fix(api): trusted client IP, bounded bodies, limiter pruning, and redacted sync errors

app/.env.example

@@ -1,3 +1,3 @@
 # Copy to .env.local for local dev. Never commit real values.
 
 # Public site URL (used in metadata, image URLs, share cards)
@@ -65,3 +65,9 @@
 
 # Wallets allowed to moderate posts (comma-separated, lowercase)
 ADMIN_WALLETS=
+
+# Rate-limit keys: how many proxies of our own a request passes. Default 1 (Fly's proxy is the edge, so fly-client-ip is
+# the client). Set 2 when a proxy service fronts the app: fly-client-ip is then that proxy, and the client is the entry it
+# appended, one in from the address Fly appends for the app itself. Only holds while that proxy is the only way in.
+# Blank, 0 or junk means 1.
+# TRUSTED_PROXY_HOPS=1

app/src/app/api/bridge/quote/route.ts

@@ -1,3 +1,4 @@
+import { clientIp } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { BRIDGE_PRIVATE_HEADERS, bridgeErrorResponse, getBridgeQuote, readBridgeJson } from "@/lib/bridge/relay";
 import { BridgeApiError, parseBridgeRequest } from "@/lib/bridge/validation";
@@ -6,7 +7,7 @@ export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
 export async function POST(req: Request) {
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`bridge:quote:ip:${ip}`, 20)) return bridgeErrorResponse(new BridgeApiError("Too many quotes. Please wait a moment.", 429));
   try {
     if (req.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase() !== "application/json") throw new BridgeApiError("Send a JSON request.", 415);

app/src/app/api/bridge/status/route.ts

@@ -1,3 +1,4 @@
+import { clientIp } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { BRIDGE_PRIVATE_HEADERS, bridgeErrorResponse, getBridgeStatus } from "@/lib/bridge/relay";
 import { BridgeApiError } from "@/lib/bridge/validation";
@@ -6,7 +7,7 @@ export const dynamic = "force-dynamic";
 export const runtime = "nodejs";
 
 export async function GET(req: Request) {
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`bridge:status:ip:${ip}`, 100)) return bridgeErrorResponse(new BridgeApiError("Too many status requests. Please wait a moment.", 429));
   try {
     const params = new URL(req.url).searchParams;

app/src/app/api/launch/chart-provider/route.test.ts

@@ -1,6 +1,8 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { GET } from "./route";
+// these requests stand for ones Fly Proxy delivered: clientIp reads fly-client-ip only on a Fly Machine
+process.env.FLY_APP_NAME ??= "openlaunch-test";
 const identity={chain:"base",token:"0x"+"a".repeat(40),quote:"0x"+"0".repeat(40),pool:"0x"+"b".repeat(64)};
 function request(overrides: Partial<typeof identity> = {}, ip="chart-test") {
   return new Request("http://localhost/api/launch/chart-provider?"+new URLSearchParams({...identity,...overrides}),{headers:{"fly-client-ip":ip}});

app/src/app/api/launch/chart-provider/route.ts

@@ -1,14 +1,15 @@
 import { isChartPool } from "@/lib/launchpad/chart-pool";
 import { lookupGeckoPool } from "@/lib/launchpad/geckoterminal";
 import { createGeckoCache } from "@/lib/launchpad/gecko-cache";
+import { clientIp } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 
 export const dynamic = "force-dynamic";
 const lookup = createGeckoCache(lookupGeckoPool, () => Date.now());
 
 export async function GET(request: Request) {
   const headers = { "cache-control": "no-store" };
-  const ip = (request.headers.get("fly-client-ip") || request.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(request);
   if (rateLimited(`chart:ip:${ip}`, 60)) return Response.json({ error: "Too many chart requests. Try again shortly." }, { status: 429, headers: { ...headers, "retry-after": "60" } });
   const query = new URL(request.url).searchParams;
   const pool = { chain: query.get("chain"), token: query.get("token"), poolId: query.get("pool"), quote: query.get("quote") };

app/src/app/api/launch/edit/nonce/route.ts

@@ -1,20 +1,17 @@
 import { NextResponse } from "next/server";
 import { isAddress } from "viem";
 import { isChainKey } from "@/lib/chainPublic";
+import { clientIp, readJson } from "@/lib/http";
 import { issueNonce, rateLimited } from "@/lib/launchpad/editServer";
 
 export const dynamic = "force-dynamic";
 
