security+DRY: fix open redirect, add x402 replay protection, extract shared helpers

Security:
- disconnect/route.ts: validate next param to prevent open redirect
- x402Server.ts: add in-memory nonce dedup for settleOnChain:false routes
- x402Server.ts: sanitize error detail fields to prevent info disclosure

DRY (DRY):
- api-utils.ts: add requireAuth, getEnv, ARC_USDC_ADDRESS, ARC_TREASURY_FALLBACK, ARC_CHAIN_ID
- quiz/route.ts, quiz/claim/route.ts, thesis/[id]/route.ts, stats/route.ts: replace local NO_STORE_HEADERS with import
- quiz/claim/route.ts, thesis/[id]/route.ts: replace local getEnv with import
- keys/list/route.ts, keys/generate/route.ts, alerts/subscribe/route.ts: replace inline regex with isValidEthereumAddress

Author: chindris-mihai-alexandru

frontend/src/app/api/alerts/subscribe/route.ts

@@ -12,7 +12,7 @@
 import { NextResponse } from 'next/server'
 import { auth } from '../../../../../auth'
 import { prisma } from '@/lib/prisma'
-import { NO_STORE_HEADERS, handleServerError } from '@/lib/api-utils'
+import { NO_STORE_HEADERS, handleServerError, isValidEthereumAddress } from '@/lib/api-utils'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
@@ -38,7 +38,7 @@ export async function POST(req: Request) {
     const body = (await req.json().catch(() => null)) as AlertPayload | null
     const wallet = typeof body?.wallet === 'string' ? body.wallet.trim() : ''
 
-    if (!wallet || !/^0x[a-fA-F0-9]{40}$/.test(wallet)) {
+    if (!wallet || !isValidEthereumAddress(wallet)) {
       return NextResponse.json(
         { success: false, error: 'Invalid wallet address' },
         { status: 400, headers: NO_STORE_HEADERS }

frontend/src/app/api/disconnect/route.ts

@@ -17,7 +17,9 @@ export async function GET(req: Request) {
   }
 
   const { searchParams } = new URL(req.url)
-  const redirectTo = searchParams.get('next') ?? '/'
+  const rawNext = searchParams.get('next') ?? '/'
+  // Prevent open redirect: only allow relative paths starting with /
+  const redirectTo = rawNext.startsWith('/') && !rawNext.startsWith('//') ? rawNext : '/'
 
   const mode = searchParams.get('mode')
   const response = mode === 'json'

frontend/src/app/api/keys/generate/route.ts

@@ -12,7 +12,7 @@ import { NextResponse } from 'next/server'
 import { createHash, randomBytes } from 'crypto'
 import { auth } from '../../../../../auth'
 import { prisma } from '@/lib/prisma'
-import { NO_STORE_HEADERS, handleServerError } from '@/lib/api-utils'
+import { NO_STORE_HEADERS, handleServerError, isValidEthereumAddress } from '@/lib/api-utils'
 import { Tier } from '@/lib/subscription'
 
 export const runtime = 'nodejs'
@@ -44,7 +44,7 @@ export async function POST(req: Request) {
     const body = (await req.json().catch(() => null)) as KeyPayload | null
     const wallet = typeof body?.wallet === 'string' ? body.wallet.trim() : ''
 
-    if (!wallet || !/^0x[a-fA-F0-9]{40}$/.test(wallet)) {
+    if (!wallet || !isValidEthereumAddress(wallet)) {
       return NextResponse.json(
         { success: false, error: 'Invalid wallet address' },
         { status: 400, headers: NO_STORE_HEADERS }

frontend/src/app/api/keys/list/route.ts

@@ -8,7 +8,7 @@
 import { NextResponse } from 'next/server'
 import { auth } from '../../../../../auth'
 import { prisma } from '@/lib/prisma'
-import { NO_STORE_HEADERS, handleServerError } from '@/lib/api-utils'
+import { NO_STORE_HEADERS, handleServerError, isValidEthereumAddress } from '@/lib/api-utils'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
@@ -26,7 +26,7 @@ export async function GET(req: Request) {
     const { searchParams } = new URL(req.url)
     const wallet = searchParams.get('wallet')?.trim() ?? ''
 
