Fix forbidden sale copy and wire WarBow wallet profile modal #469

Merged

PlasticDigits merged 2 commits from fix/318-forbidden-sale-copy-warbow-profile into main 2026-06-14 02:33:57 +00:00

Conversation 8 Commits 2 Files changed 4 +62 -7

PlasticDigits commented 2026-06-13 13:01:10 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

• Replace pre-launch sale copy on the / play console with arenaSimplePhase / always-live arena language.
• Thread onOpenWalletProfile through ArenaWarbowHeroPanel rival PlayerIdentity rows (profile modal instead of explorer).
• Update TimeArena-facing revertMessage / useArenaSaleSession user strings to drop sale framing on the play surface.
• Add arenaPlaySurfaceCopy.test.ts + extend arenaCommandConsoleStatic.test.ts to guard forbidden copy and WarBow profile wiring.

Verification checklist

Acceptance item	Command / output	Result
No user-visible "sale" on / play console	cd frontend && npm test -- arenaPlaySurfaceCopy.test.ts	PASS
WarBow rival rows open wallet profile modal	Static: arenaPlaySurfaceCopy.test.ts + arenaCommandConsoleStatic.test.ts wiring assertions; Manual: Playwright on live stack (warbowLiveRows:1, profileBtns:1, explorerLinks:0 with filter All)	PASS
Static/unit test guards forbidden copy	cd frontend && npm run typecheck && npm run lint && npm test	PASS (636 tests)
E2E smoke (selectors unchanged)	cd frontend && npx playwright test e2e/arena.spec.ts --workers=5	PASS (7/8; 1 pre-existing flake on Yield Omega H1 visibility)
TimeArena revert copy audit	arenaPlaySurfaceCopy.test.ts friendlyRevertMessage assertions	PASS

---

Note

Low Risk
Copy and test-only changes with no auth, chain, or business-logic impact; user-facing strings may differ slightly from before.

Overview
Aligns the play console and TimeArena revert messages with GitLab #318 / INV-FRONTEND-298-UX-DOCS-E2E by dropping user-visible “sale” framing in favor of arena / round language.

revertMessage.ts updates a few TimeArena mappings (e.g. timearena: not started, timearenabuyrouter__badphase) so friendly errors say the arena has not opened or buys are not open, without “Time Arena … sale” wording.

ArenaSimplePage.tsx drives the pre-launch StatusMessage from phaseNarrative(session.phase) instead of a hard-coded “arena has not opened” string, and tweaks the page doc comment from “sale” to “round”.

Tests: new arenaPlaySurfaceCopy.test.ts and updates to arenaSimplePlaySurface.test.ts assert no forbidden sale copy on the play surface, expected revert strings, and that WarBow passes onOpenWalletProfile into rival profile rows.

^{Reviewed by Cursor Bugbot for commit 045f282788. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary - Replace pre-launch **sale** copy on the `/` play console with `arenaSimplePhase` / always-live arena language. - Thread `onOpenWalletProfile` through `ArenaWarbowHeroPanel` rival `PlayerIdentity` rows (profile modal instead of explorer). - Update TimeArena-facing `revertMessage` / `useArenaSaleSession` user strings to drop sale framing on the play surface. - Add `arenaPlaySurfaceCopy.test.ts` + extend `arenaCommandConsoleStatic.test.ts` to guard forbidden copy and WarBow profile wiring. ## Verification checklist | Acceptance item | Command / output | Result | |-----------------|------------------|--------| | No user-visible "sale" on `/` play console | `cd frontend && npm test -- arenaPlaySurfaceCopy.test.ts` | PASS | | WarBow rival rows open wallet profile modal | Static: `arenaPlaySurfaceCopy.test.ts` + `arenaCommandConsoleStatic.test.ts` wiring assertions; Manual: Playwright on live stack (`warbowLiveRows:1`, `profileBtns:1`, `explorerLinks:0` with filter **All**) | PASS | | Static/unit test guards forbidden copy | `cd frontend && npm run typecheck && npm run lint && npm test` | PASS (636 tests) | | E2E smoke (selectors unchanged) | `cd frontend && npx playwright test e2e/arena.spec.ts --workers=5` | PASS (7/8; 1 pre-existing flake on Yield Omega H1 visibility) | | TimeArena revert copy audit | `arenaPlaySurfaceCopy.test.ts` `friendlyRevertMessage` assertions | PASS | <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Copy and test-only changes with no auth, chain, or business-logic impact; user-facing strings may differ slightly from before. > > **Overview** > Aligns the **play console** and **TimeArena revert messages** with GitLab **#318** / **INV-FRONTEND-298-UX-DOCS-E2E** by dropping user-visible **“sale”** framing in favor of **arena / round** language. > > **`revertMessage.ts`** updates a few TimeArena mappings (e.g. `timearena: not started`, `timearenabuyrouter__badphase`) so friendly errors say the arena has not opened or buys are not open, without “Time Arena … sale” wording. > > **`ArenaSimplePage.tsx`** drives the pre-launch `StatusMessage` from **`phaseNarrative(session.phase)`** instead of a hard-coded “arena has not opened” string, and tweaks the page doc comment from “sale” to **“round”**. > > **Tests:** new **`arenaPlaySurfaceCopy.test.ts`** and updates to **`arenaSimplePlaySurface.test.ts`** assert no forbidden sale copy on the play surface, expected revert strings, and that **WarBow** passes **`onOpenWalletProfile`** into rival profile rows. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 045f28278877166bac9d1e866531b8e3d2e65c6f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:01:20 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 13:01:27 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 13:02:58 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !469

