code/cl8y-dex-terraclassic

Fork 0

Security: wrap pause and rate limit tests assert button visibility only, not copy or disabled state [SEC-A02] #389

New issue

Closed

opened 2026-06-18 15:03:55 +00:00 by totdking · 14 comments

totdking commented

2026-06-18 15:03:55 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-18 15:04:59 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-A02: Write user-facing copy for trading blacklist, pair pause, wrap pause, rate limit, indexer outage, and excessive slippage states. Verify: frontend tests assert clear messages and disabled CTAs where applicable.

Summary

Copy exists for wrap pause ("Wrapping is Temporarily Paused") and rate limit ("Rate Limit Exceeded") but the only test covering these states checks that a button is visible on screen without asserting the specific copy text or confirming the button is in a disabled state.

What Was Checked

frontend-dapp/src/pages/SwapPage.tsx lines 893-895, 903 -- confirmed copy for both states
frontend-dapp/e2e/wrap-swap.spec.ts lines 205-218 -- the only test covering these states
All other test files in src/**/__tests__/ and frontend-dapp/e2e/ searched for wrap pause and rate limit assertions

Expected (per checklist)

Frontend tests must assert the specific message copy is displayed and that the submit CTA is disabled for both wrap pause and rate limit states.

Actual

wrap-swap.spec.ts test E12 uses filter({ hasText: /Rate Limit|Insufficient|Swap/i }) which matches multiple possible button states with an OR pattern. It asserts the button is visible but does not confirm which text is showing, does not confirm the button is disabled, and does not isolate the wrap pause state separately from rate limit. There is no unit test for either state.

Evidence

frontend-dapp/src/pages/SwapPage.tsx line 893: "Wrapping is Temporarily Paused" button copy
frontend-dapp/src/pages/SwapPage.tsx line 903: "Rate Limit Exceeded" button copy
frontend-dapp/e2e/wrap-swap.spec.ts lines 205-218: regex matches three states at once, no disabled assertion, no copy-specific assertion
No unit test found for either state

Suggested Fix

Split E12 into two focused tests or add unit tests (Vitest + Testing Library) that:

Mock wrap mapper pause state and assert the button text is exactly "Wrapping is Temporarily Paused" and the button is disabled
Mock a 429 rate limit response and assert the button text is exactly "Rate Limit Exceeded" and the button is disabled Each state should be tested in isolation so a regression in one does not hide a failure in the other.

Verification Checklist

Steps to confirm the fix is complete and the checklist item can be marked done.

Test asserts "Wrapping is Temporarily Paused" copy is displayed when wrap mapper is paused
Test asserts the swap submit button is disabled in wrap pause state
Test asserts "Rate Limit Exceeded" copy is displayed on 429 response
Test asserts the swap submit button is disabled in rate limit state
Wrap pause and rate limit states are tested in isolation, not combined in one regex match
All new tests pass in CI

Labels

~security , pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-A02: Write user-facing copy for trading blacklist, pair pause, wrap pause, rate limit, indexer outage, and excessive slippage states. Verify: frontend tests assert clear messages and disabled CTAs where applicable. --- ### Summary Copy exists for wrap pause ("Wrapping is Temporarily Paused") and rate limit ("Rate Limit Exceeded") but the only test covering these states checks that a button is visible on screen without asserting the specific copy text or confirming the button is in a disabled state. --- ### What Was Checked - `frontend-dapp/src/pages/SwapPage.tsx` lines 893-895, 903 -- confirmed copy for both states - `frontend-dapp/e2e/wrap-swap.spec.ts` lines 205-218 -- the only test covering these states - All other test files in `src/**/__tests__/` and `frontend-dapp/e2e/` searched for wrap pause and rate limit assertions --- ### Expected (per checklist) Frontend tests must assert the specific message copy is displayed and that the submit CTA is disabled for both wrap pause and rate limit states. --- ### Actual `wrap-swap.spec.ts` test E12 uses `filter({ hasText: /Rate Limit|Insufficient|Swap/i })` which matches multiple possible button states with an OR pattern. It asserts the button is visible but does not confirm which text is showing, does not confirm the button is disabled, and does not isolate the wrap pause state separately from rate limit. There is no unit test for either state. --- ### Evidence - `frontend-dapp/src/pages/SwapPage.tsx` line 893: "Wrapping is Temporarily Paused" button copy - `frontend-dapp/src/pages/SwapPage.tsx` line 903: "Rate Limit Exceeded" button copy - `frontend-dapp/e2e/wrap-swap.spec.ts` lines 205-218: regex matches three states at once, no disabled assertion, no copy-specific assertion - No unit test found for either state --- ### Suggested Fix Split E12 into two focused tests or add unit tests (Vitest + Testing Library) that: - Mock wrap mapper pause state and assert the button text is exactly "Wrapping is Temporarily Paused" and the button is disabled - Mock a 429 rate limit response and assert the button text is exactly "Rate Limit Exceeded" and the button is disabled Each state should be tested in isolation so a regression in one does not hide a failure in the other. --- ### Verification Checklist Steps to confirm the fix is complete and the checklist item can be marked done. - [ ] Test asserts "Wrapping is Temporarily Paused" copy is displayed when wrap mapper is paused - [ ] Test asserts the swap submit button is disabled in wrap pause state - [ ] Test asserts "Rate Limit Exceeded" copy is displayed on 429 response - [ ] Test asserts the swap submit button is disabled in rate limit state - [ ] Wrap pause and rate limit states are tested in isolation, not combined in one regex match - [ ] All new tests pass in CI --- ### Labels ~security , `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-18 15:38:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 01:43:40 +00:00

