Add post-buy effect toasts on Arena play route (#337) #510

2026-06-19T06:36:56Z

PlasticDigits commented

2026-06-19 06:36:56 +00:00

(Migrated from gitlab.com)

Summary

Adds post-buy effect toasts on the Arena play route (/) for GitLab #337.

After a successful CHARM buy, the UI shows a compact glass toast per effect line (timer extension, +XP, level-up, WarBow BP, flag, Last Buyer). Copy reuses buildArenaBuyProjectedEffectLines / buildArenaBuyActualEffectLines with indexer-first resolution and a preview fallback when the buy row is not indexed yet. Toasts overlay the command console (max 4 visible, ~4s auto-dismiss, prefers-reduced-motion respected). Optional subdued charmed_confirm plays on the first toast only.

Acceptance checklist

Criterion	Verification	Result
Successful CHARM buy on `/` emits one toast per effect	`cd frontend && CI=1 npm run test:e2e -- --workers=5 e2e/anvil-arena-03-wallet-writes.spec.ts` (test: "DOUB buy shows post-buy effect toasts on /")	PASS
Toasts auto-dismiss without user action	`ArenaEffectToastStack.test.tsx` timing constants + manual Anvil buy	PASS
No layout shift of timer/buy panel; safe mobile overlay	CSS `position:absolute` stack in `.arena-command-console`; screenshot review	PASS
Glass styling + screenshots (desktop / tablet / mobile)	Issue #337 comment with Playwright captures	PASS
`cd frontend && npm run typecheck && npm run lint && npm test`	Ran on branch	PASS

Verification for third parties

bash scripts/e2e-anvil.sh with PLAYWRIGHT_SPECS=e2e/anvil-arena-03-wallet-writes.spec.ts — expect toast test PASS.
Or local stack: bash scripts/start-qa-local-full-stack.sh --live-sale --no-swarm, cd frontend && npm run dev, connect mock wallet, buy CHARM — data-testid="arena-buy-effect-toast" visible.
Unit: cd frontend && npm test -- arenaBuyEffectToastLines.test.ts ArenaEffectToastStack.test.tsx
Docs: INV-FRONTEND-337-BUY-EFFECT-TOASTS in docs/testing/invariants-and-business-logic.md

GitLab #337 (parent gap from #331)
Invariant: INV-FRONTEND-337-BUY-EFFECT-TOASTS
Arena views: docs/frontend/arena-views.md#post-buy-effect-toasts-gitlab-337

## Summary Adds post-buy effect toasts on the Arena play route (`/`) for GitLab #337. After a successful CHARM buy, the UI shows a compact glass toast per effect line (timer extension, +XP, level-up, WarBow BP, flag, Last Buyer). Copy reuses `buildArenaBuyProjectedEffectLines` / `buildArenaBuyActualEffectLines` with indexer-first resolution and a preview fallback when the buy row is not indexed yet. Toasts overlay the command console (max 4 visible, ~4s auto-dismiss, `prefers-reduced-motion` respected). Optional subdued `charmed_confirm` plays on the first toast only. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Successful CHARM buy on `/` emits one toast per effect | `cd frontend && CI=1 npm run test:e2e -- --workers=5 e2e/anvil-arena-03-wallet-writes.spec.ts` (test: "DOUB buy shows post-buy effect toasts on /") | PASS | | Toasts auto-dismiss without user action | `ArenaEffectToastStack.test.tsx` timing constants + manual Anvil buy | PASS | | No layout shift of timer/buy panel; safe mobile overlay | CSS `position:absolute` stack in `.arena-command-console`; screenshot review | PASS | | Glass styling + screenshots (desktop / tablet / mobile) | Issue #337 comment with Playwright captures | PASS | | `cd frontend && npm run typecheck && npm run lint && npm test` | Ran on branch | PASS | ## Verification for third parties 1. `bash scripts/e2e-anvil.sh` with `PLAYWRIGHT_SPECS=e2e/anvil-arena-03-wallet-writes.spec.ts` — expect toast test PASS. 2. Or local stack: `bash scripts/start-qa-local-full-stack.sh --live-sale --no-swarm`, `cd frontend && npm run dev`, connect mock wallet, buy CHARM — `data-testid="arena-buy-effect-toast"` visible. 3. Unit: `cd frontend && npm test -- arenaBuyEffectToastLines.test.ts ArenaEffectToastStack.test.tsx` 4. Docs: `INV-FRONTEND-337-BUY-EFFECT-TOASTS` in `docs/testing/invariants-and-business-logic.md` ## Related - GitLab #337 (parent gap from #331) - Invariant: `INV-FRONTEND-337-BUY-EFFECT-TOASTS` - Arena views: `docs/frontend/arena-views.md#post-buy-effect-toasts-gitlab-337`

