fix(launch): a11y, bounded caches, volume finiteness, timer cleanup, network-scoped indexer reads

README.md

@@ -448,7 +448,7 @@ All backend services share a single `.env` file (root or per-package). Copy `.en
 | `API_AUTH_KEY` | — | API key for protected endpoints |
 | `CORS_ORIGINS` | `http://localhost:3000` | Comma-separated allowed origins (required in production) |
 | `WS_AUTH_SECRET` | — | HMAC secret for WebSocket token auth |
-| `WS_AUTH_REQUIRED` | `false` | Require WS auth tokens |
+| `WS_AUTH_REQUIRED` | *(prod: `true`, else `false`)* | Require WS auth tokens. Default follows `NODE_ENV`; set explicitly to override. |
 | `MAX_WS_CONNECTIONS` | `1000` | Global WebSocket connection limit |
 
 ### Keeper Service

SECURITY.md

@@ -32,7 +32,12 @@ WebSocket connections support optional authentication:
 
 ### Configuration
 
-- `WS_AUTH_REQUIRED=true` — Require authentication (default: false)
+- `WS_AUTH_REQUIRED` — Require authentication. **The default is environment-dependent, not `false`:**
+  required when `NODE_ENV=production`, optional otherwise. Setting the variable to
+  `true` or `false` overrides that in either direction.
+  (Implemented in `percolator-api/src/routes/ws.ts:52-56`; this repo only documents it.)
+  Startup fails closed: production without `WS_AUTH_SECRET` exits, and so does
+  `WS_AUTH_REQUIRED=true` without a secret.
 - `WS_AUTH_SECRET` — Secret key for HMAC tokens (change in production!)
 
 ### Authentication Methods
@@ -164,7 +169,9 @@ Rate limit violations are:
    CORS_ORIGINS=http://localhost:3000,http://localhost:3001
    ```
 
-2. **Keep auth disabled** for easier testing
+2. **Auth is already off in development** — the default outside
+   `NODE_ENV=production` is optional, so no setting is needed. Set it explicitly
+   only to override:
    ```bash
    WS_AUTH_REQUIRED=false
    ```

app/__tests__/api/issue-2509-malformed-body.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// #2509 — omitting `slabAddress` deliberately means "apply to ALL admin-oracle
+// markets". The old handler caught a JSON parse failure and left `body = {}`,
+// so a truncated or corrupt payload silently widened a single-market change
+// into a fleet-wide one. Empty and malformed are different requests.
+describe("#2509 set-price-cap distinguishes empty from malformed body", () => {
+  const src = fs.readFileSync(
+    path.join(__dirname, "../../app/api/oracle/set-price-cap/route.ts"),
+    "utf8",
+  );
+
+  it("reads the raw body and only parses when non-empty", () => {
+    expect(src).toMatch(/await req\.text\(\)/);
+    expect(src).toMatch(/rawBody\.trim\(\)\s*!==\s*""/);
+  });
+
+  it("returns 400 on malformed JSON rather than falling through", () => {
+    // the parse failure path must produce a 400, not an empty-object default
+    const parseCatch = src.slice(src.indexOf("JSON.parse(rawBody)"));
+    expect(parseCatch).toMatch(/status:\s*400/);
+    expect(parseCatch).toMatch(/Malformed JSON body/);
+  });
+
+  it("no longer treats a parse failure as the all-markets default", () => {
+    // the old shape: `try { body = await req.json() } catch { /* empty ok */ }`
+    expect(src).not.toMatch(/body\s*=\s*await req\.json\(\)/);
+  });
+
+  it("rejects a non-object JSON body (array / null) too", () => {
+    expect(src).toMatch(/Array\.isArray\(body\)/);
+  });
+});

app/__tests__/api/issue-2510-truncation.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// #2510 — `totalTrades: rows.length` reported the CAPPED row count with nothing
+// marking it as a floor, so a wallet above the cap silently under-reported every
+// aggregate (volume, fees, unique markets) with no signal to the caller.
+describe("#2510 trader stats surface truncation", () => {
+  const src = fs.readFileSync(
+    path.join(__dirname, "../../app/api/trader/[wallet]/stats/route.ts"),
+    "utf8",
+  );
+
+  it("names the cap once instead of repeating a literal", () => {
+    expect(src).toMatch(/export const TRADER_STATS_MAX_ROWS = 10_000;/);
+    // the raw literal must not survive in the queries, or cap and flag can drift
+    expect(src).not.toMatch(/\.limit\(10_000\)/);
+  });
+
+  it("applies the named cap to BOTH query paths (primary and fallback)", () => {
+    const uses = src.match(/\.limit\(TRADER_STATS_MAX_ROWS\)/g) ?? [];
+    expect(uses.length).toBeGreaterThanOrEqual(2);
+  });
+
+  it("exposes a truncated flag derived from the cap", () => {
+    expect(src).toMatch(/truncated:\s*rows\.length >= TRADER_STATS_MAX_ROWS/);
+  });
+
+  it("declares truncated on the response type", () => {
+    expect(src).toMatch(/truncated:\s*boolean;/);
+  });
+
+  it("sets truncated:false on the empty-result path", () => {
+    expect(src).toMatch(/totalTrades:\s*0,\s*\n\s*truncated:\s*false,/);
+  });
+});

