Skip to content

feat: add SEP-0043 signature verification for browser wallets #19

Description

@EmeditWeb

Problem

The auth/verify endpoint only accepts raw Ed25519
signatures. The Freighter browser extension signs using
SEP-0043, which adds a prefix to the message before
signing. So browser-based apps can't authenticate with
StepFi without the mobile app.

Context

SEP-0043 is the Stellar standard for browser wallet
signing. Supporting it makes StepFi-Web work for
Freighter and Rabet users.

Before Starting

Read these context files:

  • context/architecture-context.md
  • context/code-standards.md
  • src/modules/auth/auth.service.ts
  • src/modules/auth/dto/verify-request.dto.ts

What To Build

Update auth.service.ts verify() method to:

  1. Try raw Ed25519 verification first (mobile)
  2. If that fails, try SEP-0043 verification (browser)
  3. Return JWT if either succeeds

Add signatureType field to VerifyRequestDto:
signatureType: 'raw' | 'sep0043' (optional, defaults to raw)

SEP-0043 prefix: the message signed is:
'Stellar Signing Key: ' + nonce

Files To Touch

  • src/modules/auth/auth.service.ts
  • src/modules/auth/dto/verify-request.dto.ts

Acceptance Criteria

  • Raw Ed25519 signatures still work (mobile)
  • SEP-0043 signatures work (browser/Freighter)
  • Both return same JWT structure
  • Unit tests cover both signature types
  • npm run build passes

Mandatory Checks Before PR

  • npm run build passes with zero TypeScript errors
  • No any types
  • Unit tests added for both paths
  • PR references this issue

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions