Commit Graph

865 Commits

Author SHA1 Message Date
pezkuwichain fa811dcfc7 fix: wait for block finalization in verify-deposit instead of failing
Replace hard fail on unfinalized blocks with a retry loop that polls
every 6 seconds up to 60 seconds. The TX is already fully verified via
events at this point — we just wait for GRANDPA finality before crediting.
2026-02-23 22:09:46 +03:00
pezkuwichain 646e388b28 fix: wait for block finalization in verify-deposit instead of failing
Replace hard fail on unfinalized blocks with a retry loop that polls
every 6 seconds up to 60 seconds. The TX is already fully verified via
events at this point — we just wait for GRANDPA finality before crediting.
2026-02-23 22:09:46 +03:00
pezkuwichain ee50666c64 fix: route P2P deposits and verification to Asset Hub instead of relay chain
DepositModal was building transactions via relay chain API, and all three
edge functions (verify-deposit, process-withdraw, process-withdrawal) had
RPC endpoints hardcoded or defaulting to the relay chain. This caused
deposit verification to fail with "Transaction not yet finalized" and
created a chain mismatch with the withdrawal system which operates on
Asset Hub.

- DepositModal: use assetHubApi instead of api for transfer TX
- verify-deposit: RPC_HTTP/RPC_WS default to asset-hub-rpc (env override)
- process-withdraw: RPC_ENDPOINT default to asset-hub-rpc (env override)
- process-withdrawal: RPC_ENDPOINT default to asset-hub-rpc
2026-02-23 21:50:57 +03:00
pezkuwichain a50a5dbffb fix: route P2P deposits and verification to Asset Hub instead of relay chain
DepositModal was building transactions via relay chain API, and all three
edge functions (verify-deposit, process-withdraw, process-withdrawal) had
RPC endpoints hardcoded or defaulting to the relay chain. This caused
deposit verification to fail with "Transaction not yet finalized" and
created a chain mismatch with the withdrawal system which operates on
Asset Hub.

- DepositModal: use assetHubApi instead of api for transfer TX
- verify-deposit: RPC_HTTP/RPC_WS default to asset-hub-rpc (env override)
- process-withdraw: RPC_ENDPOINT default to asset-hub-rpc (env override)
- process-withdrawal: RPC_ENDPOINT default to asset-hub-rpc
2026-02-23 21:50:57 +03:00
pezkuwichain 6d23668535 fix: update edge functions for wallet-based auth
- process-withdraw: replace auth.getUser() with userId from request body
- process-withdrawal: fix esm.sh imports to npm: style (@pezkuwi/api@16.5.11)
2026-02-23 20:09:36 +03:00
pezkuwichain 1f9111bdd4 fix: update edge functions for wallet-based auth
- process-withdraw: replace auth.getUser() with userId from request body
- process-withdrawal: fix esm.sh imports to npm: style (@pezkuwi/api@16.5.11)
2026-02-23 20:09:36 +03:00
pezkuwichain 341b6f6644 fix: replace auth.uid() RLS policies with open access for wallet-based auth
All P2P table RLS policies used auth.uid() which returns NULL since users
authenticate via wallet, not Supabase Auth. Replace with open access policies.

Financial security maintained through SECURITY DEFINER RPC functions
(escrow lock/release/refund, process_deposit, request_withdraw).
2026-02-23 20:04:20 +03:00
pezkuwichain 6cfc64475c fix: replace auth.uid() RLS policies with open access for wallet-based auth
All P2P table RLS policies used auth.uid() which returns NULL since users
authenticate via wallet, not Supabase Auth. Replace with open access policies.

Financial security maintained through SECURITY DEFINER RPC functions
(escrow lock/release/refund, process_deposit, request_withdraw).
2026-02-23 20:04:20 +03:00
pezkuwichain bb772668ba feat: replace supabase auth with citizen/visa identity system for P2P
Replace all supabase.auth.getUser() calls with P2PIdentityContext that
resolves identity from on-chain citizen NFT or off-chain visa system.

- Add identityToUUID() in shared/lib/identity.ts (UUID v5 from citizen/visa number)
- Add P2PIdentityContext with citizen NFT detection and visa fallback
- Add p2p_visa migration for off-chain visa issuance
- Refactor p2p-fiat.ts: all functions now accept userId parameter
- Fix all P2P components to use useP2PIdentity() instead of useAuth()
- Update verify-deposit edge function: walletToUUID -> identityToUUID
- Add P2PLayout with identity gate (wallet/citizen/visa checks)
- Wrap all P2P routes with P2PLayout in App.tsx
2026-02-23 19:54:57 +03:00
pezkuwichain a80a2cfb07 feat: replace supabase auth with citizen/visa identity system for P2P
Replace all supabase.auth.getUser() calls with P2PIdentityContext that
resolves identity from on-chain citizen NFT or off-chain visa system.

