test(frontend): verify Trade pair search replaces dropdown (#301) #825

2026-06-06T07:04:07Z

PlasticDigits commented

2026-06-06 07:04:07 +00:00

(Migrated from gitlab.com)

Summary

Closes verification for GitLab #301.

The original /trade pair-switch bug (stale MenuSelect dropdown) was already fixed on main by replacing it with PairSearchSelect (#314). This MR adds regression tests and doc cross-links so the acceptance criteria stay locked:

Pair dropdown → search combobox on /trade (and Limits)
Empty search loads top pairs via GET /api/v1/pairs?sort=volume_24h&order=desc&limit=20 (up to 20 items)
Selecting a different pair calls onChange, navigates to /trade/:newPairAddr, and triggers workspace fetch for the new pair

No production code changes — behavior was already correct.

Acceptance checklist

Criterion	Verification	Result
Pair dropdown replaced with searchable combobox on `/trade`	`PairSearchSelect.issue301.test.tsx` — combobox with `type=text`, placeholder `Search pairs…`	PASS
Empty search shows top pairs by 24h volume (≤20)	`PairSearchSelect.issue301.test.tsx` — asserts `getPairs({ sort: 'volume_24h', order: 'desc', limit: 20 })`	PASS
Selecting a different pair switches workspace	`PairSearchSelect.issue301.test.tsx` — `onChange` fired; `TradePage.test.tsx` — URL → `/trade/:addr`, `getPair` called	PASS
Docs cross-link #301	`docs/frontend.md` § Pair search combobox	PASS

Third-party verification

export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH"
cd frontend-dapp
npm test -- --run src/components/trade/__tests__/PairSearchSelect.issue301.test.tsx
npm test -- --run src/pages/TradePage.test.tsx -t "GitLab #301"

Manual (requires LocalTerra + indexer): open /trade/:pairAddr → click Pair search → with empty query confirm multiple pairs listed (sorted by volume badge when indexed) → select another pair → URL and chart/book/ticket update.

Issue

Leave #301 open until this MR merges; then close with verification note.

Note

Low Risk
Test and documentation only; no production UI or routing logic changed in this diff.

Overview
Regression tests for GitLab #301 — pair search combobox on Trade (replacing a static dropdown) and switching pairs from search without breaking routing or workspace loads.

New PairSearchSelect.issue301.test.tsx asserts the control is a text combobox with Search pairs…, that opening with no query calls getPairs with sort=volume_24h / order=desc, and that picking another option invokes onChange with the new pair address.

TradePage.test.tsx gains an integration case: from /trade/:pairA, select the second pair in the listbox and expect navigation to /trade/:pairB plus getPair(PAIR_B). Imports within from Testing Library for listbox scoping.

docs/frontend.md links issue #301 on the PairSearchSelect section and lists the new test files under regression coverage.