PlasticDigits commented

2026-06-19 06:39:31 +00:00

(Migrated from gitlab.com)

Security review — MR !510

Commit reviewed: 5d8564c77fc416be0dcaafc9e59ff940ede42e27
Branch: issue-337-post-buy-effect-toasts → main
Scope: Post-buy effect toast UI on Arena play route (ArenaEffectToastStack, useArenaBuyEffectToasts, arenaBuyEffectToastLines, ArenaSimplePage integration, CSS, docs/tests). No contract, indexer, or auth-layer changes.

Method

Traced toast copy from onBuySuccess → buildArenaBuyProjectedEffectLines / buildArenaBuyActualEffectLines (indexer-first via findViewerBuyAtHead) → ArenaEffectToastStack render sink.
Checked injection surfaces (XSS/HTML, CSS class injection), authz (viewer buy matching), state bounds, secret leakage, SSRF/shell/SQL, and EVM/on-chain impact (none in diff).

Outcome

FINDINGS: 0 medium+ vulnerabilities on this diff.

NONE — no block:security label applied.

Notes (informational, below reporting threshold)

Toast text is rendered as React text children ({toast.line}), not dangerouslySetInnerHTML; effect strings are produced by existing numeric/format helpers and static labels (formatBuyProjectedXpLine, formatPreviewTimerPill, INDEXED_BP_PILL_LABEL, etc.) — same data path as ArenaBuyProjectedEffectsPills.
Indexed buy selection requires recentBuys[0].buyer to match the connected wallet; no new authz bypass for showing another user’s buy effects.
Toast queue capped at 4 (ARENA_BUY_EFFECT_TOAST_MAX_VISIBLE); no unbounded client state from this feature.

No inline security threads — nothing met medium+ severity with a plausible exploit path.

## Security review — MR !510 **Commit reviewed:** `5d8564c77fc416be0dcaafc9e59ff940ede42e27` **Branch:** `issue-337-post-buy-effect-toasts` → `main` **Scope:** Post-buy effect toast UI on Arena play route (`ArenaEffectToastStack`, `useArenaBuyEffectToasts`, `arenaBuyEffectToastLines`, `ArenaSimplePage` integration, CSS, docs/tests). No contract, indexer, or auth-layer changes. ### Method - Traced toast copy from `onBuySuccess` → `buildArenaBuyProjectedEffectLines` / `buildArenaBuyActualEffectLines` (indexer-first via `findViewerBuyAtHead`) → `ArenaEffectToastStack` render sink. - Checked injection surfaces (XSS/HTML, CSS class injection), authz (viewer buy matching), state bounds, secret leakage, SSRF/shell/SQL, and EVM/on-chain impact (none in diff). ### Outcome **FINDINGS: 0** medium+ vulnerabilities on this diff. **NONE** — no `block:security` label applied. ### Notes (informational, below reporting threshold) - Toast text is rendered as React text children (`{toast.line}`), not `dangerouslySetInnerHTML`; effect strings are produced by existing numeric/format helpers and static labels (`formatBuyProjectedXpLine`, `formatPreviewTimerPill`, `INDEXED_BP_PILL_LABEL`, etc.) — same data path as `ArenaBuyProjectedEffectsPills`. - Indexed buy selection requires `recentBuys[0].buyer` to match the connected wallet; no new authz bypass for showing another user’s buy effects. - Toast queue capped at 4 (`ARENA_BUY_EFFECT_TOAST_MAX_VISIBLE`); no unbounded client state from this feature. No inline security threads — nothing met medium+ severity with a plausible exploit path.

PlasticDigits commented

2026-06-19 07:45:32 +00:00

(Migrated from gitlab.com)

mentioned in commit e1ebea744e

mentioned in commit e1ebea744e3ff5b623e3875e4fcf84574b2d90ca

PlasticDigits (Migrated from gitlab.com) merged commit e1ebea744e into main

2026-06-19 07:45:33 +00:00

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!510

Rows
Columns