Unblock gold purchases and harden the gold app

[ebma]

Summary

A review of apps/gold (ouro. by Vortex, live at /pt-br/gold/) found that no real purchase can complete in production, plus recovery, security and UX defects. This PR fixes what can be fixed safely in the gold app and its Netlify config. API-side findings are listed at the end for follow-up. Every commit is self-contained and passes the gold suite.

Blocking: KYC readiness used a credential-only endpoint

getBrazilBuyReadiness called /v1/ramp-info through the SDK. That route only accepts API credentials (validatePublicKey, apiKeyAuth) and reports on the credential owner, never on the OTP session.

The production build sets no VITE_VORTEX_PUBLIC_KEY: the inlined env object in the live bundle only contains VITE_SIGNING_SERVICE_PATH, and GET /v1/ramp-info answers 401 CREDENTIAL_REQUIRED. So every buy stopped after the e-mail code with "A public or secret API credential is required", and every sell looped back to the code.

Gold now reads the session user's own Avenia account through /v1/brl/getUser, which uses the same resolution as ramp registration. It skips KYC only on identityStatus === "CONFIRMED", as validateKyc.actor.ts does.

Recovery

• Resuming a sell. GET /v1/ramp/:id returns unsignedTxs only with showUnsignedTxs=true, and the SDK never sends that. So "Continuar esta venda" always failed after a declined wallet prompt, a reload or a receipt timeout.
• Abandoned ramps locked the device. Both buttons resume the stored operation, and it was only cleared on a terminal status. Unstarted ramps never become terminal, and failed sells were never cleared.
  • Now a ramp still initial one hour after createdAt counts as failed. The unhandled-payment worker starts paid PIX ramps well before that (it runs every 15 minutes).
  • Failed sells are now cleared, like failed buys.
• Polling. One failed status request ended polling and sent the buyer to the support screen. Transient errors (no response, 408/425/429, 5xx) are now retried, up to 5 in a row.
• PIX countdown. It counted timer ticks, which pause while the user is in the banking app, and it invented 10 minutes on resume. It now reads the clock and uses createdAt + 15 min when a status response has no expiresAt.
• Session refresh. Any refresh error cleared the session. The security spec (Supabase OTP rule 9) allows teardown only on 401.

Correctness and UX

• Price chart. Only 42 days were fetched, so "1A" and "Tudo" showed six weeks, and the badge always showed the 42-day change (−2.6 % live under 1A, against +10.8 % over the actual year). The chart now fetches 365 days, drops "Tudo" (the public CoinGecko API caps history at a year) and shows each period's own change in pt-BR format.
• OTP e-mail language. The OTP e-mail arrived in English, and the API reset the user's stored locale to en-US. Gold now sends locale: "pt-BR", as the widget does.
• Repeated e-mail codes. Every buy and sell asked for a new e-mail code, even with a valid Vortex session in the same tab. Like the widget's stored user e-mail, the session now keeps the address it was verified for and is reused only for that address; a rejected session falls back to the code step. The second sign-in itself (Privy for the wallet, Vortex OTP for the ramp) stays by design.
• KYC country code. country and countryOfTaxId change from "BR" to "BRA", matching packages/kyc. The API passes both unchanged to Avenia.
• Legal links and contrast. The login note now links the pt-BR terms and privacy policy it says the user accepts. Legal and fee notes go from 11px #837d74 (4.0:1) to 12px #6b665f (5.6:1).

Security, CI and performance

• Headers. Netlify now sends these headers for /pt-br/gold/*:

  • frame-ancestors 'none' and X-Frame-Options: DENY, because the page signs transactions and collects PIX keys.
  • nosniff, a referrer policy and a permissions policy.

  The standalone gold.satoshipay.io release had the latter set; the Netlify move dropped them. The headers are scoped to gold, so the widget stays frameable.

• Tests in CI. The root test script and the test job in .github/workflows/ci.yml now run gold's node --test suite (bun run test:gold), which never ran before.

