fix(api): require CID ownership to unpin IPFS content (IDOR)

.kiro/specs/analytics-integration/requirements.md

@@ -6,22 +6,27 @@
 > opt-out via `AnalyticsOptOut`.
 
 ## Status
+
 **Superseded — do not implement**
 
 ## Summary
+
 Integrates privacy-preserving telemetry and user consent tracking into the StellarForge frontend application following strict opt-in guidelines.
 
 ## Specifications & Requirements
+
 1. **Consent First**: Analytics telemetry MUST be disabled by default until explicit user opt-in consent is provided via CookieConsentBanner.
 2. **Opt-Out & Bypass Protection**: Automated checks (`scripts/check-analytics-bypass.mjs`) must verify that telemetry cannot be triggered when consent is missing or revoked.
 3. **ADR Alignment**: Privacy guarantees must conform to ADR-005 specifications.
 
 ## Implementation & Verification
+
 - Privacy Architecture: `docs/adr/ADR-005-analytics-privacy-consent.md`
 - Telemetry Service: `frontend/src/services/analytics.ts`
 - React Hook & Consent: `frontend/src/hooks/useAnalytics.ts`, `frontend/src/components/CookieConsentBanner.tsx`
 - Automated Enforcement: `frontend/scripts/check-analytics-bypass.mjs`
 
 ## Related Issues
+
 - Issue #1118: ADR-005's privacy guarantees have no traceable link to the code that implements them
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/cargo-lock-version-control/requirements.md

@@ -1,14 +1,18 @@
 # Cargo Lock Version Control Spec
 
 ## Status
+
 **Closed / Satisfied**
 
 ## Summary
+
 The goal of tracking Rust contract lockfiles in version control is already satisfied in this repository.
 
 ## Verification & Implementation
+
 - `contracts/Cargo.lock` is tracked in git.
 - Dependabot is configured in `.github/dependabot.yml` to automatically monitor and update Cargo dependencies.
 
 ## Related Issues
+
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/changelog/requirements.md

@@ -1,19 +1,24 @@
 # Changelog Automation Spec
 
 ## Status
+
 **Shipped & Verified**
 
 ## Summary
+
 Automate `CHANGELOG.md` updates from conventional commit messages during automated releases.
 
 ## Specifications & Shipped Functionality
+
 1. **Semantic Release Integration**: `.releaserc.json` includes `@semantic-release/changelog` and `@semantic-release/git`.
 2. **Automated Commit & Release Notes**: On release, semantic-release generates release notes and updates `CHANGELOG.md` in root.
 3. **Repository Tracked**: `CHANGELOG.md` is committed and up to date in repository root.
 
 ## Configuration References
+
 - Release Config: `.releaserc.json`
 - Changelog File: `CHANGELOG.md`
 
 ## Related Issues
+
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/eslint-import-order/requirements.md

@@ -1,18 +1,23 @@
 # ESLint Import Order Spec
 
 ## Status
+
 **Closed / Resolved**
 
 ## Summary
+
 Spec for enforcing import ordering via ESLint plugin.
 
 ## Resolution & Rationale
+
 - Code formatting and import organization are handled via Prettier (`.prettierrc`) and ESLint flat config (`frontend/eslint.config.js`).
 - Additional strict import ordering rules via `eslint-plugin-import` were evaluated and determined to be unneeded due to existing Prettier and TypeScript formatting workflows.
 
 ## Configuration References
+
 - ESLint Flat Config: `frontend/eslint.config.js`
 - Prettier Config: `.prettierrc`
 
 ## Related Issues
+
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/fee-display/requirements.md

@@ -37,26 +37,33 @@ Pre-signature fee display that shows the user the exact fee amount (in XLM + USD
 - A test asserts that the displayed total matches the `fee_payment` argument that will be submitted in the transaction.
 - A test covers the recipient breakdown when a fee split is configured.
 - A test covers the `count > 1` multiplier.
+
 # Fee Display Spec
 
 ## Status
+
 **Partially Shipped (Active Issue #1108)**
 
 ## Summary
+
 Provide transparent, real-time fee breakdown and simulation before the user signs Soroban smart contract transactions.
 
