Security: frontend tests for trading blacklist copy and disabled CTAs (#388) #917

2026-06-19T01:40:46Z

PlasticDigits commented

2026-06-19 01:40:46 +00:00

(Migrated from gitlab.com)

Summary

Adds Vitest coverage for SEC-A02 / GitLab #388: when the trading blacklist blocks a wallet, token, or pair, the dApp must show the correct describeTradingBlacklistBlock user-facing copy and disable primary action CTAs.

New unit tests for describeTradingBlacklistBlock copy variants
Shared tradingBlacklistMocks helper for useTradingBlacklist hook mocks
SwapPage tests: alert copy + disabled Trading restricted swap button for wallet/token/pair
TradePage / TradeOrderTicket tests: alert copy + disabled Place limit buttons for wallet/token/pair
Documents the regression invariant in docs/security-model.md

Acceptance checklist

Criterion	Verification	Result
Unit tests for wallet blacklist: message + disabled swap CTA	`cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx -t "wallet blacklist"`	PASS
Unit tests for token blacklist: message + disabled action CTAs	`cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "token blacklist"`	PASS
Unit tests for pair blacklist: message + disabled action CTAs	`cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "pair blacklist"`	PASS
SwapPage and TradeOrderTicket covered	`cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "trading blacklist"`	PASS
Copy source locked by service unit tests	`cd frontend-dapp && npx vitest run src/services/terraclassic/__tests__/blacklist.test.ts`	PASS
All new tests pass in CI	MR pipeline `test-frontend` job	PENDING

Verification checklist (third parties)

Check out this branch and run:

cd frontend-dapp
npx vitest run src/services/terraclassic/__tests__/blacklist.test.ts \
  src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "trading blacklist"

Expect 10 passed (4 copy + 3 swap + 3 trade/limit).

Confirm docs/security-model.md trading blacklist section links to the new tests and mock helper.
Optional: on LocalTerra with a blacklisted wallet, manually confirm Swap shows the same copy and Trading restricted — not required for this MR (unit tests mock the hook).

## Summary Adds Vitest coverage for SEC-A02 / GitLab #388: when the trading blacklist blocks a wallet, token, or pair, the dApp must show the correct `describeTradingBlacklistBlock` user-facing copy and disable primary action CTAs. - New unit tests for `describeTradingBlacklistBlock` copy variants - Shared `tradingBlacklistMocks` helper for `useTradingBlacklist` hook mocks - SwapPage tests: alert copy + disabled **Trading restricted** swap button for wallet/token/pair - TradePage / TradeOrderTicket tests: alert copy + disabled **Place limit** buttons for wallet/token/pair - Documents the regression invariant in `docs/security-model.md` ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Unit tests for wallet blacklist: message + disabled swap CTA | `cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx -t "wallet blacklist"` | PASS | | Unit tests for token blacklist: message + disabled action CTAs | `cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "token blacklist"` | PASS | | Unit tests for pair blacklist: message + disabled action CTAs | `cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "pair blacklist"` | PASS | | SwapPage and TradeOrderTicket covered | `cd frontend-dapp && npx vitest run src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "trading blacklist"` | PASS | | Copy source locked by service unit tests | `cd frontend-dapp && npx vitest run src/services/terraclassic/__tests__/blacklist.test.ts` | PASS | | All new tests pass in CI | MR pipeline `test-frontend` job | PENDING | ## Verification checklist (third parties) 1. Check out this branch and run: ```bash cd frontend-dapp npx vitest run src/services/terraclassic/__tests__/blacklist.test.ts \ src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx -t "trading blacklist" ``` Expect **10 passed** (4 copy + 3 swap + 3 trade/limit). 2. Confirm `docs/security-model.md` trading blacklist section links to the new tests and mock helper. 3. Optional: on LocalTerra with a blacklisted wallet, manually confirm Swap shows the same copy and **Trading restricted** — not required for this MR (unit tests mock the hook).

PlasticDigits commented

2026-06-19 01:42:37 +00:00

(Migrated from gitlab.com)

Security review — MR !917

Commit reviewed: 59d87e5f87e3f6d9b9554face7c4d45c28d27650

Scope: Added/modified files in this MR only — docs/security-model.md, Vitest coverage (SwapPage.test.tsx, TradePage.test.tsx, blacklist.test.ts), and shared test helper src/test/tradingBlacklistMocks.ts.

Method: Diff review; traced mock data through test assertions; confirmed src/test and *.test.* are excluded from the production app TypeScript build (tsconfig.app.json); verified no new runtime dependencies or production code changes.

Outcome: FINDINGS: 0 medium+

Summary: This MR adds regression tests and documentation for SEC-A02 / #388 (trading blacklist alert copy and disabled swap/limit CTAs). Changes are test-only plus docs. Mock helpers live under src/test/ and are not shipped in the app bundle. Tests mock useTradingBlacklist with static fixture responses; they do not alter on-chain enforcement, auth paths, or user-input handling in production.

No injection, authz bypass, secret leakage, XSS, or supply-chain issues were introduced by this diff. describeTradingBlacklistBlock (tested, not modified) returns fixed strings from boolean flags; token/pair addresses in API responses are not interpolated into displayed copy.

Inline threads: None (no medium+ findings).

## Security review — MR !917 **Commit reviewed:** `59d87e5f87e3f6d9b9554face7c4d45c28d27650` **Scope:** Added/modified files in this MR only — `docs/security-model.md`, Vitest coverage (`SwapPage.test.tsx`, `TradePage.test.tsx`, `blacklist.test.ts`), and shared test helper `src/test/tradingBlacklistMocks.ts`. **Method:** Diff review; traced mock data through test assertions; confirmed `src/test` and `*.test.*` are excluded from the production app TypeScript build (`tsconfig.app.json`); verified no new runtime dependencies or production code changes. **Outcome:** `FINDINGS: 0` medium+ **Summary:** This MR adds regression tests and documentation for SEC-A02 / #388 (trading blacklist alert copy and disabled swap/limit CTAs). Changes are test-only plus docs. Mock helpers live under `src/test/` and are not shipped in the app bundle. Tests mock `useTradingBlacklist` with static fixture responses; they do not alter on-chain enforcement, auth paths, or user-input handling in production. No injection, authz bypass, secret leakage, XSS, or supply-chain issues were introduced by this diff. `describeTradingBlacklistBlock` (tested, not modified) returns fixed strings from boolean flags; token/pair addresses in API responses are not interpolated into displayed copy. **Inline threads:** None (no medium+ findings).