chore: back-merge main → dev (2026-07-22)

android/app/src/main/AndroidManifest.xml

@@ -59,6 +59,14 @@
                 <data android:pathPrefix="/withdraw/" />
                 <data android:path="/receipt" />
                 <data android:pathPrefix="/receipt/" />
+                <data android:path="/history" />
+                <data android:pathPrefix="/history/" />
+                <data android:path="/rewards" />
+                <data android:pathPrefix="/rewards/" />
+                <data android:path="/badges" />
+                <data android:pathPrefix="/badges/" />
+                <data android:path="/profile" />
+                <data android:pathPrefix="/profile/" />
             </intent-filter>
 
         </activity>
@@ -78,6 +86,15 @@
         <meta-data
             android:name="asset_statements"
             android:resource="@string/capacitor_passkey_asset_statements" />
+
+        <!-- Don't let OneSignal fire its own ACTION_VIEW for a notification's
+             launch URL. The tap opens the app and useNativePlugins routes on the
+             deep link in-app instead — which covers destinations outside the App
+             Links filter above, doesn't depend on link verification, and keeps
+             iOS and Android on the same code path. -->
+        <meta-data
+            android:name="com.onesignal.suppressLaunchURLs"
+            android:value="true" />
     </application>
 
     <!-- Phone-only: require a telephony radio so Play filters out Wi-Fi-only

ios/App/App/Info.plist

@@ -49,6 +49,12 @@
 	<string>Peanut may use your location to help verify your identity and prevent fraud during account setup and support.</string>
 	<key>ITSAppUsesNonExemptEncryption</key>
 	<false/>
+	<!-- Stop OneSignal calling openURL for a notification's launch URL. iOS won't
+	     re-enter this app for its own universal link, so without this a tapped push
+	     bounces the user out to Safari. useNativePlugins routes the deep link in-app
+	     from the click listener instead. -->
+	<key>OneSignal_suppress_launch_urls</key>
+	<true/>
 	<key>UILaunchStoryboardName</key>
 	<string>LaunchScreen</string>
 	<key>UIMainStoryboardFile</key>

next.config.js

@@ -5,6 +5,97 @@ const withBundleAnalyzer =
 
 const redirectsConfig = require('./redirects.json')
 