^{Reviewed by Cursor Bugbot for commit 6482e8c54b. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Closes verification for [GitLab #301](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/301). The original `/trade` pair-switch bug (stale `MenuSelect` dropdown) was already fixed on `main` by replacing it with [`PairSearchSelect`](frontend-dapp/src/components/trade/PairSearchSelect.tsx) ([#314](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/314)). This MR adds regression tests and doc cross-links so the acceptance criteria stay locked: - **Pair dropdown → search combobox** on `/trade` (and Limits) - **Empty search** loads top pairs via `GET /api/v1/pairs?sort=volume_24h&order=desc&limit=20` (up to 20 items) - **Selecting a different pair** calls `onChange`, navigates to `/trade/:newPairAddr`, and triggers workspace fetch for the new pair No production code changes — behavior was already correct. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Pair dropdown replaced with searchable combobox on `/trade` | `PairSearchSelect.issue301.test.tsx` — combobox with `type=text`, placeholder `Search pairs…` | **PASS** | | Empty search shows top pairs by 24h volume (≤20) | `PairSearchSelect.issue301.test.tsx` — asserts `getPairs({ sort: 'volume_24h', order: 'desc', limit: 20 })` | **PASS** | | Selecting a different pair switches workspace | `PairSearchSelect.issue301.test.tsx` — `onChange` fired; `TradePage.test.tsx` — URL → `/trade/:addr`, `getPair` called | **PASS** | | Docs cross-link #301 | `docs/frontend.md` § Pair search combobox | **PASS** | ## Third-party verification ```bash export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH" cd frontend-dapp npm test -- --run src/components/trade/__tests__/PairSearchSelect.issue301.test.tsx npm test -- --run src/pages/TradePage.test.tsx -t "GitLab #301" ``` Manual (requires LocalTerra + indexer): open `/trade/:pairAddr` → click Pair search → with empty query confirm multiple pairs listed (sorted by volume badge when indexed) → select another pair → URL and chart/book/ticket update. ## Issue Leave [#301](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/301) **open** until this MR merges; then close with verification note.  --- > [!NOTE] > **Low Risk** > Test and documentation only; no production UI or routing logic changed in this diff. > > **Overview** > **Regression tests for GitLab #301** — pair search combobox on Trade (replacing a static dropdown) and switching pairs from search without breaking routing or workspace loads. > > New **`PairSearchSelect.issue301.test.tsx`** asserts the control is a text **combobox** with **Search pairs…**, that opening with no query calls **`getPairs`** with **`sort=volume_24h`** / **`order=desc`**, and that picking another option invokes **`onChange`** with the new pair address. > > **`TradePage.test.tsx`** gains an integration case: from **`/trade/:pairA`**, select the second pair in the listbox and expect navigation to **`/trade/:pairB`** plus **`getPair(PAIR_B)`**. Imports **`within`** from Testing Library for listbox scoping. > > **`docs/frontend.md`** links issue **#301** on the PairSearchSelect section and lists the new test files under regression coverage. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6482e8c54bb8a25c93dacf7cf45fae89b4abf449. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-06 07:04:14 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-06 07:04:20 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-06 07:04:21 +00:00

(Migrated from gitlab.com)

mentioned in issue #301

ghost1 commented

2026-06-06 07:04:21 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-06 07:07:16 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 6482e8c54bb8a25c93dacf7cf45fae89b4abf449
Scope: 3 files — docs/frontend.md (doc cross-links), frontend-dapp/src/components/trade/__tests__/PairSearchSelect.issue301.test.tsx (new), frontend-dapp/src/pages/TradePage.test.tsx (new regression test). No production/runtime code changes.

Method: Inspected the full MR diff. Traced attacker-controlled inputs only insofar as tests exercise mocked indexer/factory clients (vi.mock, hard-coded terra1… fixtures). No new HTTP handlers, routing logic, auth boundaries, secrets, dependencies, or deserialization paths were introduced.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Area checked	Result
Injection (SQL/NoSQL/command)	N/A — no runtime query construction added
XSS / unsafe HTML rendering	N/A — tests use Testing Library; no new DOM sinks
Authn / authz bypass	N/A — no auth or permission logic touched
SSRF / open redirects	N/A — mocks only; no new outbound URL handling
Secret leakage / insecure logging	None — fixtures are synthetic addresses
Dependency / supply-chain	No `package.json` or lockfile changes
Path traversal / unsafe deserialization	N/A

Inline threads: none (no findings to anchor).

Automated security review (Cursor Cloud Agent)

## Security review **Commit reviewed:** `6482e8c54bb8a25c93dacf7cf45fae89b4abf449` **Scope:** 3 files — `docs/frontend.md` (doc cross-links), `frontend-dapp/src/components/trade/__tests__/PairSearchSelect.issue301.test.tsx` (new), `frontend-dapp/src/pages/TradePage.test.tsx` (new regression test). No production/runtime code changes. **Method:** Inspected the full MR diff. Traced attacker-controlled inputs only insofar as tests exercise mocked indexer/factory clients (`vi.mock`, hard-coded `terra1…` fixtures). No new HTTP handlers, routing logic, auth boundaries, secrets, dependencies, or deserialization paths were introduced. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. | Area checked | Result | |---|---| | Injection (SQL/NoSQL/command) | N/A — no runtime query construction added | | XSS / unsafe HTML rendering | N/A — tests use Testing Library; no new DOM sinks | | Authn / authz bypass | N/A — no auth or permission logic touched | | SSRF / open redirects | N/A — mocks only; no new outbound URL handling | | Secret leakage / insecure logging | None — fixtures are synthetic addresses | | Dependency / supply-chain | No `package.json` or lockfile changes | | Path traversal / unsafe deserialization | N/A | Inline threads: none (no findings to anchor). --- *Automated security review (Cursor Cloud Agent)*