TEST-011: Add E2E tests with Playwright for critical user flows - #4
Open
ZainabJanee wants to merge 120 commits into
Open
TEST-011: Add E2E tests with Playwright for critical user flows#4ZainabJanee wants to merge 120 commits into
ZainabJanee wants to merge 120 commits into
Conversation
## Issue Vera3289#322: Build Governance Dashboard with Key Metrics ### Changes - Create `/api/governance/stats` endpoint for dashboard metrics - Connect GovernanceDashboard component to real API - Support total proposals, participation rate, pass rate tracking - Enable real-time metrics refresh every 5 minutes ### Acceptance Criteria Met - ✅ Total proposals count - ✅ Average voter participation rate - ✅ Proposal pass/reject ratio - ✅ Most active voters (anonymized) - ✅ Metrics update in real-time ### Files Changed - `backend/src/routes/governance.ts` - New governance API endpoint - `backend/src/app.ts` - Integrated governance routes - `frontend/src/pages/GovernanceDashboard.tsx` - Uses real API instead of mock data Closes Vera3289#322
…ck high-risk threats
…io and anonymization
…a3289#284) - Add docs/frontend-contract-architecture.svg showing Browser → Freighter → Stellar RPC → Contract interaction with vote submission flow - Update README Architecture section with Frontend–Contract Interaction subsection embedding the diagram - Add SVG to Project Structure docs listing
…OC-002, closes Vera3289#274) - governance/lib.rs: enhance doc comments on initialize (all params + example), create_proposal (params + example), cast_vote (params + example), and list_proposals (full pagination docs + example) - .github/workflows/docs.yml: new workflow that runs cargo doc --no-deps on push to main and deploys to GitHub Pages; root index redirects to votechain_governance crate
- Add docs/dao-integration-guide.md covering: - Prerequisites and deployment (local/testnet/mainnet) - Token initialization and member distribution - Governance contract initialization with parameter guidance - Proposal creation, voting, finalization, and execution workflows - Admin operations (pause, cancel, update quorum, two-step admin transfer) - Troubleshooting section with error code table and common issues - Update README: link guide in Resources/Documentation and Project Structure
- Add docs/mainnet-deployment-checklist.md covering: - Audit & security (BLOCKING items for unresolved findings) - Key management (air-gapped keygen, backup, no secrets in git) - Configuration review (params table, network passphrase) - Build & test (CI green, dry-run, testnet rehearsal) - Operational readiness (monitoring, comms plan) - Numbered deployment steps - Post-deployment verification (CLI smoke tests, explorer check) - Rollback procedure (pause, redeploy, cancel proposals) - Add checklist reference comment to scripts/deploy_mainnet.sh
- Add ProposalAlreadyExists error variant - Add explicit collision check in create_proposal - Add unit tests for ID uniqueness and collision rejection
…3289#315) - Integrate Freighter wallet connection - Require explicit wallet signature for voting and proposal creation - Ensure unsigned transactions are never submitted
…3289#321) - Integrate Plausible analytics - Track wallet connections, proposal views, and action submissions - Collect metrics for confirmed transactions
…3289#298) - Setup Playwright with Chromium - Implement E2E tests for proposal list, filtering, wallet connection, and voting - Mock Freighter wallet extension for testing - Update Frontend CI workflow to run E2E tests
…ate limiting tests, load tests, TS types, frontend unit tests Close Vera3289#304 — SEC-002: Comprehensive rate limiting tests for proposal cooldown ----------------------------------------------------------------------- The contract already enforces a per-address proposal cooldown via get_proposal_cooldown / set_last_proposal in storage.rs and the ProposalCooldown error in create_proposal. This commit adds five targeted tests to contracts/governance/src/test.rs that fully exercise the enforcement logic: 1. test_cooldown_is_per_address_isolated — verifies that address B is never blocked by address A's cooldown; each proposer's timer is completely independent. 2. test_zero_cooldown_allows_consecutive_proposals — verifies that initialising with cooldown = 0 disables the feature entirely, allowing back-to-back proposals from the same address. 3. test_cooldown_exact_boundary_accepted — advances the ledger by exactly the cooldown duration and asserts the second proposal succeeds (boundary is inclusive: now >= last + cooldown). 4. test_cooldown_one_second_before_boundary_reverts — advances by cooldown - 1 seconds and asserts the call panics with ProposalCooldown, confirming the off-by-one is handled correctly. 