(Migrated from gitlab.com)

mentioned in commit 8e0561c433

mentioned in commit 8e0561c433bf115954659cf341e9451c80cb029e

PlasticDigits commented

2026-06-19 01:43:58 +00:00

(Migrated from gitlab.com)

mentioned in merge request !920

PlasticDigits commented

2026-06-19 01:54:35 +00:00

(Migrated from gitlab.com)

mentioned in commit 7d8b4d1b41

mentioned in commit 7d8b4d1b411beae4d598ebd810d6d3eb2ae51ec9

PlasticDigits commented

2026-06-19 09:04:25 +00:00

(Migrated from gitlab.com)

mentioned in commit 7cd9c41b3b

mentioned in commit 7cd9c41b3bbcc4e8cd6741ddb7ae0679a2515747

PlasticDigits commented

2026-06-19 09:04:44 +00:00

(Migrated from gitlab.com)

mentioned in merge request !921

PlasticDigits commented

2026-06-19 10:12:57 +00:00

(Migrated from gitlab.com)

mentioned in commit 4b0e10401f

mentioned in commit 4b0e10401f4caef39cb09a4bbc91fa98b8639e89

PlasticDigits commented

2026-06-19 10:43:02 +00:00

(Migrated from gitlab.com)

Verification complete — PASS

Verified GitLab #389 / launch checklist SEC-A02 (wrap pause + wrap rate limit CTA copy and disabled state) on main @ 4b0e1040.

Checklist

Item	Result	How verified
Assert "Wrapping is Temporarily Paused" copy when wrap mapper is paused	PASS	Vitest `SwapPage.test.tsx` — `shows disabled Wrapping is Temporarily Paused CTA when wrap mapper is paused`; Playwright `wrap-swap.spec.ts` — isolated describe `wrap mapper paused shows disabled Wrapping is Temporarily Paused CTA`
Assert submit CTA disabled in wrap pause state	PASS	Both tests: `toBeDisabled()` / `await expect(btn).toBeDisabled()`
Assert "Rate Limit Exceeded" copy on wrap rate limit	PASS	Vitest — `shows disabled Rate Limit Exceeded CTA when wrap mapper rate limit is exceeded` (`checkRateLimitExceeded` mock); Playwright E12 — `getByRole('button', { name: 'Rate Limit Exceeded' })` with LCD route mock (`routeWrapMapperRateLimitExceeded`)
Assert submit CTA disabled in rate limit state	PASS	Vitest + E12 both assert disabled
Wrap pause and rate limit tested in isolation (no combined regex)	PASS	Separate Vitest cases; E12 is rate-limit-only; wrap pause in dedicated `Swap wrap safety CTA — isolated LCD mocks` describe; old `Rate Limit\|Insufficient\|Swap` OR pattern removed from `wrap-swap.spec.ts`
All tests pass	PASS	Commands below — 2/2 Vitest, 2/2 Playwright

Commands run

# Unit (no chain)
bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \
  src/pages/SwapPage.test.tsx -t "Wrapping is Temporarily Paused|Rate Limit Exceeded"
# → 2 passed

bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \
  src/pages/SwapPage.test.tsx -t "SEC-A02"
# → 5 passed (includes #388 blacklist + #389 wrap cases)

