ci(release): publish latest release

Author: hello-happy-puppy

RELEASE

@@ -1,6 +1,6 @@
 IPFS hash of the deployment:
-- CIDv0: `QmZ886Y4R1mRjvShMBjdoML9w4YWW7AQ4TEx6yPX99njMt`
-- CIDv1: `bafybeifahl4nbhp4cflojwiis54zx2qou27tdwekvtbi47ire27sdk73vm`
+- CIDv0: `QmNftmD2jYM2MD7TjHfd7wmu3tgBvXJCra1Z1z9xEYtrLA`
+- CIDv1: `bafybeiae5xwpty5fbnkusf3g5twy3dpy2bjgjemsw6jvd4wehdyn46xbam`
 
 The latest release is always mirrored at [app.uniswap.org](https://app.uniswap.org).
 
@@ -10,5 +10,5 @@ You can also access the Uniswap Interface from an IPFS gateway.
 Your Uniswap settings are never remembered across different URLs.
 
 IPFS gateways:
-- https://bafybeifahl4nbhp4cflojwiis54zx2qou27tdwekvtbi47ire27sdk73vm.ipfs.dweb.link/
-- [ipfs://QmZ886Y4R1mRjvShMBjdoML9w4YWW7AQ4TEx6yPX99njMt/](ipfs://QmZ886Y4R1mRjvShMBjdoML9w4YWW7AQ4TEx6yPX99njMt/)
+- https://bafybeiae5xwpty5fbnkusf3g5twy3dpy2bjgjemsw6jvd4wehdyn46xbam.ipfs.dweb.link/
+- [ipfs://QmNftmD2jYM2MD7TjHfd7wmu3tgBvXJCra1Z1z9xEYtrLA/](ipfs://QmNftmD2jYM2MD7TjHfd7wmu3tgBvXJCra1Z1z9xEYtrLA/)

VERSION

@@ -1 +1 @@
-web/5.154.2
+web/5.154.3

apps/web/src/state/livePrices/LivePricesProvider.tsx

@@ -1,12 +1,6 @@
-import {
-  createFetchClient,
-  getEntryGatewayUrl,
-  getWebSocketUrl,
-  provideSessionService,
-  SharedQueryClient,
-} from '@universe/api'
-import { isDevEnv, REQUEST_SOURCE } from '@universe/environment'
-import { FeatureFlags, getIsSessionServiceEnabled, useFeatureFlag } from '@universe/gating'
+import { getEntryGatewayUrl, getWebSocketUrl, SharedQueryClient } from '@universe/api'
+import { isDevEnv } from '@universe/environment'
+import { FeatureFlags, useFeatureFlag } from '@universe/gating'
 import type { TokenPriceMessage, TokenSubscriptionParams } from '@universe/prices'
 import {
   createPriceKey,
@@ -21,6 +15,7 @@ import type { ReactElement, ReactNode } from 'react'
 import { useState } from 'react'
 import { RemotePriceProvider } from 'uniswap/src/features/prices/RemotePriceProvider'
 import { logger } from 'utilities/src/logger/logger'
+import { createLivePricesFetchClient } from '~/state/livePrices/createLivePricesFetchClient'
 
 function createLivePricesClient(): WebSocketClient<TokenSubscriptionParams, TokenPriceMessage['data']> | null {
   const wsUrl = getWebSocketUrl()
@@ -40,15 +35,7 @@ function createLivePricesClient(): WebSocketClient<TokenSubscriptionParams, Toke
     devtoolsName: 'livePricesConnection',
   })
 
