Add Comprehensive API Input Validation and Sanitization

[llinsss]

Description:

Problem

Inconsistent input validation across endpoints creates security vulnerabilities and poor error messages. Need standardized validation layer.

Proposed Solution

Implement comprehensive validation:

• Joi schemas for all request bodies
• Centralized validation middleware
• Detailed validation error messages
• Type coercion and sanitization
• Request size limits per endpoint

Technical Requirements

• Create Joi schemas for all endpoints
• Validation middleware with custom error formatting
• Sanitize inputs (trim, lowercase where appropriate)
• Validate nested objects and arrays
• Custom validators for blockchain addresses, tags, etc.

Example

const transferSchema = Joi.object({
  recipient: Joi.string().pattern(/^@[a-z0-9_]{3,20}$/).required(),
  amount: Joi.number().positive().precision(18).required(),
  chain: Joi.string().valid('starknet', 'base', 'flow', 'lisk', 'u2u').required(),
  token: Joi.string().required()
});

Files to Modify/Create

New Files:

• backend/middleware/validateRequest.js - Centralized validation middleware
• backend/validators/customValidators.js - Custom Joi validators
• backend/validators/blockchainValidators.js - Address/tag validators
• backend/tests/validation.enhanced.test.js - Enhanced validation tests
• docs/VALIDATION_GUIDE.md - Validation documentation

Modify:

• backend/schemas/transaction.js - Enhance with detailed validation
• backend/schemas/wallet.js - Enhance with detailed validation
• backend/schemas/payment.js - Enhance with detailed validation
• backend/schemas/user.js - Enhance with detailed validation
• backend/schemas/kyc.js - Enhance with detailed validation
• backend/schemas/auth.js - Enhance with detailed validation
• backend/schemas/balance.js - Enhance with detailed validation
• backend/schemas/dispute.js - Enhance with detailed validation
• backend/schemas/export.js - Enhance with detailed validation
• backend/schemas/scheduledPayment.js - Enhance with detailed validation
• backend/routes/transactions.js - Apply validation middleware
• backend/routes/wallets.js - Apply validation middleware
• backend/routes/auth.js - Apply validation middleware
• backend/routes/users.js - Apply validation middleware
• backend/middleware/validation.js - Enhance existing validation
• backend/utils/response.js - Add validation error formatter

Acceptance Criteria

• All endpoints have Joi validation schemas
• Validation errors return 400 with details
• Custom validators for domain-specific types
• Input sanitization applied automatically
• Validation schemas documented
• Test coverage for validation logic

[drips-wave]

This issue has been added to the Stellar Wave Program and is worth 200 Points.

🧑‍💻 Interested in contributing? Apply to work on this issue on Drips Wave, earn points, and receive rewards.

Warning

Only applications submitted via the apply link above will be considered. Please do not apply by commenting on the issue or opening a PR directly.

🤠 Repo maintainers: You can manage this issue's Points and Complexity on your Maintainer Dashboard here. Please keep an eye on applications and respond quickly 💙

ℹ️ Learn more about Drips Wave

[rosemary21]

@rosemary21 has applied to work on this issue as part of the Stellar Wave Program's 3rd wave.

I’d like to work on this issue because it addresses a core architectural gap that impacts security, reliability, and developer experience across the entire backend. Inconsistent validation is one of the most common sources of bugs and vulnerabilities—especially in APIs handling financial or structured data—because it allows malformed or unsafe inputs to slip through different entry points.Relevant Experience
I’ve implemented Joi-based validation systems in Node.js/Express apps, including reusable schema patterns and centralized middleware.
Experience building validation pipelines that handle:
Type coercion (e.g., strings → numbers/booleans)
Input sanitization (trimming, normalization)
Nested object and array validation
I’ve designed custom validators for domain-specific formats (e.g., wallet addresses, IDs, tags), ensuring strict correctness beyond basic types.
Strong experience with error handling and formatting, returning structured, developer-friendly validation errors instead of generic messages.
I’ve worked on APIs where I enforced request size limits and payload constraints to prevent abuse and performance issues.
Familiar with integrating validation into existing codebases incrementally without breaking current endpoints.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @rosemary21 to this issue.

[drips-wave]

Congratulations, @rosemary21! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on March 30, 2026.

🧑‍💻 @rosemary21: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been marked as completed by a Drips Wave moderator for @rosemary21 as part of the Stellar Wave Program's 3rd Wave 🥳

Moderator's reason: [Auto-assessed] The contributor successfully implemented the comprehensive validation system as requested, including the centralized middleware, custom blockchain validators, documentation, and a robust test suite. PR #264 was merged by maintainers and directly references the issue, satisfying all acceptance criteria.

😎 @rosemary21: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

ℹ️ Note: This issue was marked complete via moderation. Points were issued even though the GitHub issue remains open.