Sign MoonPay widget URLs with IP binding

[j0ntz]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

Runtime dependency on EdgeApp/edge-info-server#155 (the `POST /v1/moonpay/signUrl` route) being deployed, and ops provisioning `providers.moonpay` in the `createHmac` couch doc.

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

No visual changes: this routes each MoonPay buy/sell widget URL through the info server to be IP-bound and signed before it is opened.

Description

Asana task

MoonPay's on-ramp security upgrade ("IP Matching", hard deadline Aug 7 / prod switch Aug 8) makes MoonPay refuse to load widget URLs that are not signed and bound to a hash of the customer's device IP.

Adds a signMoonpayUrl(url) helper that posts the built widget URL to the info server's POST /v1/moonpay/signUrl (EdgeApp/edge-info-server#155), which captures the caller's public IP and returns the URL with allowedIpAddress + signature appended. The helper is wired into every MoonPay widget launch, in both live code paths:

• src/plugins/ramps/moonpay/moonpayRampPlugin.ts (new ramps plugin) — buy + sell
• src/plugins/gui/providers/moonpayProvider.ts (legacy provider, still registered via amountQuotePlugin) — buy + sell

Each path signs the URL immediately before opening the widget webview and opens the signed URL.

Testing: end-to-end in-app widget load is blocked on external preconditions (route not yet deployed, MoonPay secret not yet provisioned in couch, MoonPay enforcement not enabled until Aug 8). The signing mechanism is verified in edge-info-server (unit-tested against the guide's reference vector + a real HTTP round-trip whose signature passes MoonPay's re-derivation). This client change is verified by tsc, npm run verify/jest (123 related tests), and eslint.

Asana: https://app.asana.com/1/9976422036640/project/1213880789473005/task/1216403654258324

---

Note

Medium Risk
Fiat on-ramp flows now depend on the info server signing route and correct IP binding; failure blocks MoonPay widgets until backend/ops preconditions are met.

Overview
MoonPay’s IP-matching requirement means buy/sell widget URLs must be signed and bound to the user’s public IP before the WebView opens. This PR adds signMoonpayUrl, which POSTs the built widget URL to the info server’s POST /v1/moonpay/signUrl and opens the returned signedUrl instead of the raw link.

Signing is wired into both MoonPay entry points: the legacy moonpayProvider and moonpayRampPlugin (buy and sell). On the ramp sell flow, the URL is re-signed on each WebView open so retries after cancel/failure get a fresh signature.

Unrelated to MoonPay: ramp UI components gain testIDs (rampFiatDropdown, rampCryptoDropdown, provider pills) for automation. CHANGELOG notes the behavioral change; moonpayProvider was dropped from an ESLint override list.

^{Reviewed by Cursor Bugbot for commit 3d27453. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ff6e43d. Configure here.}

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}