Route MoonPay iOS buys through a Private Relay interstitial check - #6151
Route MoonPay iOS buys through a Private Relay interstitial check#6151j0ntz wants to merge 2 commits into
Conversation
Sorry, something went wrong.
📸 Test evidencemoonpay buy quotes
safari widget fallback bound
safari interstitial unbound
Captured by the agent's in-app test run (build-and-test). |
Sorry, something went wrong.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Sorry, something went wrong.
There was a problem hiding this comment.
Claude Code Review
Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.
Tip: disable this comment in your organization's Code Review settings.
Sorry, something went wrong.
iOS buy opens the MoonPay widget in an SFSafariViewController whose traffic can egress through iCloud Private Relay, so a widget URL bound to the app-fetch IP mismatches what MoonPay observes for relay users and will fail their buys once IP-match enforcement turns on. The buy path now asks the info server for a relay-check interstitial URL and opens that in the Safari view: the server observes the Safari view's own egress and 302s to the widget URL signed with the IP binding when the addresses agree, or without it when they diverge. Any interstitial failure falls back to today's bound flow, so the change cannot regress buys even against servers without relay-check support. Sell and Android are untouched. MOONPAY_RELAY_CHECK_SIGN_PROXY (dev builds only) reroutes the one relay-check POST through an alternate egress so the unbound branch is reproducible on a simulator. The TDD at src/docs/moonpay-private-relay-interstitial.md documents both repos' changes.
paullinator
left a comment
There was a problem hiding this comment.
Additional Findings
- suggestion: PR Requirements leaves all device-test boxes unchecked with "No visual changes", while the Description/TDD correctly call out that the physical-device Private Relay pass is still outstanding and that MoonPay enforcement must stay off until it completes.
- Keep the no-visual-changes note, but add an explicit checklist item for the iCloud+ Private Relay on-device buy pass, and leave it unchecked until done.
Sorry, something went wrong.
|
Top-level review note (review 4965479992) addressed: the Requirements checklist now carries an explicit unchecked item for the iCloud+ Private Relay on-device buy pass (MoonPay enforcement stays off until it completes), alongside the no-visual-changes note. |
Sorry, something went wrong.
|
Addressed (Requirements now carries the unchecked iCloud+ Private Relay on-device buy pass item; details in the earlier reply comment). |
Sorry, something went wrong.
Reviewers
At least 1 approving review is required to merge this pull request.
Technical Design Document
moonpay-private-relay-interstitial.md
CHANGELOG
Does this branch warrant an entry to the CHANGELOG?
Dependencies
EdgeApp/edge-info-server#160 (soft dependency: without it the app falls back to today's bound flow, so this PR is safe to land first)
Requirements
If you have made any visual changes to the GUI. Make sure you have:
No visual changes: only the URL handed to the external Safari view differs; the relay pass above is the outstanding device item.
Description
Asana task
iOS buys open the MoonPay widget through the server's Private Relay relay-check interstitial instead of a directly IP-bound URL, so the server can compare the app-fetch and Safari-view egress addresses and sign the widget URL with or without the binding. Any interstitial failure falls back to today's bound flow, so buys cannot regress; sell and Android are untouched. MOONPAY_RELAY_CHECK_SIGN_PROXY (dev builds only) makes the divergence branch reproducible on a simulator.
The TDD linked above carries the full design for both repos. The physical-device Private Relay pass is the outstanding manual item; MoonPay enforcement stays off until it completes.
Note
Medium Risk
Changes the critical path for iOS fiat on-ramp URL signing and IP binding, with intentional fallback to the old flow on failure; paired info-server behavior determines whether relay users succeed under MoonPay enforcement.
Overview
iOS MoonPay buys no longer open a directly IP-bound widget URL in Safari. They first request a relay-check interstitial from the info server (relayCheck: true on signUrl); that URL is opened in SFSafariViewController so the server can compare app-fetch vs Safari egress and redirect to a signed widget with or without allowedIpAddress. Sell and Android buy still use direct bound signing.
If the interstitial request fails (network, old server, empty URL), the buy path falls back to today’s bound signMoonpayUrl flow so buys should not regress without the paired info-server deploy.
moonpaySign.ts centralizes postSignUrl (shared timeout and error handling). Dev-only MOONPAY_RELAY_CHECK_SIGN_PROXY reroutes the relay-check POST through an alternate egress for simulator testing of the unbound branch.
Adds unit tests for signing and interstitial fetch, a CHANGELOG entry, and a cross-repo TDD in moonpay-private-relay-interstitial.md.
Reviewed by Cursor Bugbot for commit 2b5d37c. Bugbot is set up for automated code reviews on this repo. Configure here.