feat: Add treasury 1Click API endpoint with security validation

[petersalomonsen]

Add Treasury 1Click API Endpoint

Overview

This PR adds a new endpoint for integrating with the 1Click API to enable treasury swap operations for Sputnik DAOs. The endpoint provides secure quote fetching for token swaps with built-in security validation.

Endpoint

• Path: /api/treasury/oneclick-quote
• Method: POST
• Purpose: Fetches swap quotes from 1Click API and returns formatted proposal payloads for DAO treasury operations

Features

Core Functionality

• Integrates with 1Click API for cross-chain token swaps
• Supports both authenticated (with JWT) and unauthenticated requests
• Returns formatted proposal payloads ready for DAO voting
• Automatic 7-day deadline calculation for DAO voting period

Security Features

• Sputnik DAO Validation: Only accepts *.sputnik-dao.near addresses for treasury operations
• Triple validation: Checks treasuryDaoID, refundTo, and recipient addresses
• Bearer JWT Authentication: Supports optional JWT authentication for better rates
• Dynamic API Key Reading: API key is read per request from environment variables

Request Format

{
  "treasuryDaoID": "treasury.sputnik-dao.near",
  "inputToken": {
    "id": "wrap.near",
    "symbol": "wNEAR"
  },
  "outputToken": {
    "id": "nep141:token_address",
    "symbol": "USDC.e",
    "blockchain": "near"
  },
  "amountIn": "1000000000000000000000000",
  "slippageTolerance": "100",
  "networkOut": "near"
}

Response Format

{
  "success": true,
  "proposalPayload": {
    "tokenIn": "wrap.near",
    "tokenInSymbol": "wNEAR",
    "tokenOut": "nep141:token_address",
    "networkOut": "near",
    "amountIn": "1.0",
    "quote": {
      "amountOut": "2640966",
      "amountOutFormatted": "2.640966",
      "depositAddress": "...",
      "signature": "..."
    }
  },
  "quoteRequest": { ... }
}

Testing

Unit Tests

• Comprehensive test coverage in test/oneclick-treasury.test.ts
• Tests for validation, error handling, and mocked API responses
• Validates Sputnik DAO address requirements
• Tests authentication error scenarios

Integration Tests

• New integration test file: test/oneclick-treasury.integration.test.ts
• Makes real API calls to verify functionality
• Tests include:
  • ✅ Successful quote retrieval without API key (with 0.1% fee)
  • ✅ Error handling for invalid tokens
  • ✅ Authentication error with invalid JWT tokens (401 → 500)
• Can be skipped in CI with SKIP_INTEGRATION_TESTS=true

Running Tests

# Run all tests
npm test

# Run only unit tests
npm test -- test/oneclick-treasury.test.ts

# Run integration tests
npm test -- test/oneclick-treasury.integration.test.ts

# Skip integration tests in CI
SKIP_INTEGRATION_TESTS=true npm test

Development Environment

GitHub Codespaces / DevContainer Support

• Added .devcontainer/devcontainer.json configuration
• Node.js 22 development environment
• Automatic dependency installation via postCreateCommand.sh
• PostgreSQL database setup for local development
• Pre-configured VS Code extensions (ESLint, Prettier, Prisma)
• Memory optimization: NODE_OPTIONS="--max-old-space-size=4096" for tests

Environment Variables

• ONECLICK_API_KEY: Optional JWT token for authenticated requests (better rates)
• ONECLICK_API_URL: Override 1Click API URL (defaults to production)
• DATABASE_URL: PostgreSQL connection string (auto-configured in devcontainer)

Error Handling

• 400: Bad Request (invalid tokens, missing parameters)
• 403: Forbidden (non-Sputnik DAO addresses)
• 500: Internal Server Error (API authentication failures, unexpected errors)
• Detailed error messages for debugging
• Axios error handling with proper status code propagation

API Authentication

• Without API Key: Works but includes 0.1% fee
• With Valid JWT: Better rates, no additional fees
• With Invalid JWT: Returns 401 from 1Click, converted to 500 with clear error message
• Bearer token format: Authorization: Bearer <JWT_TOKEN>

Changes Summary

• ✨ New treasury 1Click endpoint with Sputnik DAO validation
• 🔒 Security-first design with address validation
• 🧪 Comprehensive unit and integration tests
• 🐳 DevContainer configuration for easy development
• 📝 Dynamic API key reading for better testing
• 🔧 Improved error handling for edge cases

[petersalomonsen]

@race-of-sloths include

[race-of-sloths]

@petersalomonsen Thank you for your contribution! Your pull request is now a part of the Race of Sloths!

Current status: executed

Reviewer	Score
@Megha-Dev-19	8

Your contribution is much appreciated with a final score of 8!
You have received 150 (80 base + 45 weekly bonus + 20% lifetime bonus) Sloth points for this contribution

@Megha-Dev-19 received 25 Sloth Points for reviewing and scoring this pull request.

Another weekly streak completed, well done @petersalomonsen! To keep your weekly streak and get another bonus make pull request next week! Looking forward to see you in race-of-sloths

What is the Race of Sloths

Race of Sloths is a friendly competition where you can participate in challenges and compete with other open-source contributors within your normal workflow

For contributors:

• Tag @race-of-sloths inside your pull requests
• Wait for the maintainer to review and score your pull request
• Check out your position in the Leaderboard
• Keep weekly and monthly streaks to reach higher positions
• Boast your contributions with a dynamic picture of your Profile

For maintainers:

• Score pull requests that participate in the Race of Sloths and receive a reward
• Engage contributors with fair scoring and fast responses so they keep their streaks
• Promote the Race to the point where the Race starts promoting you
• Grow the community of your contributors

Feel free to check our website for additional details!

Bot commands

• For contributors
  • Include a PR: @race-of-sloths include to enter the Race with your PR
• For maintainers:
  • Invite contributor @race-of-sloths invite to invite the contributor to participate in a race or include it, if it's already a runner.
  • Assign points: @race-of-sloths score [1/2/3/5/8/13] to award points based on your assessment.
  • Reject this PR: @race-of-sloths exclude to send this PR back to the drawing board.
  • Exclude repo: @race-of-sloths pause to stop bot activity in this repo until @race-of-sloths unpause command is called

[Megha-Dev-19]

@race-of-sloths score 8