Repository navigation
fix: pre-launch hardening for the app (mock payees, pending sends, CSP, vendored SDK 0.3.3) - #91
Merged
Merged
Conversation
…irect_lock (Item 3)
The vendored 0.3.2 tarball had neither TX_PENDING nor the trustline fix, so the pending-send flow never ran. Vendor 0.3.3 (sha512 pinned), never build a claim link from a default lock id when the id can't be read, resume a pending send after a reload, match only lock_created in the event fallback, and re-export the SDK's own KinlockError so instanceof checks (request form) match SDK errors again.
Prerendered pages (/ and /attester) can't carry the request's nonce, so the site-wide CSP blocked all of their scripts and they never hydrated. Force dynamic rendering at the root layout. Roadmap: M3-42 DONE, M3-43 DONE.
The indexer exited at startup because E2E_START_LEDGER (5421502) is older than testnet RPC's ~7-day event history, failing every PR. The PR job only runs the claim-fragment privacy test, which reads chain state, so start the indexer only for the signed run on main. That run still needs a fixture contract inside RPC retention (M3-45). Roadmap: M3-44 DONE, M3-45 TODO.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Fixes from the pre-launch review: the mock payee fallback is removed, direct mode is gated behind a flag, pending sends no longer invite a double payment, preflight asks for acknowledgement when a blocking check is unknown, the nonce CSP applies site-wide, and the SDK is vendored with an integrity hash. A follow-up verification pass found that several of those fixes didn't work in practice, and those problems are fixed here too.
Changes
Mock payees removed (M3-36): when the indexer is down, pages show the unavailable state, and
mock-data.tsis deleted.Direct mode gated (M3-37):
NEXT_PUBLIC_ENABLE_DIRECT_PAYMENTSdefaults to false, because the deployed contract predatescreate_direct_lock.Pending sends (M3-38, M3-42):
TX_PENDINGthe app pollsgetTransactioninstead of re-enabling Send.Preflight (M3-39): an
unknownresult on a blocking check now requires acknowledgement.CSP (M3-40, M3-43): the nonce CSP applies to every route, and every route is rendered per request. Before this, prerendered
/and/attesterhad every script blocked.SDK vendoring (M3-41, M3-42):
@kinlock/sdkis vendored at 0.3.3 with a sha512 in the lockfile. The previous 0.3.2 tarball had neitherTX_PENDINGnor the trustline fix.Error class:
lib/sdk.tsre-exports the SDK's ownKinlockError, soinstanceofin the request form matches SDK errors again.CI (M3-44): the PR
e2ejob no longer starts the indexer. It was failing at startup becauseE2E_START_LEDGER(5421502) is older than testnet RPC's ~7-day event history (startLedger must be within the ledger range: 5511598 - 5632557). The PR job only runs the claim-fragment privacy test, which reads chain state, so it doesn't need the indexer. The indexer now runs only for the signed run onmain.Hard rules / invariants touched
None. Claim-link secrets stay in browser storage only, and the CSP is stricter than before.
Tests
confirmedLockIdnever returns a default id.lib.KinlockErroris the SDK class.pollTransactionthrows the SDK'sKinlockError.pnpm lint,pnpm typecheck,pnpm test(206/206 pass) andpnpm build. All green, and every page builds as dynamic.pnpm start:/and/attesterhydrate with every script carrying the request nonce and no CSP violations./sendshows the pending screen after a reload and keeps the record when confirmation times out.claim-fragment-privacy.spec.tspasses locally against a production build with no indexer running (the same setup as the PR job now).pnpm e2e, or a real wallet send on testnet.Docs / ADR
.env.exampledocumentsNEXT_PUBLIC_ENABLE_DIRECT_PAYMENTS. No ADR changes.Roadmap
Rows M3-36 through M3-44 are all
DONE, and M3-45 is added asTODO, with a Changelog entry for each. Progress counts were computed withscripts/roadmap-progresson a copy, because the script can't parse this file's column-padded §3 header, then updated by hand.Assumptions and open questions
fix/prelaunch-hardening). The vendoredvendor/kinlock-sdk-0.3.3.tgzwas packed from that branch, so merge the SDK PR first and re-vendor if the published tarball differs.connect-srcallowshttps://*.stellar.organdhttps://albedo.linkfor the wallet kit. Other wallets (e.g. WalletConnect-based ones) are untested under this CSP.@kinlock/contract(bindings) is still pulled from a GitHub release URL with no integrity hash in the lockfile, the same supply-chain gap that item 9 fixed for the SDK. It is not changed here.maine2e is still broken (M3-45). The fixture contract's payee registration has aged out of RPC history, so the indexer can't ingest the fixture payee. It needs a fixture contract redeployed per run, or on a schedule shorter than RPC retention. That isn't fixed here.