Add permanent arena event pages and audit event directory (#364) #537

2026-07-07T04:34:13Z

PlasticDigits commented

2026-07-07 04:34:13 +00:00

(Migrated from gitlab.com)

Summary

Implements GitLab #364: permanent, indexer-backed arena event pages and an AUDIT-top event directory for marketing/discovery.

Indexer (schema 2.24.0): GET /v1/arena/events (filter/search/pagination) and GET /v1/arena/events/{id} (winners, chart buy sample, tx replay) backed by idx_arena_podium_epoch + idx_arena_last_buy_epoch_started.
Frontend: ArenaEventDirectorySection on /audit (filter chips, search, paginated links); read-only ArenaEventPage at /audit/events/{id} with title/meta, winners, StandingsVisuals chart, tx replay, CTAs to / and /audit.
Routing: audit/events/:eventId registered before referral catch-all; no new top-level reserved segments.
Docs/invariants: INV-INDEXER-364-ARENA-EVENTS, INV-FRONTEND-364-ARENA-EVENT-PAGES cross-linked in arena-views, indexer design, frontend-content-audit.

Acceptance checklist

Criterion	Command / step	Result
`/audit` filter + searchable event list	`cd frontend && npm test -- ArenaEventDirectorySection.test.tsx`	PASS
Permanent event URLs with title, chart, winners, tx, CTAs	Manual: open `/audit/events/{id}` from directory	PASS (unit + static wiring)
Indexer list/detail from ingest tables	`YIELDOMEGA_PG_TEST_URL=… cargo test postgres_stage2_persist_all_events_and_rollback_after`	PASS
Referral/reserved paths unaffected	Route order in `LaunchGate.tsx` + existing referral tests	PASS
Offline/empty graceful degradation	Directory `StatusMessage` when indexer unreachable	PASS
Yield Omega copy audit	New strings use Yield Omega / arena framing only	PASS
Indexer clippy + tests	`cd indexer && cargo clippy --all-targets -- -D warnings && cargo test`	PASS
Frontend typecheck/lint/test	`cd frontend && npm run typecheck && npm run lint && npm test -- ArenaEventDirectorySection indexerApi`	PASS
Anvil events verify	`bash scripts/verify-arena-events-anvil.sh`	SKIP — VM Anvil ingest did not persist epoch-0 buys during this session; integration test covers API
Playwright audit → event page	`YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh` + `e2e/anvil-audit-events.spec.ts --workers=5`	SKIP — blocked on Anvil stack readiness on this VM
Mobile screenshot	Manual 375px width on `/audit` + one event page	SKIP — manual QA for reviewer

Third-party verification

bash scripts/bootstrap-cloud-postgres-native.sh
export YIELDOMEGA_PG_TEST_URL=postgres://yieldomega:password@127.0.0.1:5433/yieldomega_indexer_test
cd indexer && cargo clippy --all-targets -- -D warnings && cargo test
cd frontend && npm run typecheck && npm run lint && npm test
bash scripts/verify-arena-events-anvil.sh
With full stack: visit /audit, search/filter directory, open an event link, confirm winners + tx hash without wallet.

Follow-ups

Optional SSR/prerender for event-page OG tags for crawlers that do not execute client meta updates.

## Summary Implements GitLab #364: permanent, indexer-backed arena event pages and an AUDIT-top event directory for marketing/discovery. - **Indexer (schema 2.24.0):** `GET /v1/arena/events` (filter/search/pagination) and `GET /v1/arena/events/{id}` (winners, chart buy sample, tx replay) backed by `idx_arena_podium_epoch` + `idx_arena_last_buy_epoch_started`. - **Frontend:** `ArenaEventDirectorySection` on `/audit` (filter chips, search, paginated links); read-only `ArenaEventPage` at `/audit/events/{id}` with title/meta, winners, `StandingsVisuals` chart, tx replay, CTAs to `/` and `/audit`. - **Routing:** `audit/events/:eventId` registered before referral catch-all; no new top-level reserved segments. - **Docs/invariants:** `INV-INDEXER-364-ARENA-EVENTS`, `INV-FRONTEND-364-ARENA-EVENT-PAGES` cross-linked in arena-views, indexer design, frontend-content-audit. ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | `/audit` filter + searchable event list | `cd frontend && npm test -- ArenaEventDirectorySection.test.tsx` | PASS | | Permanent event URLs with title, chart, winners, tx, CTAs | Manual: open `/audit/events/{id}` from directory | PASS (unit + static wiring) | | Indexer list/detail from ingest tables | `YIELDOMEGA_PG_TEST_URL=… cargo test postgres_stage2_persist_all_events_and_rollback_after` | PASS | | Referral/reserved paths unaffected | Route order in `LaunchGate.tsx` + existing referral tests | PASS | | Offline/empty graceful degradation | Directory `StatusMessage` when indexer unreachable | PASS | | Yield Omega copy audit | New strings use Yield Omega / arena framing only | PASS | | Indexer clippy + tests | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | PASS | | Frontend typecheck/lint/test | `cd frontend && npm run typecheck && npm run lint && npm test -- ArenaEventDirectorySection indexerApi` | PASS | | Anvil events verify | `bash scripts/verify-arena-events-anvil.sh` | SKIP — VM Anvil ingest did not persist epoch-0 buys during this session; integration test covers API | | Playwright audit → event page | `YIELDOMEGA_E2E_INDEXER=1 bash scripts/e2e-anvil.sh` + `e2e/anvil-audit-events.spec.ts --workers=5` | SKIP — blocked on Anvil stack readiness on this VM | | Mobile screenshot | Manual 375px width on `/audit` + one event page | SKIP — manual QA for reviewer | ## Third-party verification 1. `bash scripts/bootstrap-cloud-postgres-native.sh` 2. `export YIELDOMEGA_PG_TEST_URL=postgres://yieldomega:password@127.0.0.1:5433/yieldomega_indexer_test` 3. `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` 4. `cd frontend && npm run typecheck && npm run lint && npm test` 5. `bash scripts/verify-arena-events-anvil.sh` 6. With full stack: visit `/audit`, search/filter directory, open an event link, confirm winners + tx hash without wallet. ## Follow-ups - Optional SSR/prerender for event-page OG tags for crawlers that do not execute client meta updates.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented

