add: url signing for onramper widget

[L03TJ3]

Description

Adding endpoing to Sign url content for onramper flow.

• include endpoint that signs url for onramper flow
• awaiting receiving secret key from onramper support before this flow can be tested.

Summary by Sourcery

Add an endpoint to sign Onramper URL content using a configurable secret and expose it through the verification API.

New Features:

• Introduce a POST /verify/onramper/sign endpoint that returns an HMAC-SHA256 signature for provided Onramper URL content using a server-side secret.

Tests:

• Add integration tests covering successful signing, missing payload validation, and missing secret handling for the Onramper signing endpoint.

[sourcery-ai]

Hey - I've found 2 issues, and left some high level feedback:

• Consider whether allowing passport.authenticate(['jwt', 'anonymous']) on /verify/onramper/sign is intended, as this exposes a generic signing oracle to unauthenticated callers; you may want to require a fully authenticated user or additional checks.
• The signContent validation currently treats non-string values the same as missing input; if this endpoint might be used programmatically, distinguishing between missing and invalid types (or coercing via String(signContent)) could make error handling clearer.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider whether allowing `passport.authenticate(['jwt', 'anonymous'])` on `/verify/onramper/sign` is intended, as this exposes a generic signing oracle to unauthenticated callers; you may want to require a fully authenticated user or additional checks.
- The `signContent` validation currently treats non-string values the same as missing input; if this endpoint might be used programmatically, distinguishing between missing and invalid types (or coercing via `String(signContent)`) could make error handling clearer.

## Individual Comments

### Comment 1
<location path="src/server/verification/verificationAPI.js" line_range="801" />
<code_context>
+  app.post(
+    '/verify/onramper/sign',
+    requestRateLimiter(20, 1),
+    passport.authenticate(['jwt', 'anonymous'], { session: false }),
+    wrapAsync(async (req, res) => {
+      const { log, body = {} } = req
</code_context>
<issue_to_address>
**🚨 issue (security):** Allowing the `anonymous` strategy here turns this into a public signing oracle, which effectively exposes the HMAC capability to anyone.

With `passport.authenticate(['jwt', 'anonymous'])`, this endpoint will sign arbitrary `signContent` with the shared HMAC secret for unauthenticated callers, effectively exposing the signing capability and undermining the purpose of the secret.

Require a strictly authenticated strategy (e.g. `jwt` only) and/or add authorization so only trusted callers can access this endpoint; otherwise any external party can generate valid Onramper signatures as if they held the secret.
</issue_to_address>

### Comment 2
<location path="src/server/verification/__tests__/verificationAPI.js" line_range="552-558" />
<code_context>
+      })
+    })
+
+    test('POST /verify/onramper/sign returns 400 for missing signContent', async () => {
+      await request(server).post('/verify/onramper/sign').send({}).expect(400, {
+        ok: -1,
+        error: 'missing signContent'
+      })
+    })
+
</code_context>
<issue_to_address>
**suggestion (testing):** Add a test case for non-string `signContent` to cover the type check branch.

The case where `signContent` is present but not a string (`typeof signContent !== 'string'`) isn’t currently tested. Please add a test (e.g. `send({ signContent: { foo: 'bar' } })` or a number/array) and assert it returns the same 400 response, so the type guard branch is covered and protected against regressions.

```suggestion
    test('POST /verify/onramper/sign returns 400 for missing signContent', async () => {
      await request(server).post('/verify/onramper/sign').send({}).expect(400, {
        ok: -1,
        error: 'missing signContent'
      })
    })

    test('POST /verify/onramper/sign returns 400 for non-string signContent', async () => {
      await request(server).post('/verify/onramper/sign').send({
        signContent: { foo: 'bar' }
      }).expect(400, {
        ok: -1,
        error: 'missing signContent'
      })
    })

```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}