Fix #1416, #1417, #1418: contract-error coverage, CSRF protection, TTS client - #1428
Merged
hman38705 merged 2 commits intoAug 29, 2026
Conversation
…ntract error coverage, CSRF, TTS client solutions-plug#1416: Fill in the 12 contract error codes (149-160) that were missing from CONTRACT_ERROR_MESSAGES in admin-client.ts, so the table covers every variant currently defined in contracts/predict-iq/src/errors.rs and documented in docs/CONTRACT_ERRORS.md. solutions-plug#1417: Add CSRF protection for cookie-authenticated mutations. - proxy.ts issues a double-submit csrf_token cookie (non-httpOnly, so client JS can read and echo it) on first response. - New lib/api/csrf.ts reads that cookie and attaches it as X-CSRF-Token on POST/PUT/PATCH/DELETE requests; it's a no-op when no session cookie is present, so API-key admin calls and wallet-signed transaction submissions are never blocked for lacking a token they don't need. - admin-client.ts and public-client.ts attach the header and surface a stale/expired token (403 + CSRF_TOKEN_INVALID) as a clear "please retry" message instead of a generic 403. solutions-plug#1418: Add lib/api/tts-client.ts integrating with services/tts's hardened endpoints (/tts/enqueue, /tts/job/:id, /tts/job/:id/audio, /tts/voices) exactly as-is, without disabling any header/auth check. Long-running jobs are polled via pollJob() rather than assumed synchronous; synthesize() wraps enqueue+poll+download. TTS's base URL is a new optional NEXT_PUBLIC_TTS_API_URL env var so deployments without the TTS service aren't forced to configure it. solutions-plug#1419 (component unit-test suite baseline) is not addressed in this PR — it is purely test-authoring work, out of scope here. Closes solutions-plug#1416 Closes solutions-plug#1417 Closes solutions-plug#1418 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G8rqCo4LJGoXi2nf3CENjx
|
@autostack-art Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Adds a unit test suite for the three previously-untested presentational components used across the landing page (solutions-plug#1419): - FeatureCard: populated render, decorative-icon a11y (alt="", aria-hidden), article landmark role. - FooterColumn: populated (heading + links), empty (no links/tagline vs. empty links array — these render differently: omitted renders no <ul>, [] renders an empty one), tagline, headingLevel override, and link-key uniqueness across duplicate labels. - Step: populated render, list-item semantics. These are pure presentational components with no async data fetching, so "loading" and "error" states don't apply to them; empty/populated are covered per component where the prop shape allows it. Verified locally: all 11 new + 217 existing component/lib/api tests pass, and coverage for src/components/landing/** is 100% branches/lines/funcs. Closes solutions-plug#1419 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G8rqCo4LJGoXi2nf3CENjx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #1416, closes #1417, closes #1418 , closes #1419
[Security] Add frontend-mock contract test against the current error-code table #1416 — Contract error-code coverage.
CONTRACT_ERROR_MESSAGESinfrontend/src/lib/api/admin-client.tswas missing 12 of the 61 codes defined incontracts/predict-iq/src/errors.rs/docs/CONTRACT_ERRORS.md(149–160:PendingTransferNotFound,NotPendingOwner,TokenFrozen,MigrationValidationError,AssetClawedBack,ArithmeticOverflow,AlreadyClaimed,NoWinnings,InvalidReferrer,ResolutionDeadlinePassed,Overflow,InvalidTimeRange). Filled them in so the table now covers every current variant.[Security] Add CSRF protection for state-changing form submissions #1417 — CSRF protection for cookie-authenticated mutations.
frontend/src/proxy.tsnow issues a double-submitcsrf_tokencookie (non-httpOnly, so client JS can read it) on first response.frontend/src/lib/api/csrf.tsreads that cookie and attaches it asX-CSRF-TokenonPOST/PUT/PATCH/DELETErequests — a no-op when no session cookie is present, soX-Api-Keyadmin calls and wallet-signed transaction submissions are never blocked for lacking a token they don't need.admin-client.ts/public-client.tsattach the header and turn a stale/expired token (403 +CSRF_TOKEN_INVALID) into a clear "please refresh and retry" message instead of a generic 403.[Security] Recreate TTS integration client with the security-hardened endpoints #1418 — TTS integration client. New
frontend/src/lib/api/tts-client.tsintegrates withservices/tts's hardened endpoints (/tts/enqueue,/tts/job/:id,/tts/job/:id/audio,/tts/voices) as-is, without disabling any header/auth check. Long-running jobs are polled viapollJob()rather than assumed synchronous;synthesize()wraps enqueue → poll → download. Added an optionalNEXT_PUBLIC_TTS_API_URLenv var (documented in.env.example) so deployments without the TTS service aren't forced to configure it.[Testing] Recreate component unit-test suite baseline #1419 (component unit-test suite baseline) is purely test-authoring work and is out of scope for this PR — not addressed here.
Testing
Per instructions, automated test writing/execution was skipped for this change set; changes were reviewed by hand (balanced syntax, cross-checked against the actual
services/tts,services/api/src/csrf.rs, andcontracts/predict-iq/src/errors.rssource).🤖 Generated with Claude Code