+/**
+ * Sentry's CSP-report ingest endpoint, derived from the browser DSN
+ * (`<protocol>://<publicKey>@<host><path>/<projectId>`). Returns null when the
+ * DSN is absent or malformed, in which case the policy still ships — it just
+ * has nowhere to report, which is better than emitting a broken `report-uri`.
+ *
+ * Protocol and any path prefix are preserved: self-hosted Sentry is commonly
+ * mounted under a sub-path, and flattening one would silently post reports to
+ * an endpoint that doesn't exist.
+ */
+function sentryCspReportUri() {
+    const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN
+    if (!dsn) return null
+    try {
+        const { protocol, host, username, pathname } = new URL(dsn)
+        const segments = pathname.split('/').filter(Boolean)
+        const projectId = segments.pop()
+        if (!host || !username || !projectId) return null
+        const prefix = segments.length ? `/${segments.join('/')}` : ''
+        return `${protocol}//${host}${prefix}/api/${projectId}/security/?sentry_key=${username}`
+    } catch {
+        return null
+    }
+}
+
+/**
+ * First-draft CSP, shipped REPORT-ONLY.
+ *
+ * Nothing here is enforced yet: the app currently has no script-src at all, so
+ * an XSS anywhere is unconstrained. Guessing the allow-list and enforcing it
+ * would blank the app; instead this collects violation reports from real
+ * traffic until the list is known to be complete, then it gets promoted to the
+ * enforcing `Content-Security-Policy` header.
+ *
+ * Known-loose parts, to tighten before promotion:
+ * - `'unsafe-inline'` / `'unsafe-eval'` in script-src: Next's inline bootstrap
+ *   and the wallet SDKs need them today. Moving to nonces is its own change.
+ * - connect-src can't enumerate every chain RPC (they come from env and vary by
+ *   network), so the report stream is what completes this list.
+ */
+function contentSecurityPolicyReportOnly() {
+    const reportUri = sentryCspReportUri()
+    const directives = [
+        "default-src 'self'",
+        // PostHog is same-origin via the /relay rewrite, so it needs no entry here.
+        "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://client.crisp.chat https://static.sumsub.com",
+        "style-src 'self' 'unsafe-inline' https://client.crisp.chat",
+        "img-src 'self' data: blob: https:",
+        "font-src 'self' data: https://client.crisp.chat",
+        [
+            "connect-src 'self'",
+            'https://api.peanut.me',
+            'https://*.peanut.me',
+            'https://*.ingest.sentry.io',
+            'https://*.ingest.us.sentry.io',
+            'https://www.google-analytics.com',
+            'https://rpc.zerodev.app',
+            'https://*.g.alchemy.com',
+            'https://rpc.ankr.com',
+            'https://assets.coingecko.com',
+            'https://coin-images.coingecko.com',
+            'https://api.frankfurter.app',
+            'https://dolarapi.com',
+            'https://client.crisp.chat',
+            'wss://client.relay.crisp.chat',
+            'https://*.sumsub.com',
+            'https://widget.manteca.dev',
+        ].join(' '),
+        "frame-src 'self' https://client.crisp.chat https://*.sumsub.com https://widget.manteca.dev https://mpago.la",
+        "worker-src 'self' blob:",
+        "object-src 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+    ]
+    // Both delivery mechanisms on purpose: `report-uri` is deprecated but what
+    // Firefox/Safari actually send today, `report-to` (backed by the
+    // Reporting-Endpoints header below) is what replaces it in Chromium.
+    // Shipping only one would undercount violations and promote the policy on
+    // a partial picture.
+    if (reportUri) directives.push(`report-uri ${reportUri}`, `report-to ${CSP_REPORT_GROUP}`)
+    return directives.join('; ')
+}
+
+const CSP_REPORT_GROUP = 'csp-endpoint'
+
+function reportingEndpointsHeader() {
+    const reportUri = sentryCspReportUri()
+    if (!reportUri) return []
+    return [{ key: 'Reporting-Endpoints', value: `${CSP_REPORT_GROUP}="${reportUri}"` }]
+}
+
 // Get git commit hash at build time
 let gitCommitHash = 'unknown'
 try {
@@ -186,7 +277,14 @@ let nextConfig = {
                     },
                     // Security headers - prevents clickjacking and other attacks
                     // Using frame-ancestors instead of X-Frame-Options to allow specific domains
-                    { key: 'Content-Security-Policy', value: "frame-ancestors 'self' https://hugo0.com" },
+                    // object-src/base-uri are safe to enforce today: the app embeds no
+                    // plugins and sets no <base>, so neither can break a working page.
+                    {
+                        key: 'Content-Security-Policy',
+                        value: "frame-ancestors 'self' https://hugo0.com; object-src 'none'; base-uri 'self'",
+                    },
+                    { key: 'Content-Security-Policy-Report-Only', value: contentSecurityPolicyReportOnly() },
+                    ...reportingEndpointsHeader(),
                     { key: 'X-Content-Type-Options', value: 'nosniff' },
                     { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
                 ],

scripts/__tests__/native-build-scan.test.js

@@ -0,0 +1,57 @@
+const fs = require('fs')
+const path = require('path')
+const Module = require('module')
+
+const SCRIPT_PATH = path.join(__dirname, '..', 'native-build.js')
+
+// native-build.js is a script, not a module: it calls main() at import time and
+// exports nothing. Load the real source with that call stripped so the scan
+// helpers can be asserted against the actual app tree.
+function loadScriptInternals() {
+    const source = fs.readFileSync(SCRIPT_PATH, 'utf-8')
+    const withoutEntrypoint = source.replace(/\nmain\(\)\s*$/, '\n')
+    expect(withoutEntrypoint).not.toBe(source)
+
+    const exposed =
+        withoutEntrypoint +
+        '\nmodule.exports = { isHandledByTransform, detectUncoveredServerRoutes, P0_TRANSFORMS, APP_DIR }\n'
+
+    const mod = new Module(SCRIPT_PATH, null)
+    mod.filename = SCRIPT_PATH
+    mod.paths = Module._nodeModulePaths(path.dirname(SCRIPT_PATH))
+    mod._compile(exposed, SCRIPT_PATH)
+    return mod.exports
+}
+
+const { isHandledByTransform, detectUncoveredServerRoutes, P0_TRANSFORMS, APP_DIR } = loadScriptInternals()
+
+const toPosix = (p) => p.split(path.sep).join('/')
+
+describe('native build server-route scan', () => {
+    it('treats every P0_TRANSFORMS entry as handled', () => {
+        for (const transform of P0_TRANSFORMS) {
+            expect(isHandledByTransform(transform.path)).toBe(true)
+        }
+    })
+
+    // The scan passes `path.relative(APP_DIR, full)` into the predicate. If the
+    // predicate compared a different path shape it would silently never match.
+    it('matches the relative path shape the scan actually computes', () => {
+        for (const transform of P0_TRANSFORMS) {
+            const absolute = path.join(APP_DIR, transform.path)
+            expect(isHandledByTransform(path.relative(APP_DIR, absolute))).toBe(true)
+        }
+    })
+
+    it('does not suppress routes that are not transformed', () => {
+        expect(isHandledByTransform('some/other/page.tsx')).toBe(false)
+        expect(isHandledByTransform('api/foo/route.ts')).toBe(false)
+        expect(isHandledByTransform('(mobile-ui)/claim/layout.tsx')).toBe(false)
+    })
+
+    it('does not flag transformed pages as uncovered server routes', () => {
+        const transformed = new Set(P0_TRANSFORMS.map((t) => t.path))
+        const offenders = detectUncoveredServerRoutes().filter((o) => transformed.has(toPosix(o.rel)))
+        expect(offenders).toEqual([])
+    })
+})