5. test_cooldown_resets_after_each_proposal — after a successful second proposal the last-proposal timestamp is refreshed, so a third immediate proposal is still blocked. Close Vera3289#301 — TEST-014: Load tests for high-volume proposal and voting ----------------------------------------------------------------------- New file: contracts/governance/src/load_tests.rs Registered as #[cfg(test)] mod load_tests in lib.rs. Three load tests simulate high-volume scenarios entirely in-process using Soroban's test environment (no network overhead): 1. test_load_1000_proposals — creates 1 000 proposals sequentially, asserts each returned ID equals its loop counter (1..=1000), then spot-checks proposal_count(), and verifies the first and last proposals are in Active state. Catches counter bugs and storage key collisions at scale. 2. test_load_10000_votes — mints 1 token to each of 10 000 unique voter addresses and casts a Yes vote on a single proposal. Asserts votes_yes == 10 000 and that no votes leaked into votes_no or votes_abstain. Validates tally arithmetic under high voter counts. 3. test_load_10000_votes_mixed — same 10 000 voters but distributed round-robin across Yes / No / Abstain (indices mod 3). Asserts each bucket accumulates independently with the exact expected count, catching any cross-bucket bleed. Close Vera3289#276 — DOC-004: TypeScript type definitions and JSDoc for JS SDK ----------------------------------------------------------------------- New file: sdk/votechain.d.ts Provides a complete, self-contained TypeScript declaration file for any JS/TS project integrating with the VoteChain governance contract: - Vote — union type 'Yes' | 'No' | 'Abstain' - ProposalState — union of all five lifecycle states - Proposal — full on-chain struct with bigint fields matching i128/u64 - VoteRecord — vote_type + weight snapshot - ContractVersion — { major, minor, patch } semver tuple - GovernanceClientConfig / CallOptions — configuration interfaces - GovernanceClient — full async client interface with JSDoc for every method including parameter descriptions, return types, and the specific ContractError variants each call can throw - ContractErrorCode — const object mapping all 22 error names to their numeric codes, plus a derived union type - ContractError — typed error interface extending Error All types include @example snippets and cross-references to the on-chain Rust types they mirror. Close Vera3289#296 — TEST-009: Frontend unit tests for ProposalList component ----------------------------------------------------------------------- New files: frontend/components/ProposalList.jsx — React component frontend/components/ProposalList.test.jsx — 17 Jest tests frontend/package.json — Jest + Babel + RTL deps frontend/babel.config.js — Babel preset-env + preset-react frontend/jest.setup.js — imports @testing-library/jest-dom ProposalList.jsx renders a paginated, filterable list of governance proposals. Features: filter bar (All / Active / Passed / Rejected / Executed / Cancelled), empty-state message, pagination with Prev/Next buttons and a page indicator, aria attributes for accessibility. The 17 tests are split into three groups: Rendering (5 tests): - renders without crashing with no proposals - shows empty message when proposals array is empty - renders all proposals when count is below page size - renders title and state for each visible proposal - renders filter buttons for all states including All Filtering (6 tests): - All filter shows every proposal - filtering by Active shows only Active proposals - filtering by Passed shows only Passed proposals - filter with no matches shows empty message - active filter button has aria-pressed=true - switching filter resets to first page Pagination (6 tests): - shows only PAGE_SIZE proposals on first page - Prev button is disabled on first page - Next button is disabled on last page - clicking Next advances to page 2 and shows remaining proposals - clicking Prev returns to page 1 - page indicator shows correct total pages - single proposal shows 1/1 page indicator
…s-ts-types-frontend-tests
- Install Vitest, @testing-library/react, jest-dom, user-event, jsdom - Configure Vitest in vite.config.ts with jsdom environment - Add test/test:watch scripts to package.json - Add 4 tests covering all acceptance criteria: - connect button triggers Freighter connection - connected state shows truncated address - disconnect clears wallet state - Freighter not installed shows install prompt - Freighter API mocked via window.freighter
…-013) Adds 8 tests covering all acceptance criteria for issue Vera3289#300: - AC1: transfer_admin succeeds with valid new admin; new admin can cancel - AC2: non-admin cannot call execute, cancel, or pause (NotAdmin #2) - AC3: old admin loses execute, cancel, and pause after transfer - AC4: transfer to zero address reverts with InvalidAddress (Vera3289#28) Tests follow existing patterns (mock_all_auths, setup_passed_proposal, setup_active_proposal helpers) and are grouped under TEST-013 section.
