follow-up(!15): post-merge tasks after EVM account= coverage (#16) #18

New issue

Closed

opened 2026-08-31 04:58:23 +00:00 by PlasticDigits · 3 comments

PlasticDigits commented

2026-08-31 04:58:23 +00:00

(Migrated from gitlab.com)

Context

Shipped in !33 (closes #16): Playwright + unit proof of the integrator account= path on /sign/evm (matching lower + EIP-55, WC mismatch, deeplink preservation, hostile query). Bind helper was not reimplemented.

Local merge review (see #16 comment): no conflicts; npx vitest run src/evm src/query.test.ts (53) and Playwright evm-sign (17, workers=5, PLAYWRIGHT_WEB_PORT=5174) green. GitLab CI was ci_quota_exceeded (not a code defect).

These items remain after merge.

Remaining work

Optional ops / production spot-check (was unchecked on #16): https://terms.cl8y.com/sign/evm?property=<registered>&account=0x… shows Sign as 0x…; connecting a different injected account does not Accepted. The bind was already in the production bundle before this test MR.
Integrator smoke: after clickwrap 0.1.1 Accept from voting (or buildSignUrl({ account })), portal URL includes account= and Sign as matches the connected voting address.

Not in this issue

Solana /sign/solana account= bind — #17.
Telegram ids / #2 terms disclosure.
CI ci_quota_exceeded on !33 pipelines — GitLab minutes/quota, same as #10 / #13. Not a code defect.
Re-doing #15 mobile discovery.

Verify (when ops land)

# Production (registered property):
# /sign/evm?property=…&account=0x… → Sign as that address; other injected wallet → different wallet, no Accepted

## Context Shipped in [!33](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/merge_requests/15) (closes [#16](https://gitlab.com/plasticdigits/cl8y-ecosystem-legal/-/issues/16)): Playwright + unit proof of the integrator `account=` path on `/sign/evm` (matching lower + EIP-55, WC mismatch, deeplink preservation, hostile query). Bind helper was **not** reimplemented. Local merge review (see [#16 comment](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/work_items/16#note_3760697023)): no conflicts; `npx vitest run src/evm src/query.test.ts` (53) and Playwright `evm-sign` (17, workers=5, `PLAYWRIGHT_WEB_PORT=5174`) green. GitLab CI was `ci_quota_exceeded` (not a code defect). These items remain after merge. ## Remaining work - [ ] **Optional ops / production spot-check (was unchecked on #16):** `https://terms.cl8y.com/sign/evm?property=<registered>&account=0x…` shows *Sign as 0x…*; connecting a different injected account does not Accepted. The bind was already in the production bundle before this test MR. - [ ] **Integrator smoke:** after clickwrap **0.1.1** Accept from voting (or `buildSignUrl({ account })`), portal URL includes `account=` and *Sign as* matches the connected voting address. ## Not in this issue - Solana `/sign/solana` `account=` bind — [#17](https://gitlab.com/plasticdigits/cl8y-ecosystem-legal/-/issues/17). - Telegram ids / `#2` terms disclosure. - CI `ci_quota_exceeded` on !33 pipelines — GitLab minutes/quota, same as #10 / #13. Not a code defect. - Re-doing [#15](https://gitlab.com/plasticdigits/cl8y-ecosystem-legal/-/issues/15) mobile discovery. ## Verify (when ops land) ```bash # Production (registered property): # /sign/evm?property=…&account=0x… → Sign as that address; other injected wallet → different wallet, no Accepted ```

PlasticDigits commented

2026-08-31 04:58:23 +00:00

(Migrated from gitlab.com)

marked as related to #16

PlasticDigits commented

2026-08-31 09:23:21 +00:00

(Migrated from gitlab.com)

Verify — 2026-08-31

Re-checked leftover #18 against main (4f29049) and live terms.cl8y.com. Bind helper was already in the production bundle (#16).

Production spot-check (automation browser)

https://terms.cl8y.com/sign/evm?property=cl8y.com&account=0x2222222222222222222222222222222222222222 shows Sign as 0x2222… as a text node
Hostile account=javascript:alert(1) is the same text node; Open in MetaMask / Binance hrefs stay https://link.metamask.io/dapp/… / https://app.binance.com/cedefi/dapp?url=… (query account is preserved on the portal URL, never used as a javascript: / data: link scheme)
Connecting a different injected account → different wallet, no Accepted — not run (no MetaMask/Binance inject in this browser). Covered locally by web/e2e/evm-sign.spec.ts (mismatch + WC mismatch + hostile; 43/43 workers=5)

Integrator smoke

Clickwrap 0.1.1 TermsGate Accept puts account= on sign_urls.evm (unit: packages/cl8y-clickwrap/src/react/react.test.tsx)
Live voting (or other) Accept → portal URL includes account= and Sign as matches the connected voting address — not run (no voting session here)

Leaving open until a human confirms the injected-mismatch path on prod and an integrator Accept smoke.

## Verify — 2026-08-31 Re-checked leftover #18 against `main` (`4f29049`) and live `terms.cl8y.com`. Bind helper was already in the production bundle (#16). ### Production spot-check (automation browser) - [x] `https://terms.cl8y.com/sign/evm?property=cl8y.com&account=0x2222222222222222222222222222222222222222` shows **Sign as 0x2222…** as a text node - [x] Hostile `account=javascript:alert(1)` is the same text node; Open in MetaMask / Binance hrefs stay `https://link.metamask.io/dapp/…` / `https://app.binance.com/cedefi/dapp?url=…` (query `account` is preserved on the **portal** URL, never used as a `javascript:` / `data:` link scheme) - [ ] Connecting a **different injected** account → *different wallet*, no Accepted — **not run** (no MetaMask/Binance inject in this browser). Covered locally by `web/e2e/evm-sign.spec.ts` (mismatch + WC mismatch + hostile; 43/43 workers=5) ### Integrator smoke - [x] Clickwrap **0.1.1** `TermsGate` Accept puts `account=` on `sign_urls.evm` (unit: `packages/cl8y-clickwrap/src/react/react.test.tsx`) - [ ] Live voting (or other) Accept → portal URL includes `account=` and *Sign as* matches the connected voting address — **not run** (no voting session here) Leaving open until a human confirms the injected-mismatch path on prod and an integrator Accept smoke.

PlasticDigits commented

2026-08-31 11:18:09 +00:00

(Migrated from gitlab.com)

Closing after API + web redeploy check.

Remaining real-wallet / integrator smoke is pending a user reopening report if something still fails in the wild.

Closing after API + web redeploy check. Remaining real-wallet / integrator smoke is pending a user reopening report if something still fails in the wild.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-08-31 11:18:11 +00:00