fix(affiliate): scope signed login and consume nonces once

[0xApotheosis]

Description

Accept affiliate login signatures only for the configured dashboard origin, expected statement and Arbitrum chain. Store challenges in PostgreSQL and consume them atomically so a nonce cannot be redeemed twice across service replicas.

Issue and verify JWTs with a dedicated issuer, audience and algorithm. Existing unscoped tokens no longer authorize affiliate changes.

What this affects

Affiliate dashboard wallet sign-in and protected affiliate-settings changes in swap-service. It is the affiliate administrator's signed login, not a new login requirement for ordinary ShapeShift users or device notification profiles. Existing affiliate sessions must sign in again.

Risk

High: changes affiliate login and requires a database migration. Existing sessions will need to sign in again. The policy intentionally matches the current dashboard message and chain 42161.

Deployment and QA environment

Pre-merge: Engineering deploys swap-service from this PR to an isolated Railway microservices QA environment, applies the siwe_nonces PostgreSQL migration, and configures SIWE_ALLOWED_ORIGINS for the exact test dashboard origin. Replicas must share the same test database. The current Railway project has develop/production environments, not a verified per-PR preview.

Build a test affiliate dashboard with VITE_API_URL pointing at that swap-service and post its URL. Dashboard preview hosting was not verified, so this PR does not assume an automatic preview exists. The existing dashboard UI is sufficient; no dashboard code change is required. Prepare a registered test affiliate account and safe original/replacement settings for Operations.

Release: Apply the migration and configure the production dashboard origin before deploying swap-service. Repeat the sign-in/settings smoke test against the intended production dashboard after deployment. Explain the required re-login to affiliate operators. There is no native app or main trading-app release dependency.

QA handoff: Environment inventory was checked on 9 October 2026. Before Operations starts, Engineering posts the exact app/install links, deployed commit/build numbers, test fixtures and readiness confirmation in this PR. Operations records the browser/device, steps passed/failed and screenshots of failures. Environment preparation and tests described here are a plan, not a claim that deployment or live QA has already happened.

Testing

Engineering

Validated locally: 11 signature/policy/replay/JWT tests, TypeScript, changed-source lint and Prisma schema validation passed.

With Node 22 and Yarn 4:

yarn install --immutable
yarn db:generate
yarn jest --config apps/swap-service/jest.config.ts --runInBand --runTestsByPath apps/swap-service/src/affiliate/__tests__/siwe-auth.test.ts
yarn prisma validate

The tests use real signatures with mocked nonce persistence. Run the following against a disposable PostgreSQL database and two service replicas.

Integration/security checks — Engineering

The checks below require service configuration, API tools or backend observation. Engineering owns them; the click-through Operations checklist follows. Any environment setup mentioned here must follow the deployment plan above.

1. Apply the SIWE nonce migration and configure SIWE_ALLOWED_ORIGINS to the exact dashboard origin. Sign in from that dashboard and confirm the authenticated account can load and update its own affiliate settings using test values.
2. Sign otherwise valid messages with another origin/domain, a different statement, another chain, future issuance or an expired lifetime. Each must be rejected without issuing a token.
3. Redeem the same valid nonce concurrently through both replicas. Exactly one request must succeed. Replay it afterward and confirm rejection.
4. Confirm login works with both ordinary and compact EIP-2098 signatures from supported wallets.
5. Try an old JWT or a token with the wrong issuer/audience/algorithm. Affiliate changes must be denied. Sign in again and confirm the replacement session works.

Operations

Open: Engineering's test affiliate dashboard, using the supplied registered test wallet and settings values.

1. Connect the test wallet and open Settings. Click Sign In, then approve the wallet's sign-in message. The page should show Authenticated. This signs a message; it should not ask to send a transaction or pay gas.
2. In Affiliate BPS, enter the supplied test value and click Update. Refresh the page. The saved value should still be shown.
3. Restore the original BPS value with Update, then refresh and check it again.
4. Click Sign Out. The page should return to the sign-in state and protected editing controls should no longer be available. Sign in again and check that editing is restored.
5. Engineering supplies a browser profile holding an old session from before this change. Open Settings there and try the prepared update. It must require a fresh valid sign-in. Sign in again and confirm the update works, then restore the original value.

Pass: A valid affiliate can sign in and manage its own test settings; an old session cannot silently keep authorization. Engineering covers forged signatures, other origins/chains and concurrent nonce replay.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}