qa: complete #463 verification — e2e wrap rate-limit banner #998

2026-06-30T22:37:30Z

PlasticDigits commented

2026-06-30 22:37:30 +00:00

(Migrated from gitlab.com)

Summary

Verification of GitLab #463 (SEC-I05 F-04): MR !988 added the inline swap-wrap-rate-limit-banner alert on / when the wrap-mapper rate limit blocks submit. This MR closes the remaining acceptance gap — Playwright E12 now asserts the banner is visible with retry guidance (not only the disabled CTA label), and docs/playbook cross-links document the SEC-I05 F-04 checks.

Acceptance checklist

Item	Result	How verified
`isRateLimitExceeded` triggers inline alert below swap form	PASS	`SwapPage.tsx` lines 1711–1714: `alert-error` block gated on `isRateLimitExceeded` with `data-testid="swap-wrap-rate-limit-banner"` (merged in !988)
Alert copy clear and actionable (retry guidance)	PASS	`WRAP_RATE_LIMIT_EXCEEDED_MESSAGE`: "Daily wrap limit reached for this amount. Wait and try again later, or reduce the amount."
Unit test asserts alert renders when rate limit exceeded	PASS	`npm run test:run -- src/pages/SwapPage.test.tsx -t "rate-limit alert"` → 1 passed
E2e test asserts alert visible when rate limit exceeded	PASS (this MR)	`npx playwright test e2e/wrap-swap.spec.ts -g "E12: rate limit exceeded" --project=e2e-tx` → 1 passed (asserts `swap-wrap-rate-limit-banner` + retry copy)

Test plan

Vitest: bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/pages/SwapPage.test.tsx -t "rate-limit alert"
Playwright E12: bash scripts/with-node.sh --cwd frontend-dapp -- npx playwright test e2e/wrap-swap.spec.ts -g "E12: rate limit exceeded" --project=e2e-tx (LocalTerra + deploy env)
Docs/playbook updated: docs/testing.md, skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md, frontend-dapp/e2e/README.md

## Summary Verification of GitLab #463 (SEC-I05 F-04): MR !988 added the inline `swap-wrap-rate-limit-banner` alert on `/` when the wrap-mapper rate limit blocks submit. This MR closes the remaining acceptance gap — **Playwright E12** now asserts the banner is visible with retry guidance (not only the disabled CTA label), and docs/playbook cross-links document the SEC-I05 F-04 checks. ## Acceptance checklist | Item | Result | How verified | |------|--------|--------------| | `isRateLimitExceeded` triggers inline alert below swap form | **PASS** | `SwapPage.tsx` lines 1711–1714: `alert-error` block gated on `isRateLimitExceeded` with `data-testid="swap-wrap-rate-limit-banner"` (merged in !988) | | Alert copy clear and actionable (retry guidance) | **PASS** | `WRAP_RATE_LIMIT_EXCEEDED_MESSAGE`: "Daily wrap limit reached for this amount. Wait and try again later, or reduce the amount." | | Unit test asserts alert renders when rate limit exceeded | **PASS** | `npm run test:run -- src/pages/SwapPage.test.tsx -t "rate-limit alert"` → 1 passed | | E2e test asserts alert visible when rate limit exceeded | **PASS** (this MR) | `npx playwright test e2e/wrap-swap.spec.ts -g "E12: rate limit exceeded" --project=e2e-tx` → 1 passed (asserts `swap-wrap-rate-limit-banner` + retry copy) | ## Test plan - [x] Vitest: `bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/pages/SwapPage.test.tsx -t "rate-limit alert"` - [x] Playwright E12: `bash scripts/with-node.sh --cwd frontend-dapp -- npx playwright test e2e/wrap-swap.spec.ts -g "E12: rate limit exceeded" --project=e2e-tx` (LocalTerra + deploy env) - [x] Docs/playbook updated: `docs/testing.md`, `skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md`, `frontend-dapp/e2e/README.md`

PlasticDigits commented

2026-06-30 22:40:15 +00:00

(Migrated from gitlab.com)

Security review — MR !998

Commit reviewed: cca89a6ad4ece4017086d84c67d0043344170c4a
Base: a19bb72260d4d439d51d0764baddcb9631bf8189

Scope

Diff-only review of QA verification for GitLab #463 (SEC-I05 F-04): Playwright E12 assertions for the wrap rate-limit inline banner, plus docs/playbook cross-links. No production (SwapPage.tsx, wrapMapper.ts, LCD client) code changes in this MR.

Method

Traced attacker-controlled inputs to sinks in added/modified paths.
Confirmed E12 uses existing routeWrapMapperRateLimitExceeded LCD route mock (test-only; contract-address allowlist + fixed JSON payloads).
Verified banner assertions target static copy (WRAP_RATE_LIMIT_EXCEEDED_MESSAGE) via data-testid, not interpolated user/LCD strings.
Checked prior MR notes/discussions: none to reconcile.

Outcome

FINDINGS: 0 (no medium, high, or critical issues on this diff)

Security review: no medium+ findings on this diff.

Inline threads: none (no findings).

Notes (informational, not findings)

Production banner rendering (merged in !988) displays a compile-time constant in JSX text content — no new XSS or injection surface introduced by this MR. E2E mock helpers remain confined to Playwright test execution and do not ship to users.

## Security review — MR !998 **Commit reviewed:** `cca89a6ad4ece4017086d84c67d0043344170c4a` **Base:** `a19bb72260d4d439d51d0764baddcb9631bf8189` ### Scope Diff-only review of QA verification for GitLab #463 (SEC-I05 F-04): Playwright E12 assertions for the wrap rate-limit inline banner, plus docs/playbook cross-links. No production (`SwapPage.tsx`, `wrapMapper.ts`, LCD client) code changes in this MR. ### Method - Traced attacker-controlled inputs to sinks in added/modified paths. - Confirmed E12 uses existing `routeWrapMapperRateLimitExceeded` LCD route mock (test-only; contract-address allowlist + fixed JSON payloads). - Verified banner assertions target static copy (`WRAP_RATE_LIMIT_EXCEEDED_MESSAGE`) via `data-testid`, not interpolated user/LCD strings. - Checked prior MR notes/discussions: none to reconcile. ### Outcome **FINDINGS: 0** (no medium, high, or critical issues on this diff) **Security review: no medium+ findings on this diff.** Inline threads: none (no findings). ### Notes (informational, not findings) Production banner rendering (merged in !988) displays a compile-time constant in JSX text content — no new XSS or injection surface introduced by this MR. E2E mock helpers remain confined to Playwright test execution and do not ship to users.

PlasticDigits commented

2026-07-01 00:09:09 +00:00

(Migrated from gitlab.com)

mentioned in commit 4621116ed2

mentioned in commit 4621116ed2b587f1cb1ffd3b1b1420249decd427