Sign MoonPay widget URLs with IP binding

[j0ntz]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

Runtime dependency on EdgeApp/edge-info-server#155 (the `POST /v1/moonpay/signUrl` route) being deployed, and ops provisioning `providers.moonpay` in the `createHmac` couch doc.

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

No visual changes: this routes each MoonPay buy/sell widget URL through the info server to be IP-bound and signed before it is opened.

Description

Asana task

MoonPay's on-ramp security upgrade ("IP Matching", hard deadline Aug 7 / prod switch Aug 8) makes MoonPay refuse to load widget URLs that are not signed and bound to a hash of the customer's device IP.

Adds a signMoonpayUrl(url) helper that posts the built widget URL to the info server's POST /v1/moonpay/signUrl (EdgeApp/edge-info-server#155), which captures the caller's public IP and returns the URL with allowedIpAddress + signature appended. The helper is wired into every MoonPay widget launch, in both live code paths:

• src/plugins/ramps/moonpay/moonpayRampPlugin.ts (new ramps plugin) — buy + sell
• src/plugins/gui/providers/moonpayProvider.ts (legacy provider, still registered via amountQuotePlugin) — buy + sell

Each path signs the URL immediately before opening the widget webview and opens the signed URL.

Testing: end-to-end in-app widget load is blocked on external preconditions (route not yet deployed, MoonPay secret not yet provisioned in couch, MoonPay enforcement not enabled until Aug 8). The signing mechanism is verified in edge-info-server (unit-tested against the guide's reference vector + a real HTTP round-trip whose signature passes MoonPay's re-derivation). This client change is verified by tsc, npm run verify/jest (123 related tests), and eslint.

Asana: https://app.asana.com/1/9976422036640/project/1213880789473005/task/1216403654258324

---

Note

Medium Risk
All MoonPay widget launches now depend on the info server signing route and correct ops config; signing failures block buy/sell until deployed, but changes are localized to MoonPay URL handling plus test IDs.

Overview
MoonPay buy and sell widget URLs are no longer opened directly. A new signMoonpayUrl helper POSTs each built URL to the info server (POST v1/moonpay/signUrl), which returns an IP-bound, signed URL MoonPay requires for its on-ramp security upgrade.

That helper is wired into both MoonPay integrations before the webview opens: the legacy moonpayProvider and moonpayRampPlugin (buy external webview and sell webview). On the sell path that can re-open the widget after a failed/cancelled send, the URL is re-signed on each open so signatures stay fresh.

The PR also threads optional testIDs through ramp UI (PillButton, provider pill on payment option cards, crypto dropdown, per-payment-type provider pills) for Maestro automation.

^{Reviewed by Cursor Bugbot for commit 94420c1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 94420c1. Configure here.}