 ## Current State & Shipped Code
+
 - `FeeDisplay.tsx` component is partially implemented (`frontend/src/components/FeeDisplay.tsx`).
 - Basic fee estimation is displayed in certain UI components, but pre-signature fee breakdowns for complex Soroban invocation resource requirements (resource fee, network fee, inclusion fee) are missing.
 
 ## Requirements & Remaining Gaps
+
 1. **Pre-Signature Breakdown**: Show explicit breakdown of base fee, resource fee, and maximum transaction fee prior to Freighter wallet signature prompt.
 2. **Dynamic Estimation**: Re-estimate fees dynamically when transaction parameters change.
 3. **Error Feedback**: Present clear user notification when estimated fee exceeds account balance.
 
 ## Implementation References
+
 - Component: `frontend/src/components/FeeDisplay.tsx`
 
 ## Related Issues
+
 - Issue #1108: No pre-signature fee breakdown shown to users
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/invalid-parameters-validation/requirements.md

@@ -12,38 +12,45 @@ Drift detection via `scripts/check-validation-drift.sh` (CI: `.github/workflows/
 
 ## Bounds (matching contract)
 
-| Field    | Max   | Unit    |
-|----------|-------|---------|
-| name     | 32    | UTF-8 bytes |
-| symbol   | 12    | UTF-8 bytes |
-| decimals | 18    | integer |
+| Field    | Max | Unit        |
+| -------- | --- | ----------- |
+| name     | 32  | UTF-8 bytes |
+| symbol   | 12  | UTF-8 bytes |
+| decimals | 18  | integer     |
 
 ## See Also
 
 - `contracts/token-factory/src/lib.rs`:749 — `validate_token_params`
 - `frontend/src/utils/validation.ts` — `validateTokenParams`, exported constants
 - `scripts/check-validation-drift.sh` — CI drift detection
+
 # Invalid Parameters Validation Spec
 
 ## Status
+
 **Shipped with Contract Divergences (Active Issue #1099)**
 
 ## Summary
+
 Ensure rigorous parameter validation across Frontend, API, and Soroban Smart Contracts to prevent invalid token creation or parameter rejection.
 
 ## Current State & Shipped Code
+
 - Frontend parameter validation implemented in `frontend/src/utils/validation.ts` and `frontend/src/components/CreateToken.tsx`.
 - API payload schema validation implemented in `api/_lib/schemaValidation.ts`.
 - Contract validation implemented in `contracts/token-factory/src/lib.rs`.
 
 ## Identified Divergences & Gaps
+
 - Issue #1099 identifies divergence where frontend validation limits, regex patterns, or string length rules differ from the Soroban smart contract invariants.
 - Frontend and backend validation bounds must strictly match contract bounds.
 
 ## Requirements
+
 1. **Contract Parity**: Input validation rules in frontend/API must strictly mirror smart contract constraints.
 2. **Immediate Feedback**: Display clear field-level error messages before submitting transactions.
 
 ## Related Issues
+
 - Issue #1099: Frontend validation silently diverges from the contract in both directions
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/skeleton-loaders/requirements.md

@@ -1,20 +1,25 @@
 # Skeleton Loaders Spec
 
 ## Status
+
 **Shipped & Verified**
 
 ## Summary
+
 Provide standardized skeleton components to indicate asynchronous loading states throughout the application.
 
 ## Specifications & Shipped Functionality
+
 1. **UI Skeleton Component**: Reusable Tailwind-styled animated pulsing placeholder (`Skeleton.tsx`).
 2. **Storybook Stories**: Documented variant loading states in Storybook (`Skeleton.stories.tsx`).
 3. **Application Integration**: Used across main application flows including token dashboards, token detail views, and metadata cards.
 