app/__tests__/api/issue-2520-mint-existence.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// #2520 — every pre-existing check on this route was SHAPE-only (valid pubkey,
+// printable name, ticker charset, decimals range). A syntactically valid pubkey
+// for an account that was never created still landed in `devnet_mints`.
+describe("#2520 devnet-register-mint verifies the mint on-chain", () => {
+  const src = fs.readFileSync(
+    path.join(__dirname, "../../app/api/devnet-register-mint/route.ts"),
+    "utf8",
+  );
+
+  it("fetches the account before upserting", () => {
+    expect(src).toMatch(/getAccountInfo\(new PublicKey\(mintAddress\)\)/);
+  });
+
+  it("rejects a nonexistent account", () => {
+    expect(src).toMatch(/does not exist on devnet/);
+  });
+
+  it("requires the token program as owner AND the exact SPL mint length", () => {
+    expect(src).toMatch(/owner\.equals\(TOKEN_PROGRAM_ID\)/);
+    expect(src).toMatch(/SPL_MINT_LEN\s*=\s*82/);
+    expect(src).toMatch(/data\.length\s*!==\s*SPL_MINT_LEN/);
+  });
+
+  it("fails CLOSED on an RPC error rather than falling through to the upsert", () => {
+    // an advisory check that skips on error would leave the issue half-closed
+    const catchBlock = src.slice(src.indexOf("mint existence check failed"));
+    expect(catchBlock).toMatch(/status:\s*503/);
+    expect(catchBlock).toMatch(/return NextResponse\.json/);
+  });
+
+  it("runs BEFORE the DB upsert", () => {
+    expect(src.indexOf("getAccountInfo")).toBeLessThan(src.indexOf('from("devnet_mints")'));
+  });
+});

app/__tests__/components/FooterSocialA11y.test.tsx

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// #2243 — the footer social icons carried `title` only. `title` is not a reliable
+// accessible name (screen readers vary, and it is invisible on keyboard focus), so
+// each link needs an explicit aria-label and each decorative glyph aria-hidden.
+describe("#2243 footer social links have accessible names", () => {
+  const src = fs.readFileSync(
+    path.join(__dirname, "../../components/layout/Footer.tsx"),
+    "utf8",
+  );
+
+  const socials = ["GitHub", "X (Twitter)", "Discord", "Telegram"];
+
+  it.each(socials)("labels the %s link", (name) => {
+    expect(src).toContain(`aria-label="Percolator on ${name}"`);
+  });
+
+  it("hides every decorative social glyph from the a11y tree", () => {
+    // Count the social anchors by their aria-labels, then require at least as many
+    // aria-hidden svgs — so adding a link without hiding its glyph fails here.
+    const labelled = (src.match(/aria-label="Percolator on /g) ?? []).length;
+    const hidden = (src.match(/<svg aria-hidden="true"/g) ?? []).length;
+    expect(labelled).toBe(socials.length);
+    expect(hidden).toBeGreaterThanOrEqual(labelled);
+  });
+});

app/__tests__/hooks/issue-2412-liq-severity.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { getLiquidationSeverity } from "../../hooks/usePortfolio";
+
+// #2412 — both comparisons are FALSE for NaN, so an unguarded non-finite
+// distance fell through to "safe": a position at liquidation risk rendering as
+// fine. That is the one direction a risk indicator must never fail in.
+describe("#2412 getLiquidationSeverity never reports safe on bad data", () => {
+  it("does not report NaN as safe", () => {
+    expect(getLiquidationSeverity(NaN)).not.toBe("safe");
+  });
+
+  it("does not report Infinity as safe", () => {
+    expect(getLiquidationSeverity(Infinity)).not.toBe("safe");
+    expect(getLiquidationSeverity(-Infinity)).not.toBe("safe");
+  });
+
+  it("fails toward danger, not merely warning", () => {
+    // A suppressed warning is a liquidation the user never saw coming; a
+    // spurious one is noise. The asymmetry justifies the loudest bucket.
+    expect(getLiquidationSeverity(NaN)).toBe("danger");
+  });
+
+  it("still classifies real values correctly — the guard did not flatten it", () => {
+    expect(getLiquidationSeverity(5)).toBe("danger");
+    expect(getLiquidationSeverity(10)).toBe("danger");
+    expect(getLiquidationSeverity(20)).toBe("warning");
+    expect(getLiquidationSeverity(30)).toBe("warning");
+    expect(getLiquidationSeverity(31)).toBe("safe");
+    expect(getLiquidationSeverity(100)).toBe("safe");
+  });
+});

