Frontend/four issues content csp docs

[Mac-5]

Summary

1. Content page integration tests for unlock flow

content/[id] previously only had a test for the page shell (subscription badge), not the actual unlock flow. Added frontend/src/app/content/[id]/unlock-flow.test.tsx, which mocks the content API layer (getContentById) directly and asserts:

• Gated content without an active subscription renders the locked overlay ("Exclusive Content" + Subscribe CTA)
• Un-gated content renders the full player immediately
• Gated content resolves to the full player once the access check reflects an active subscription

Uses fake timers to deterministically advance past the simulated access-check delay, keeping the suite stable in CI.

2. Local env + Freighter quickstart for the frontend package

Contributors had no documented path to set up the frontend locally or connect Freighter to the local API.

• Added frontend/.env.example (API base URL, Stellar network, Horizon/Soroban RPC overrides, contract IDs, feature flags, dev-auth shortcut) and un-ignored it in frontend/.gitignore (which blanket-ignores .env*).
• Added frontend/docs/LOCAL_QUICKSTART.md: a ~15-minute walkthrough (prerequisites → env setup → install/run → connect Freighter → smoke-test checklist) plus troubleshooting for common wallet/CORS/CSP failures.
• Added frontend/README.md linking the quickstart and other existing docs (CSP, security headers, wallet system, accessibility) — no frontend README existed before.

3. Enforce CSP connect-src for configured Soroban RPC

next.config.ts's CSP builder hardcoded a fixed Stellar host list and never read NEXT_PUBLIC_SOROBAN_RPC_URL / NEXT_PUBLIC_HORIZON_URL. Pointing the app at a non-default RPC silently broke wallet calls once CSP blocked the un-listed host.

• Extracted CSP construction into frontend/src/lib/csp.ts (buildConnectSrcHosts, buildContentSecurityPolicy), independently testable from next.config.ts.
• connect-src now always includes the API origin + default Stellar hosts, plus whatever host is configured via NEXT_PUBLIC_SOROBAN_RPC_URL / NEXT_PUBLIC_HORIZON_URL, deduped.
• next.config.ts now delegates to the shared helper; existing default-host behavior is unchanged.
• Documented the full allowed host list and rationale in frontend/docs/CSP.md

4. CSP regression test for wallet connect-src hosts

CSP changes can silently break wallets — a refactor can drop a Stellar host and nothing fails until a wallet throws a CSP violation in production.

• Added frontend/src/lib/csp.test.ts asserting: every default Stellar host isresent, env-configured RPC/Horizon hosts are added and deduped, arbitraryunconfigured hosts are rejected, and localhost:*/127.0.0.1:* only appear outside production.
• Documented the regression test and the update process (edit DEFAULT_STELLAR_he docs together) in frontend/docs/CSP.md`.

Changes

Test Plan

Automated tests added or updated

• Unit tests (backend/src/**/*.spec.ts) — service/guard/decorator logic in isolation
• Integration / e2e tests (backend/test/**/*.e2e-spec.ts) — HTTP round-trips with mocked infrastructure
• Frontend component tests (frontend/src/**/*.test.{ts,tsx}) — React component behaviour
• Frontend e2e tests (frontend/e2e/**/*.spec.ts) — Playwright browser flows
• Contract tests (contract/) — Soroban/Rust unit tests via cargo test
• No new tests required — explain why: ___

How to run the tests locally

# Backend unit tests
cd backend && npm test

# Backend e2e tests (requires no live DB — uses in-memory mocks)
cd backend && npm run test:e2e

# Frontend component tests
cd frontend && npx vitest run

# Frontend e2e tests (requires dev server on :3000 and API on :3001)
cd frontend && npx playwright test

# Contract tests
cd contract && cargo test

Manual verification checklist

• Happy path works end-to-end in a local environment
• Error / edge cases handled gracefully (stale state, invalid input, disconnected wallet)
• No regressions in closely related API or UI flows
• Rate-limiting, auth guards, and feature flags behave as expected where touched
• Linting passes: cd backend && npm run lint / cd frontend && npm run lint

Related issues

Notes for reviewers

Closes #1492
Closes #1493
Closes #1488
Closes #1494

[drips-wave]

@Mac-5 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits