBUTION_ACCOUNT_TYPE }}
+      DISBURSEMENT_CSV_FILE_NAME: ${{ matrix.DISBURSEMENT_CSV_FILE_NAME }}
+      REGISTRATION_CONTACT_TYPE: ${{ matrix.REGISTRATION_CONTACT_TYPE }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,11 +6,78 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ## Unreleased
 
-None
+## [3.0.0](https://github.com/stellar/stellar-disbursement-platform-backend/releases/tag/3.0.0) ([diff](https://github.com/stellar/stellar-disbursement-platform-backend/compare/2.1.1...3.0.0))
+
+Release of the Stellar Disbursement Platform `v3.0.0`. In this release, receiver registration does not need to be done
+exclusively through SMS as it now supports new types. The options are `PHONE_NUMBER`, `EMAIL`,
+`EMAIL_AND_WALLET_ADDRESS`, and `PHONE_NUMBER_AND_WALLET_ADDRESS`. If a receiver is registered with a wallet address,
+they can receive the payment right away without having to go through the SEP-24 registration flow.
+
+This version is only compatible with the [stellar/stellar-disbursement-platform-frontend] version `3.0.0`.
+
+### Breaking Changes
+
+- Renamed properties and environment variables related to Email Registration Support [#412](https://github.com/stellar/stellar-disbursement-platform-backend/pull/412)
+  - Renamed `MAX_INVITATION_SMS_RESEND_ATTEMPT` environment variable to `MAX_INVITATION_RESEND_ATTEMPTS`
+  - Renamed `organization.sms_resend_interval` to `organization.receiver_invitation_resend_interval_days`
+  - Renamed `organization.sms_registration_message_template` to `organization.receiver_registration_message_template`
+  - Renamed `disbursement.sms_registration_message_template` to `disbursement.receiver_registration_message_template`
+
+### Added
+
+- Ability to register receivers using email addresses
+  - Update the `receiver_registered_successfully.tmpl` HTML template to display the contact info [#418](https://github.com/stellar/stellar-disbursement-platform-backend/pull/418)
+  - Update `/wallet-registration/verification` to accommodate different verification methods [#416](https://github.com/stellar/stellar-disbursement-platform-backend/pull/416)
+  - Update send and auto-retry invitation scheduler job to work with email [#415](https://github.com/stellar/stellar-disbursement-platform-backend/pull/415)
+  - Update `POST /wallet-registration/otp` to send OTPs through email [#413](https://github.com/stellar/stellar-disbursement-platform-backend/pull/413)
+  - Rename SMS-related fields in `organization` and `disbursement` to be more generic [#412](https://github.com/stellar/stellar-disbursement-platform-backend/pull/412)
+  - Update process disbursement instructions to accept email addresses [#404](https://github.com/stellar/stellar-disbursement-platform-backend/pull/404)
+  - Add an initial screen so receivers can choose between phone number and email registration during registration [#406](https://github.com/stellar/stellar-disbursement-platform-backend/pull/406)
+  - Add message channel priority to the `organizations` table [#400](https://github.com/stellar/stellar-disbursement-platform-backend/pull/400)
+  - Add `MessageDispatcher` to SDP to send messages to different channels [#391](https://github.com/stellar/stellar-disbursement-platform-backend/pull/391)
+  - Update the development endpoint `DELETE .../phone-number/...` to `DELETE .../contact-info/...`, allowing it to delete based on the email as well [#438](https://github.com/stellar/stellar-disbursement-platform-backend/pull/438)
+  - Remove the word "phone" from the default organization's `otp_message_template` [#439](https://github.com/stellar/stellar-disbursement-platform-backend/pull/439)
+  - Rename SMS-related field and update Helm docs [#468](https://github.com/stellar/stellar-disbursement-platform-backend/pull/468)
+- Ability to register receivers with a Stellar wallet address directly by providing contact info and a wallet address. The options currently are `PHONE_NUMBER_AND_WALLET_ADDRESS` and `EMAIL_AND_WALLET_ADDRESS`
+  - Create `GET /registration-contact-types` endpoint [#451](https://github.com/stellar/stellar-disbursement-platform-backend/pull/451)
+  - Update `POST /disbursements` and `GET /disbursements` APIs to persist and return the Registration Contact Type [#452](https://github.com/stellar/stellar-disbursement-platform-backend/pull/452), [#454](https://github.com/stellar/stellar-disbursement-platform-backend/pull/454)
+  - Allow `disbursement.verification_field` to be empty [#456](https://github.com/stellar/stellar-disbursement-platform-backend/pull/456)
+  - Integrate wallet address in processing disbursement instructions [#453](https://github.com/stellar/stellar-disbursement-platform-backend/pull/453)
+  - Add user-managed wallets [#458](https://github.com/stellar/stellar-disbursement-platform-backend/pull/458)
+- Add Twilio SendGrid as a supported email client [#444](https://github.com/stellar/stellar-disbursement-platform-backend/pull/444)
+
+### Changed
+
+- Replaced deprecated Circle Accounts API by adopting the Circle API endpoints `GET /v1/businessAccount/balances` and `GET /configuration` [#433](https://github.com/stellar/stellar-disbursement-platform-backend/pull/433)
+- `PATCH /receiver` now allows patching the phone number and email address of a receiver [#436](https://github.com/stellar/stellar-disbursement-platform-backend/pull/436)
+- Increased window for clients to perform token refresh [#437](https://github.com/stellar/stellar-disbursement-platform-backend/pull/437)
+- Other technical changes ([#383](https://github.com/stellar/stellar-disbursement-platform-backend/pull/383), [#450](https://github.com/stellar/stellar-disbursement-platform-backend/pull/450))
+
+### Fixed
+
+- Unable to get a token from the Forgot Password flow after messaging service failure [#466](https://github.com/stellar/stellar-disbursement-platform-backend/pull/466)
+- ReCaptcha blocks retrying verification during wallet registration [#473](https://github.com/stellar/stellar-disbursement-platform-backend/pull/473)
+
+### Removed
+
+- Removed countries from the flow and deleted any references to them from the database [#455](https://github.com/stellar/stellar-disbursement-platform-backend/pull/455), [#462](https://github.com/stellar/stellar-disbursement-platform-backend/pull/462)
+
+### Security and Dependencies
+
+- Fix HTML injection vulnerability [#419](https://github.com/stellar/stellar-disbursement-platform-backend/pull/419)
+- Fix HTML escaping [#420](https://github.com/stellar/stellar-disbursement-platform-backend/pull/420)
+- Removed support for the HTTP headers `X-XSS-Protection`, `X-Forwarded-Host`, `X-Real-IP`, and `True-Client-IP` [#448](https://github.com/stellar/stellar-disbursement-platform-backend/pull/448)
+- Improved validation to ensure the instruction file being uploaded is a `*.csv` file [#443](https://github.com/stellar/stellar-disbursement-platform-backend/pull/443)
+- Ensure validation of URLs with the HTTPS schema on Pubnet [#445](https://github.com/stellar/stellar-disbursement-platform-backend/pull/445)
+- Add path validation to the `readDisbursementCSV` method used in integration tests [#437](https://github.com/stellar/stellar-disbursement-platform-backend/pull/437)
+- Bump `golangci/golangci-lint-action` [#380](https://github.com/stellar/stellar-disbursement-platform-backend/pull/380)
+- Bump `golang` in the all-docker group [#387](https://github.com/stellar/stellar-disbursement-platform-backend/pull/387), [#394](https://github.com/stellar/stellar-disbursement-platform-backend/pull/394), [#414](https://github.com/stellar/stellar-disbursement-platform-backend/pull/414)
+- Bump minor and patch dependencies across directories [#381](https://github.com/stellar/stellar-disbursement-platform-backend/pull/381), [#395](https://github.com/stellar/stellar-disbursement-platform-backend/pull/395), [#403](https://github.com/stellar/stellar-disbursement-platform-backend/pull/403), [#411](https://github.com/stellar/stellar-disbursement-platform-backend/pull/411), [#429](https://github.com/stellar/stellar-disbursement-platform-backend/pull/429), [#430](https://github.com/stellar/stellar-disbursement-platform-backend/pull/430), [#431](https://github.com/stellar/stellar-disbursement-platform-backend/pull/431), [#441](https://github.com/stellar/stellar-disbursement-platform-backend/pull/441).
 