-  const fetchClient = createFetchClient({
-    baseUrl: subscriptionApiUrl,
-    getHeaders: () => ({
-      'Content-Type': 'application/json',
-      'x-request-source': REQUEST_SOURCE,
-    }),
-    getSessionService: () =>
-      provideSessionService({ getBaseUrl: () => getEntryGatewayUrl(), getIsSessionServiceEnabled }),
-  })
+  const fetchClient = createLivePricesFetchClient({ subscriptionApiUrl })
 
   const subscriptionHandler = createPriceSubscriptionHandler({
     client: fetchClient,

apps/web/src/state/livePrices/createLivePricesFetchClient.test.ts

@@ -0,0 +1,64 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createLivePricesFetchClient } from '~/state/livePrices/createLivePricesFetchClient'
+
+vi.mock('@universe/gating', () => ({
+  getIsSessionServiceEnabled: (): boolean => false,
+}))
+
+/**
+ * On web the session is an HttpOnly cookie; the browser only attaches it to
+ * cross-origin EventSubscriptionService requests when the fetch runs with
+ * `credentials: 'include'`. Without it the entry gateway sees no session and
+ * Subscribe / RefreshSession fail with 401 — these tests are that contract.
+ */
+describe('createLivePricesFetchClient', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  function setup(): { fetchMock: ReturnType<typeof vi.fn> } {
+    const fetchMock = vi.fn(async () => new Response(JSON.stringify({}), { status: 200 }))
+    vi.stubGlobal('fetch', fetchMock)
+    return { fetchMock }
+  }
+
+  it('sends credentials: include on Subscribe so the web session cookie is attached', async () => {
+    const { fetchMock } = setup()
+    const client = createLivePricesFetchClient({ subscriptionApiUrl: 'https://entry-gateway.example.com' })
+
+    await client.post('/uniswap.notificationservice.v1.EventSubscriptionService/Subscribe', {
+      body: JSON.stringify({ connectionId: 'connection-1' }),
+    })
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://entry-gateway.example.com/uniswap.notificationservice.v1.EventSubscriptionService/Subscribe',
+      expect.objectContaining({ credentials: 'include', method: 'POST' }),
+    )
+  })
+
+  it('sends credentials: include on RefreshSession so the web session cookie is attached', async () => {
+    const { fetchMock } = setup()
+    const client = createLivePricesFetchClient({ subscriptionApiUrl: 'https://entry-gateway.example.com' })
+
+    await client.post('/uniswap.notificationservice.v1.EventSubscriptionService/RefreshSession', {
+      body: JSON.stringify({ connectionId: 'connection-1' }),
+    })
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://entry-gateway.example.com/uniswap.notificationservice.v1.EventSubscriptionService/RefreshSession',
+      expect.objectContaining({ credentials: 'include', method: 'POST' }),
+    )
+  })
+
+  it('still applies the request-source header alongside the credentials mode', async () => {
+    const { fetchMock } = setup()
+    const client = createLivePricesFetchClient({ subscriptionApiUrl: 'https://entry-gateway.example.com' })
+
+    await client.post('/uniswap.notificationservice.v1.EventSubscriptionService/Subscribe', {
+      body: JSON.stringify({ connectionId: 'connection-1' }),
+    })
+
+    const init = fetchMock.mock.calls[0]?.[1] as RequestInit
+    expect(new Headers(init.headers).get('x-request-source')).toBeTruthy()
+  })
+})

apps/web/src/state/livePrices/createLivePricesFetchClient.ts

@@ -0,0 +1,23 @@
+import { createFetchClient, type FetchClient, getEntryGatewayUrl, provideSessionService } from '@universe/api'
+import { REQUEST_SOURCE } from '@universe/environment'
+import { getIsSessionServiceEnabled } from '@universe/gating'
+
+/**
+ * FetchClient for the EventSubscriptionService RPCs (Subscribe / Unsubscribe /
+ * RefreshSession). These are session-authenticated: on web the session lives in
+ * an HttpOnly cookie on the entry gateway host, so requests must run with
+ * `credentials: 'include'` for the browser to attach it when the entry gateway
+ * is reached cross-origin (same pattern as the trading API clients).
+ */
+export function createLivePricesFetchClient({ subscriptionApiUrl }: { subscriptionApiUrl: string }): FetchClient {
+  return createFetchClient({
+    baseUrl: subscriptionApiUrl,
+    getHeaders: () => ({
+      'Content-Type': 'application/json',
+      'x-request-source': REQUEST_SOURCE,
+    }),
+    getSessionService: () =>
+      provideSessionService({ getBaseUrl: () => getEntryGatewayUrl(), getIsSessionServiceEnabled }),
+    defaultOptions: { credentials: 'include' },
+  })
+}