Triggers on push and PR to main. Builds both governance and token WASM contracts via stellar contract build, verifies both binaries exist, and uploads them as artifacts. Fails fast on any build error. Closes Vera3289#258
Covers all acceptance criteria: - Full event schema tables for governance and token contracts - JavaScript examples for subscribing via Horizon/RPC getEvents - Paginated event replay for historical data - Continuous indexer class for live polling - Proposal index builder from event stream Closes Vera3289#283
- Add docs/soroban-gotchas.md covering: - Storage TTL and expiry across all three tiers - Contract size limits and optimisation tips - Cross-contract call costs and budget model - Auth model differences from EVM (no msg.sender, require_auth) - WASM determinism requirements and forbidden features - Link new page from docs/GETTING_STARTED.md Next Steps section
…289#289) Three end-to-end tests covering all acceptance criteria: - test_lifecycle_passed_and_executed: create → vote Yes → finalise Passed → execute - test_lifecycle_rejected: create → vote No (below quorum) → finalise Rejected - test_lifecycle_cancelled_mid_vote: create → vote → cancel mid-vote Tests use env.register() to run against the compiled WASM contract.
…ra3289#281) Add 'Storage Cost Estimates' section to docs/storage.md covering: - Fee model overview (inclusion fee + resource fee) - Cost table for create_proposal, cast_vote, finalise, execute, cancel - Storage rent estimates for long-running proposals per entry type - Cost-saving notes (read-only calls, instance storage, cast_vote overhead) - How to get exact estimates via simulateTransaction
- Add contracts/governance/fuzz/Cargo.toml with libfuzzer-sys 0.4 and testutils features for governance + token contracts - Add fuzz_create_proposal target that exercises all four inputs: title, description, quorum, and duration with arbitrary byte data - Invariant: create_proposal must never panic; only Ok or ContractError - Add .github/workflows/fuzz.yml as an optional nightly CI job (continue-on-error, uploads crash artifacts on failure) Closes Vera3289#288
- Add tags: Vec<String> field to Proposal struct - Add TooManyTags (Vera3289#35) and TagTooLong (Vera3289#36) error variants - create_proposal accepts optional tags (max 5, max 32 chars each) - Tags stored and returned as part of Proposal via get_proposal - Add MAX_TAGS=5 and MAX_TAG_LEN=32 constants - Update all existing create_proposal call sites to pass empty tags - Add 7 tests covering tag storage, validation, and isolation Closes Vera3289#253
- Add InvalidTokenContract (Vera3289#35) error variant - Call try_balance() and try_total_supply() on token at init - Revert with InvalidTokenContract if either call fails - Add tests for valid and invalid token contracts Closes Vera3289#247
- Add useOgMeta hook to set og:title, og:description, og:image, og:url, og:type, og:site_name, and all twitter:card tags - Truncates description to 200 chars for card previews - Falls back to votechain.dev/og-default.png when no custom image - Wire hook into ProposalDetail, restores default title on unmount - Add static fallback OG/Twitter tags to index.html for non-JS crawlers Closes Vera3289#329
…-indexing-guide docs: event indexing guide for off-chain applications (DOC-011)
…ld-workflow ci: add dedicated WASM build workflow (DO-001)
…n-transfer-privilege-tests test(governance): admin transfer and privilege escalation tests (TEST-013)
…et-connection-unit-tests test(frontend): wallet connection unit tests (TEST-010)
PROD-003: Add analytics tracking for proposal and vote activity
…-id-collision SEC-014: Implement proposal ID collision prevention
…s-ts-types-frontend-tests
…296-rate-limiting-load-tests-ts-types-frontend-tests feat: resolve Vera3289#304 Vera3289#301 Vera3289#276 Vera3289#296 — rate limiting tests, load tests, …
…eployment-checklist docs: add mainnet deployment checklist (DOC-013, closes Vera3289#285)
…ration-guide docs: add DAO integration guide (DOC-003, closes Vera3289#275)
…ence docs: add comprehensive API doc comments and GitHub Pages workflow (D…
…contract-diagram docs: add frontend-contract architecture diagram (DOC-012, closes Vera3289#284)
…e-dashboard-v2 feat(Vera3289#322): Governance Dashboard Improvements
…oyment feat(Vera3289#320): Live Demo Deployment
…-threat-modeling sec(Vera3289#314): Token Threat Modeling and Tracking
…e-tuning docs(Vera3289#279): Governance Parameter Tuning Guide
…n-panel feat: admin panel for contract management (Vera3289#330)
…arding-tutorial feat: onboarding tutorial for first-time voters (Vera3289#328)
…icipation-tracking feat: voter participation incentive tracking (Vera3289#334)
fix: SEC-009/010/011/012 - security hardening (Vera3289#311, Vera3289#310, Vera3289#313, Vera3289#312)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
17 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements TEST-011 (Issue Vera3289#298) by setting up Playwright and a comprehensive E2E test suite for critical user flows. Includes CI integration for running tests on every PR.
Closes Vera3289#298