Auditar VITE_PINATA_SECRET: confirmar que sea JWT público o moverlo a proxy backend

[David1984TK]

Contexto

En .env.example aparece VITE_PINATA_SECRET. Todo lo prefijado con VITE_ se bundlea en el JS público del frontend y queda visible a cualquier usuario.

Si esa variable es:

• ✅ Un JWT público de Pinata (gateway-only, sin permisos de mutación) → ok, solo renombrar a algo menos confuso (VITE_PINATA_GATEWAY_TOKEN).
• ❌ Un API secret con permisos de upload → riesgo crítico: cualquiera puede subir archivos a tu cuenta o quemar la cuota.

Tareas

• Inspeccionar la variable real en Vercel y verificar permisos del token en el dashboard de Pinata.
• Si tiene permisos de upload:
  • Crear endpoint /upload-ipfs en bimex-indexer que reciba el archivo, valide tamaño/tipo (ya existe validarArchivo), y haga el upload desde backend con el secret real.
  • Frontend llama al proxy en lugar de a Pinata directamente.
  • Rotar el secret expuesto.
• Documentar la decisión en docs/.
• Agregar test E2E del flujo de upload.

Referencia

• bimex-frontend/.env.example
• bimex-frontend/src/utils/ipfs.js

[AbdulmalikAlayande]

@AbdulmalikAlayande has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hola David, soy Abdulmalik, me gustaría trabajar en esta issue.
Entiendo el riesgo: como la variable empieza con VITE_, termina en el bundle público del frontend y queda visible para cualquiera. Si solo es un token de gateway, el arreglo es renombrarlo. Si tiene permisos de upload, es un problema serio y hay que sacarlo del frontend.

Mi plan sería este:
Primero reviso el token real en Vercel y en el dashboard de Pinata para confirmar qué permisos tiene. Eso decide todo lo demás.
Si tiene permisos de upload, creo el endpoint /upload-ipfs en bimex-indexer, que reciba el archivo, lo valide con validarArchivo que ya existe, y haga el upload desde el backend con el secret real. El frontend llamaría a ese proxy en vez de ir directo a Pinata. Después roto el secret expuesto.

Al final documento la decisión en docs/ y agrego el test E2E del flujo de upload.
¿Hay algo más de infraestructura que deba saber antes de empezar?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @AbdulmalikAlayande to this issue.

[JClark011]

@JClark011 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello Maintainer, I’ve reviewed the issue description and I’m confident I can work on it effectively. Please assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @JClark011 to this issue.

[Zarmaijemimah]

@Zarmaijemimah has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I’ll look to work on this issue please kindly assign thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Zarmaijemimah to this issue.

[drips-wave]

Congratulations, @sochima2! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @sochima2: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[Hollujay]

@Hollujay has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Hollujay to this issue.

[drips-wave]

Congratulations, @Zarmaijemimah! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @Zarmaijemimah: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