• Images. The landing hero goes from a 1.96 MB PNG to a 209 KB WebP, and the wordmark from 273 KB to 34 KB.

Added in review

• Buy amount locked while quoting. With a reusable session the amount step requests the quote itself; an amount typed meanwhile was shown as the purchase value while the PIX is for the quoted amount.
• Stale error cleared on "Voltar", now that the amount step shows the flow error.
• Failed operations stay visible. Failed and abandoned operations are cleared so they stop blocking new ones, but now stay in "Movimentações" as "Compra/Venda não concluída" with the full operation code for support.
• Signing guard. Resuming a sell signs transactions fetched from the ramp status, and neither the SDK nor the API checks what the user's wallet signs. The wallet now only signs the approve of at most the quoted PAXG to Squid's router (0xce16…D666) and the router swap; anything else fails before the wallet prompt. The unused typed-data handler is removed.
• Start window. updateRamp and startRamp refuse 15 minutes after registration, so a swap sent later (e.g. resuming an old sell) strands the gold. Gold refuses to broadcast within 4 minutes of that deadline and releases the dead ramp.
• Price arrow points down when the period's change is negative.
• CI runs the gold tests (🧪 Gold tests in the test job).

Test plan

• bun run test:gold: 33 pass. There were 17 on staging, and each new test fails there.
• bunx vitest run src/tests/netlify-headers.test.ts src/tests/netlify-redirects.test.ts in apps/frontend. The headers test fails without the netlify.toml change.
• bun run build:gold with the production env.
• Demo-mode walkthrough with no console errors:
  • landing and login links
  • the three chart periods
  • buy to PIX and completion
  • sell to completion
• The gold test step runs in the CI test job.
• On the deploy preview, curl -I <preview>/pt-br/gold/ (and /index.html) shows the new headers; /pt-BR/gold/ 301s to it, /pt-br/widget has none.
• After release, a real low-value buy: the OTP e-mail is in Portuguese, an approved user skips KYC, and the PIX step is reached.
• A real small sell: decline the wallet prompt once, then "Continuar esta venda".
• A second purchase in the same tab goes from the amount straight to the review, without a new e-mail code.

Follow-ups

API

• CPF reservation and enumeration: Validate BRL tax IDs and bind KYC to the claimed CPF #1395 (checksum validation, KYC/KYB bound to the claimed tax ID, cap on probes of other accounts' tax IDs, release runbook). Making a claim exclusive only on approval stays open (RISK-026).
• Sell recovery: Start funded sell ramps that the client never started #1394, the recovery worker starts funded SELL ramps whose client never started them.
• PAXG availability: Retry the Squid token list when it fails to load at boot #1391, the Squid token list is retried until it loads.

Gold

• Landing load, KYC polling, ephemeral keys, CPF check digits: Gold: faster landing, sturdier KYC polling, CPF check and key cleanup #1392 (stacked on this PR).
• Signing checks: in this PR (see "Added in review").
• Selling needs ETH for gas: kept as is for now.
• Widget: the main widget's sign flow has the same missing start-window check; tracked separately.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for vrtx-dashboard canceled.

Name	Link
🔨 Latest commit	082d0fe
🔍 Latest deploy log	https://app.netlify.com/projects/vrtx-dashboard/deploys/6abbc1e51e8e0f0008ceb940

[netlify]

✅ Deploy Preview for vortex-sandbox ready!

Name	Link
🔨 Latest commit	082d0fe
🔍 Latest deploy log	https://app.netlify.com/projects/vortex-sandbox/deploys/6abbc1e52532db00071c258c
😎 Deploy Preview	https://deploy-preview-1388--vortex-sandbox.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for vortexfi ready!

Name	Link
🔨 Latest commit	082d0fe
🔍 Latest deploy log	https://app.netlify.com/projects/vortexfi/deploys/6abbc1e535ae930008927328
😎 Deploy Preview	https://deploy-preview-1388--vortexfi.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.