feat(dapp): authenticate read endpoints with SIWE-issued JWT

[sadiq1971]

Dapp counterpart to the middleware's read-API authentication (ChainSafe/canton-middleware#352 / #353 / #354). The transfer listings (/api/v2/transfer/incoming|outgoing|completed) and /profile are now called with a SIWE-issued bearer token instead of the removed X-Signature/X-Message headers and ?address= query parameter.

What changed

New lib/auth.ts — the SIWE (EIP-4361) session layer:

• ensureAuthToken: fetches a nonce from GET /auth/nonce, builds the EIP-4361 message (EIP-55 checksummed address, as siwe-go requires), signs it with personal_sign, and exchanges it at POST /auth/login for the JWT. Tokens are cached in sessionStorage per address and refreshed 60s before expires_at.
• Single-flight per (middleware, address): dashboard pages fire 3–4 read calls at once; they share one login, so the user sees exactly one MetaMask prompt.
• authorizedFetch: attaches Authorization: Bearer on reads; on a 401 (token rejected early / signing key rotated) it drops the session and re-logins once.
• Auth-disabled fallback: when the middleware has no auth config block the /auth routes 404, and reads fall back to the legacy ?address= parameter — so the dapp works against both middleware versions during rollout.
• interactive: false mode for the refresh auto-reconnect path: a page load never pops a signature prompt; an expired session just lands back on the connect button (same behavior as before).

Connect flow (App.tsx): the old login:<addr>:<ts> session signature and its expired-retry dance are gone. getUser now triggers the SIWE login when needed. Since /auth/login rejects unregistered addresses (address is not registered, 401), that rejection — surfaced as NotRegisteredError — routes to registration where a null profile used to. Prompt count is unchanged: one signature on connect, one on registration.

SIWE message parameters must match the middleware's auth config or login is rejected:

• domain/uri default to the dapp's own origin, overridable with VITE_SIWE_DOMAIN / VITE_SIWE_URI (plumbed through the Dockerfile/entrypoint). The local docker stack needs the overrides (localhost / http://localhost) since vite serves on port 3000 — documented in .env.example and docs/testing-with-middleware.md.
• chain_id is fetched from the middleware's own /eth RPC, which the auth config mirrors on every deployed network — no new config needed.

Sessions (lib/session.ts) now store {token, expiresAt}; leftover pre-JWT entries parse as "no session", so upgraded users just reconnect once.

Token expiry mid-session (TTL 6h) surfaces as one re-login prompt on the next read, per the no-refresh-token design in canton-middleware#354.

⚠️ Deploy order: the middleware (#354, or at least its auth-disabled build) must deploy before this dapp. Against a pre-#354 middleware, /profile still requires the removed X-Signature/X-Message headers, and this dapp can no longer send them — connect would fail for everyone. The legacy fallback here targets #354's auth-disabled mode, not the pre-#354 API.

Deploy note: on deployed networks no SIWE env overrides are needed — the middleware's auth configs pin domain/uri to the dapp origin (evm-middleware.chainsafe.io on mainnet, dapp-dev1.01.chainsafe.dev on devnet), which is exactly what the dapp sends by default. The VITE_SIWE_DOMAIN/VITE_SIWE_URI overrides are only for local dev, where the docker stack expects localhost / http://localhost while vite serves on localhost:3000.

Tests

packages/dapp/src/lib/auth.test.ts (first dapp unit tests): message layout, bearer attachment + token reuse, concurrent-read single-flight, auth-disabled fallback, 401 re-login, expiry-margin refresh, non-interactive SessionExpiredError, NotRegisteredError, and single-flight cleanup after a failed login. A workflow-backed self-review added fixes (and tests) for: the concurrent-401 race that could wipe a freshly re-issued token, the auth-disabled marker not being re-stored after disconnect, the post-registration dashboard entry popping an unplanned signature prompt (sign-in now runs on the “Go to dashboard” click), serialized nonce/chain-id fetches aging the nonce, case-sensitive matching of the “not registered” rejection, and two divergent isUserRejection helpers. npm test, npm run lint, npm run format:check, and npm run build all pass.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request implements Sign-In with Ethereum (SIWE, EIP-4361) to authenticate read-endpoint requests against the middleware. It introduces a new auth module to manage nonces, signatures, and JWT session tokens, and updates API calls (profile and transfer listings) to use bearer tokens with a fallback to the legacy query parameter. Feedback is provided regarding a case-sensitive error message check in the login flow that could be made more robust by using a case-insensitive comparison.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The error message check msg.includes("not registered") is case-sensitive. If the server's error message capitalization changes (e.g., to "Not registered" or "Address is not registered"), this check will fail to identify the unregistered state, leading to unexpected behavior. It is safer to perform a case-insensitive check using .toLowerCase().

Suggested change

	if (res.status === 401 && msg.includes("not registered")) throw new NotRegisteredError();
	if (res.status === 401 && msg.toLowerCase().includes("not registered")) throw new NotRegisteredError();