Auth: Challenge Endpoint (POST /auth/challenge)

[codebestia]

Background

Sign In With Stellar requires the wallet to sign a server-generated message. The backend must issue a time-limited, single-use challenge string tied to the requesting wallet address. This is the first step of the two-step auth flow.

Proposed Steps

1. Create POST /auth/challenge route
2. Accept { address: string } in the request body
3. Validate that address is a valid Stellar public key (using StrKey.isValidEd25519PublicKey from @stellar/stellar-sdk)
4. Generate a cryptographically random nonce (crypto.randomBytes(32).toString('hex'))
5. Persist an AuthNonce record with expiresAt = now + 5 minutes
6. Return a structured challenge message that the wallet will sign
7. Clean up expired nonces on each call

Acceptance Criteria

• POST /auth/challenge with a valid Stellar address returns 200 with { message, nonce, expiresAt }
• POST /auth/challenge with an invalid address returns 400 with a clear error
• Nonce is persisted to AuthNonce table
• Expired nonces are cleaned up before each new challenge is generated
• The challenge message format is deterministic and matches what the frontend signs

[Ebenezer199914]

can i work on this

[jaynomyaro]

Hi! I’m a full-stack developer with a strong blockchain background. I’d love to handle this issue and can deliver a clean, reliable solution. Kindly assign it to me.

[gloskull]

Hello, I have 4 years of experience delivering solutions for projects like this, covering backend, frontend, and smart contract development. After carefully reviewing your requirements, I have a clear understanding of the task and am confident in my ability to deliver a clean, efficient, and thoroughly tested solution on time. I prioritize code quality, maintainability, and industry best practices throughout the development process.

[leocagli]

I'd like to work on this issue, please assign me so I can begin implementation.