core: implement minimum reputation threshold enforcement

[EmeditWeb]

Problem

create_loan() does not check if the borrower meets
the minimum reputation threshold stored in the
parameters contract.

What To Build

1. Add reputation check in create_loan()
2. Add credit limit enforcement

Files To Touch

• contracts/creditline-contract/src/lib.rs
• contracts/creditline-contract/src/errors.rs
• contracts/creditline-contract/src/tests.rs

Acceptance Criteria

• Loans rejected below minimum score
• Credit limit enforced per reputation tier
• Typed errors returned (not panic)
• All existing tests still pass

Mandatory Checks Before PR

• cargo build passes
• All tests pass
• PR references this issue

[teeschima]

Hi,

I'd like to work on this issue.

My understanding is that the goal is to introduce API-key based authentication for vendor-to-server integrations, replacing the need for wallet-based JWT authentication in machine-to-machine communication.

My implementation plan would be:

• Create an api_keys table in Supabase with support for key metadata, permissions, status, timestamps, and vendor association.
• Generate cryptographically secure API keys and return the plaintext key only once during creation.
• Store only a hashed version of the key in the database.
• Implement CRUD endpoints for API key management in the vendors module.
• Create an ApiKeyGuard that validates incoming API keys and authenticates requests.
• Enforce permission scopes per key for protected vendor endpoints.
• Add unit tests covering successful authentication, invalid keys, revoked keys, and permission enforcement.
• Maintain strict TypeScript typing with no any usage.
• Verify npm run build passes before opening the PR.
• Reference this issue in the PR and include testing details.

I have experience with TypeScript, NestJS-style backend architectures, authentication systems, REST APIs, database design, and secure credential management.

Looking forward to contributing.

[mofejo1]

kindly assign this to me