 ## Implementation References
+
 - Core Component: `frontend/src/components/UI/Skeleton.tsx`
 - Component Stories: `frontend/src/components/UI/Skeleton.stories.tsx`
 - Exports: `frontend/src/components/UI/index.ts`
 
 ## Related Issues
+
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/soroban-token-sdk-audit/design.md

@@ -23,12 +23,14 @@ A professional smart contract audit of `soroban_token_contract.wasm` (from `stel
 ### Option B: Document provenance and require explicit risk acceptance (chosen)
 
 Create `docs/token-wasm-provenance.md` that:
+
 - Identifies the canonical upstream source
 - States the honest audit status (not independently audited by this project)
 - Provides a deployment log template so every deployer records their specific hash and decision
 - Links to the mainnet checklist item that enforces this before any production deploy
 
 This approach:
+
 - Closes the unsourced "audited" claim gap immediately
 - Creates an enforceable gate in the deployment process
 - Provides an upgrade path when a future audit is completed
@@ -41,6 +43,7 @@ This approach:
 ### `docs/token-wasm-provenance.md`
 
 Sections:
+
 1. **What is `token_wasm_hash`?** — explains the security dependency
 2. **Upstream reference implementation** — table of source, SDK version, maintainer
 3. **Audit status** — honest declaration of current state; explains what "well-reviewed" vs "audited" means

.kiro/specs/soroban-token-sdk-audit/requirements.md

@@ -26,6 +26,7 @@ The factory references `soroban-token-sdk = "26.1.0"` for its own token interact
 ### REQ-01: Provenance documentation
 
 A document must exist in `docs/` that answers:
+
 - What is the canonical source of the token WASM used by the factory?
 - Which upstream repository, version/tag, and commit does it come from?
 - What SDK version was it compiled against?
@@ -35,6 +36,7 @@ A document must exist in `docs/` that answers:
 ### REQ-02: Deployment log template
 
 The provenance document must include a deployment log table for deployers to record:
+
 - Network (testnet/mainnet)
 - Exact source tag/commit
 - Resulting WASM hash (hex)
@@ -44,6 +46,7 @@ The provenance document must include a deployment log table for deployers to rec
 ### REQ-03: Checklist enforcement
 
 `docs/mainnet-deployment-checklist.md` must contain a specific line item requiring deployers to:
+
 - Confirm the WASM provenance is documented
 - Confirm the WASM hash is recorded
 - Confirm the audit status or risk-acceptance decision is on file
@@ -91,25 +94,31 @@ The audit gap was resolved by:
 3. Confirming that `README.md` Step 4 (Upload Token Contract WASM) correctly qualifies the `soroban-examples` source with a pinned-tag requirement and a provenance notice — it does not make any unsourced "audited" claim.
 
 If a professional audit is subsequently commissioned, the report should be filed under `docs/audits/` and both `docs/token-wasm-provenance.md` and this spec should be updated to reflect the findings.
+
 # Soroban Token SDK Security Audit Spec
 
 ## Status
+
 **Scoped, Not Executed (Active Issue #1113)**
 
 ## Summary
+
 Perform security audit and WASM verification for deployed Soroban Token Factory smart contracts and compiled WebAssembly binaries.
 
 ## Objectives & Scope
+
 1. **Bytecode Verification**: Verify target WASM bytecode hashes against source code compilations.
 2. **Reentrancy & Authorization**: Audit administrative capability checks, authorization wrappers (`require_auth`), and fee distribution logic.
 3. **Fuzzing & Property Tests**: Ensure fuzz targets in `contracts/token-factory/fuzz` achieve required coverage without panic conditions.
 4. **WASM Optimization**: Enforce contract WASM binary size constraints.
 
