Verify #320: fix indexer cursor pagination doc drift #492

Merged

PlasticDigits merged 1 commit from verify/issue-320-indexer-cursor-pagination into main 2026-06-14 12:08:50 +00:00

Conversation 4 Commits 1 Files changed 2 +2 -2

PlasticDigits commented 2026-06-14 11:59:47 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Issue #320 verification found one remaining doc drift: docs/indexer/design.md API guidelines still claimed cursor pagination was not implemented on Arena list routes, contradicting both api_arena.rs (shipped in #319) and the same file's §319 cursor section. Updated the pagination guideline and INV-DOCS-320-INDEXER-ROUTES to match.

All other #320 acceptance items were already satisfied on main (product constants, route IA, pause ops, indexer routes/events).

Acceptance checklist

Criterion	Command / review	Result
Progression/CRED constants match TimeArena.sol	Manual diff: MAX_PLAYER_LEVEL=5 in ArenaXp.sol; FIRST_BUY_CRED_BONUS=1100e18, CRED_PER_CHARM_WAD=100e18 in TimeArena.sol vs docs/product/time-arena.md + arena-v2.md	PASS
Route IA consistent (product + audit docs)	frontend/src/app/LaunchGate.tsx vs docs/testing/frontend-content-audit.md legacy redirect table; npm test -- frontendContentAudit	PASS
Pause doc matches _requireLive()	claimWarBowFlag uses _requireLiveAndAutoroll() → _requireLive(); docs/operations/pause-and-final-signoff.md L25 + final-signoff-and-value-movement.md	PASS
Indexer design lists routes + events	docs/indexer/design.md HTTP list includes last-buy-epoch-pricing, warbow/latest-bp; event map includes LastBuyEpochStarted, etc.	PASS (pagination line fixed in this MR)
bash scripts/check-doc-anchors.sh	Ran in verify loop	PASS
npm test -- surfaceContent	cd frontend && npm test -- surfaceContent	PASS (4 tests)
Content audit + console static tests	npm test -- frontendContentAudit arenaCommandConsoleStatic	PASS (11 tests)
Manual LaunchGate.tsx review	Play /, AUDIT /arena/protocol, legacy /arena→/, no ArenaSubnav in RootLayout.tsx	PASS
No contradictory CRED/level across specs	rg '150 CRED|uncapped' docs/product	PASS (no hits)
bash scripts/check-arena-naming.sh	Ran during verify	PASS

Follow-ups

• docs/testing/manual-qa-checklists.md still references /arena as the play URL and the removed decision row in §291/§298 manual steps — out of #320 file scope but worth a dedicated cleanup pass aligned with frontend-content-audit.md.

---

Note

Low Risk
Markdown-only reconciliation with existing #319 API behavior; no code, config, or deployment impact.

Overview
Fixes #320 doc drift: indexer API guidelines no longer claim cursor pagination is absent on Arena list routes.

docs/indexer/design.md — The pagination bullet now documents optional cursor ({block_number}:{log_index}) and next_cursor on GET /v1/arena/buys and GET /v1/arena/activity, with limit/offset kept for compatibility (#319, #320). This replaces the outdated line that said cursor-style pagination was not implemented.

docs/testing/invariants-and-business-logic.md — INV-DOCS-320-INDEXER-ROUTES now requires design.md to mention optional cursor on those two routes, matching api_arena.rs / INV-INDEXER-319-CURSOR-PAGE.

Documentation-only; no runtime or API behavior changes.

