code/cl8y-ecosystem-legal

Fork 0

ops: register ust1cmm.com property + CORS + portal redirect allowlist #8

New issue

Closed

opened 2026-08-15 09:52:07 +00:00 by PlasticDigits · 2 comments

PlasticDigits commented

2026-08-15 09:52:07 +00:00

(Migrated from gitlab.com)

Summary

Register USTR CMM (ust1cmm.com) as a Legal property and allow the production origin to call the API and return from the portal.

Integrator: ustr-cmm#12 / ustr-cmm!28. The frontend already uses @plasticdigits/cl8y-clickwrap with property=ust1cmm.com and network=TerraClassic. Without this ops change, connected wallets on https://ust1cmm.com fail-closed (Failed to fetch / unsigned) even after a portal sign.

Acceptances are per hostname. A signature on cl8y.com or dex.cl8y.com is not evidence for ust1cmm.com.

Related: #7 (wildcard CORS) does not cover this — ust1cmm.com is a different registrable domain. Add the exact origin.

Actions (Legal Coolify / hosts)

1. Register the property

From a cl8y-ecosystem-legal checkout (script prompts for ADMIN_TOKEN hidden; do not put the token in this issue or in ustr-cmm):

./scripts/register-property.sh ust1cmm.com "USTR CMM"
./scripts/register-property.sh --list

2. Legal API env (`api.terms.cl8y.com`)

Add the exact origin to CORS_ORIGINS (comma-separated, no trailing slash):

# keep existing entries; append
CORS_ORIGINS=…,https://ust1cmm.com

Redeploy / restart the API so build_cors picks it up.

3. Legal portal env (`terms.cl8y.com` web build)

Add the exact origin to VITE_REDIRECT_URI_ALLOWLIST and rebuild the portal (Vite bakes this in):

# keep existing entries; append
VITE_REDIRECT_URI_ALLOWLIST=…,https://ust1cmm.com

Do not enable VITE_ALLOW_LOCALHOST_REDIRECT on production portal.

4. Verify

# property exists + Terra Classic sign URL
curl -sS 'https://api.terms.cl8y.com/api/v1/terms/latest?property=ust1cmm.com' | jq '{property, version_label, terra: .sign_urls.terra_classic}'

# CORS preflight from the dapp origin
curl -sSI -X OPTIONS 'https://api.terms.cl8y.com/api/v1/signatures/status' \
  -H 'Origin: https://ust1cmm.com' \
  -H 'Access-Control-Request-Method: GET' \
  | grep -i 'access-control-allow-origin'
# expect: Access-Control-Allow-Origin: https://ust1cmm.com

On https://ust1cmm.com: connect a new terra1… → accept panel → portal /sign/terra-classic?property=ust1cmm.com&redirect_uri=https%3A%2F%2Fust1cmm.com%2F… → return → signed_latest: true.

Pins

Item	Value
Property	`ust1cmm.com`
Display name	`USTR CMM`
Origin	`https://ust1cmm.com`
Network	`TerraClassic` / API `TERRA_CLASSIC`
Do not use	`cl8y.com`, `dex.cl8y.com`, `www.ust1cmm.com` (unless that host is actually served)

Out of scope

No ADMIN_TOKEN in the ustr-cmm frontend.
No change to terms text / version unless product asks.
ustr-cmm Coolify does not need new Legal URLs (SDK defaults to api.terms.cl8y.com / terms.cl8y.com). See integrator issue #12 for frontend env (mostly: leave VITE_PLAYWRIGHT_E2E and VITE_LEGAL_PROPERTY unset on prod).

## Summary Register **USTR CMM** (`ust1cmm.com`) as a Legal property and allow the production origin to call the API and return from the portal. Integrator: [ustr-cmm#12](https://gitlab.com/PlasticDigits2/ustr-cmm/-/issues/12) / [ustr-cmm!28](https://gitlab.com/PlasticDigits2/ustr-cmm/-/merge_requests/10). The frontend already uses `@plasticdigits/cl8y-clickwrap` with `property=ust1cmm.com` and `network=TerraClassic`. Without this ops change, connected wallets on `https://ust1cmm.com` fail-closed (`Failed to fetch` / unsigned) even after a portal sign. Acceptances are **per hostname**. A signature on `cl8y.com` or `dex.cl8y.com` is not evidence for `ust1cmm.com`. Related: [#7](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/issues/7) (wildcard CORS) does **not** cover this — `ust1cmm.com` is a different registrable domain. Add the **exact** origin. --- ## Actions (Legal Coolify / hosts) ### 1. Register the property From a `cl8y-ecosystem-legal` checkout (script prompts for `ADMIN_TOKEN` hidden; do not put the token in this issue or in ustr-cmm): ```bash ./scripts/register-property.sh ust1cmm.com "USTR CMM" ./scripts/register-property.sh --list ``` ### 2. Legal API env (`api.terms.cl8y.com`) Add the exact origin to `CORS_ORIGINS` (comma-separated, no trailing slash): ```bash # keep existing entries; append CORS_ORIGINS=…,https://ust1cmm.com ``` Redeploy / restart the API so `build_cors` picks it up. ### 3. Legal portal env (`terms.cl8y.com` **web build**) Add the exact origin to `VITE_REDIRECT_URI_ALLOWLIST` and **rebuild** the portal (Vite bakes this in): ```bash # keep existing entries; append VITE_REDIRECT_URI_ALLOWLIST=…,https://ust1cmm.com ``` Do **not** enable `VITE_ALLOW_LOCALHOST_REDIRECT` on production portal. ### 4. Verify ```bash # property exists + Terra Classic sign URL curl -sS 'https://api.terms.cl8y.com/api/v1/terms/latest?property=ust1cmm.com' | jq '{property, version_label, terra: .sign_urls.terra_classic}' # CORS preflight from the dapp origin curl -sSI -X OPTIONS 'https://api.terms.cl8y.com/api/v1/signatures/status' \ -H 'Origin: https://ust1cmm.com' \ -H 'Access-Control-Request-Method: GET' \ | grep -i 'access-control-allow-origin' # expect: Access-Control-Allow-Origin: https://ust1cmm.com ``` On `https://ust1cmm.com`: connect a new `terra1…` → accept panel → portal `/sign/terra-classic?property=ust1cmm.com&redirect_uri=https%3A%2F%2Fust1cmm.com%2F…` → return → `signed_latest: true`. --- ## Pins | Item | Value | |------|--------| | Property | `ust1cmm.com` | | Display name | `USTR CMM` | | Origin | `https://ust1cmm.com` | | Network | `TerraClassic` / API `TERRA_CLASSIC` | | Do not use | `cl8y.com`, `dex.cl8y.com`, `www.ust1cmm.com` (unless that host is actually served) | ## Out of scope - No `ADMIN_TOKEN` in the ustr-cmm frontend. - No change to terms text / version unless product asks. - ustr-cmm Coolify does **not** need new Legal URLs (SDK defaults to `api.terms.cl8y.com` / `terms.cl8y.com`). See integrator issue #12 for frontend env (mostly: leave `VITE_PLAYWRIGHT_E2E` and `VITE_LEGAL_PROPERTY` **unset** on prod).