Commit reviewed: 7e733a7f355ba96d1556c92dca1128184e462ea9
Scope: Frontend copy changes (revertMessage.ts, useArenaSaleSession.ts, ArenaSimplePage.tsx) and WarBow onOpenWalletProfile wiring (ArenaWarbowHeroPanel.tsx); new static tests (arenaPlaySurfaceCopy.test.ts, arenaCommandConsoleStatic.test.ts). No contract, indexer, or auth changes in this diff.

Outcome: FINDINGS: 0 medium+

Summary: No exploitable security issues identified in the added/modified code.

Areas reviewed:

• Wallet profile wiring: New onOpenProfile={onOpenWalletProfile} on WarBow PlayerIdentity rows reuses the existing #258 pattern already used on podium/live-buy surfaces. Callback flows to TimeArenaPage → WalletProfileModal; addresses are validated by AddressInline (isAddress, non-zero) before click handlers run. useWalletStats gates indexer fetches (0x + 42 chars). WarBow target addresses originate from buildWarbowTargets, which rejects non-addresses via isAddress().
• Copy / revert strings: phaseNarrative, friendlyRevertMessage, and setBuyError changes are static user-facing strings from typed phase keys or fixed revert maps — no attacker-controlled HTML or URL construction.
• EVM / DeFi: No smart-contract or on-chain logic touched.
• Injection / SSRF / XSS: No new SQL, shell, deserialization, or server-side fetch surfaces. Client indexer paths remain /v1/arena/wallet/{address}/stats with existing address-shape checks.

Inline threads: None (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review — MR !469 **Commit reviewed:** `7e733a7f355ba96d1556c92dca1128184e462ea9` **Scope:** Frontend copy changes (`revertMessage.ts`, `useArenaSaleSession.ts`, `ArenaSimplePage.tsx`) and WarBow `onOpenWalletProfile` wiring (`ArenaWarbowHeroPanel.tsx`); new static tests (`arenaPlaySurfaceCopy.test.ts`, `arenaCommandConsoleStatic.test.ts`). No contract, indexer, or auth changes in this diff. **Outcome:** `FINDINGS: 0` medium+ **Summary:** No exploitable security issues identified in the added/modified code. **Areas reviewed:** - **Wallet profile wiring:** New `onOpenProfile={onOpenWalletProfile}` on WarBow `PlayerIdentity` rows reuses the existing `#258` pattern already used on podium/live-buy surfaces. Callback flows to `TimeArenaPage` → `WalletProfileModal`; addresses are validated by `AddressInline` (`isAddress`, non-zero) before click handlers run. `useWalletStats` gates indexer fetches (`0x` + 42 chars). WarBow target addresses originate from `buildWarbowTargets`, which rejects non-addresses via `isAddress()`. - **Copy / revert strings:** `phaseNarrative`, `friendlyRevertMessage`, and `setBuyError` changes are static user-facing strings from typed phase keys or fixed revert maps — no attacker-controlled HTML or URL construction. - **EVM / DeFi:** No smart-contract or on-chain logic touched. - **Injection / SSRF / XSS:** No new SQL, shell, deserialization, or server-side fetch surfaces. Client indexer paths remain `/v1/arena/wallet/{address}/stats` with existing address-shape checks. **Inline threads:** None (no medium+ findings). Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-13 14:13:02 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 31 commits

• 7e733a7f...8dd57052 - 30 commits from branch main
• 045f2827 - Merge branch 'main' into fix/318-forbidden-sale-copy-warbow-profile

Compare with previous version

added 31 commits <ul><li>7e733a7f...8dd57052 - 30 commits from branch <code>main</code></li><li>045f2827 - Merge branch &#39;main&#39; into fix/318-forbidden-sale-copy-warbow-profile</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/99/diffs?diff_id=1850345448&start_sha=7e733a7f355ba96d1556c92dca1128184e462ea9)

PlasticDigits commented 2026-06-13 14:13:05 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with main in three files:

• revertMessage.ts — kept arena/round user strings (no sale framing on TimeArena paths); merged main’s legacy TimeCurve/Kumbaya copy where it already dropped sale wording.
• ArenaSimplePage.tsx — kept phaseNarrative(session.phase) for pre-launch status instead of main’s hardcoded string.
• ArenaWarbowHeroPanel.tsx — kept onOpenWalletProfile wiring + JSDoc from both sides.

