feat: support Soroban WASM contract upload from URL

[badmusdare4]

Overview

This PR adds support for deploying Soroban WASM contracts directly from a URL, eliminating the need to download the binary locally and upload it manually. Developers can now pass a wasm_url field to the contract deploy endpoint. The API downloads the WASM binary with a 5MB size limit, validates the content, caches it by content hash, and supports ipfs:// and ar:// URL schemes through public gateway resolution.

Related Issue

Closes the Soroban WASM URL upload bounty issue.

Changes

🌐 URL-Based WASM Deployment Support

• [MODIFY] apps/api/src/modules/contracts/contracts.service.ts

  • Adds URL-based WASM download flow with a configurable 5MB maximum.
  • Validates downloaded content for valid WASM magic bytes before deployment.
  • Caches downloaded WASM by SHA-256 content hash to avoid duplicate downloads.
  • Resolves ipfs:// and ar:// URLs through public gateways.

• [MODIFY] apps/api/src/modules/contracts/contracts.controller.ts

  • Extends the deploy endpoint to accept an optional wasm_url parameter.
  • Adds specific error responses for invalid URLs, timeouts, oversized files, and invalid WASM content.

• [MODIFY] apps/api/src/modules/contracts/contracts.module.ts

  • Configures HTTP client with download timeout and cache storage for WASM blobs.

• [MODIFY] apps/api/src/modules/contracts/contracts.controller.spec.ts

  • Adds integration tests covering successful URL deployment, invalid URLs, timeouts, oversized files, hash-cache reuse, and IPFS/Arweave gateway resolution.

Verification Results

npm test -- apps/api/src/modules/contracts/contracts.controller.spec.ts
✅ 16/16 passed

Live acceptance check:
✅ wasm_url accepted by deploy endpoint
✅ Downloaded WASM validated before deployment
✅ 5MB size limit enforced (larger files rejected)
✅ Content hash cache prevents redundant downloads
✅ IPFS and Arweave URLs resolved via public gateways
✅ Invalid URL / timeout / oversized file errors handled

Acceptance Criteria	Status
Contract deploy accepts wasm_url parameter	✅ Optional wasm_url accepted on deploy endpoint
Downloaded WASM is validated before deployment	✅ WASM magic bytes checked before deployment
File size limit is enforced (5MB default)	✅ >5MB downloads rejected with 413
Content hash caching prevents redundant downloads	✅ SHA-256 cache key reuses downloaded contracts
IPFS and Arweave URLs are resolved via public gateways	✅ ipfs:// and ar:// gateway resolution implemented
Error handling covers invalid URLs, timeout, and oversized files	✅ Clear 400/504/413 error responses
Integration tests cover URL-based deployment flow	✅ New spec tests cover success and failure paths

Closes #131

[drips-wave]

@badmusdare4 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits