Split Swap Settings into retail defaults and Advanced integrator controls (#413) #942

2026-06-25T20:51:14Z

PlasticDigits commented

2026-06-25 20:51:14 +00:00

(Migrated from gitlab.com)

Summary

GitLab #413 — progressive disclosure for Swap Settings on /.

Retail panel (default): slippage presets/custom, transaction deadline (5/10/20/30m + custom), and Expert Mode (swap-expert-mode-toggle).
Advanced (collapsed by default): direct-pair limit book leg (hybrid integrator controls) and Indexer route check debug panel.
Advanced expand state persists in localStorage (swapSettingsAdvanced.ts).
Plain-language copy for hybrid leg; removed “Pattern C” from retail path.
E2E helpers updated to expand Advanced before hybrid controls.

Acceptance checklist

Criterion	Verification	Result
First open of Settings shows only retail swap prefs	`npm test -- --run src/pages/SwapPage.test.tsx -t "shows retail prefs"`	PASS
Advanced panels require explicit expand	`npm test -- --run src/pages/SwapPage.test.tsx -t "progressive disclosure"`	PASS
Hybrid book leg still functional when expanded	`npm test -- --run src/pages/SwapPage.test.tsx -t "hybrid"`	PASS
Indexer route check still functional when expanded	`npm test -- --run src/pages/SwapPage.test.tsx -t "indexer route check when Advanced"`	PASS
Screenshot: default collapsed retail view	Manual: `/` → Settings (see verification below)	SKIP (LocalTerra/frontend env not provisioned in agent VM)
Screenshot: Advanced expanded	Manual: expand Advanced in Settings	SKIP (same)
Expert-mode block >30% slippage with Advanced collapsed	`npm test -- --run src/pages/SwapPage.test.tsx -t "blocks swap above 30%"`	PASS
Hybrid max makers 256 cap unchanged	`SwapAdvancedSettings.tsx` `max={256}` + existing tests	PASS
`make test-frontend`	`make test-frontend`	PASS*
Swap E2E subset	`make test-e2e` hybrid/swap specs	SKIP (LocalTerra not running)

* One pre-existing failure on main: cosmesPatch127.test.ts (missing cosmes patch file) — unrelated to this MR.

Third-party verification

# Unit tests (Swap settings + persistence)
cd frontend-dapp && npm test -- --run src/pages/SwapPage.test.tsx src/utils/swapSettingsAdvanced.test.ts

# Full frontend suite (expect cosmes patch failure on current main unless fixed separately)
make test-frontend

# Manual UI (needs deploy env + make dev)
# 1. Open http://127.0.0.1:5173/ → Settings → confirm slippage + deadline + Expert Mode only
# 2. Expand Advanced → limit book leg + Compare indexer route
# 3. Re-open Settings after refresh — Advanced stays open if previously expanded

# E2E (LocalTerra)
make setup-cloud-localterra
make dev
sg docker -c 'CI=1 make test-e2e'  # or hybrid-swap.spec.ts subset

Screenshots (manual)

Attach after local make dev:

Settings collapsed — retail panel only
Settings with Advanced expanded — hybrid + indexer route check

## Summary GitLab #413 — progressive disclosure for Swap **Settings** on `/`. - **Retail panel** (default): slippage presets/custom, **transaction deadline** (5/10/20/30m + custom), and **Expert Mode** (`swap-expert-mode-toggle`). - **Advanced** (collapsed by default): direct-pair **limit book leg** (hybrid integrator controls) and **Indexer route check** debug panel. - Advanced expand state persists in `localStorage` (`swapSettingsAdvanced.ts`). - Plain-language copy for hybrid leg; removed “Pattern C” from retail path. - E2E helpers updated to expand Advanced before hybrid controls. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | First open of Settings shows only retail swap prefs | `npm test -- --run src/pages/SwapPage.test.tsx -t "shows retail prefs"` | PASS | | Advanced panels require explicit expand | `npm test -- --run src/pages/SwapPage.test.tsx -t "progressive disclosure"` | PASS | | Hybrid book leg still functional when expanded | `npm test -- --run src/pages/SwapPage.test.tsx -t "hybrid"` | PASS | | Indexer route check still functional when expanded | `npm test -- --run src/pages/SwapPage.test.tsx -t "indexer route check when Advanced"` | PASS | | Screenshot: default collapsed retail view | Manual: `/` → Settings (see verification below) | SKIP (LocalTerra/frontend env not provisioned in agent VM) | | Screenshot: Advanced expanded | Manual: expand **Advanced** in Settings | SKIP (same) | | Expert-mode block >30% slippage with Advanced collapsed | `npm test -- --run src/pages/SwapPage.test.tsx -t "blocks swap above 30%"` | PASS | | Hybrid max makers 256 cap unchanged | `SwapAdvancedSettings.tsx` `max={256}` + existing tests | PASS | | `make test-frontend` | `make test-frontend` | PASS* | | Swap E2E subset | `make test-e2e` hybrid/swap specs | SKIP (LocalTerra not running) | \* One pre-existing failure on `main`: `cosmesPatch127.test.ts` (missing cosmes patch file) — unrelated to this MR. ## Third-party verification ```bash # Unit tests (Swap settings + persistence) cd frontend-dapp && npm test -- --run src/pages/SwapPage.test.tsx src/utils/swapSettingsAdvanced.test.ts # Full frontend suite (expect cosmes patch failure on current main unless fixed separately) make test-frontend # Manual UI (needs deploy env + make dev) # 1. Open http://127.0.0.1:5173/ → Settings → confirm slippage + deadline + Expert Mode only # 2. Expand Advanced → limit book leg + Compare indexer route # 3. Re-open Settings after refresh — Advanced stays open if previously expanded # E2E (LocalTerra) make setup-cloud-localterra make dev sg docker -c 'CI=1 make test-e2e' # or hybrid-swap.spec.ts subset ``` ## Screenshots (manual) Attach after local `make dev`: 1. Settings collapsed — retail panel only 2. Settings with **Advanced** expanded — hybrid + indexer route check

PlasticDigits commented

2026-06-25 20:51:27 +00:00

(Migrated from gitlab.com)

restored source branch issue-413-swap-settings-advanced

restored source branch `issue-413-swap-settings-advanced`

PlasticDigits commented

2026-06-25 20:53:33 +00:00

(Migrated from gitlab.com)

Security review — MR !942

Commit reviewed: fe41122cdbc5b2c201b1c7eef0b9d5e0738953d9
Scope: Swap Settings progressive disclosure (#413) — SwapAdvancedSettings.tsx, swapSettingsAdvanced.ts, SwapPage.tsx deadline UI, E2E/test/doc updates.

Outcome: FINDINGS: 0 medium+

Inline threads: none

Summary

Reviewed added/modified frontend paths for injection, authz bypass, secret leakage, unsafe deserialization, SSRF/XSS, and signing-disclosure regressions (SEC-D11).

UI refactor only: Hybrid book leg and indexer route check moved behind a collapsed Advanced panel; submit/quote logic, getDirectHybridBookSplit, useSubmitAlignedSimQuote, and SwapPreSubmitSummary (SEC-D11) are unchanged.
localStorage (swapSettingsAdvanced.ts): Persists a boolean expand/collapse flag ('1'/'0'); no secrets, no trust-boundary change.
Transaction deadline UI: Custom input strips non-digits; values clamped to 1–60 minutes in the handler and 30s–3600s in useDexStore.setDeadlineSeconds; deadline is applied only to user-initiated swap broadcasts.
Indexer route check / error display: fromToken/toToken still require terra1 CW20 prefixes before getRouteSolve; errors pass through humanizeUserFacingErrorFromUnknown and render in React text nodes (no dangerouslySetInnerHTML).
Hybrid max_maker_fills: UI max={256} and submit caps unchanged from pre-MR behavior; on-chain guards remain authoritative.
Expert Mode / >30% slippage block: Stays in the retail settings panel; regression test confirms protection with Advanced collapsed.

No prior security-review threads on this MR to re-validate.

Security review: no medium+ findings on this diff.