# E2E (LocalTerra + deploy env)
make setup-cloud-localterra  # fresh deploy after stale-state fund error
bash scripts/with-node.sh --cwd frontend-dapp -- npx playwright test \
  e2e/wrap-swap.spec.ts -g "SEC-A02|wrap mapper paused" --project=e2e-tx
# → 2 passed

Evidence in tree

Copy: SwapPage.tsx — pause → Wrapping is Temporarily Paused, rate limit → Rate Limit Exceeded
Vitest: SwapPage.test.tsx describe wrap pause and wrap rate limit CTA (SEC-A02 / GitLab #389)
E2E mocks: e2e/helpers/wrap-mapper-lcd-mock.ts; tests in e2e/wrap-swap.spec.ts
Docs/playbook: docs/testing.md § Swap wrap safety CTA, skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md

Note: Rate limit coverage is the on-chain wrap mapper quota (checkRateLimitExceeded / LCD rate_limit query mock), not indexer HTTP 429 — consistent with skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md.

No repo changes from this verification pass.

## Verification complete — PASS Verified GitLab **#389** / launch checklist **SEC-A02** (wrap pause + wrap rate limit CTA copy and disabled state) on `main` @ `4b0e1040`. ### Checklist | Item | Result | How verified | |------|--------|--------------| | Assert **"Wrapping is Temporarily Paused"** copy when wrap mapper is paused | **PASS** | Vitest `SwapPage.test.tsx` — `shows disabled Wrapping is Temporarily Paused CTA when wrap mapper is paused`; Playwright `wrap-swap.spec.ts` — isolated describe `wrap mapper paused shows disabled Wrapping is Temporarily Paused CTA` | | Assert submit CTA **disabled** in wrap pause state | **PASS** | Both tests: `toBeDisabled()` / `await expect(btn).toBeDisabled()` | | Assert **"Rate Limit Exceeded"** copy on wrap rate limit | **PASS** | Vitest — `shows disabled Rate Limit Exceeded CTA when wrap mapper rate limit is exceeded` (`checkRateLimitExceeded` mock); Playwright E12 — `getByRole('button', { name: 'Rate Limit Exceeded' })` with LCD route mock (`routeWrapMapperRateLimitExceeded`) | | Assert submit CTA **disabled** in rate limit state | **PASS** | Vitest + E12 both assert disabled | | Wrap pause and rate limit tested **in isolation** (no combined regex) | **PASS** | Separate Vitest cases; E12 is rate-limit-only; wrap pause in dedicated `Swap wrap safety CTA — isolated LCD mocks` describe; old `Rate Limit\|Insufficient\|Swap` OR pattern removed from `wrap-swap.spec.ts` | | All tests pass | **PASS** | Commands below — 2/2 Vitest, 2/2 Playwright | ### Commands run ```bash # Unit (no chain) bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \ src/pages/SwapPage.test.tsx -t "Wrapping is Temporarily Paused|Rate Limit Exceeded" # → 2 passed bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \ src/pages/SwapPage.test.tsx -t "SEC-A02" # → 5 passed (includes #388 blacklist + #389 wrap cases) # E2E (LocalTerra + deploy env) make setup-cloud-localterra # fresh deploy after stale-state fund error bash scripts/with-node.sh --cwd frontend-dapp -- npx playwright test \ e2e/wrap-swap.spec.ts -g "SEC-A02|wrap mapper paused" --project=e2e-tx # → 2 passed ``` ### Evidence in tree - Copy: `SwapPage.tsx` — pause → `Wrapping is Temporarily Paused`, rate limit → `Rate Limit Exceeded` - Vitest: `SwapPage.test.tsx` describe `wrap pause and wrap rate limit CTA (SEC-A02 / GitLab #389)` - E2E mocks: `e2e/helpers/wrap-mapper-lcd-mock.ts`; tests in `e2e/wrap-swap.spec.ts` - Docs/playbook: `docs/testing.md` § Swap wrap safety CTA, `skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md` **Note:** Rate limit coverage is the **on-chain wrap mapper quota** (`checkRateLimitExceeded` / LCD `rate_limit` query mock), not indexer HTTP 429 — consistent with `skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md`. No repo changes from this verification pass.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-19 10:43:03 +00:00

PlasticDigits commented

2026-06-25 14:13:01 +00:00

(Migrated from gitlab.com)

mentioned in issue #422