Conversation
Stack human tip then agent panel until xl, SOL-only Solana Pay (USDC is not receipt-eligible), and make curl/signature fields scroll instead of clip. Receipt payer is the on-chain fee payer only; verify requires a SystemProgram transfer to payTo, fail-closed blockTime, and a durable single-use signature store. Shared PublicKey address checks, Solana Pay recipient validation, ::ffff: SSRF mapping, lab finite timestamps + optional payTo bind, and exact-case wallet confirm. Co-authored-by: Phoenix <grachkovsky@gmail.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Browser JS cannot read the 402 challenge header unless it is listed in Access-Control-Expose-Headers. Add PAYMENT-REQUIRED and Payment-Required alongside the existing response twins on OPTIONS and JSON responses. Co-authored-by: Phoenix <grachkovsky@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR #3 (does not touch PR #1 /
cursor/agent-ux-musts-e117).(A)
/donatelayout + SOL-onlyxl(gap-6 xl:grid-cols-2). Removes the earlylgtwo-column that clipped curl and cramped tip cards at ~1280 and trapped horizontal scroll at ~390.pre/curl:min-w-0 max-w-full overflow-x-auto whitespace-pre text-xs.min-w-0 w-full, placeholderPaste base58 tx signature, helper for Phantom / Explorer.grid-cols-1 gap-3 p-4; labels wrap instead of colliding with amounts.border-border bg-surface.onchain-sol) only; copy states USDC is not receipt-eligible. Receive/practice USDC is unchanged.(B) P0 security / Protocol CLEAR
payer= on-chain fee payer only (resolveReceiptPayer). Clientpayload.payeris never credited; mismatch rejects.transfer/transferWithSeedtopayTo. Balance-delta alone does not credit. MissingblockTimefails closed.SET NX, else filesystemO_EXCL). Not process-localcreditedSignatures. Fail-closed if the store cannot claim.PublicKey+ on-curve wallet for donatepayTo. Regex-only API gate removed.encodeSolanaPayUrlvalidates recipient as a canonical public key.check-402isPrivateIp:::ffff:mapped IPv4 (the old:ffff:prefix never matched). Unrecognised forms fail closed.exact-lab:Number.isFinite(timestamp)before the age window; optionalpayTobind in the signed message when the challenge advertises it. Framing stays educationalexact-lab≠ facilitatorexactUSDC. Lab nonces remain process-local (labeled).(P1 follow-up) CORS
Access-Control-Expose-HeadersPAYMENT-REQUIREDandPayment-Requiredin addition to the existingX-PAYMENT-RESPONSE/PAYMENT-RESPONSEtwins, so browser JS can read the challenge header. Other CORS allow-origin / allow-headers unchanged.Out of scope: dead auth/db/multiplayer delete; Home/gloss Mood A on PR #1; donation address/economics copy.
Production note
Donation receipts need a durable replay store. Set
KV_REST_API_URL+KV_REST_API_TOKEN(or Upstash equivalents) on Vercel. Local/dev usesdata/credited-donation-sigs/(gitignored).Tests
npm run test:p0— mapped IPv4, address gate vs regex, Solana Pay recipient, instruction bind, client payer mismatch, lab timestamp/payTo, filesystem single-use claim, CORS expose list includes Payment-Required twins.Hypothesis (confirmed)
lg:grid-cols-2was too early; donate API preferredproof.payload.payeroverresult.payer. Both are fixed.