 /** POST {chain, token, wallet} → {nonce, expiresAt}. Only the token's creator gets one. */
 export async function POST(req: Request) {
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`nonce:ip:${ip}`, 30)) return NextResponse.json({ error: "slow down" }, { status: 429 });
-  let b: { chain?: unknown; token?: unknown; wallet?: unknown };
-  try {
-    b = (await req.json()) as typeof b;
-  } catch {
-    return NextResponse.json({ error: "bad json" }, { status: 400 });
-  }
+  const b = await readJson(req, 2_048);
+  if (!b) return NextResponse.json({ error: "bad json" }, { status: 400 });
   if (!isChainKey(b.chain) || typeof b.token !== "string" || !isAddress(b.token) || typeof b.wallet !== "string" || !isAddress(b.wallet)) return NextResponse.json({ error: "bad params" }, { status: 400 });
   const n = await issueNonce(b.chain, b.token, b.wallet);
   if (!n) return NextResponse.json({ error: "not the creator" }, { status: 403 });

app/src/app/api/launch/edit/route.ts

@@ -1,19 +1,16 @@
 import { NextResponse } from "next/server";
 import { isChainKey } from "@/lib/chainPublic";
+import { clientIp, readJson } from "@/lib/http";
 import { applySignedEdit, rateLimited } from "@/lib/launchpad/editServer";
 
 export const dynamic = "force-dynamic";
 
 /** POST {chain, token, wallet, nonce, expiresAt, signature, fields} → applies a creator-signed metadata edit. */
 export async function POST(req: Request) {
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`edit:ip:${ip}`, 20)) return NextResponse.json({ error: "slow down" }, { status: 429 });
-  let b: Record<string, unknown>;
-  try {
-    b = (await req.json()) as Record<string, unknown>;
-  } catch {
-    return NextResponse.json({ error: "bad json" }, { status: 400 });
-  }
+  const b = await readJson(req, 16_384);
+  if (!b) return NextResponse.json({ error: "bad json" }, { status: 400 });
   if (!isChainKey(b.chain) || typeof b.token !== "string" || typeof b.wallet !== "string") return NextResponse.json({ error: "bad params" }, { status: 400 });
   const r = await applySignedEdit({ chain: b.chain, token: b.token, wallet: b.wallet, nonce: b.nonce, expiresAt: b.expiresAt, signature: b.signature, fields: (b.fields ?? {}) as Record<string, unknown> });
   if (!r.ok) return NextResponse.json({ error: r.error }, { status: r.status });

app/src/app/api/launch/image/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { clientIp, readFormData } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { BANNER_MAX_BYTES, IMAGE_UPLOADS_PER_HOUR, checkUpload, imageRole, isWalletParam, maxBytesFor, randomImageKey } from "@/lib/launchpad/images";
 import { toBannerWebp, toLogoWebp } from "@/lib/launchpad/imageProcess";
@@ -18,18 +19,15 @@ const HOUR = 60 * 60_000;
  */
 export async function POST(req: Request) {
   if (!imageUploadsEnabled()) return NextResponse.json({ error: "uploads not configured" }, { status: 503 });
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`img:ip:${ip}`, IMAGE_UPLOADS_PER_HOUR * 2, HOUR)) return NextResponse.json({ error: "slow down" }, { status: 429 });
-  const declared = Number(req.headers.get("content-length") || 0);
-  // the role is inside the body, so the early check allows the larger (banner) cap; the real cap is applied below
-  if (declared > BANNER_MAX_BYTES + 16 * 1024) return NextResponse.json({ error: "image must be ≤ 4 MB" }, { status: 413 });
-
-  let form: FormData;
-  try {
-    form = await req.formData();
-  } catch {
-    return NextResponse.json({ error: "bad form" }, { status: 400 });
+  // the role is inside the body, so the early cap allows the larger (banner) size; the role's real cap is applied below.
+  // readFormData caps chunked uploads too, before the multipart body is buffered.
+  const parsed = await readFormData(req, BANNER_MAX_BYTES + 16 * 1024);
+  if (!parsed.ok) {
+    return NextResponse.json({ error: parsed.tooLarge ? "image must be ≤ 4 MB" : "bad form" }, { status: parsed.tooLarge ? 413 : 400 });
   }
+  const form = parsed.form;
   const wallet = form.get("wallet");
   const file = form.get("file");
   const role = imageRole(form.get("kind"));