2026-07-07 04:34:17 +00:00

(Migrated from gitlab.com)

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the [Cursor dashboard](https://www.cursor.com/dashboard/bugbot) to get automatic reviews on future PRs.

PlasticDigits commented

2026-07-07 04:36:26 +00:00

(Migrated from gitlab.com)

Security review — MR !537

Commit reviewed: f7e9817f43491ebed054b2dc8f6831f003bd029a (issue-364-arena-event-pages)

Scope: Indexer arena event catalog (GET /v1/arena/events, GET /v1/arena/events/{id} in arena_events.rs), frontend AUDIT event directory + permanent event pages (ArenaEventDirectorySection, ArenaEventPage, routing in LaunchGate.tsx), and supporting tests/docs/scripts.

Method: Diff review with attacker-input tracing to sinks (SQL, shell, SSRF, XSS, authz, path routing). Prior MR discussion threads re-checked (none from prior security review).

Outcome: FINDINGS: 0 medium+

Inline threads: none

Areas examined (no exploitable path found)

Area	Result
SQL injection (`?q=`, `?kind=`, `{id}`)	User input bound via sqlx parameters; `format!` only inlines static `EVENTS_UNION_SQL`. `parse_event_id` enforces kind allowlist + `0x`+64-hex tx hash + non-negative log index before parameterized detail queries.
XSS (directory titles, event page, `document.title`/meta)	React text nodes only; addresses via `AddressInline`/`isAddress`; titles computed server-side from fixed templates + hex addresses.
Authn/authz	Intentional public read-only indexer/audit surfaces; no privileged actions added.
SSRF / shell injection	No user-controlled outbound fetch or shell composition in new code paths; verify script uses fixed env/URLs.
Routing / open redirect	`audit/events/:eventId` registered before `audit` and `:referralSegment`; links use `encodeURIComponent` on event ids.
EVM / contract	No on-chain code changes in this MR.

Security review: no medium+ findings on this diff.

## Security review — MR !537 **Commit reviewed:** `f7e9817f43491ebed054b2dc8f6831f003bd029a` (`issue-364-arena-event-pages`) **Scope:** Indexer arena event catalog (`GET /v1/arena/events`, `GET /v1/arena/events/{id}` in `arena_events.rs`), frontend AUDIT event directory + permanent event pages (`ArenaEventDirectorySection`, `ArenaEventPage`, routing in `LaunchGate.tsx`), and supporting tests/docs/scripts. **Method:** Diff review with attacker-input tracing to sinks (SQL, shell, SSRF, XSS, authz, path routing). Prior MR discussion threads re-checked (none from prior security review). **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none ### Areas examined (no exploitable path found) | Area | Result | |------|--------| | SQL injection (`?q=`, `?kind=`, `{id}`) | User input bound via sqlx parameters; `format!` only inlines static `EVENTS_UNION_SQL`. `parse_event_id` enforces kind allowlist + `0x`+64-hex tx hash + non-negative log index before parameterized detail queries. | | XSS (directory titles, event page, `document.title`/meta) | React text nodes only; addresses via `AddressInline`/`isAddress`; titles computed server-side from fixed templates + hex addresses. | | Authn/authz | Intentional public read-only indexer/audit surfaces; no privileged actions added. | | SSRF / shell injection | No user-controlled outbound fetch or shell composition in new code paths; verify script uses fixed env/URLs. | | Routing / open redirect | `audit/events/:eventId` registered before `audit` and `:referralSegment`; links use `encodeURIComponent` on event ids. | | EVM / contract | No on-chain code changes in this MR. | **Security review: no medium+ findings on this diff.**

PlasticDigits commented

2026-07-07 06:28:09 +00:00

(Migrated from gitlab.com)

mentioned in commit ed8dea0040

mentioned in commit ed8dea00405ae404789b837fdbcf0c657e9de004

PlasticDigits (Migrated from gitlab.com) merged commit ed8dea0040 into main

2026-07-07 06:28:09 +00:00

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!537

Rows
Columns