 ## [2.1.1](https://github.com/stellar/stellar-disbursement-platform-backend/releases/tag/2.1.1) ([diff](https://github.com/stellar/stellar-disbursement-platform-backend/compare/2.1.0...2.1.1))
 
 ### Changed
+
 - Removed calls related to the deprecated Circle Accounts API and replaced them with calls to `GET /v1/businessAccount/balances` and `GET /configuration`.  [#433](https://github.com/stellar/stellar-disbursement-platform-backend/pull/433).
 
 ## [2.1.0](https://github.com/stellar/stellar-disbursement-platform-backend/releases/tag/2.1.0) ([diff](https://github.com/stellar/stellar-disbursement-platform-backend/compare/2.0.0...2.1.0))

diff --git a/Dockerfile b/Dockerfile
@@ -3,7 +3,7 @@
 # To push:
 #    make docker-push
 
-FROM golang:1.22.1-bullseye AS build
+FROM golang:1.23.3-bullseye AS build
 ARG GIT_COMMIT
 
 WORKDIR /src/stellar-disbursement-platform
@@ -13,11 +13,11 @@ ADD . ./
 RUN go build -o /bin/stellar-disbursement-platform -ldflags "-X main.GitCommit=$GIT_COMMIT" .
 
 
-FROM ubuntu:22.04
+FROM ubuntu:24.04
 
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates
 # ADD migrations/ /app/migrations/
 COPY --from=build /bin/stellar-disbursement-platform /app/
 EXPOSE 8001
 WORKDIR /app
-ENTRYPOINT ["./stellar-disbursement-platform"]
+ENTRYPOINT ["./stellar-disbursement-platform"]
diff --git a/Dockerfile.development b/Dockerfile.development
@@ -1,5 +1,5 @@
 # Stage 1: Build the Go application
-FROM golang:1.22.1-bullseye AS build
+FROM golang:1.23.3-bullseye AS build
 ARG GIT_COMMIT
 
 WORKDIR /src/stellar-disbursement-platform
@@ -9,7 +9,7 @@ COPY . ./
 RUN go build -o /bin/stellar-disbursement-platform -ldflags "-X main.GitCommit=$GIT_COMMIT" .
 