PlasticDigits commented

2026-08-15 10:05:09 +00:00

(Migrated from gitlab.com)

Ops complete — verification 2026-08-15

Completed on Legal Coolify / hosts (no ADMIN_TOKEN recorded here).

Steps done

Property — ./scripts/register-property.sh ust1cmm.com "USTR CMM" (and --list).
API — appended https://ust1cmm.com to CORS_ORIGINS on api.terms.cl8y.com; API restarted.
Portal — appended https://ust1cmm.com to VITE_REDIRECT_URI_ALLOWLIST; portal rebuilt. VITE_ALLOW_LOCALHOST_REDIRECT left off in production.

Automated verify (pass)

Property + Terra Classic sign URL

GET https://api.terms.cl8y.com/api/v1/terms/latest?property=ust1cmm.com

Field	Result
`property`	`ust1cmm.com`
`version_label`	`1.5`
`sign_urls.terra_classic`	`https://terms.cl8y.com/sign/terra-classic?property=ust1cmm.com`
`content_sha256`	`fe8f0029fb14fb8c1705f6c462d384153660ac98954502a406634f73822f6189`

CORS preflight (OPTIONS /api/v1/signatures/status, Origin: https://ust1cmm.com)

HTTP 200
Access-Control-Allow-Origin: https://ust1cmm.com

Negative check: Origin: https://www.ust1cmm.com → no Access-Control-Allow-Origin (expected; exact origin only).

Portal allowlist (production bundle)

https://terms.cl8y.com/assets/index-BEep-Wfy.js includes https://ust1cmm.com alongside existing origins (cl8y.com, dex.cl8y.com, yieldomega.com, …). No VITE_ALLOW_LOCALHOST_REDIRECT string in the bundle.

Not run here

Live wallet round-trip on https://ust1cmm.com (connect terra1… → portal sign → signed_latest: true) still needs a Keplr session on the dapp. API + CORS + baked redirect origin are in place for that path.

Closing: issue acceptance curls and portal bake-in succeeded.

## Ops complete — verification 2026-08-15 Completed on Legal Coolify / hosts (no `ADMIN_TOKEN` recorded here). ### Steps done 1. **Property** — `./scripts/register-property.sh ust1cmm.com "USTR CMM"` (and `--list`). 2. **API** — appended `https://ust1cmm.com` to `CORS_ORIGINS` on `api.terms.cl8y.com`; API restarted. 3. **Portal** — appended `https://ust1cmm.com` to `VITE_REDIRECT_URI_ALLOWLIST`; portal rebuilt. `VITE_ALLOW_LOCALHOST_REDIRECT` left off in production. ### Automated verify (pass) **Property + Terra Classic sign URL** ``` GET https://api.terms.cl8y.com/api/v1/terms/latest?property=ust1cmm.com ``` | Field | Result | |-------|--------| | `property` | `ust1cmm.com` | | `version_label` | `1.5` | | `sign_urls.terra_classic` | `https://terms.cl8y.com/sign/terra-classic?property=ust1cmm.com` | | `content_sha256` | `fe8f0029fb14fb8c1705f6c462d384153660ac98954502a406634f73822f6189` | **CORS preflight** (`OPTIONS /api/v1/signatures/status`, `Origin: https://ust1cmm.com`) - HTTP 200 - `Access-Control-Allow-Origin: https://ust1cmm.com` Negative check: `Origin: https://www.ust1cmm.com` → no `Access-Control-Allow-Origin` (expected; exact origin only). **Portal allowlist (production bundle)** `https://terms.cl8y.com/assets/index-BEep-Wfy.js` includes `https://ust1cmm.com` alongside existing origins (`cl8y.com`, `dex.cl8y.com`, `yieldomega.com`, …). No `VITE_ALLOW_LOCALHOST_REDIRECT` string in the bundle. ### Not run here Live wallet round-trip on `https://ust1cmm.com` (connect `terra1…` → portal sign → `signed_latest: true`) still needs a Keplr session on the dapp. API + CORS + baked redirect origin are in place for that path. Closing: issue acceptance curls and portal bake-in succeeded.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-08-15 10:05:10 +00:00

PlasticDigits commented

2026-08-25 07:04:39 +00:00

(Migrated from gitlab.com)

mentioned in issue #12