-    if (!wallet || !/^0x[a-fA-F0-9]{40}$/.test(wallet)) {
+    if (!wallet || !isValidEthereumAddress(wallet)) {
       return NextResponse.json(
         { success: false, error: 'Invalid wallet address' },
         { status: 400, headers: NO_STORE_HEADERS }

frontend/src/app/api/quiz/claim/route.ts

@@ -18,21 +18,12 @@ import { NextResponse } from 'next/server'
 import { auth } from '../../../../../auth'
 import { prisma } from '@/lib/prisma'
 import { withX402 } from '@/lib/x402Server'
-
-
-function getEnv(val: string | undefined, fallback: string): string {
-  if (!val || val === 'undefined' || val === 'null' || val === '') return fallback;
-  return val;
-}
+import { NO_STORE_HEADERS, getEnv, ARC_TREASURY_FALLBACK, ARC_USDC_ADDRESS } from '@/lib/api-utils'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
-const NO_STORE_HEADERS = {
-  'Cache-Control': 'no-store, max-age=0',
-}
-
 type QuizAttemptPayload = {
   desk?: unknown
   score?: unknown
@@ -50,9 +41,9 @@ export const POST = withX402(
     // 0.001 USDC processing fee — user earns 0.5 USDC reward on correct answers
     priceUsdc: 0.001,
     description: 'Quiz claim processing fee — earn 0.5 USDC on correct answer',
-    treasuryAddress: getEnv(process.env.ROSETTA_TREASURY_ADDRESS, '0x000000000000000000000000000000000000dEaD'),
+    treasuryAddress: getEnv(process.env.ROSETTA_TREASURY_ADDRESS, ARC_TREASURY_FALLBACK),
     arcRpcUrl: process.env.NEXT_PUBLIC_ARC_RPC_URL!,
-    usdcAddress: getEnv(process.env.NEXT_PUBLIC_USDC_ARC_ADDRESS, '0x3600000000000000000000000000000000000000'),
+    usdcAddress: getEnv(process.env.NEXT_PUBLIC_USDC_ARC_ADDRESS, ARC_USDC_ADDRESS),
     settlerPrivateKey: process.env.ARC_SETTLER_PRIVATE_KEY!,
   },
   async (req: Request) => {

frontend/src/app/api/quiz/route.ts

@@ -1,15 +1,12 @@
 import { NextResponse } from 'next/server'
 import { auth } from '../../../../auth'
 import { prisma } from '@/lib/prisma'
+import { NO_STORE_HEADERS, ARC_TREASURY_FALLBACK, ARC_USDC_ADDRESS } from '@/lib/api-utils'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
-const NO_STORE_HEADERS = {
-  'Cache-Control': 'no-store, max-age=0',
-}
-
 type QuizAttemptPayload = {
   desk?: unknown
   score?: unknown

frontend/src/app/api/stats/route.ts

@@ -1,14 +1,11 @@
 import { NextResponse } from 'next/server'
 import { prisma } from '@/lib/prisma'
+import { NO_STORE_HEADERS } from '@/lib/api-utils'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
-const NO_STORE_HEADERS = {
-  'Cache-Control': 'no-store, max-age=0',
-}
-
 /**
  * GET /api/stats
  *

frontend/src/app/api/thesis/[id]/route.ts

@@ -26,29 +26,20 @@
 import { NextResponse } from 'next/server'
 import { prisma } from '@/lib/prisma'
 import { withX402 } from '@/lib/x402Server'
-
-
-function getEnv(val: string | undefined, fallback: string): string {
-  if (!val || val === 'undefined' || val === 'null' || val === '') return fallback;
-  return val;
-}
+import { NO_STORE_HEADERS, getEnv, ARC_TREASURY_FALLBACK, ARC_USDC_ADDRESS } from '@/lib/api-utils'
 
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
 
-const NO_STORE_HEADERS = {
-  'Cache-Control': 'no-store, max-age=0',
-}
-
 export const GET = withX402(
   {
     resource: '/api/thesis/[id]',
     priceUsdc: 0.001,
     description: 'Full thesis reasoning chain — 0.001 USDC',
-    treasuryAddress: getEnv(process.env.ROSETTA_TREASURY_ADDRESS, '0x000000000000000000000000000000000000dEaD'),
+    treasuryAddress: getEnv(process.env.ROSETTA_TREASURY_ADDRESS, ARC_TREASURY_FALLBACK),
     arcRpcUrl: process.env.NEXT_PUBLIC_ARC_RPC_URL!,
-    usdcAddress: getEnv(process.env.NEXT_PUBLIC_USDC_ARC_ADDRESS, '0x3600000000000000000000000000000000000000'),
+    usdcAddress: getEnv(process.env.NEXT_PUBLIC_USDC_ARC_ADDRESS, ARC_USDC_ADDRESS),
     settlerPrivateKey: process.env.ARC_SETTLER_PRIVATE_KEY!,
     // Thesis unlock is a demo read-gate: verify x402 proof, then unlock.
     // Quiz claims still perform on-chain settlement.

frontend/src/lib/api-utils.ts

@@ -6,6 +6,7 @@
  */
 
 import { NextResponse } from 'next/server'
+import { auth } from '../../auth'
 
 /** Standard no-cache headers for all API responses. */
 export const NO_STORE_HEADERS = { 'Cache-Control': 'no-store, max-age=0' } as const
@@ -16,7 +17,46 @@ export function isValidEthereumAddress(addr: string): boolean {
 }
 
