[Muhamadmust]

Summary of Changes

• Startup Configuration Validation: Enhanced templates/api-service/src/config.js with field-specific validation for Stellar Horizon and RPC URLs, strict protocol enforcement (HTTPS required for remote endpoints; plain HTTP permitted only for localhost/127.0.0.1 development), embedded credentials rejection, non-empty network and host checks, and strict integer port boundary parsing.
• Template Test Suite: Added a comprehensive test suite in templates/api-service/test/config.test.js covering accurate public Testnet defaults, valid custom HTTPS endpoints, localhost/loopback exceptions, clear URL validation errors, remote HTTP rejection, unsupported protocol rejection, user credential rejection, API port validation, non-empty network/host strings, and secret-free boundary guarantees.
• Documentation & Examples: Updated templates/api-service/.env.example and templates/api-service/README.md with official public Testnet defaults, an explicit local standalone development example (http://127.0.0.1:8000), clear startup validation rules, and security guidance against storing secrets.
• CLI Template Generation Tests: Updated tests/api-service-template.test.ts to assert that test/config.test.js exists in generated projects and that the standalone network examples and validation rules are documented.

Testing

• node --test templates/api-service/test/*.test.js: 13/13 tests passed (10 in config.test.js + 3 in server.test.js).
• npm test -- tests/api-service-template.test.ts: Passed (verifies npm run check and npm test execute cleanly in generated project output).
• ESLint and Prettier checks passed.

Security

• Remote Stellar Horizon and Soroban RPC endpoints strictly require HTTPS; plain HTTP is restricted to localhost and 127.0.0.1 development.
• Endpoint URLs are validated to reject embedded user credentials or access tokens.
• Preserves zero-secret boundary in src/stellar-client.js: does not accept, store, or expose signing secrets, seed phrases, or private keys.

Closes #147
Fixes #147

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8fab47fe-944b-41b9-aa2e-58bda27836e5

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}