feat: add address validation to prevent saving invalid Ethereum addresses

[scottrepreneur]

Summary

Implements BUILD-1148 by adding comprehensive Ethereum address validation using viem's isAddress function to prevent invalid address records from being saved to the database.

Changes

• ✅ Add address validation utility (src/utils/viem.ts)

  • validateEthereumAddress() function that throws on invalid addresses
  • isValidEthereumAddress() boolean helper function
  • Uses viem's isAddress for robust validation (0x prefix, 42 chars, valid hex, EIP-55 checksum)

• ✅ Update Users Service (src/db/services/users-service.ts)

  • Add validation to all address insertion/processing points:
    • createOrUpdateUser() - validates before adding addresses
    • saveUserAddress() - validates before saving address records
    • updateAddressVerification() - validates before verification updates
    • getUserByAddress() - validates lookup addresses
  • Throws clear errors instead of saving invalid data

• ✅ Update API Routes (src/routes/users.ts)

  • Add validation to address parameters in:
    • GET /address/:address
    • GET /address/:address/permissions
    • GET /verifications?address=...
  • Return proper 400 status codes for invalid addresses

Validation Requirements

• ✅ Must be 0x prefixed and exactly 42 characters long
• ✅ Must contain only valid hexadecimal characters
• ✅ Uses viem's isAddress function as specified
• ✅ Throws errors instead of saving invalid records

Test Results

Valid addresses accepted:

• 0x1234567890123456789012345678901234567890 ✅
• 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ✅

Invalid addresses rejected:

• 0xgetuser1234567890123456789012345678901234 ❌ (non-hex chars)
• 0xnonexistentaddress ❌ (wrong length)
• invalid-address ❌ (no 0x prefix)

Test plan

• Verify valid addresses are accepted in all service methods
• Verify invalid addresses are rejected with clear error messages
• Verify API routes return proper 400 status codes for invalid addresses
• Verify database operations throw instead of saving invalid data

🤖 Generated with Claude Code

[linear]

BUILD-1148 Don't save invalid address records, throw instead

• must be 0x and 42 alpha characters
• check isAddress from viem before processing