Sign MoonPay widget URLs with IP binding

MoonPay's on-ramp security upgrade refuses to load widget URLs that are
not signed and bound to a hash of the customer's device IP. Route every
MoonPay buy/sell widget URL through the info server's /v1/moonpay/signUrl
endpoint (which captures the public IP and applies the allowedIpAddress +
signature params) before opening it, in both the new ramps plugin and the
still-registered legacy fiat provider.

Author: j0ntz

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased (develop)
 
+- changed: Sign MoonPay buy/sell widget URLs and bind them to the customer's IP via the info server, for MoonPay's on-ramp IP-matching security upgrade.
+
 ## 4.49.0 (staging)
 
 - added: Monero wallet import support

eslint.config.mjs

@@ -455,7 +455,6 @@ export default [
 
       'src/plugins/gui/providers/bityProvider.ts',
 
-      'src/plugins/gui/providers/moonpayProvider.ts',
       'src/plugins/gui/providers/mtpelerinProvider.ts',
 
       'src/plugins/gui/providers/revolutProvider.ts',

src/plugins/gui/providers/moonpayProvider.ts

@@ -51,6 +51,7 @@ import {
   RETURN_URL_PAYMENT,
   validateExactRegion
 } from './common'
+import { signMoonpayUrl } from './moonpaySign'
 const providerId = 'moonpay'
 const storeId = 'com.moonpay'
 const partnerIcon = 'moonpay_symbol_prp.png'
@@ -643,6 +644,7 @@ export const moonpayProvider: FiatProviderFactory = {
               }
               urlObj.set('query', queryObj)
               console.log('Approving moonpay buy quote url=' + urlObj.href)
+              const signedUrl = await signMoonpayUrl(urlObj.href)
               const handleBuyDeeplinkAsync = async (
                 link: unknown
               ): Promise<void> => {
@@ -695,7 +697,7 @@ export const moonpayProvider: FiatProviderFactory = {
                 handleBuyDeeplinkAsync(link).catch(() => {})
               }
               await showUi.openExternalWebView({
-                url: urlObj.href,
+                url: signedUrl,
                 providerId,
                 deeplinkHandler: handleBuyDeeplink
               })
@@ -718,6 +720,7 @@ export const moonpayProvider: FiatProviderFactory = {
               }
               urlObj.set('query', queryObj)
               console.log('Approving moonpay sell quote url=' + urlObj.href)
+              const signedUrl = await signMoonpayUrl(urlObj.href)
 
               let inPayment = false
 
@@ -867,7 +870,7 @@ export const moonpayProvider: FiatProviderFactory = {
                   onUrlChangeAsync(uri).catch(() => {})
                 }
                 await showUi.openWebView({
-                  url: urlObj.href,
+                  url: signedUrl,
                   onUrlChange,
                   onClose: () => {}
                 })

src/plugins/gui/providers/moonpaySign.ts

@@ -0,0 +1,28 @@
+import { asObject, asString } from 'cleaners'
+
+import { fetchInfo } from '../../../util/network'
+
+const asMoonpaySignResponse = asObject({ signedUrl: asString })
+
+/**
+ * Ask the info server to bind a Moonpay widget URL to the caller's public IP
+ * and sign it. Moonpay's on-ramp security upgrade refuses to load widget URLs
+ * that are not signed and IP-bound, so every buy/sell widget URL must be routed
+ * through here before it is opened.
+ */
+export const signMoonpayUrl = async (url: string): Promise<string> => {
+  const response = await fetchInfo(
+    'v1/moonpay/signUrl',
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ url })
+    },
+    10000
+  )
+  if (!response.ok) {
+    throw new Error(`Moonpay URL signing failed: ${response.status}`)
+  }
+  const reply = await response.json()
+  return asMoonpaySignResponse(reply).signedUrl
+}

src/plugins/ramps/moonpay/moonpayRampPlugin.ts

@@ -44,6 +44,7 @@ import {
   RETURN_URL_PAYMENT,
   validateExactRegion
 } from '../../gui/providers/common'
+import { signMoonpayUrl } from '../../gui/providers/moonpaySign'
 import { addTokenToArray } from '../../gui/util/providerUtils'
 import { rampDeeplinkManager } from '../rampDeeplinkHandler'
 import type {
@@ -833,9 +834,10 @@ export const moonpayRampPlugin: RampPluginFactory = (
                 }
                 urlObj.set('query', queryObj)
                 console.log('Approving moonpay buy quote url=' + urlObj.href)
+                const signedUrl = await signMoonpayUrl(urlObj.href)
 
                 deeplinkToken = await openExternalWebView({
-                  url: urlObj.href,
+                  url: signedUrl,
                   deeplink: {
                     direction: 'buy',
                     providerId: pluginId,
@@ -993,13 +995,14 @@ export const moonpayRampPlugin: RampPluginFactory = (
                 }
                 urlObj.set('query', queryObj)
                 console.log('Approving moonpay sell quote url=' + urlObj.href)
+                const signedUrl = await signMoonpayUrl(urlObj.href)
 
                 let inPayment = false
 
                 const openWebView = async (): Promise<void> => {
                   await new Promise<void>((resolve, reject) => {
                     navigation.navigate('guiPluginWebView', {
-                      url: urlObj.href,
+                      url: signedUrl,
                       onClose: () => {
                         resolve()
                       },