^{Reviewed by Cursor Bugbot for commit f5632269af. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Issue #320 verification found one remaining doc drift: `docs/indexer/design.md` API guidelines still claimed cursor pagination was **not** implemented on Arena list routes, contradicting both `api_arena.rs` (shipped in #319) and the same file's §319 cursor section. Updated the pagination guideline and **`INV-DOCS-320-INDEXER-ROUTES`** to match. All other #320 acceptance items were already satisfied on `main` (product constants, route IA, pause ops, indexer routes/events). ## Acceptance checklist | Criterion | Command / review | Result | |-----------|------------------|--------| | Progression/CRED constants match `TimeArena.sol` | Manual diff: `MAX_PLAYER_LEVEL=5` in `ArenaXp.sol`; `FIRST_BUY_CRED_BONUS=1100e18`, `CRED_PER_CHARM_WAD=100e18` in `TimeArena.sol` vs `docs/product/time-arena.md` + `arena-v2.md` | **PASS** | | Route IA consistent (product + audit docs) | `frontend/src/app/LaunchGate.tsx` vs `docs/testing/frontend-content-audit.md` legacy redirect table; `npm test -- frontendContentAudit` | **PASS** | | Pause doc matches `_requireLive()` | `claimWarBowFlag` uses `_requireLiveAndAutoroll()` → `_requireLive()`; `docs/operations/pause-and-final-signoff.md` L25 + `final-signoff-and-value-movement.md` | **PASS** | | Indexer design lists routes + events | `docs/indexer/design.md` HTTP list includes `last-buy-epoch-pricing`, `warbow/latest-bp`; event map includes `LastBuyEpochStarted`, etc. | **PASS** (pagination line fixed in this MR) | | `bash scripts/check-doc-anchors.sh` | Ran in verify loop | **PASS** | | `npm test -- surfaceContent` | `cd frontend && npm test -- surfaceContent` | **PASS** (4 tests) | | Content audit + console static tests | `npm test -- frontendContentAudit arenaCommandConsoleStatic` | **PASS** (11 tests) | | Manual `LaunchGate.tsx` review | Play `/`, AUDIT `/arena/protocol`, legacy `/arena`→`/`, no `ArenaSubnav` in `RootLayout.tsx` | **PASS** | | No contradictory CRED/level across specs | `rg '150 CRED\|uncapped' docs/product` | **PASS** (no hits) | | `bash scripts/check-arena-naming.sh` | Ran during verify | **PASS** | ## Follow-ups - `docs/testing/manual-qa-checklists.md` still references `/arena` as the play URL and the removed decision row in §291/§298 manual steps — out of #320 file scope but worth a dedicated cleanup pass aligned with `frontend-content-audit.md`. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Markdown-only reconciliation with existing #319 API behavior; no code, config, or deployment impact. > > **Overview** > Fixes **#320** doc drift: indexer API guidelines no longer claim cursor pagination is absent on Arena list routes. > > **`docs/indexer/design.md`** — The pagination bullet now documents optional **`cursor`** (`{block_number}:{log_index}`) and **`next_cursor`** on **`GET /v1/arena/buys`** and **`GET /v1/arena/activity`**, with **`limit`/`offset`** kept for compatibility ([#319](https://gitlab.com/PlasticDigits/yieldomega/-/issues/319), [#320](https://gitlab.com/PlasticDigits/yieldomega/-/issues/320)). This replaces the outdated line that said cursor-style pagination was **not** implemented. > > **`docs/testing/invariants-and-business-logic.md`** — **`INV-DOCS-320-INDEXER-ROUTES`** now requires design.md to mention optional **`cursor`** on those two routes, matching **`api_arena.rs`** / **`INV-INDEXER-319-CURSOR-PAGE`**. > > Documentation-only; no runtime or API behavior changes. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f5632269afb011eb9386d589bd2bedd485df6f9f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 11:59:54 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 12:00:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 12:01:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !492

Commit reviewed: f5632269afb011eb9386d589bd2bedd485df6f9f
Base: 1b4f62603ad71a96e2acde0b5efc0f0d7b33a6dd

Scope

Documentation-only reconciliation for #320:

• docs/indexer/design.md — pagination guideline updated to document optional cursor / next_cursor on GET /v1/arena/buys and GET /v1/arena/activity (behavior shipped in #319).
• docs/testing/invariants-and-business-logic.md — INV-DOCS-320-INDEXER-ROUTES invariant text aligned with the same.

Diff: 2 files, 2 insertions / 2 deletions. No Rust, Solidity, frontend, config, dependency, or deployment changes.

Method

• Full MR diff inspected; no attacker-controlled input sinks introduced.
• Referenced api_arena.rs at head SHA only to confirm the doc change describes existing behavior (#319 cursor pagination with BlockLogCursor parsing, bad_cursor_response() on malformed input, parameterized SQL binds) — not new code in this MR.
• Prior MR discussion threads: none (first security pass).

Outcome

FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Markdown-only edits cannot introduce injection, authn/authz bypass, SSRF, secret leakage, or EVM/on-chain risk. No new attack surface, dependency, or operational exposure.

Inline threads: none (no findings).

## Security review — MR !492 **Commit reviewed:** `f5632269afb011eb9386d589bd2bedd485df6f9f` **Base:** `1b4f62603ad71a96e2acde0b5efc0f0d7b33a6dd` ### Scope Documentation-only reconciliation for #320: - `docs/indexer/design.md` — pagination guideline updated to document optional `cursor` / `next_cursor` on `GET /v1/arena/buys` and `GET /v1/arena/activity` (behavior shipped in #319). - `docs/testing/invariants-and-business-logic.md` — `INV-DOCS-320-INDEXER-ROUTES` invariant text aligned with the same. **Diff:** 2 files, 2 insertions / 2 deletions. No Rust, Solidity, frontend, config, dependency, or deployment changes. ### Method - Full MR diff inspected; no attacker-controlled input sinks introduced. - Referenced `api_arena.rs` at head SHA only to confirm the doc change describes existing behavior (#319 cursor pagination with `BlockLogCursor` parsing, `bad_cursor_response()` on malformed input, parameterized SQL binds) — not new code in this MR. - Prior MR discussion threads: none (first security pass). ### Outcome **FINDINGS: 0** medium+ Security review: **no medium+ findings** on this diff. Markdown-only edits cannot introduce injection, authn/authz bypass, SSRF, secret leakage, or EVM/on-chain risk. No new attack surface, dependency, or operational exposure. **Inline threads:** none (no findings).

PlasticDigits commented 2026-06-14 12:08:50 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 561063f7c6

mentioned in commit 561063f7c6cb0ba345c811a84be33aaafa34227f

PlasticDigits (Migrated from gitlab.com) merged commit 561063f7c6 into main 2026-06-14 12:08:50 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!492

No description provided.