app/src/app/api/launch/meta/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { clientIp, readJson } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { MetaConflict, saveMeta, validateMeta } from "@/lib/launchpad/meta";
 import { LAUNCHPAD_CONFIGURED } from "@/lib/launchpad/config";
@@ -11,14 +12,10 @@ export async function POST(req: Request) {
   if (!LAUNCHPAD_CONFIGURED) return NextResponse.json({ error: "launchpad unconfigured" }, { status: 503 });
   // Unsigned by design (salt secrecy decides conflicts), so the IP bucket is
   // the only thing stopping junk-row sprays and predictToken RPC burn.
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`meta:ip:${ip}`, 20)) return NextResponse.json({ error: "slow down" }, { status: 429 });
-  let body: unknown;
-  try {
-    body = await req.json();
-  } catch {
-    return NextResponse.json({ error: "bad json" }, { status: 400 });
-  }
+  const body = await readJson(req, 8_192);
+  if (!body) return NextResponse.json({ error: "bad json" }, { status: 400 });
   const v = validateMeta((body ?? {}) as Partial<Parameters<typeof validateMeta>[0]>);
   if (!v.ok) return NextResponse.json({ error: v.error }, { status: 400 });
   try {

app/src/app/api/launch/sync/route.ts

@@ -1,9 +1,10 @@
 import { NextResponse } from "next/server";
 import { DEFAULT_CHAIN, isChainKey } from "@/lib/chainPublic";
+import { clientIp } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { applyLaunchTx, pollAll } from "@/lib/launchpad/indexer";
 import { forgetBoostLane } from "@/lib/launchpad/boostServer";
-import { publicError } from "@/lib/launchpad/redact";
+import { publicError, redactUrls } from "@/lib/launchpad/redact";
 
 export const dynamic = "force-dynamic";
 
@@ -12,7 +13,7 @@ export async function POST(req: Request) {
   // Unauthenticated and the most expensive route in the app (a tx-less call
   // fans out over every configured chain: log ranges, heals and backfills),
   // so it gets the same per-IP bucket as the other write endpoints.
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`sync:ip:${ip}`, 10)) return NextResponse.json({ error: "slow down" }, { status: 429 });
   const u = new URL(req.url);
   const tx = u.searchParams.get("tx");
@@ -27,12 +28,23 @@ export async function POST(req: Request) {
       return NextResponse.json(r);
     } catch (err) {
       // never the raw message: a failed RPC read quotes the upstream URL, and a keyed provider URL carries its API key
+      console.warn("[launch-sync] receipt apply failed:", redactUrls(err instanceof Error ? err.message : String(err)));
       return NextResponse.json({ error: publicError(err, "sync failed") }, { status: 502 });
     }
   }
   try {
-    return NextResponse.json(await pollAll());
+    const all = await pollAll();
+    // pollAll's per-chain reasons are viem messages too; redact before they reach an unauthenticated caller.
+    // Copy instead of mutating: a shared single-flight poll result can be read by the loop and other requests.
+    const safe = Object.fromEntries(
+      Object.entries(all).map(([chainKey, result]) => [
+        chainKey,
+        result.reason ? { ...result, reason: redactUrls(result.reason) } : result,
+      ]),
+    );
+    return NextResponse.json(safe);
   } catch (err) {
+    console.warn("[launch-sync] poll failed:", redactUrls(err instanceof Error ? err.message : String(err)));
     return NextResponse.json({ error: publicError(err, "sync failed") }, { status: 502 });
   }
 }

