feat: replace Infura IPFS credentials with a Pinata JWT and gateway token

[levalleux-ludo]

Adapts the dapp to core-components#1040, pulled in by the react-kit 0.43.0-alpha.0 / common 1.35.0-alpha.0 bump in the first commit.

Why

Infura's IPFS service is decommissioned. The default ipfsMetadataUrl for every environment is now https://uploads.pinata.cloud/v3/files, and the old ipfsProjectId / ipfsProjectSecret pair is replaced by two distinct credentials:

new option	header	used for
ipfsJwt	Authorization: Bearer <jwt>	uploads
ipfsGatewayToken	x-pinata-gateway-token	reads, through a gateway that restricts them

The old project id/secret only ever fed the upload header, so REACT_APP_IPFS_JWT is its direct replacement.

Nothing fails to compile without this change — ipfsProjectId / ipfsProjectSecret are deprecated rather than removed, and pnpm tsc was green before it. This is a runtime migration: left as-is, every upload would reach Pinata carrying an Infura Basic header and 401.

Env vars

• REACT_APP_INFURA_IPFS_PROJECT_ID + REACT_APP_INFURA_IPFS_PROJECT_SECRET → REACT_APP_IPFS_JWT (required)
• REACT_APP_IPFS_GATEWAY_TOKEN (optional) — a gateway with public reads needs none, and the SDK ignores the value for any host that is not a dedicated Pinata gateway. Deliberately left out of the deploy workflow's required-value guard so those environments still deploy green.

.env.example also repoints REACT_APP_IPFS_GATEWAY / REACT_APP_IPFS_IMAGE_GATEWAY, which still named bosonprotocol.infura-ipfs.io — a host that no longer resolves.

Also passing ipfsGateway

The Pinata upload endpoint cannot serve reads, so IpfsMetadataStorage can no longer cat(). CoreSDKContext and useIpfsStorage now pass ipfsGateway alongside the token; without it every metadata read falls through to the SDK's public default gateway.

Header construction reuses the library's own hooks.getIpfsHeaders instead of rebuilding it, so the spelling stays in step with what IpfsMetadataStorage reads back.

⚠️ Required before merge — GitHub environment secrets

Deploys break until testing / staging / production are updated:

• add REACT_APP_IPFS_JWT — the deploy now fails fast without it
• add REACT_APP_IPFS_GATEWAY_TOKEN only where the gateway restricts reads
• delete REACT_APP_INFURA_IPFS_PROJECT_ID / REACT_APP_INFURA_IPFS_PROJECT_SECRET
• repoint the REACT_APP_IPFS_GATEWAY / REACT_APP_IPFS_IMAGE_GATEWAY variables off infura-ipfs.io

Verification

• pnpm tsc, pnpm lint:check, pnpm prettier:check — all clean
• pnpm test — 44 tests, 3 suites, all passing
• pnpm build — succeeds; confirmed REACT_APP_IPFS_JWT is inlined into the main bundle
• no INFURA_IPFS / infuraProject references left in the tree

Still to do by hand, against a real Pinata JWT (DevTools → Network): a product page read returns 200; a seller-profile logo upload POSTs to uploads.pinata.cloud/v3/files with Authorization: Bearer … and returns 200; the offer full-description widget renders. Worth running twice — once with REACT_APP_IPFS_GATEWAY_TOKEN unset against a public gateway, once set against a restricted *.mypinata.cloud one.

Out of scope

public/index.html's og:image still points at a dead infura-ipfs.io CID. Video.tsx strips that same host off legacy URLs and refetches via ipfs://<cid> — kept, since existing metadata still carries those URLs. lens.infura-ipfs.io in lib/utils/ipfs.ts is Lens' gateway, not ours.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The migration updates config, SDK wiring, and deploy-time env validation consistently, and only minor maintainability feedback remains.

Pull request overview

This PR migrates the dapp’s IPFS integration away from deprecated Infura credentials to Pinata’s JWT + optional gateway token model, aligning the app’s runtime configuration with the updated @bosonprotocol/react-kit/common stack.

Changes:

• Replace ipfsProjectId/ipfsProjectSecret usage with ipfsJwt + ipfsGatewayToken and reuse hooks.getIpfsHeaders for upload header construction.
• Pass ipfsGateway and ipfsGatewayToken through Core SDK context and IPFS metadata storage hook to support authenticated reads via dedicated Pinata gateways.
• Update deploy workflow + .env.example to use the new environment variables and bump @bosonprotocol/common / @bosonprotocol/react-kit versions.

File summaries

File	Description
src/pages/common/OfferFullDescription.tsx	Updates widget provider props to use Pinata JWT/gateway token instead of Infura project credentials.
src/lib/utils/hooks/useIpfsStorage.ts	Extends IPFS metadata storage initialization to pass gateway + optional gateway token for reads.
src/lib/config.ts	Adds REACT_APP_IPFS_JWT / REACT_APP_IPFS_GATEWAY_TOKEN config wiring and swaps header construction to hooks.getIpfsHeaders.
src/components/core-sdk/CoreSDKContext.tsx	Plumbs ipfsGateway and ipfsGatewayToken into useCoreSdk initialization.
package.json	Bumps @bosonprotocol/common and @bosonprotocol/react-kit to versions that support the new IPFS auth model.
pnpm-lock.yaml	Lockfile updates reflecting dependency bumps and transitive additions.
.github/workflows/deploy_reusable.yaml	Switches deploy secrets/env validation from Infura credentials to REACT_APP_IPFS_JWT (+ optional gateway token).
.env.example	Documents the new env vars and updates example gateway host away from infura-ipfs.io.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 7/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Preview deployment

View	URL
dApp	https://b85bdce4.interface-a9d.pages.dev/#/dapp
DR Center	https://b85bdce4.interface-a9d.pages.dev/#/dr_center

Built from aac9d3d.