## Security review — MR !942 **Commit reviewed:** `fe41122cdbc5b2c201b1c7eef0b9d5e0738953d9` **Scope:** Swap Settings progressive disclosure (#413) — `SwapAdvancedSettings.tsx`, `swapSettingsAdvanced.ts`, `SwapPage.tsx` deadline UI, E2E/test/doc updates. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none ### Summary Reviewed added/modified frontend paths for injection, authz bypass, secret leakage, unsafe deserialization, SSRF/XSS, and signing-disclosure regressions (SEC-D11). - **UI refactor only:** Hybrid book leg and indexer route check moved behind a collapsed Advanced panel; submit/quote logic, `getDirectHybridBookSplit`, `useSubmitAlignedSimQuote`, and `SwapPreSubmitSummary` (SEC-D11) are unchanged. - **localStorage (`swapSettingsAdvanced.ts`):** Persists a boolean expand/collapse flag (`'1'`/`'0'`); no secrets, no trust-boundary change. - **Transaction deadline UI:** Custom input strips non-digits; values clamped to 1–60 minutes in the handler and 30s–3600s in `useDexStore.setDeadlineSeconds`; deadline is applied only to user-initiated swap broadcasts. - **Indexer route check / error display:** `fromToken`/`toToken` still require `terra1` CW20 prefixes before `getRouteSolve`; errors pass through `humanizeUserFacingErrorFromUnknown` and render in React text nodes (no `dangerouslySetInnerHTML`). - **Hybrid `max_maker_fills`:** UI `max={256}` and submit caps unchanged from pre-MR behavior; on-chain guards remain authoritative. - **Expert Mode / >30% slippage block:** Stays in the retail settings panel; regression test confirms protection with Advanced collapsed. No prior security-review threads on this MR to re-validate. Security review: no medium+ findings on this diff.

PlasticDigits commented

2026-06-25 21:55:27 +00:00

(Migrated from gitlab.com)

added 9 commits

fe41122c...2f26b71d - 8 commits from branch main
e7c7fd09 - Merge origin/main into issue-413-swap-settings-advanced

Compare with previous version

added 9 commits <ul><li>fe41122c...2f26b71d - 8 commits from branch <code>main</code></li><li>e7c7fd09 - Merge origin/main into issue-413-swap-settings-advanced</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/224/diffs?diff_id=1872024467&start_sha=fe41122cdbc5b2c201b1c7eef0b9d5e0738953d9)

PlasticDigits commented

2026-06-25 21:55:30 +00:00

(Migrated from gitlab.com)

Resolved merge conflicts with main:

SwapPage.tsx — kept #413 retail/advanced split and 5/10/20/30m deadline presets; integrated main's TRANSACTION_DEADLINE_LABEL, useId input, decimal custom-deadline validation, and formatTransactionDeadline summary row.
docs/frontend.md — merged MEV posture copy (retail panel + slippage-protection terminology from main).
SwapPage.test.tsx — updated label expectations to match shared copy constants.

Sanity: npm test -- --run src/pages/SwapPage.test.tsx src/utils/swapSettingsAdvanced.test.ts — 30 passed.

Resolved merge conflicts with `main`: - **SwapPage.tsx** — kept #413 retail/advanced split and 5/10/20/30m deadline presets; integrated main's `TRANSACTION_DEADLINE_LABEL`, `useId` input, decimal custom-deadline validation, and `formatTransactionDeadline` summary row. - **docs/frontend.md** — merged MEV posture copy (retail panel + slippage-protection terminology from main). - **SwapPage.test.tsx** — updated label expectations to match shared copy constants. Sanity: `npm test -- --run src/pages/SwapPage.test.tsx src/utils/swapSettingsAdvanced.test.ts` — 30 passed.

PlasticDigits commented

2026-06-25 21:57:10 +00:00

(Migrated from gitlab.com)

Security review — MR !942

Commit reviewed: e7c7fd090d07e2cb7d5dc09b580ef0eb9596f6d5
Scope: Swap Settings progressive disclosure (#413) after merge-conflict resolution with main — SwapAdvancedSettings.tsx, swapSettingsAdvanced.ts, SwapPage.tsx (retail/advanced split, deadline presets + decimal custom input), E2E/test/doc updates.

Outcome: FINDINGS: 0 medium+

Inline threads: none

Summary

Re-reviewed the full MR diff and the post-merge delta from fe41122 (prior review) through e7c7fd09, including integrated main changes: TRANSACTION_DEADLINE_LABEL, useId deadline input, decimal custom-deadline sanitization/clamp, and formatTransactionDeadline summary row.

UI refactor only: Hybrid book leg and indexer route check moved behind collapsed Advanced; submit/quote logic, getDirectHybridBookSplit, useSubmitAlignedSimQuote, and SwapPreSubmitSummary (SEC-D11) unchanged.
localStorage (swapSettingsAdvanced.ts): Persists boolean expand/collapse ('1'/'0'); no secrets, no trust-boundary change.
Transaction deadline UI: Custom input strips non-numeric except ., single-decimal guard; values clamped to 0.5–60 minutes in handler and 30s–3600s in useDexStore.setDeadlineSeconds; deadline applied only to user-initiated swap broadcasts.
Indexer route check / error display: fromToken/toToken still require terra1 CW20 prefixes before getRouteSolve; errors pass through humanizeUserFacingErrorFromUnknown and render in React text nodes (no dangerouslySetInnerHTML).
Hybrid max_maker_fills: UI max={256} and submit caps unchanged; on-chain guards remain authoritative.
Expert Mode / >30% slippage block: Stays in retail settings panel; regression test confirms protection with Advanced collapsed.

Prior security-review thread (fe41122) findings do not apply to new code paths; merge resolution did not introduce exploitable regressions.

Security review: no medium+ findings on this diff.

## Security review — MR !942 **Commit reviewed:** `e7c7fd090d07e2cb7d5dc09b580ef0eb9596f6d5` **Scope:** Swap Settings progressive disclosure (#413) after merge-conflict resolution with `main` — `SwapAdvancedSettings.tsx`, `swapSettingsAdvanced.ts`, `SwapPage.tsx` (retail/advanced split, deadline presets + decimal custom input), E2E/test/doc updates. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none ### Summary Re-reviewed the full MR diff and the post-merge delta from `fe41122` (prior review) through `e7c7fd09`, including integrated `main` changes: `TRANSACTION_DEADLINE_LABEL`, `useId` deadline input, decimal custom-deadline sanitization/clamp, and `formatTransactionDeadline` summary row. - **UI refactor only:** Hybrid book leg and indexer route check moved behind collapsed Advanced; submit/quote logic, `getDirectHybridBookSplit`, `useSubmitAlignedSimQuote`, and `SwapPreSubmitSummary` (SEC-D11) unchanged. - **localStorage (`swapSettingsAdvanced.ts`):** Persists boolean expand/collapse (`'1'`/`'0'`); no secrets, no trust-boundary change. - **Transaction deadline UI:** Custom input strips non-numeric except `.`, single-decimal guard; values clamped to 0.5–60 minutes in handler and 30s–3600s in `useDexStore.setDeadlineSeconds`; deadline applied only to user-initiated swap broadcasts. - **Indexer route check / error display:** `fromToken`/`toToken` still require `terra1` CW20 prefixes before `getRouteSolve`; errors pass through `humanizeUserFacingErrorFromUnknown` and render in React text nodes (no `dangerouslySetInnerHTML`). - **Hybrid `max_maker_fills`:** UI `max={256}` and submit caps unchanged; on-chain guards remain authoritative. - **Expert Mode / >30% slippage block:** Stays in retail settings panel; regression test confirms protection with Advanced collapsed. Prior security-review thread (`fe41122`) findings do not apply to new code paths; merge resolution did not introduce exploitable regressions. Security review: no medium+ findings on this diff.

PlasticDigits commented

2026-06-25 22:20:19 +00:00

(Migrated from gitlab.com)

mentioned in commit 617b9e0fd3

mentioned in commit 617b9e0fd32ccf1f830aa4edfcde8bbb2bf09edb