app/src/app/api/launch/watchlist/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { dbConfigured } from "@/lib/db";
+import { clientIp } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { ethUsd } from "@/lib/launchpad/ethPrice";
 import { WatchlistInputError, getWatchlistData, parseWatchlistRequest, readWatchlistBody } from "@/lib/launchpad/watchlistData";
@@ -9,9 +10,7 @@ export const dynamic = "force-dynamic";
 /** Read-only POST keeps the user's device-local token list out of URLs. Nothing is persisted. */
 export async function POST(req: Request) {
   const headers = { "cache-control": "no-store" };
-  // Fly's proxy sets fly-client-ip. The first x-forwarded-for entry is whatever the client sent, so the
-  // fallback is the last one, which the proxy appended: a spoofed header never buys a fresh rate-limit bucket.
-  const ip = req.headers.get("fly-client-ip")?.trim() || (req.headers.get("x-forwarded-for") ?? "").split(",").at(-1)?.trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`watchlist:ip:${ip}`, 60)) {
     return NextResponse.json({ error: "Too many refreshes. Try again shortly." }, { status: 429, headers: { ...headers, "retry-after": "60" } });
   }

app/src/app/api/posts/mod/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { SIGNED_BODY_MAX, clientIp, readJson } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { moderate } from "@/lib/launchpad/postsServer";
 import { adminFromRequest, fromAdminOrigin } from "@/lib/admin/session";
@@ -11,14 +12,10 @@ export const dynamic = "force-dynamic";
  * session of the same wallet (moderate checks it), sent from the site's own pages.
  */
 export async function POST(req: Request) {
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`mod:ip:${ip}`, 30)) return NextResponse.json({ error: "slow down" }, { status: 429 });
-  let b: Record<string, unknown>;
-  try {
-    b = (await req.json()) as Record<string, unknown>;
-  } catch {
-    return NextResponse.json({ error: "bad json" }, { status: 400 });
-  }
+  const b = await readJson(req, SIGNED_BODY_MAX);
+  if (!b) return NextResponse.json({ error: "bad json" }, { status: 400 });
   if (typeof b.wallet !== "string") return NextResponse.json({ error: "bad params" }, { status: 400 });
   let session: string | null;
   try {

app/src/app/api/posts/report/route.ts

@@ -1,19 +1,16 @@
 import { NextResponse } from "next/server";
+import { SIGNED_BODY_MAX, clientIp, readJson } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { reportPost } from "@/lib/launchpad/postsServer";
 
 export const dynamic = "force-dynamic";
 
 /** POST {postId, wallet, reason, nonce, ts, signature} */
 export async function POST(req: Request) {
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`report:ip:${ip}`, 20)) return NextResponse.json({ error: "slow down" }, { status: 429 });
-  let b: Record<string, unknown>;
-  try {
-    b = (await req.json()) as Record<string, unknown>;
-  } catch {
-    return NextResponse.json({ error: "bad json" }, { status: 400 });
-  }
+  const b = await readJson(req, SIGNED_BODY_MAX);
+  if (!b) return NextResponse.json({ error: "bad json" }, { status: 400 });
   if (typeof b.wallet !== "string") return NextResponse.json({ error: "bad params" }, { status: 400 });
   if (rateLimited(`report:wallet:${b.wallet.toLowerCase()}`, 20)) return NextResponse.json({ error: "slow down" }, { status: 429 });
   const r = await reportPost({ postId: b.postId, wallet: b.wallet, reason: b.reason, nonce: b.nonce, ts: b.ts, signature: b.signature });

app/src/app/api/posts/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { isAddress } from "viem";
 import { isChainKey } from "@/lib/chainPublic";
+import { SIGNED_BODY_MAX, clientIp, readJson } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { createPost, listFeed, listTokenPosts } from "@/lib/launchpad/postsServer";
 import { memo } from "@/lib/launchpad/memo";
@@ -34,14 +35,10 @@ export async function GET(req: Request) {
 
