[Feature] Admin incident review and pause authorization UI - #265
Open
morelucks wants to merge 8 commits into
Open
[Feature] Admin incident review and pause authorization UI#265morelucks wants to merge 8 commits into
morelucks wants to merge 8 commits into
Conversation
…ointSave-org#263) Implements comprehensive admin self-service emergency controls for pool management: Smart Contract Changes: - Add pause(), unpause(), emergency_withdraw() functions to rotational pool - Add Admin and Paused storage keys - Add admin authorization checks - Add is_paused() and admin() view functions - Prevent deposits/payouts when paused Frontend Features: - SEP-53 wallet signature proof utilities (client + server) - AdminEmergencyControls component with pause/resume/emergency_withdraw UI - Confirmation dialogs with warnings for each action - Real-time pool status alerts - Integration with group detail page API Layer: - POST /api/pools/[id]/admin endpoint for admin actions - Wallet proof verification using Stellar cryptography - Rate limiting (5 actions per minute per pool) - Eligibility checks and safeguards - Activity logging with tx hash tracking Database: - Add pause_reason and paused_at columns to pools table - Migration script provided - Updated TypeScript types Security: - SEP-53 signature verification prevents address spoofing - 5-minute timestamp expiration - Ownership verification against pool creator - Rate limiting prevents abuse - Audit logging for all actions - Multiple confirmations for irreversible actions Internationalization: - Full EN + ES translations for all UI strings - i18n utility functions Testing: - Unit tests for wallet proof message generation - Timestamp validation tests - Signature verification tests - Ownership check tests Documentation: - Comprehensive implementation guide - Usage instructions for admins - Security considerations - Testing checklist - Future enhancement roadmap Closes JointSave-org#263
- Resolved smart contract conflicts: kept upstream rotational contract with all new features - Resolved wallet-proof conflicts: kept our new SEP-53 implementation - Resolved supabase.ts conflicts: merged pause_reason/paused_at with upstream archival fields - Removed old dashboard/group/[id]/page.tsx (moved to [locale] structure) - Integrated AdminEmergencyControls into new GroupClient.tsx component - Added GovernancePanel import to fix missing component All conflicts resolved and feature preserved in new upstream structure.
- Added incident review page at /dashboard/admin/security/incidents - Created IncidentReviewCard component for reviewing security incidents - Created PauseAuthorizationPanel for managing automatic on-chain pause - Added PausedPoolBanner component shown to all pool members - Integrated paused pool banner into GroupClient - Added revokePauseAuthorizationMessage() to wallet-proof.ts - Added comprehensive i18n strings (EN + ES) for incidents and pauseAuth - Created component tests for incident status mapping and authorization rendering - Deep-links from paused pool notifications to incident review screen Fixes JointSave-org#261
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements the incident review and pause authorization UI for the security circuit breaker, completing issue #261.
closes #261
The backend APIs for incident management and pause authorizations were already complete. This PR adds the missing frontend layer to make them accessible to pool admins.
Changes
New Components
Integrations
PausedPoolBannerintoGroupClient.tsx- shown when pool status is 'paused'revokePauseAuthorizationMessage()function towallet-proof.tsfor signing revocation proofsi18n
admin.incidents.*andadmin.pauseAuth.*namespacesgroup.paused.*translations for the paused pool bannerTesting
incident-review.test.tsxcovering:Acceptance Criteria
✅ Admin can open, review, and act on incidents for pools they own (resolve/resume/record on-chain hash)
✅ Admin can pre-authorize, list, and revoke automatic on-chain pause from the UI
✅ Paused pool shows a banner with pause_reason, notifications link to review screen
✅ EN + ES translations present
✅ Component tests cover incident status mapping and authorization status rendering
Notes
callerAddressand handles 403s gracefullyRelated
Fixes #261
Part of the security circuit breaker initiative that started with PR #259 (automated incident response) and PR #264 (admin emergency controls).
Testing
Tested with: