Sign MoonPay widget URLs with IP binding

[j0ntz]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

Runtime dependency on EdgeApp/edge-info-server#155 (the `POST /v1/moonpay/signUrl` route) being deployed, and ops provisioning `providers.moonpay` in the `createHmac` couch doc.

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

No visual changes: this routes each MoonPay buy/sell widget URL through the info server to be IP-bound and signed before it is opened.

Description

Asana task

MoonPay's on-ramp security upgrade ("IP Matching", hard deadline Aug 7 / prod switch Aug 8) makes MoonPay refuse to load widget URLs that are not signed and bound to a hash of the customer's device IP.

Adds a signMoonpayUrl(url) helper that posts the built widget URL to the info server's POST /v1/moonpay/signUrl (EdgeApp/edge-info-server#155), which captures the caller's public IP and returns the URL with allowedIpAddress + signature appended. The helper is wired into every MoonPay widget launch, in both live code paths:

• src/plugins/ramps/moonpay/moonpayRampPlugin.ts (new ramps plugin) — buy + sell
• src/plugins/gui/providers/moonpayProvider.ts (legacy provider, still registered via amountQuotePlugin) — buy + sell

Each path signs the URL immediately before opening the widget webview and opens the signed URL.

Testing: end-to-end in-app widget load is blocked on external preconditions (route not yet deployed, MoonPay secret not yet provisioned in couch, MoonPay enforcement not enabled until Aug 8). The signing mechanism is verified in edge-info-server (unit-tested against the guide's reference vector + a real HTTP round-trip whose signature passes MoonPay's re-derivation). This client change is verified by tsc, npm run verify/jest (123 related tests), and eslint.

Asana: https://app.asana.com/1/9976422036640/project/1213880789473005/task/1216403654258324

---

Note

Medium Risk
MoonPay buy/sell flows now depend on a new info-server call on every widget open; failures block ramps until the server route and secrets are deployed, but signing secrets stay off the client.

Overview
MoonPay’s IP-matching requirement means buy/sell widget URLs must be signed and bound to the user’s public IP before the WebView opens. This PR adds signMoonpayUrl, which POSTs the built widget URL to the info server’s POST /v1/moonpay/signUrl and opens the returned signedUrl.

That helper is wired into both MoonPay entry points: the legacy moonpayProvider and the ramps moonpayRampPlugin, for buy and sell. The sell ramp path re-signs on each WebView open so IP-bound signatures stay fresh when the widget is reopened after a failed or cancelled send.

Runtime dependency: edge-info-server must expose the signing route and MoonPay credentials must be provisioned server-side; otherwise widget loads will fail at signing time.

^{Reviewed by Cursor Bugbot for commit 91e84b1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ff6e43d. Configure here.}

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}