 /** POST {chain, token, wallet, parentId?, body, nonce, ts, signature} → new post. */
 export async function POST(req: Request) {
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   if (rateLimited(`post:ip:${ip}`, 30)) return NextResponse.json({ error: "slow down" }, { status: 429 });
-  let b: Record<string, unknown>;
-  try {
-    b = (await req.json()) as Record<string, unknown>;
-  } catch {
-    return NextResponse.json({ error: "bad json" }, { status: 400 });
-  }
+  const b = await readJson(req, SIGNED_BODY_MAX);
+  if (!b) return NextResponse.json({ error: "bad json" }, { status: 400 });
   if (!isChainKey(b.chain) || typeof b.token !== "string" || typeof b.wallet !== "string") return NextResponse.json({ error: "bad params" }, { status: 400 });
   const r = await createPost({ chain: b.chain, token: b.token, wallet: b.wallet, parentId: b.parentId, body: b.body, nonce: b.nonce, ts: b.ts, signature: b.signature });
   if (!r.ok) return NextResponse.json({ error: r.error }, { status: r.status });

app/src/app/api/presence/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { clientIp } from "@/lib/http";
 import { rateLimited } from "@/lib/launchpad/editServer";
 import { looksLikeBot, prunePresence, readPulse, recordBeacon, visitorHash } from "@/lib/launchpad/presence";
 import { memo } from "@/lib/launchpad/memo";
@@ -16,7 +17,7 @@ let lastPrune = 0;
 export async function POST(req: Request) {
   const ua = req.headers.get("user-agent") ?? "";
   if (looksLikeBot(ua)) return NextResponse.json(await readPulse(), { headers: { "cache-control": "no-store" } });
-  const ip = (req.headers.get("fly-client-ip") || req.headers.get("x-forwarded-for") || "").split(",")[0].trim() || "0.0.0.0";
+  const ip = clientIp(req);
   // The visitor hash mixes in the UA, which the caller fully controls: without
   // a bucket, rotating UAs mints a fresh bb_presence row per request and
   // inflates visits. 30/min leaves normal beaconing (~every few seconds) alone.

app/src/app/api/rpc/route.test.ts

@@ -186,6 +186,22 @@ test("Base B20 fallback still receives only allowed reads", async (t) => {
   assert.deepEqual((await response.json()).find((r: { id: number }) => r.id === 1), result(1, "0x42"));
 });
 
+test("an unreadable Base B20 fallback is a retryable 502, never the primary's B20 error", async (t) => {
+  let calls = 0;
+  t.mock.method(globalThis, "fetch", async () => {
+    calls++;
+    if (calls === 1) return Response.json([{ jsonrpc: "2.0", id: 1, error: { code: -32603, message: "EVM error OpcodeNotFound" } }]);
+    // the fallback node answers 200 and its body stream breaks
+    return new Response(new ReadableStream({ start(controller) { controller.error(new Error("reset")); } }), { status: 200 });
+  });
+  const response = await POST(request([call(1, "eth_call")]));
+  assert.equal(calls, 2);
+  assert.equal(response.status, 502);
+  const body = await response.json();
+  assert.equal(Array.isArray(body), false, "a non-RPC body, so viem takes its HTTP retry path");
+  assert.match(body.error, /temporarily unavailable/);
+});
+
 test("Arc routing uses its configured server upstream with the same read-only allowlist", async (t) => {
   const previous = process.env.ARC_RPC_URL;
   process.env.ARC_RPC_URL = "https://arc-rpc.example.test/private-test-key";