fix: resend OTP button, optimistic contribution state, unified address validation, and claim-name security hardening (#341, #343, #334, #332)

[software321dev]

Summary

This PR addresses four key security, usability, and data consistency issues in cocor-tech/moistello-frontend:

1. Wire up inert Resend button in withdraw OTP step (Closes #341)

• Issue: The Resend button in the OTP step of the withdrawal flow was a no-op / inert.
• Fix: Wired up handleResendOtp in OtpStep and useWithdrawWizard with:
  • 60-second cooldown timer disabling repeated resend attempts.
  • Active loading state disabling.
  • Accessibility improvements: added explicit button roles, states, and countdown feedback.
• Tests: Added unit tests in src/app/(dashboard)/wallet/withdraw/steps/otp-step.test.tsx verifying resend trigger, cooldown countdown, and loading state behavior.

2. Correct optimistic update in useContribute (Closes #343)

• Issue: Optimistic updates in useContribute used fabricated user IDs and lacked stable rollback handling, causing double invalidation and potential UI state mismatch.
• Fix: Unified useContribute to leverage useOptimisticMutation with stable synthetic temp IDs (createTempId()), OPTIMISTIC_PENDING_USER_ID, snapshot-based cache rollbacks on error, and single invalidation on success. Ensured contribution modal in circles/[id]/page.tsx only closes on successful contribution.
• Tests: Verified with existing optimistic mutation test suite in src/hooks/__tests__/use-circles-optimistic.test.tsx.

3. Unify Stellar address validation (Closes #334)

• Issue: Inconsistent address validation across wallet adapters and API routes allowed invalid Base32 characters or malformed Stellar addresses.
• Fix: Canonicalized address validation using validateStellarAddress in src/lib/stellar/validate-address.ts enforcing Base32 RFC 4648 (A-Z2-7, length 56, starts with G). Updated WCSessionOrchestrator in src/lib/wallet/wc2-session-manager.ts and balance route in src/app/api/wallet/balance/route.ts to use the canonical validator.
• Tests: Comprehensive unit tests in src/lib/stellar/__tests__/validate-address.test.ts covering valid addresses, excluded Base32 characters (0, 1, 8, 9), lowercase characters, length bounds, and invalid prefixes.

4. Harden /claim-name anonymous endpoint (Closes #332)

• Issue: /claim-name was an unauthenticated endpoint vulnerable to rate-limit exhaustion, name-squatting, and invalid character injection.
• Fix: Implemented POST /api/claim-name in src/app/api/claim-name/route.ts featuring:
  • Server-side rate limiting: Max 5 claims per minute per IP address (returns HTTP 429).
  • Input validation & canonicalization: Trims, lowercases, and enforces 3-30 character length with alphanumeric, underscore, and hyphen pattern (^[a-z0-9_-]{3,30}$).
  • Ownership binding: Binds claimed names to authenticated user IDs to prevent unauthorized name squatting across accounts (returns HTTP 409).
• Tests: Added unit tests in src/app/api/claim-name/route.test.ts testing success, unauthenticated rejection, input format validation, ownership binding protection, and rate limiting.

---

Verification

• Unit Tests: All 17 targeted tests passed successfully.
• TypeScript: Executed npx tsc --noEmit with 0 type errors.

Closes #341
Closes #343
Closes #334
Closes #332

[vercel]

Someone is attempting to deploy a commit to the Nzubechukwu 's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@software321dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits