Remove developer jargon from retail UI alerts and errors (#414) #940

Merged

PlasticDigits merged 1 commit from issue-414-retail-ui-copy into main

2026-06-25 21:51:39 +00:00

PlasticDigits commented

2026-06-25 20:46:42 +00:00

(Migrated from gitlab.com)

Summary

Removes developer/integrator jargon from retail-facing alerts, quote disclosures, and error surfaces tied to #414:

Quote disclosures (directHybridQuote.ts, swapDisclosure.ts) — plain language (“limit book + pool”, “estimated output”) instead of Pattern C, hybrid_simulation, indexer/LCD internals.
Trade market panel — retail intro + Learn more link; quote failures routed through humanizeUserFacingErrorFromUnknown.
Limit pre-submit summary — footer uses “Learn more about limit order fees” (no GitLab issue ref or raw filename).
Swap hybrid alert — retail copy + Learn more footnote (replaces integrator semantics / docs/limit-orders.md inline).
Docs/skills — docs/frontend.md invariant row + skills/AGENTS_FRONTEND_USER_ERRORS.md retail-copy rule.

Acceptance checklist

Criterion	Verification	Result
No `GitLab #`, `Pattern C`, or `hybrid_simulation` in retail-visible copy	`rg 'Pattern C\|GitLab #\|hybrid_simulation' frontend-dapp/src --glob '!*/.test.*'` (user strings only; comments excluded)	PASS
Market panel errors humanized	`TradeMarketOrderPanel.submitSnapshot.test.tsx` — `humanizes simulated quote failures`	PASS
Pre-submit footers use Learn more, not issue IDs	`LimitOrderPreSubmitSummary.test.tsx`	PASS
Screenshot: trade market quote card disclosure	Fixture screenshot `/tmp/issue-414-screenshots/trade-market-quote-disclosure.png` (matches `trade-market-quote` testid copy)	PASS
Screenshot: limit pre-submit footer	`/tmp/issue-414-screenshots/limit-pre-submit-footer.png`	PASS
Screenshot: market panel quote failure	`/tmp/issue-414-screenshots/trade-market-quote-error.png`	PASS
`make test-frontend`	Full suite	PASS (1053/1054; pre-existing `cosmesPatch127.test.ts` patch-file failure on this VM)
`humanizeUserFacingError.test.ts` extended	Market quote shapes + pause/blacklist preserved	PASS
SEC-D11 pre-submit field tests (#409)	`TradeMarketOrderPanel.submitSnapshot` + `LimitOrderPreSubmitSummary` tests	PASS

Verification for third parties

# Grep audit (retail strings — ignore comment-only hits)
rg 'Pattern C|GitLab #|hybrid_simulation' frontend-dapp/src --glob '!**/*.test.*'

# Targeted unit tests
bash scripts/with-node.sh --cwd frontend-dapp -- ./node_modules/.bin/vitest run \
  src/components/trade/__tests__/TradeMarketOrderPanel.submitSnapshot.test.tsx \
  src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx \
  src/utils/__tests__/humanizeUserFacingError.test.ts \
  src/utils/directHybridQuote.test.ts \
  src/utils/swapDisclosure.test.ts \
  src/pages/SwapPage.test.tsx -t "shows hybrid book warning"

# Full frontend (note: cosmes patch SHA test may fail on VMs without patches/)
make test-frontend

Manual UI (requires LocalTerra): make setup-cloud-localterra && make dev → /trade Market tab → enter amount → confirm quote card disclosure; Limit tab → pre-submit footer link; force quote failure (stop indexer) → plain-language alert.

Parent gap analysis: #411
Agent playbook: skills/AGENTS_FRONTEND_USER_ERRORS.md
Frontend invariants: docs/frontend.md#user-facing-errors-humanization