- Add identityToUUID() in shared/lib/identity.ts (UUID v5 from citizen/visa number)
- Add P2PIdentityContext with citizen NFT detection and visa fallback
- Add p2p_visa migration for off-chain visa issuance
- Refactor p2p-fiat.ts: all functions now accept userId parameter
- Fix all P2P components to use useP2PIdentity() instead of useAuth()
- Update verify-deposit edge function: walletToUUID -> identityToUUID
- Add P2PLayout with identity gate (wallet/citizen/visa checks)
- Wrap all P2P routes with P2PLayout in App.tsx
2026-02-23 19:54:57 +03:00
pezkuwichain 350b65dec3 fix: resolve critical fast-xml-parser vulnerability and block deploy on audit
- Override fast-xml-parser to ^5.3.6 (fixes CVE-2026-25896, CVE-2026-26278, CVE-2026-25128)
- Add security-audit to deploy job dependencies in quality-gate workflow
2026-02-23 18:23:55 +03:00
pezkuwichain aa3a49f0f6 fix: resolve critical fast-xml-parser vulnerability and block deploy on audit
- Override fast-xml-parser to ^5.3.6 (fixes CVE-2026-25896, CVE-2026-26278, CVE-2026-25128)
- Add security-audit to deploy job dependencies in quality-gate workflow
2026-02-23 18:23:55 +03:00
pezkuwichain b9024cb034 fix: use direct fetch for verify-deposit to read error responses 2026-02-23 12:29:28 +03:00
pezkuwichain b7c4937122 fix: use direct fetch for verify-deposit to read error responses 2026-02-23 12:29:28 +03:00
pezkuwichain d7935e2c4f fix: suppress eslint any warnings in verify-deposit edge function 2026-02-23 12:18:56 +03:00
pezkuwichain 9518dcd501 fix: suppress eslint any warnings in verify-deposit edge function 2026-02-23 12:18:56 +03:00
pezkuwichain dc24f18805 fix: verify-deposit blockchain verification and wallet-based auth
- Drop auth.users FK constraints for wallet-based authentication
- Fix deferrable unique constraint on blockchain_tx_hash (ON CONFLICT compat)
- Rewrite block search: HTTP RPC + blake2b instead of WS-only @pezkuwi/api
- Add blockNumber hint for faster verification of older transactions
- Normalize SS58/hex addresses via base58 for reliable comparison
- DepositModal captures approximate block number after tx submission
2026-02-23 12:16:15 +03:00
pezkuwichain cbf98e4dc9 fix: verify-deposit blockchain verification and wallet-based auth
- Drop auth.users FK constraints for wallet-based authentication
- Fix deferrable unique constraint on blockchain_tx_hash (ON CONFLICT compat)
- Rewrite block search: HTTP RPC + blake2b instead of WS-only @pezkuwi/api
- Add blockNumber hint for faster verification of older transactions
- Normalize SS58/hex addresses via base58 for reliable comparison
- DepositModal captures approximate block number after tx submission
2026-02-23 12:16:15 +03:00
pezkuwichain f749618d3e fix: enforce security audit - remove continue-on-error 2026-02-23 10:19:49 +03:00
pezkuwichain 7183e659c6 fix: enforce security audit - remove continue-on-error 2026-02-23 10:19:49 +03:00
pezkuwichain 776c45bbd1 fix: remove web3Enable cache to prevent stale extension state 2026-02-23 09:57:14 +03:00
pezkuwichain bc03bd87a1 fix: remove web3Enable cache to prevent stale extension state 2026-02-23 09:57:14 +03:00
pezkuwichain ac18e1b98d fix: replace Supabase Auth with on-chain sender verification in verify-deposit
Removed JWT auth requirement from edge function. Now uses wallet address
from request body and verifies it matches the on-chain transaction sender.
This works with wallet-based auth instead of Supabase Auth.
2026-02-23 08:49:18 +03:00
pezkuwichain 52daa7642d fix: replace Supabase Auth with on-chain sender verification in verify-deposit
Removed JWT auth requirement from edge function. Now uses wallet address
from request body and verifies it matches the on-chain transaction sender.
This works with wallet-based auth instead of Supabase Auth.
2026-02-23 08:49:18 +03:00
pezkuwichain 35a911ae5f fix: suppress eslint any warning in get-signer 2026-02-23 08:31:07 +03:00
pezkuwichain ef44b06a47 fix: suppress eslint any warning in get-signer 2026-02-23 08:31:07 +03:00
pezkuwichain 9863f11224 fix: cache web3Enable to prevent authorization flooding
Consolidated all web3Enable/web3FromAddress calls through getSigner helper.
Cached web3Enable promise so it only runs once per session.
