[trustosaretin]

Closes #540, Closes #541, Closes #542, Closes #544

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)

---

Summary

This PR resolves four Stellar Wave issues: an open-redirect vulnerability in middleware, raw JWTs leaking into API cache keys, a wallet error banner that always linked to Freighter, and missing HSTS/COOP/COEP/CORP security headers. Each fix is scoped to the files named in its issue.

Motivation / Context

• Fix open redirect vulnerability in middleware #541: redirect was assigned to url.pathname unvalidated, allowing /connect?redirect=https://evil.com to bounce signed-in users to a phishing site.
• Remove JWT from API cache key to prevent memory exposure #542: cacheKey concatenated the full JWT, so credentials could appear in heap dumps and memory snapshots.
• Update wallet error banner for multi-wallet support #540: LOBSTR and Rabet users hitting not_installed were sent to install Freighter.
• Add HSTS, COOP, and COEP security headers #544: Responses lacked HSTS, COOP, COEP, and CORP, leaving first-visit MITM and cross-origin isolation gaps.

Closes #540, Closes #541, Closes #542, Closes #544

Changes

Issue	File	Change
#541	src/middleware.ts	Added isSafeRedirectPath — only same-origin relative paths (/…, no //, no ://, no \) are honoured; anything else falls back to /dashboard.
#541	src/middleware.test.ts	Tests for absolute http/https, protocol-relative, backslash, empty, and safe relative redirect values.
#542	src/lib/api/client.ts	hashJwtForCacheKey (dual FNV-1a, 64-bit) replaces the raw JWT in cacheKey. Exported for tests.
#542	src/lib/api/client.test.ts	Asserts the raw token is absent from the digest, hashing is deterministic, and per-token cache hit/miss is unchanged.
#544	next.config.mjs	Added Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Embedder-Policy: credentialless, Cross-Origin-Resource-Policy: same-origin, and production-only Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
#540	src/components/shared/wallet-error-banner.tsx	Resolves the selected wallet via getSelectedWalletId() and links to Freighter, LOBSTR, or Rabet install pages; unknown/null selection lists all three.

Testing

• New unit tests added in src/middleware.test.ts (6 cases) and src/lib/api/client.test.ts (4 cases).
• Coverage: malicious redirect values (https://evil.com, http://evil.com/phish, //evil.com, /\evil.com, empty) and safe paths; JWT absence from cache keys, hash determinism/token discrimination, and per-token hit/miss.
• CI (npm run lint, npm run typecheck, npm test, npm run build) is the verification gate for this PR — tests were authored against the existing vitest patterns in those files.

Tradeoffs

• Remove JWT from API cache key to prevent memory exposure #542 uses a non-cryptographic 64-bit digest as the issue requested ("fast non-cryptographic hash"). Two independent FNV-1a streams keep accidental collisions negligible for the 100-entry LRU without an async Web Crypto dependency in a sync cacheKey.
• Fix open redirect vulnerability in middleware #541 validates shape (relative path, no scheme) as specified; it does not attempt a full allow-list of internal routes.
• Add HSTS, COOP, and COEP security headers #544 adds Cross-Origin-Resource-Policy: same-origin in addition to the Scope headers because the issue's "What" lists it and the acceptance criteria require all listed headers. HSTS is production-only so local HTTP development keeps working.

Out of scope

• src/app/(auth)/connect/page.tsx also reads redirect client-side (router.push(redirect || "/dashboard")). Left unchanged — Fix open redirect vulnerability in middleware #541 scopes the fix to src/middleware.ts.
• use-auth.ts still has Freighter-specific copy for the inline not_installed message. Update wallet error banner for multi-wallet support #540 scopes the change to wallet-error-banner.tsx.
• No unrelated refactors or formatting changes.

[netlify]

❌ Deploy Preview for chainlearn failed.

Name	Link
🔨 Latest commit	dc56af1
🔍 Latest deploy log	https://app.netlify.com/projects/chainlearn/deploys/6adbab8bbdee1cd79aa9d7f8