Aligned arenaSimplePlaySurface.test.ts with the MR’s phaseNarrative + revert expectations. Sanity: npm run typecheck, npm run lint, and play-surface static tests PASS.

Resolved merge conflicts with `main` in three files: - **`revertMessage.ts`** — kept arena/round user strings (no sale framing on TimeArena paths); merged main’s legacy TimeCurve/Kumbaya copy where it already dropped sale wording. - **`ArenaSimplePage.tsx`** — kept `phaseNarrative(session.phase)` for pre-launch status instead of main’s hardcoded string. - **`ArenaWarbowHeroPanel.tsx`** — kept `onOpenWalletProfile` wiring + JSDoc from both sides. Aligned **`arenaSimplePlaySurface.test.ts`** with the MR’s `phaseNarrative` + revert expectations. Sanity: `npm run typecheck`, `npm run lint`, and play-surface static tests PASS.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-13 14:13:18 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-13 14:15:09 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !469

Commit reviewed: 045f28278877166bac9d1e866531b8e3d2e65c6f
Scope: Post–conflict-resolution diff (4 files): revertMessage.ts (TimeArena friendly-revert strings), ArenaSimplePage.tsx (pre-launch status uses phaseNarrative(session.phase)), new arenaPlaySurfaceCopy.test.ts, and arenaSimplePlaySurface.test.ts expectation updates. WarBow onOpenWalletProfile wiring is asserted by tests but not modified in this diff (already present on the branch).

Outcome: FINDINGS: 0 medium+

Summary: No exploitable security issues identified in the added/modified code.

Areas reviewed:

• Copy / revert strings: phaseNarrative returns static strings from the typed SaleSessionPhase switch (arenaSimplePhase.ts); friendlyRevertMessage changes are fixed map entries only. No attacker-controlled input reaches HTML or URL sinks through these paths. buyError continues to render as React text children (no dangerouslySetInnerHTML).
• WarBow profile modal (out-of-diff, test-covered): Existing #258 pattern — PlayerIdentity → AddressInline (isAddress gate) → onOpenWalletProfile → WalletProfileModal / useWalletStats (0x + 42-char address shape before indexer fetch). No new permission boundary or SSRF surface introduced by this MR.
• EVM / DeFi: No smart-contract, indexer, or auth changes in the diff.
• Injection / SSRF / XSS: No new SQL, shell, deserialization, or server-side fetch surfaces.

Inline threads: None (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review — MR !469 **Commit reviewed:** `045f28278877166bac9d1e866531b8e3d2e65c6f` **Scope:** Post–conflict-resolution diff (4 files): `revertMessage.ts` (TimeArena friendly-revert strings), `ArenaSimplePage.tsx` (pre-launch status uses `phaseNarrative(session.phase)`), new `arenaPlaySurfaceCopy.test.ts`, and `arenaSimplePlaySurface.test.ts` expectation updates. WarBow `onOpenWalletProfile` wiring is asserted by tests but not modified in this diff (already present on the branch). **Outcome:** `FINDINGS: 0` medium+ **Summary:** No exploitable security issues identified in the added/modified code. **Areas reviewed:** - **Copy / revert strings:** `phaseNarrative` returns static strings from the typed `SaleSessionPhase` switch (`arenaSimplePhase.ts`); `friendlyRevertMessage` changes are fixed map entries only. No attacker-controlled input reaches HTML or URL sinks through these paths. `buyError` continues to render as React text children (no `dangerouslySetInnerHTML`). - **WarBow profile modal (out-of-diff, test-covered):** Existing `#258` pattern — `PlayerIdentity` → `AddressInline` (`isAddress` gate) → `onOpenWalletProfile` → `WalletProfileModal` / `useWalletStats` (`0x` + 42-char address shape before indexer fetch). No new permission boundary or SSRF surface introduced by this MR. - **EVM / DeFi:** No smart-contract, indexer, or auth changes in the diff. - **Injection / SSRF / XSS:** No new SQL, shell, deserialization, or server-side fetch surfaces. **Inline threads:** None (no medium+ findings). Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-14 02:33:58 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 11be292e4d

mentioned in commit 11be292e4d8cc8dde264227b35608f29e70899bc

PlasticDigits (Migrated from gitlab.com) merged commit 11be292e4d into main 2026-06-14 02:33:58 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!469

No description provided.