[0xApotheosis]

Description

Affiliate login accepted insufficiently scoped signatures and replayable nonces. Validates the dashboard origin/statement/Arbitrum chain, consumes PostgreSQL nonces once and scopes JWTs. Existing sessions must sign in again.

Verification

Apply siwe_nonces, configure the exact SIWE_ALLOWED_ORIGINS and use two replicas sharing a test DB. Sign in and update/restore test affiliate settings. Redeem one nonce concurrently: exactly one request should succeed. Reject wrong origins/chains, expired messages and old JWTs. Re-login should restore access.

Signature checks passed locally; database concurrency and dashboard QA remain outstanding.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}