A production-ready full-stack investment platform with WalletConnect, bot trading, exchange, KYC, and admin panel.

• Backend: NestJS + TypeScript + PostgreSQL + TypeORM (double-entry ledger)
• Queue: Redis + BullMQ
• Frontend: Next.js 15 + React + TypeScript + Tailwind CSS
• Auth: JWT + Refresh Tokens (rotating)
• Security: Helmet, rate limiting, bcrypt (12 rounds), class-validator
• Docs: Swagger/OpenAPI at /api/docs
• Infra: Docker Compose

backend/src/
  auth/          JWT auth, guards, decorators, RBAC
  users/         User profile management
  kyc/           KYC verification flow + admin queue
  wallets/       WalletConnect wallet management
  assets/        Asset registry (USD, BTC, ETH, USDT)
  ledger/        Double-entry ledger engine
  payments/      Deposits and withdrawals
  exchange/      Asset exchange (quote + execute)
  bots/          Bot strategies, instances, risk + kill switch
  admin/         Admin dashboard, user management
  audit/         Immutable audit log (global module)
  notifications/ In-app notifications (global module)
  database/      20 TypeORM entities + 29 enums

frontend/src/
  app/auth/       Login + Register
  app/dashboard/  Portfolio dashboard + balances
  app/kyc/        KYC onboarding + status
  app/deposit/    Deposit funds
  app/withdraw/   Withdraw funds
  app/exchange/   Asset exchange UI
  app/bots/       Bot trading UI
  app/admin/      Admin panel (dashboard, users, KYC, audit)

cp backend/.env.example backend/.env
cp frontend/.env.example frontend/.env
docker-compose up -d

# Backend API docs: http://localhost:4000/api/docs
# Frontend:         http://localhost:3000
# Adminer (DB):     http://localhost:8080

# Backend
cd backend && npm install && npm run start:dev

# Frontend
cd frontend && npm install && npm run dev

• POST /api/auth/register - Register
• POST /api/auth/login - Login (returns JWT + refresh token, or requires2fa flag)
• POST /api/auth/2fa/enable - Enable TOTP 2FA (returns secret + otpauth URL)
• POST /api/auth/2fa/confirm - Confirm 2FA setup with first TOTP code
• POST /api/auth/2fa/verify - Complete 2FA login with TOTP code
• POST /api/kyc/start - Start KYC (Onfido applicant + SDK token)
• POST /api/kyc/webhook - KYC provider webhook (HMAC-verified)
• GET /api/portfolio/balances - User balances
• POST /api/deposit/create - Create deposit (Stripe PaymentIntent for CARD method)
• POST /api/payments/webhook - Stripe payment webhook (HMAC-verified)
• POST /api/wallet/verify - Verify wallet ownership via SIWE signature
• POST /api/exchange/quote - Get exchange quote (30s expiry, live Binance prices)
• POST /api/exchange/execute - Execute exchange
• GET /api/bots/backtest - Run strategy backtest with candle simulation
• POST /api/bots/create-instance - Start a bot
• POST /api/admin/bots/kill-switch - Stop all bots globally
• Full Swagger docs at /api/docs

• JWT auth with rotating refresh tokens
• 8-role RBAC with guards and decorators on every endpoint
• TOTP two-factor authentication (enable/confirm/disable/login enforcement)
• KYC flow: Onfido applicant creation, SDK token, HMAC-verified webhook, admin approve/reject
• WalletConnect wallet management with SIWE signature verification
• Multi-asset support (USD, BTC, ETH, USDT, USDC, BNB, SOL, ADA, XRP, DOGE — extensible)
• Double-entry ledger with pessimistic DB locking
• Deposits (Stripe PaymentIntent for card) and withdrawals with AML/sanctions screening
• Asset exchange: live Binance price feed (60s cache, mock fallback), quote (30s expiry) + execute with fee/spread
• Bot trading: strategy marketplace, instance lifecycle, backtesting, global kill switch
• Immutable audit log (append-only, indexed by actor/action/target)
• In-app + email notifications (nodemailer SMTP) with read tracking
• Admin panel: KPIs, user management, KYC queue, audit log viewer
• Swagger/OpenAPI at /api/docs
• Docker Compose: Postgres 15, Redis 7, backend, frontend, Adminer

• bcrypt password hashing (12 rounds)
• JWT access tokens (15m) + rotating refresh tokens (30d)
• TOTP two-factor authentication via otplib
• CORS restricted to FRONTEND_URL
• Helmet HTTP security headers
• Rate limiting: 100 req / 60s per IP
• Immutable audit log for all privileged admin actions
• Atomic balance transfers with pessimistic row-level DB locks
• Stripe + Onfido webhook HMAC-SHA256 signature verification
• AML/sanctions screening on every withdrawal (address + name)

• Real KYC provider (Onfido) with HMAC-SHA256 webhook verification
• Real payment provider (Stripe) deposit intent + HMAC webhook verification
• WalletConnect v2 on-chain SIWE signature verification
• TOTP two-factor authentication (enable / confirm / disable / login enforcement)
• Email notifications via SMTP (nodemailer, fire-and-forget)
• Bot backtesting and simulation mode (GET /bots/backtest with candle data + PnL)
• Binance live price feed (public REST, 60s TTL cache, mock fallback)
• AML/sanctions screening on withdrawals (address + name check before fund lock)
• GitHub Actions CI/CD pipeline
• TypeORM migrations (replace synchronize: true for production)