fix: resolve swagger import, remittance status update, and TS duplica…

[Skinny001]

This pull request introduces a loan dispute/appeal mechanism to the backend, adds new admin endpoints for managing loan disputes, and refactors Swagger/OpenAPI documentation loading to better support ESM and test environments. It also includes improvements to test configuration and adds comprehensive tests for the new dispute flow.

Loan Dispute/Audit Mechanism:

• Adds a new migration to create a loan_disputes table, enabling the tracking of disputed loans and their resolution status.
• Implements controller logic for admins to list and resolve loan disputes, supporting both confirmation and reversal of defaults.
• Adds comprehensive integration tests for the loan dispute and resolution flow in loanDispute.test.ts.

Swagger/OpenAPI Documentation Refactor:

• Refactors Swagger config to use an ESM-compatible module, moving the main spec to swagger.esm.ts and updating the app to load Swagger docs from a dedicated entrypoint (app.with-swagger.ts). [1] [2] [3] [4]
• Removes Swagger middleware from the main app.ts to avoid loading in test environments.

Testing and Environment Setup:

• Updates jest.config.ts for better ESM support, test matching, and environment setup, and ensures correct file extensions and mocks.
• Adds a .env.test file with required test environment variables for consistent test execution.
• Downgrades jest and @types/jest in package.json for compatibility with ESM and ts-jest. [1] [2]
• Adds express as a dependency in the backend package.

Codebase Refactoring:

• Moves asyncHandler utility from middleware to a shared utils directory and updates all imports accordingly. [1] [2] [3] [4]

Other:

• Adds a test-only controller for registering test users, aiding in test setup.

close #552

[ogazboiz]

The dispute/appeal feature is a solid addition, but there are several issues that need to be sorted out before this can merge:

CI is failing (backend):

1. loanDispute.test.ts uses jest.mock() which doesn't work with ESM. You need jest.unstable_mockModule() and dynamic await import() for the module under test. Check how eventIndexer.test.ts does it for the correct pattern.

2. The existing loanEndpoints.test.ts test for GET /api/loans/:loanId now returns 500 instead of 200 because getLoanDetails was updated to also query loan_disputes, but the test mock chain doesn't have a response for that extra query.

Other issues:

3. Duplicate route - /:loanId/mark-defaulted is registered twice in identical if (NODE_ENV) blocks. Looks like a copy-paste accident.

4. Stray backend/backend/ directory - There's a backend/backend/package.json and backend/backend/package-lock.json that got committed. Looks like an accidental npm init in the wrong directory. Please remove these.

5. Swagger gutted - swagger.ts was replaced with just export const swaggerSpec = {};. Any code importing from swagger.js (not swagger.esm.js) will get an empty object. The swagger docs for POST /admin/check-defaults were also deleted.

6. Migration number - 1783000000013_add-loan-disputes.js uses the current highest number. Double check no other in-flight PR is using the same number.

7. Jest downgraded from 30 to 29 - This is a pretty big change that affects the whole test suite. If it's needed for ESM compatibility, call it out explicitly so other contributors are aware.

8. Test-only endpoints (createTestLoan, markLoanDefaulted, registerTestUser) are exposed when NODE_ENV === "development". Consider restricting these to test only so they can't accidentally be hit in a dev environment.

Please also rebase onto the latest main to pick up recent CI and codebase fixes.

[ogazboiz]

Friendly reminder to rebase your branch onto the latest main and address the review feedback when you get a chance. The codebase had some fixes recently so a rebase is needed before we can move forward. Let me know if you need help.

[ogazboiz]

heads up, a few important changes just landed on main that affect your PR:

1. axios pinned to 1.13.5 - there's an active supply chain attack on axios 1.14.1 (pulls in confirmed malware). we added overrides in all package.json files to block it.

2. CI now runs a supply chain audit before backend/frontend jobs. if your lockfile has a compromised package, CI will fail with a clear error.

3. backend test fixes - loanEndpoints tests now use valid Stellar addresses and base64 strings. if your PR was failing backend CI but you didn't touch backend code, this should fix it after rebase.

please rebase on latest main:

git fetch upstream
git rebase upstream/main
git push --force-with-lease