[PrimeFactor-Dev]

Closes #1348, Closes #1487, Closes #1488, Closes #1489

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactoring (no functional or behavioral changes)
• Performance improvement
• Documentation update
• Build / CI configuration change
• Dependency update
• Other:

---

Summary

Four targeted fixes across security hardening, CI testing, frontend reliability, and infrastructure:

1. frontend: CSP header does not restrict connect-src to known API origins #1488 — CSP connect-src in frontend/nginx.conf now restricts to known Stellar RPC/Horizon origins instead of only 'self', preventing data exfiltration while allowing legitimate blockchain calls.
2. frontend: E2E tests are not run against the production Vite build #1487 — E2E tests now include frontend/e2e/ specs and run against vite preview (production build) via a dedicated e2e-prod-build CI job that blocks merges to main.
3. frontend: campaign search input debounce is missing — fires on every keystroke #1489 — Added unit test verifying in-flight campaign search requests are cancelled when a new search starts (complementing existing debounce coverage).
4. infra(backup): Automated daily database backup verification worker restoring to isolated sandbox #1348 — Added scripts/verify-backup.sh backup verification worker that restores backups to an isolated sandbox database and runs integrity checks.

Motivation / Context

Closes #1348, Closes #1487, Closes #1488, Closes #1489

Changes

#1488 — CSP connect-src restriction

• frontend/nginx.conf: Expanded connect-src to allow https://soroban-testnet.stellar.org, https://horizon-testnet.stellar.org, https://soroban-mainnet.stellar.org, https://horizon.stellar.org
• docs/SECURITY_XSS_PREVENTION.md: Documented the connect-src policy and allowed origins

#1487 — E2E against production build

• frontend/playwright.config.js: Updated testMatch to include e2e/**/*.spec.{js,ts} alongside tests/e2e/
• .github/workflows/frontend-ci.yml: Added e2e-prod-build job that builds and runs Playwright against vite preview
• docs/E2E_TESTING.md: Documented the production-build E2E setup

#1489 — Search in-flight cancellation test

• frontend/src/Landing.test.jsx: Added test verifying stale fetch results are discarded when a new search starts

#1348 — Backup verification worker

• scripts/verify-backup.sh: New script that discovers the latest backup, restores to an isolated sandbox DB, runs integrity checks, and reports pass/fail

Testing

• npx vitest run src/Landing.test.jsx src/components/CampaignFilters.test.jsx — 13/13 passed
• CSP change is configuration-only (Nginx header); validated against known Stellar endpoints from frontend/src/config.js
• verify-backup.sh follows the same patterns as restore-db.sh (checksum, decrypt, decompress, pg_restore, smoke queries)

Tradeoffs

• connect-src includes both testnet and mainnet Stellar endpoints to support both networks without CSP changes per environment
• verify-backup.sh creates/drops a sandbox DB on the same PostgreSQL instance — sufficient for verification; full isolation would require a separate DB server
• In-flight cancellation uses AbortController as a discard flag (results dropped on abort) rather than network-level fetch abort, matching the existing apiClient pattern

Out of scope

• Wallet extension integration tests (Freighter/Rabet/xBull communicate via browser extension messaging, unaffected by connect-src)
• Full k8s CronJob wiring for verify-backup.sh scheduling
• Network-level fetch abort (current pattern discards stale results without aborting the TCP connection)

[drips-wave]

@PrimeFactor-Dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits