Prevent replayable crypto tx claims and reject already-claimed transactions

[ianalloway]

Motivation

• Close a high-severity vulnerability where an attacker could replay a public Ethereum transaction hash and mint an entitlement cookie or overwrite an existing claimant.
• Ensure crypto entitlements are bound to the first verified claimant and prevent unauthorized re-claims.

Description

• Add CryptoTransactionAlreadyClaimedError and check for an existing crypto:<normalizedHash> record in upsertCryptoEntitlement to reject replay attempts instead of merging/overwriting (updated netlify/functions/_lib/entitlements.ts).
• Normalize the txHash early and preserve the deterministic entitlement id crypto:<normalizedHash> while keeping the original claimant’s metadata intact (updated upsertCryptoEntitlement).
• Catch the new error in the verification API and return HTTP 409 with a clear reason instead of creating a new entitlement session and Set-Cookie (updated api/verify-crypto-payment.ts).
• Add a regression test netlify/functions/_lib/entitlements.test.ts that asserts replayed transaction hashes are rejected and do not grant access to a different email.

Testing

• Ran npm test and all tests passed (Test Files: 3 passed, Tests: 21 passed).
• Ran npm run lint which completed with warnings but no errors.
• Ran npm run build which completed successfully.

---

Codex Task

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[netlify]

✅ Deploy Preview for aiadvantagea ready!

Name	Link
🔨 Latest commit	1bb2ec7
🔍 Latest deploy log	https://app.netlify.com/projects/aiadvantagea/deploys/6a567d2b5807280008ff2d50
😎 Deploy Preview	https://deploy-preview-82--aiadvantagea.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.