## Summary Removes developer/integrator jargon from retail-facing alerts, quote disclosures, and error surfaces tied to [#414](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/414): - **Quote disclosures** (`directHybridQuote.ts`, `swapDisclosure.ts`) — plain language (“limit book + pool”, “estimated output”) instead of `Pattern C`, `hybrid_simulation`, indexer/LCD internals. - **Trade market panel** — retail intro + Learn more link; quote failures routed through `humanizeUserFacingErrorFromUnknown`. - **Limit pre-submit summary** — footer uses “Learn more about limit order fees” (no GitLab issue ref or raw filename). - **Swap hybrid alert** — retail copy + Learn more footnote (replaces integrator semantics / `docs/limit-orders.md` inline). - **Docs/skills** — `docs/frontend.md` invariant row + `skills/AGENTS_FRONTEND_USER_ERRORS.md` retail-copy rule. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | No `GitLab #`, `Pattern C`, or `hybrid_simulation` in retail-visible copy | `rg 'Pattern C\|GitLab #\|hybrid_simulation' frontend-dapp/src --glob '!**/*.test.*'` (user strings only; comments excluded) | **PASS** | | Market panel errors humanized | `TradeMarketOrderPanel.submitSnapshot.test.tsx` — `humanizes simulated quote failures` | **PASS** | | Pre-submit footers use Learn more, not issue IDs | `LimitOrderPreSubmitSummary.test.tsx` | **PASS** | | Screenshot: trade market quote card disclosure | Fixture screenshot `/tmp/issue-414-screenshots/trade-market-quote-disclosure.png` (matches `trade-market-quote` testid copy) | **PASS** | | Screenshot: limit pre-submit footer | `/tmp/issue-414-screenshots/limit-pre-submit-footer.png` | **PASS** | | Screenshot: market panel quote failure | `/tmp/issue-414-screenshots/trade-market-quote-error.png` | **PASS** | | `make test-frontend` | Full suite | **PASS** (1053/1054; pre-existing `cosmesPatch127.test.ts` patch-file failure on this VM) | | `humanizeUserFacingError.test.ts` extended | Market quote shapes + pause/blacklist preserved | **PASS** | | SEC-D11 pre-submit field tests (#409) | `TradeMarketOrderPanel.submitSnapshot` + `LimitOrderPreSubmitSummary` tests | **PASS** | ## Verification for third parties ```bash # Grep audit (retail strings — ignore comment-only hits) rg 'Pattern C|GitLab #|hybrid_simulation' frontend-dapp/src --glob '!**/*.test.*' # Targeted unit tests bash scripts/with-node.sh --cwd frontend-dapp -- ./node_modules/.bin/vitest run \ src/components/trade/__tests__/TradeMarketOrderPanel.submitSnapshot.test.tsx \ src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx \ src/utils/__tests__/humanizeUserFacingError.test.ts \ src/utils/directHybridQuote.test.ts \ src/utils/swapDisclosure.test.ts \ src/pages/SwapPage.test.tsx -t "shows hybrid book warning" # Full frontend (note: cosmes patch SHA test may fail on VMs without patches/) make test-frontend ``` **Manual UI** (requires LocalTerra): `make setup-cloud-localterra && make dev` → `/trade` Market tab → enter amount → confirm quote card disclosure; Limit tab → pre-submit footer link; force quote failure (stop indexer) → plain-language alert. ## Related - Parent gap analysis: [#411](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/411) - Agent playbook: `skills/AGENTS_FRONTEND_USER_ERRORS.md` - Frontend invariants: `docs/frontend.md#user-facing-errors-humanization`

PlasticDigits commented

2026-06-25 20:48:58 +00:00

(Migrated from gitlab.com)

Security review — MR !940

Commit reviewed: 2ac7215776698a16564fd04a9ac51cb5ac4ef9b2

Scope: Retail-facing copy in quote disclosures (directHybridQuote.ts, swapDisclosure.ts), hybrid/limit UI alerts (SwapPage.tsx, LimitOrderPreSubmitSummary.tsx, TradeMarketOrderPanel.tsx, WalletIndexerHistoryPanel.tsx), and new tryHumanizeFetchLikeMessage branches in humanizeOffChainError.ts (market quote / LCD / indexer transport). Docs, skills, tests, and E2E expectation updates only.

Method: Diff vs main; traced simQuery.error through humanizeUserFacingErrorFromUnknown → humanizeUserFacingError (Terra tx classifiers run before fetch/LCD patterns). Verified doc links use static DOCS_GITLAB_BASE with rel="noopener noreferrer". No dangerouslySetInnerHTML on changed surfaces. No dependency or auth/on-chain logic changes.

Outcome: FINDINGS: 0 medium+

Injection / XSS: Error text is rendered as React children; humanization reduces raw transport/LCD leakage rather than introducing HTML sinks.
Authz / trust boundaries: Quoting, submit gates (isSubmitReady, spread preflight, hybrid alignment) unchanged; pause/blacklist copy explicitly preserved in tests.
Mis-humanization: New regex branches apply after tryHumanizeTerraTxMessage; blacklist/pause/spread assertions still classify first. Broad /quote unavailable/i only affects quote-query failure UI (submit blocked when simQuery.isError).
Links: Hrefs are compile-time constants, not user-controlled.

Prior security threads: None on this MR.

Inline findings: None.

Security review: no medium+ findings on this diff.

## Security review — MR !940 **Commit reviewed:** `2ac7215776698a16564fd04a9ac51cb5ac4ef9b2` **Scope:** Retail-facing copy in quote disclosures (`directHybridQuote.ts`, `swapDisclosure.ts`), hybrid/limit UI alerts (`SwapPage.tsx`, `LimitOrderPreSubmitSummary.tsx`, `TradeMarketOrderPanel.tsx`, `WalletIndexerHistoryPanel.tsx`), and new `tryHumanizeFetchLikeMessage` branches in `humanizeOffChainError.ts` (market quote / LCD / indexer transport). Docs, skills, tests, and E2E expectation updates only. **Method:** Diff vs `main`; traced `simQuery.error` through `humanizeUserFacingErrorFromUnknown` → `humanizeUserFacingError` (Terra tx classifiers run before fetch/LCD patterns). Verified doc links use static `DOCS_GITLAB_BASE` with `rel="noopener noreferrer"`. No `dangerouslySetInnerHTML` on changed surfaces. No dependency or auth/on-chain logic changes. **Outcome:** `FINDINGS: 0` medium+ - **Injection / XSS:** Error text is rendered as React children; humanization reduces raw transport/LCD leakage rather than introducing HTML sinks. - **Authz / trust boundaries:** Quoting, submit gates (`isSubmitReady`, spread preflight, hybrid alignment) unchanged; pause/blacklist copy explicitly preserved in tests. - **Mis-humanization:** New regex branches apply after `tryHumanizeTerraTxMessage`; blacklist/pause/spread assertions still classify first. Broad `/quote unavailable/i` only affects quote-query failure UI (submit blocked when `simQuery.isError`). - **Links:** Hrefs are compile-time constants, not user-controlled. **Prior security threads:** None on this MR. **Inline findings:** None. Security review: no medium+ findings on this diff.