fix: exclude marketplace fees from private listings

[ryanio]

Fix marketplace fees in private listings and prevent CI order conflicts

Summary

This PR addresses two issues:

1. Primary fix: Marketplace fees are now properly excluded from private listings (when buyerAddress is specified in createListing). The getFees() method in src/sdk.ts has been modified to filter out marketplace fees for private listings using the OPENSEA_FEE_RECIPIENT constant.

2. CI improvement: Added a getRandomExpiration() helper function that generates random expiration times (15-60 minutes) to prevent "Order already exists" validation errors in integration tests.

3. Security fix: Replaced biased modulo operation with rejection sampling in random number generation to resolve CodeQL security alerts about cryptographically secure random numbers.

Key changes:

• Modified getFees() method to detect private listings via isPrivateListing parameter and exclude marketplace fees
• Added OPENSEA_FEE_RECIPIENT constant to src/constants.ts
• Created getRandomExpiration() helper in test/integration/setup.ts using secure rejection sampling
• Updated all integration tests to use random expiration times
• Added comprehensive integration tests for private listings

Review & Testing Checklist for Human

• Verify marketplace fee exclusion works end-to-end: Create a private listing via the API and confirm marketplace fees are not included in the order's consideration array
• Test regular listings still include fees: Create a regular listing and verify marketplace fees are still present
• Validate OPENSEA_FEE_RECIPIENT constant: Confirm 0x0000a26b00c1f0df003000390027140000faa719 is the correct marketplace fee recipient address
• Regression testing: Verify that fee calculations for different payment tokens and collection fees still work correctly
• Monitor CI for order conflicts: Check that integration tests no longer fail with "Order already exists" errors

Recommended test plan: Create both private and regular listings using the SDK with the same NFT to verify the fee behavior difference.

---

Diagram

%%{ init : { "theme" : "default" }}%%
graph TD
    SDK["src/sdk.ts<br/>getFees() method"]:::major-edit
    Constants["src/constants.ts<br/>OPENSEA_FEE_RECIPIENT"]:::minor-edit
    Setup["test/integration/setup.ts<br/>getRandomExpiration()"]:::minor-edit
    
    PostOrder["test/integration/postOrder.spec.ts<br/>Order posting tests"]:::minor-edit
    PrivateListing["test/integration/privateListing.spec.ts<br/>Private listing tests"]:::minor-edit
    
    API["OpenSea API<br/>Order validation"]:::context
    
    SDK -->|"excludes marketplace fees<br/>for private listings"| API
    Constants -->|"identifies marketplace<br/>fee recipient"| SDK
    Setup -->|"prevents order conflicts"| PostOrder
    Setup -->|"prevents order conflicts"| PrivateListing
    
    subgraph Legend
        L1[Major Edit]:::major-edit
        L2[Minor Edit]:::minor-edit
        L3[Context/No Edit]:::context
    end
    
    classDef major-edit fill:#90EE90
    classDef minor-edit fill:#87CEEB
    classDef context fill:#FFFFFF

Loading

Notes

• The core fix addresses GitHub issue Error: Server Error: Validation error: Private transactions should not include marketplace fees. #1710 about marketplace fees in private transactions
• Local integration tests pass (22 passing, 0 failing) with the new random expiration logic
• The isPrivateListing parameter in getFees() defaults to false to maintain backward compatibility
• Random expiration times range from 15-60 minutes from current time to provide sufficient variability while keeping reasonable test execution times
• Security fix uses rejection sampling to eliminate modulo bias in cryptographically secure random number generation
• All CI checks now pass including CodeQL security analysis

Session info: Requested by @ryanio
Link to Devin run: https://app.devin.ai/sessions/ab90a4a425d545c2ad20b28fb238165e

[devin-ai-integration]

Original prompt from Ryan:

 In opensea-js, please fix this issue, do not marketplace fees in private transactions  (when buyerAddress is specified in createListing). add a test for it that the api returns properly
https://github.com/ProjectOpenSea/opensea-js/issues/1710

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[ryanio]

Use the OPENSEA_FEE_RECIPIENT const

[ryanio]

Move this to setup.ts