 /**
- * Handle an unexpected server error — log + return structured 500 response.
+ * Resolve an env var with a fallback.
+ * Handles common misconfigurations: 'undefined', 'null', empty string.
+ */
+export function getEnv(val: string | undefined, fallback: string): string {
+  if (!val || val === 'undefined' || val === 'null' || val === '') return fallback
+  return val
+}
+
+/**
+ * Require authenticated session — returns 401 response if not logged in.
+ * DRY: replaces copy-pasted auth guard blocks across all API routes.
+ *
+ * Usage:
+ *   const res = await requireAuth()
+ *   if (res) return res  // 401 — stop here
+ *   const session = await auth()  // guaranteed non-null after this
+ */
+export async function requireAuth(): Promise<NextResponse | null> {
+  const session = await auth()
+  if (!session?.user) {
+    return NextResponse.json(
+      { success: false, error: 'Authentication required' },
+      { status: 401, headers: NO_STORE_HEADERS }
+    )
+  }
+  return null
+}
+
+// ─── Arc Testnet Constants ─────────────────────────────────────────────────
+
+/** USDC contract address on Arc Testnet. */
+export const ARC_USDC_ADDRESS = '0x3600000000000000000000000000000000000000'
+
+/** Treasury/dead address fallback. */
+export const ARC_TREASURY_FALLBACK = '0x000000000000000000000000000000000000dEaD'
+
+/** Arc Testnet chain ID. */
+export const ARC_CHAIN_ID = 5042002
+
+/** Handle an unexpected server error — log + return structured 500 response.
  * DRY: every route's catch block becomes `return handleServerError(error, 'Label')`.
  */
 export function handleServerError(error: unknown, context: string): NextResponse {

frontend/src/lib/x402Server.ts

@@ -57,6 +57,39 @@ import { privateKeyToAccount } from 'viem/accounts'
 import { decodePaymentHeader, buildTransferAuthorizationMessage } from './eip3009'
 import type { SignedAuthorization } from './eip3009'
 
+// ─── Replay Protection (settleOnChain: false only) ─────────────────────────
+
+/**
+ * In-memory nonce dedup for off-chain-only payments.
+ * When settleOnChain: false, the USDC contract doesn't track the nonce,
+ * so we must prevent replay attacks ourselves.
+ *
+ * Map key: nonce (hex string)
+ * Map value: expiration timestamp (ms)
+ * Cleanup runs every 60s to prevent memory growth.
+ */
+const usedNonces = new Map<string, number>()
+
+function cleanupExpiredNonces(): void {
+  const now = Date.now()
+  for (const [nonce, expiresAt] of usedNonces) {
+    if (expiresAt < now) usedNonces.delete(nonce)
+  }
+}
+setInterval(cleanupExpiredNonces, 60_000)
+
+function isNonceUsed(nonce: string): boolean {
+  return usedNonces.has(nonce)
+}
+
+function markNonceUsed(nonce: string, validBeforeMs: number): void {
+  // Cap TTL to 5 minutes to prevent memory bloat from misconfigured validBefore
+  const ttl = Math.min(validBeforeMs - Date.now(), 5 * 60 * 1000)
+  if (ttl > 0) {
+    usedNonces.set(nonce, Date.now() + ttl)
+  }
+}
+
 // ─── Arc Testnet Chain Definition (server-safe, no process.env at module level) ──
 
 /**
@@ -203,10 +236,11 @@ export function withX402(
     // ── Step 4: Verify the payment ──
     const verification = await verifyPayment(signedAuth, config)
     if (!verification.valid) {
+      console.warn(`[x402] Verification failed: ${verification.reason}`)
       return new Response(
         JSON.stringify({
           error: 'Payment verification failed',
-          detail: verification.reason,
+          detail: 'Payment signature verification failed',
           code: 'PAYMENT_VERIFICATION_FAILED',
         }),
         {
@@ -226,7 +260,7 @@ export function withX402(
         return new Response(
           JSON.stringify({
             error: 'Payment settlement failed',
-            detail: message,
+            detail: 'Settlement transaction failed',
             code: 'SETTLEMENT_FAILED',
           }),
           {
@@ -235,6 +269,23 @@ export function withX402(
           }
         )
       }
+    } else {
+      // Off-chain only: check nonce dedup to prevent replay
+      const nonceHex = signedAuth.nonce.toLowerCase()
+      if (isNonceUsed(nonceHex)) {
+        return new Response(
+          JSON.stringify({
+            error: 'Payment already used',
+            detail: 'This payment has already been redeemed',
+            code: 'PAYMENT_REPLAY_DETECTED',
+          }),
+          {
+            status: 402,
+            headers: { 'Content-Type': 'application/json' },
+          }
+        )
+      }
+      markNonceUsed(nonceHex, Number(signedAuth.validBefore) * 1000)
     }
 
     // ── Step 6: Payment verified/settled! Call the actual handler ──