Protect credits routes

[quentin-burg]

Due to comment here : #1 (comment)

We need to protect " update credits " route from malicious API call.
Currently, a user can update "virtually" credits on database.

The proposition is to :

• ask for operation hash on PUT /credits endpoint
• check if the transfer between the customer address and the vault is finalised
• wait blocks confirmation (2 blocks)

[aguillon]

I had the wrong model in mind. We don't want the user to log in with anything else than its wallet, which means we can ask for a signature for all operations/check that the credits were correctly sent in the API (using PyTezos, for instance).

• first, we'll merge 🎉 Init routes for backend #1 with no security check;
• then, we'll do what you're suggesting, which isn't a really good solution IMO (not your fault) because the credits can be sent while the API can be down;
• then we'll use an indexer in the API.