app/__tests__/lib/indexer-db-network-scope.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// #2513 — every read against the indexer DB must be scoped to the deployment's
+// network. The `trades` and `funding_history` tables both carry a `network`
+// column, but no query used it as a predicate, so a devnet deployment could
+// serve mainnet rows and vice versa.
+//
+// Asserted structurally rather than by running SQL: the failure mode is a NEW
+// query being added without the filter, and only a source-level invariant
+// catches that. A value test over the existing queries would pass forever while
+// query #13 silently leaks.
+describe("#2513 indexer-db reads are network-scoped", () => {
+  const src = fs.readFileSync(
+    path.join(__dirname, "../../lib/indexer-db.ts"),
+    "utf8",
+  );
+  const lines = src.split("\n");
+
+  it("every FROM trades / funding_history is followed by a network predicate", () => {
+    const offenders: string[] = [];
+    lines.forEach((line, i) => {
+      if (!/FROM\s+(trades|funding_history)\b/.test(line)) return;
+      // the predicate may be on this line (single-line form) or within the
+      // next few lines of the same statement
+      const window = [line, ...lines.slice(i + 1, i + 5)].join("\n");
+      if (!/network\s*=\s*\$\{getServerNetwork\(\)\}/.test(window)) {
+        offenders.push(`line ${i + 1}: ${line.trim()}`);
+      }
+    });
+    expect(offenders).toEqual([]);
+  });
+
+  it("actually found query sites — the scan cannot pass vacuously", () => {
+    const sites = lines.filter((l) => /FROM\s+(trades|funding_history)\b/.test(l));
+    expect(sites.length).toBeGreaterThanOrEqual(12);
+  });
+
+  it("imports the server-side resolver, not the localStorage one", () => {
+    expect(src).toMatch(/import \{ getServerNetwork \} from "\.\/supabase"/);
+    expect(src).not.toMatch(/from "\.\/config"/);
+  });
+});

app/__tests__/lib/issue-2321-volume-finite.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+
+// #2321 — hasVolumeData gated the volume pane on `(c.volume ?? 0) > 0`.
+// NaN > 0 is false so NaN was already excluded, but Infinity > 0 is TRUE, so a
+// single corrupt candle enabled the pane and handed Infinity to the histogram
+// series, which then scales the whole pane off that value.
+//
+// Mirrors the predicate rather than importing the component (TradingChart pulls
+// in lightweight-charts + a canvas). The assertion that matters is the shape of
+// the guard: finiteness first, then positivity.
+const hasVolumeData = (candles: { volume?: number }[]) =>
+  candles.some((c) => Number.isFinite(c.volume) && (c.volume ?? 0) > 0);
+
+describe("#2321 volume pane requires FINITE volume", () => {
+  it("rejects Infinity — the case `> 0` alone let through", () => {
+    expect(hasVolumeData([{ volume: Infinity }])).toBe(false);
+    expect(hasVolumeData([{ volume: -Infinity }])).toBe(false);
+  });
+
+  it("rejects NaN and missing volume", () => {
+    expect(hasVolumeData([{ volume: NaN }])).toBe(false);
+    expect(hasVolumeData([{}])).toBe(false);
+  });
+
+  it("still accepts a real positive volume", () => {
+    expect(hasVolumeData([{ volume: 0 }, { volume: 1234 }])).toBe(true);
+  });
+
+  it("one corrupt candle does not enable the pane on its own", () => {
+    expect(hasVolumeData([{ volume: 0 }, { volume: Infinity }])).toBe(false);
+  });
+});

app/__tests__/lib/issue-2523-payload-error.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+// #2523 — the canonicaliser's last-resort throw said only "Unsupported market
+// registration payload value". Because it is recursive, that one sentence was
+// the entire signal for a bad value buried anywhere in the payload.
+describe("#2523 payload canonicaliser error is diagnostic", () => {
+  const src = fs.readFileSync(
+    path.join(__dirname, "../../lib/market-registration-auth.ts"),
+    "utf8",
+  );
+
+  it("names the offending type", () => {
+    expect(src).toMatch(/type "\$\{typeof value\}"/);
+  });
+
+  it("names the likely causes so the message is actionable", () => {
+    expect(src).toMatch(/bigint and function values are the usual causes/);
+  });
+
+  it("does NOT interpolate the value itself — that would leak payload contents", () => {
+    // `${typeof value}` is fine; a bare `${value}` or JSON.stringify(value) in the
+    // throw would put user payload into a client-visible error and the logs.
+    const thrown = src.slice(src.indexOf("Unsupported market registration payload value"));
+    const firstThrowBlock = thrown.slice(0, 400);
+    expect(firstThrowBlock).not.toMatch(/\$\{value\}/);
+    expect(firstThrowBlock).not.toMatch(/JSON\.stringify\(value\)/);
+  });
+
+  it("keeps the sibling non-plain-object error intact", () => {
+    expect(src).toMatch(/must contain plain JSON objects/);
+  });
+});