Verify #389: fix SEC-A02 wrap-swap E2E env loading and docs #921

2026-06-19T09:04:42Z

PlasticDigits commented

2026-06-19 09:04:42 +00:00

(Migrated from gitlab.com)

Summary

Verification of GitLab #389 found the merged SEC-A02 tests and copy were correct in code, but E2E verification could not run because:

wrapMapperAddressFromEnv() only read process.env.VITE_WRAP_MAPPER_ADDRESS, which Playwright does not populate from frontend-dapp/.env.local.
Verification docs/skills referenced --project=e2e-smoke, but wrap-swap.spec.ts is in txSpecGlobs (only runs under e2e-tx).

This MR loads the wrap-mapper address from deploy output in global setup and as a .env.local fallback in the LCD mock helper, and corrects verification commands.

Acceptance checklist (#389)

Item	Result	How verified
Test asserts "Wrapping is Temporarily Paused" copy when wrap mapper paused	PASS	Vitest `SwapPage.test.tsx` + Playwright `wrap mapper paused` spec
Test asserts swap submit button disabled in wrap pause state	PASS	`expect(btn).toBeDisabled()` in both
Test asserts "Rate Limit Exceeded" copy on rate limit	PASS	Vitest + Playwright E12
Test asserts swap submit button disabled in rate limit state	PASS	`expect(btn).toBeDisabled()` in both
Wrap pause and rate limit tested in isolation	PASS	Separate `it` blocks / specs; no combined regex
All new tests pass	PASS	Commands below

Commands run

# Unit (no chain)
bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/pages/SwapPage.test.tsx -t "SEC-A02"
# 5 passed

# E2E (LocalTerra + deploy env)
sg docker -c 'CI=1 bash scripts/with-node.sh --cwd frontend-dapp -- npx playwright test e2e/wrap-swap.spec.ts -g "SEC-A02|wrap mapper paused" --project=e2e-tx'
# 2 passed

## Summary Verification of GitLab #389 found the merged SEC-A02 tests and copy were correct in code, but **E2E verification could not run** because: 1. `wrapMapperAddressFromEnv()` only read `process.env.VITE_WRAP_MAPPER_ADDRESS`, which Playwright does not populate from `frontend-dapp/.env.local`. 2. Verification docs/skills referenced `--project=e2e-smoke`, but `wrap-swap.spec.ts` is in `txSpecGlobs` (only runs under `e2e-tx`). This MR loads the wrap-mapper address from deploy output in global setup and as a `.env.local` fallback in the LCD mock helper, and corrects verification commands. ## Acceptance checklist (#389) | Item | Result | How verified | |------|--------|--------------| | Test asserts "Wrapping is Temporarily Paused" copy when wrap mapper paused | **PASS** | Vitest `SwapPage.test.tsx` + Playwright `wrap mapper paused` spec | | Test asserts swap submit button disabled in wrap pause state | **PASS** | `expect(btn).toBeDisabled()` in both | | Test asserts "Rate Limit Exceeded" copy on rate limit | **PASS** | Vitest + Playwright E12 | | Test asserts swap submit button disabled in rate limit state | **PASS** | `expect(btn).toBeDisabled()` in both | | Wrap pause and rate limit tested in isolation | **PASS** | Separate `it` blocks / specs; no combined regex | | All new tests pass | **PASS** | Commands below | ### Commands run ```bash # Unit (no chain) bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/pages/SwapPage.test.tsx -t "SEC-A02" # 5 passed # E2E (LocalTerra + deploy env) sg docker -c 'CI=1 bash scripts/with-node.sh --cwd frontend-dapp -- npx playwright test e2e/wrap-swap.spec.ts -g "SEC-A02|wrap mapper paused" --project=e2e-tx' # 2 passed ```

PlasticDigits commented

2026-06-19 09:07:19 +00:00

(Migrated from gitlab.com)

Security review — MR !921

Commit reviewed: 7cd9c41b3bbcc4e8cd6741ddb7ae0679a2515747
Scope: E2E test env loading (wrap-mapper-lcd-mock.ts, global-setup.ts) and verification docs (docs/testing.md, e2e/README.md, skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md).

Outcome: FINDINGS: 0 medium+

Summary: No medium, high, or critical vulnerabilities introduced or exposed by this diff.

Reviewed paths:

wrapMapperAddressFromEnv() fallback read of frontend-dapp/.env.local — E2E-only helper; path is derived from fixed import.meta.url relatives (no attacker-controlled traversal); value is validated with startsWith('terra1') before use; mirrors existing applyViteEnvFromEnvLocal() in global-setup.ts.
global-setup.ts addition of VITE_WRAP_MAPPER_ADDRESS — same line-parse pattern as existing LCD/indexer/token vars; runs only in Playwright global setup (dev/CI), not in production bundles.
Doc changes (e2e-smoke → e2e-tx) — no runtime security impact.

No production application code, auth boundaries, on-chain logic, or user-facing input handling changed. Contract addresses in .env.local are public deploy artifacts, not secrets.

Inline threads: none (no findings to anchor).

Security review: no medium+ findings on this diff.

## Security review — MR !921 **Commit reviewed:** `7cd9c41b3bbcc4e8cd6741ddb7ae0679a2515747` **Scope:** E2E test env loading (`wrap-mapper-lcd-mock.ts`, `global-setup.ts`) and verification docs (`docs/testing.md`, `e2e/README.md`, `skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md`). **Outcome:** `FINDINGS: 0` medium+ **Summary:** No medium, high, or critical vulnerabilities introduced or exposed by this diff. Reviewed paths: - `wrapMapperAddressFromEnv()` fallback read of `frontend-dapp/.env.local` — E2E-only helper; path is derived from fixed `import.meta.url` relatives (no attacker-controlled traversal); value is validated with `startsWith('terra1')` before use; mirrors existing `applyViteEnvFromEnvLocal()` in `global-setup.ts`. - `global-setup.ts` addition of `VITE_WRAP_MAPPER_ADDRESS` — same line-parse pattern as existing LCD/indexer/token vars; runs only in Playwright global setup (dev/CI), not in production bundles. - Doc changes (`e2e-smoke` → `e2e-tx`) — no runtime security impact. No production application code, auth boundaries, on-chain logic, or user-facing input handling changed. Contract addresses in `.env.local` are public deploy artifacts, not secrets. **Inline threads:** none (no findings to anchor). Security review: no medium+ findings on this diff.