 # Stage 2: Setup the development environment with Delve for debugging
-FROM golang:1.22.1-bullseye AS development
+FROM golang:1.23.3-bullseye AS development
 
 # set workdir according to repo structure so remote debug source code is in sync
 WORKDIR /app/github.com/stellar/stellar-disbursement-platform
@@ -24,4 +24,3 @@ RUN go install github.com/go-delve/delve/cmd/dlv@latest
 RUN chmod +x /app/github.com/stellar/stellar-disbursement-platform/stellar-disbursement-platform
 EXPOSE 8001 2345
 ENTRYPOINT ["/go/bin/dlv", "exec", "--continue", "--accept-multiclient", "--headless", "--listen=:2345", "--api-version=2", "--log", "./stellar-disbursement-platform"]
-
diff --git a/README.md b/README.md
@@ -118,9 +118,10 @@ The Message Service sends messages to users and recipients for the following rea
 - Providing one-time passcodes (OTPs) to recipients
 - Sending emails to users during account creation and account recovery flows
 
-Note that the Message Service requires that both SMS and email services are configured. For emails, AWS SES is supported. For SMS messages to recipients, Twilio is supported. AWS SNS support is not integrated yet.
+Note that the Message Service requires that both SMS and email services are configured. For emails, AWS SES and Twilio Sendgrid are supported. For SMS messages to recipients, Twilio and AWS SNS are supported.
+
+If you're using the `AWS_EMAIL` or `TWILIO_EMAIL` sender types, you'll need to verify the email address you're using to send emails in order to prevent it from being flagged by email firewalls. You can do that by following the instructions in [this link for AWS SES](https://docs.aws.amazon.com/ses/latest/dg/email-authentication-methods.html) or [this link for Twilio Sendgrid](https://www.twilio.com/docs/sendgrid/glossary/sender-authentication).
 
-If you're using the `AWS_EMAIL` sender type, you'll need to verify the email address you're using to send emails in order to prevent it from being flagged by email firewalls. You can do that by following the instructions in [this link](https://docs.aws.amazon.com/ses/latest/dg/email-authentication-methods.html).
 
 #### Wallet Registration UI
 
@@ -255,7 +256,7 @@ We recommend Background Jobs for organizations that require a simpler setup and
 > [!NOTE]  
 > Certain jobs are not listed here because they cannot be configured and are necessary to the functioning of the SDP. 
 
-* `send_receiver_wallets_sms_invitation_job`: This job is used to send disbursement invites to recipients. Its interval is configured through the `SCHEDULER_RECEIVER_INVITATION_JOB_SECONDS` environment variable.
+* `send_receiver_wallets_invitation_job`: This job is used to send disbursement invites to recipients. Its interval is configured through the `SCHEDULER_RECEIVER_INVITATION_JOB_SECONDS` environment variable.
 * `payment_to_submitter_job`: This job is used to submit payments from Core to the TSS. Its interval is configured through the `SCHEDULER_PAYMENT_JOB_SECONDS` environment variable.
 * `payment_from_submitter_job`: This job is used to notify Core that a payment has been completed. Its interval is configured through the `SCHEDULER_PAYMENT_JOB_SECONDS` environment variable.
 * `patch_anchor_platform_transactions_completion`: This job is used to patch transactions in Anchor Platform once payments reach the final state 'SUCCESS' or 'FAILED'. Its interval is configured through the `SCHEDULER_PAYMENT_JOB_SECONDS` environment variable.

diff --git a/cmd/auth.go b/cmd/auth.go
@@ -130,22 +130,22 @@ func (a *AuthCommand) Command() *cobra.Command {
 					log.Ctx(ctx).Fatalf("error getting organization data: %s", err.Error())
 				}
 
-				invitationData := htmltemplate.InvitationMessageTemplate{
+				invitationData := htmltemplate.StaffInvitationEmailMessageTemplate{
 					FirstName:          firstName,
 					Role:               role,
 					ForgotPasswordLink: forgotPasswordLink,
 					OrganizationName:   organization.Name,
 				}
 
-				msgBody, err := htmltemplate.ExecuteHTMLTemplateForInvitationMessage(invitationData)
+				msgBody, err := htmltemplate.ExecuteHTMLTemplateForStaffInvitationEmailMessage(invitationData)
 				if err != nil {
 					log.Ctx(ctx).Fatalf("error executing invitation message template: %s", err.Error())
 				}
 
 				err = emailMessengerClient.SendMessage(message.Message{
 					ToEmail: email,
 					Title:   "Welcome to Stellar Disbursement Platform",
-					Message: msgBody,
+					Body:    msgBody,
 				})
 				if err != nil {
 					log.Ctx(ctx).Fatalf("error sending invitation message: %s", err.Error())