scripts/native-build.js

@@ -248,6 +248,14 @@ function isCoveredByDisableList(relPath) {
     })
 }
 
+// P0_TRANSFORMS files are replaced with static-export-safe stubs before `next
+// build`, so their server-only exports (generateMetadata, force-dynamic) never
+// reach the export — the scan must not flag them.
+function isHandledByTransform(relPath) {
+    const normalized = relPath.split(path.sep).join('/')
+    return P0_TRANSFORMS.some((t) => t.path === normalized)
+}
+
 function detectUncoveredServerRoutes(dir = APP_DIR, found = []) {
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
         if (entry.name.includes('.disabled') || entry.name.startsWith('_')) continue
@@ -258,7 +266,7 @@ function detectUncoveredServerRoutes(dir = APP_DIR, found = []) {
             detectUncoveredServerRoutes(full, found)
             continue
         }
-        if (isCoveredByDisableList(rel)) continue
+        if (isCoveredByDisableList(rel) || isHandledByTransform(rel)) continue
         if (entry.name === 'route.ts' || entry.name === 'route.js') {
             found.push({ rel, reason: 'route handler (cannot be statically exported)' })
             continue

sentry.utils.test.ts

@@ -0,0 +1,19 @@
+import type { ErrorEvent } from '@sentry/nextjs'
+import { shouldIgnoreError } from './sentry.utils'
+
+function eventWith(partial: { message?: string; type?: string; value?: string }): ErrorEvent {
+    return {
+        message: partial.message,
+        exception: { values: [{ type: partial.type, value: partial.value }] },
+    } as unknown as ErrorEvent
+}
+
+describe('shouldIgnoreError — alreadyReported (fetchWithSentry wrapper)', () => {
+    it('ignores a re-thrown ServiceUnavailableError (already captured at the fetch site)', () => {
+        expect(shouldIgnoreError(eventWith({ type: 'ServiceUnavailableError', value: 'upstream 503' }))).toBe(true)
+    })
+
+    it('does not ignore an unrelated application error', () => {
+        expect(shouldIgnoreError(eventWith({ type: 'TypeError', value: 'x is not a function' }))).toBe(false)
+    })
+})

sentry.utils.ts

@@ -38,6 +38,15 @@ const IGNORED_ERRORS = {
     // Third-party scripts we don't control
     thirdParty: ['googletagmanager', 'gtag', 'analytics', 'hotjar', 'clarity', 'intercom', 'crisp'],
 
+    // fetchWithSentry wrapper errors: the underlying timeout/network/HTTP
+    // failure is already captured at the fetch site with full context, so the
+    // re-thrown ServiceUnavailableError bubbling to global handlers (or being
+    // console.error'd by a consumer) would only double-count it (PEANUT-UI-QDJ).
+    // Substring-matching this pattern is safe only because ServiceUnavailableError
+    // is our own internal fetchWithSentry wrapper name, not a generic string that
+    // could appear in an unrelated third-party error message.
+    alreadyReported: ['ServiceUnavailableError'],
+
     // Third-party SDK internal errors (not actionable)
     thirdPartySdkErrors: [
         'IndexedDB:Set:InternalError', // Vercel Analytics storage - fails in private browsing, not actionable
@@ -58,12 +67,14 @@ export function shouldIgnoreError(event: ErrorEvent): boolean {
     const exceptionType = event.exception?.values?.[0]?.type || ''
     const culprit = (event as any).culprit || ''
 
-    const searchText = `${message} ${exceptionValue} ${exceptionType} ${culprit}`.toLowerCase()
+    // Match each field independently — concatenating them would let a pattern
+    // match across unrelated fields and suppress a legitimate event.
+    const searchTexts = [message, exceptionValue, exceptionType, culprit]
 
     // Check all ignore patterns
     for (const patterns of Object.values(IGNORED_ERRORS)) {
         for (const pattern of patterns) {
-            if (searchText.includes(pattern.toLowerCase())) {
+            if (searchTexts.some((text) => text.toLowerCase().includes(pattern.toLowerCase()))) {
                 return true
             }
         }