 ## Related Artifacts & Tools
+
 - Fuzzing suite: `contracts/token-factory/fuzz/`
 - Audit documentation: `docs/security-triage.md`
 - WASM verification workflow: `.github/workflows/wasm-verify.yml`
 
 ## Related Issues
+
 - Issue #1113: The token-WASM security-audit spec was scoped and never executed or closed
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs

.kiro/specs/soroban-token-sdk-audit/tasks.md

@@ -28,6 +28,7 @@ Resolved via Issue 25. See [`requirements.md`](./requirements.md) for context an
 ### Task 3 — Confirm README.md has no unsourced audit claims ✅
 
 Step 4 in the deployment guide already contained the correct provenance notice:
+
 - Pinned-tag instruction (do NOT use `main`)
 - Reference to `docs/token-wasm-provenance.md`
 - Explicit statement that the project has not commissioned an independent audit
@@ -38,6 +39,7 @@ No unsourced "audited" claims found. No change required to README.md.
 ### Task 4 — Create `docs/token-wasm-provenance.md` ✅
 
 Created [`docs/token-wasm-provenance.md`](../../docs/token-wasm-provenance.md) with:
+
 - Explanation of the `token_wasm_hash` security dependency
 - Upstream source table (repository, path, interface, SDK version)
 - Honest audit status declaration
@@ -68,14 +70,15 @@ See git history for commit details.
 
 ## Files changed
 
-| File | Change |
-|---|---|
-| `docs/token-wasm-provenance.md` | Created — definitive provenance and audit status document |
-| `docs/mainnet-deployment-checklist.md` | Updated — added WASM provenance audit line item |
-| `README.md` | Already correct — no changes required |
-| `.kiro/specs/soroban-token-sdk-audit/requirements.md` | Created — this spec's requirements |
-| `.kiro/specs/soroban-token-sdk-audit/design.md` | Created — this spec's design |
-| `.kiro/specs/soroban-token-sdk-audit/tasks.md` | Created — this file |
+| File                                                  | Change                                                    |
+| ----------------------------------------------------- | --------------------------------------------------------- |
+| `docs/token-wasm-provenance.md`                       | Created — definitive provenance and audit status document |
+| `docs/mainnet-deployment-checklist.md`                | Updated — added WASM provenance audit line item           |
+| `README.md`                                           | Already correct — no changes required                     |
+| `.kiro/specs/soroban-token-sdk-audit/requirements.md` | Created — this spec's requirements                        |
+| `.kiro/specs/soroban-token-sdk-audit/design.md`       | Created — this spec's design                              |
+| `.kiro/specs/soroban-token-sdk-audit/tasks.md`        | Created — this file                                       |
+
 # Tasks: Soroban Token SDK Security Audit
 
 - [ ] 1. Execute full cargo-audit check on contracts workspace

.kiro/specs/token-metadata-display/requirements.md

@@ -1,20 +1,25 @@
 # Token Metadata Display Spec
 
 ## Status
+
 **Shipped & Verified**
 
 ## Summary
+
 Display IPFS-hosted token metadata, including token logo image, name, symbol, and description with fallbacks and loading states.
 
 ## Specifications & Shipped Functionality
+
 1. **IPFS Image Retrieval**: Fetches IPFS metadata CIDs via IPFS gateway (`ipfsToGatewayUrl`).
 2. **Skeleton & Fallbacks**: Displays circular skeleton loader while fetching, and fallback placeholder image when URI/metadata is missing or broken.
 3. **Unit Tests**: Full test suite verifying loading, resolved, and placeholder states (`TokenMetadata.test.tsx`).
 
 ## Implementation References
+
 - Component: `frontend/src/components/TokenMetadata.tsx`
 - Unit Test: `frontend/src/components/TokenMetadata.test.tsx`
 - Service: `frontend/src/services/ipfs.ts`
 
 ## Related Issues
+
 - Issue #1117: Multiple `.kiro/specs` directories are abandoned stubs