2026-02-23 08:24:41 +03:00
pezkuwichain b034954fd1 fix: cache web3Enable to prevent authorization flooding
Consolidated all web3Enable/web3FromAddress calls through getSigner helper.
Cached web3Enable promise so it only runs once per session.
2026-02-23 08:24:41 +03:00
pezkuwichain 3d1c1405e5 fix: universal getSigner helper for WalletConnect + extension signing
Replace all web3FromAddress calls with getSigner() that auto-detects
walletSource and uses WC signer or extension signer accordingly.
This fixes all signing operations when connected via WalletConnect.
2026-02-23 07:01:18 +03:00
pezkuwichain 80d8bbbcb1 fix: universal getSigner helper for WalletConnect + extension signing
Replace all web3FromAddress calls with getSigner() that auto-detects
walletSource and uses WC signer or extension signer accordingly.
This fixes all signing operations when connected via WalletConnect.
2026-02-23 07:01:18 +03:00
pezkuwichain fc9a92f58c fix: mobile UI improvements and web3Enable for WalletConnect signing
- Compact stat cards on mobile (Dashboard, Referral, P2P)
- Hide unnecessary sections on mobile (Recent Activity, NFTs, Score Calculation, Liquidity Pools, Recent Swaps)
- Fix back arrow overlapping title on all pages
- Swap Settings and Governance nav positions for better mobile dropdown
- Add back arrow to Presale page
- Add web3Enable before all web3FromAddress calls for WalletConnect compatibility
- Fix citizenship authentication signing with WalletConnect
2026-02-23 06:22:12 +03:00
pezkuwichain bcee7c2a7d fix: mobile UI improvements and web3Enable for WalletConnect signing
- Compact stat cards on mobile (Dashboard, Referral, P2P)
- Hide unnecessary sections on mobile (Recent Activity, NFTs, Score Calculation, Liquidity Pools, Recent Swaps)
- Fix back arrow overlapping title on all pages
- Swap Settings and Governance nav positions for better mobile dropdown
- Add back arrow to Presale page
- Add web3Enable before all web3FromAddress calls for WalletConnect compatibility
- Fix citizenship authentication signing with WalletConnect
2026-02-23 06:22:12 +03:00
pezkuwichain b2282ab70c debug: add WalletConnect debug logging to diagnose timeout 2026-02-23 00:57:38 +03:00
pezkuwichain 7107f18ea6 debug: add WalletConnect debug logging to diagnose timeout 2026-02-23 00:57:38 +03:00
pezkuwichain 9ea8ab0189 fix: resolve remaining mobile app lint warnings 2026-02-23 00:33:11 +03:00
pezkuwichain f9af28b56b fix: resolve remaining mobile app lint warnings 2026-02-23 00:33:11 +03:00
pezkuwichain b38798bbd4 fix: resolve remaining lint warnings (console.log and missing deps) 2026-02-23 00:28:32 +03:00
pezkuwichain 9897d6268e fix: resolve remaining lint warnings (console.log and missing deps) 2026-02-23 00:28:32 +03:00
pezkuwichain d8ff28175f fix: resolve all lint warnings in mobile and web apps 2026-02-23 00:24:17 +03:00
pezkuwichain cbbea8a5dc fix: resolve all lint warnings in mobile and web apps 2026-02-23 00:24:17 +03:00
pezkuwichain 87dfc249aa fix: WalletConnect race conditions, session validation and timeout handling 2026-02-23 00:16:34 +03:00
pezkuwichain d7278956fa fix: WalletConnect race conditions, session validation and timeout handling 2026-02-23 00:16:34 +03:00
pezkuwichain 73b5ebece6 fix: only init WalletConnect when a saved session exists 2026-02-22 22:31:52 +03:00
pezkuwichain 87f6d0471e fix: only init WalletConnect when a saved session exists 2026-02-22 22:31:52 +03:00
pezkuwichain 0f2ed1c14f fix: use deep link instead of QR on mobile, show extension only on desktop 2026-02-22 22:16:55 +03:00
pezkuwichain e593f5e4bb fix: use deep link instead of QR on mobile, show extension only on desktop 2026-02-22 22:16:55 +03:00
pezkuwichain a5eea60858 fix: show only mobile wallet option on mobile devices 2026-02-22 21:40:17 +03:00
pezkuwichain d6e59b316b fix: show only mobile wallet option on mobile devices 2026-02-22 21:40:17 +03:00
pezkuwichain ce8169eede feat: wallet modal with two connection options and Kurdistan flag for language switcher 2026-02-22 21:29:29 +03:00
pezkuwichain 981d93cc64 feat: wallet modal with two connection options and Kurdistan flag for language switcher 2026-02-22 21:29:29 +03:00