Chore/project hardening #31
Conversation
The test was failing because VITE_RPC_URI_FOR_8453 was set in .env.local, causing getRpcUrl to return the env var instead of the default fallback. Fixed by explicitly unsetting all possible env vars for chain 8453 during the fallback test.
chore: remove connect to github modal fix: wrong branch selected when creating PR
…e/project-hardening
|
@rossgalloway is attempting to deploy a commit to the yearn Team on Vercel. A member of the Team first needs to authorize it. |
There was a problem hiding this comment.
Pull Request Overview
This pull request represents a comprehensive project hardening effort that consolidates critical infrastructure improvements across authentication, upload workflows, and developer tooling. The changes establish robust shared utilities that work across both browser and Edge runtime environments while significantly refactoring the upload experience into modular, testable components.
Key changes include:
- Migration from ESLint/Prettier to Biome for unified linting and formatting
- Complete refactoring of the monolithic upload component into focused, reusable modules
- Implementation of hardened GitHub OAuth flow with crypto-strong state generation and structured logging
Reviewed Changes
Copilot reviewed 104 out of 110 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
biome.json |
Replaces ESLint/Prettier configuration with unified Biome setup for consistent code formatting and linting |
package.json |
Updates root package scripts to use Biome commands and removes deprecated tooling dependencies |
app/ |
Complete restructuring from image-tools/ to root-level app directory with modernized configuration |
scripts/ |
Removes legacy token ingestion scripts and adds new Git hooks and agent bootstrap utilities |
docs/02-APP-project-hardening/ |
Comprehensive documentation of all completed hardening tasks with technical reviews and validation logs |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
|
|
||
| function normalizeHex(value: string): string { | ||
| const trimmed = (value || '').trim(); | ||
| const withoutPrefix = trimmed.startsWith('0x') || trimmed.startsWith('0X') ? trimmed.slice(2) : trimmed; |
There was a problem hiding this comment.
The function calls startsWith twice which could be optimized. Consider using a single regex test or storing the lowercase version: const lower = trimmed.toLowerCase(); if (lower.startsWith('0x')) ...
| const withoutPrefix = trimmed.startsWith('0x') || trimmed.startsWith('0X') ? trimmed.slice(2) : trimmed; | |
| const lower = trimmed.toLowerCase(); | |
| const withoutPrefix = lower.startsWith('0x') ? trimmed.slice(2) : trimmed; |
| className="block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring-blue-500" | ||
| value={draft.chainId} | ||
| onChange={event => onChainIdChange(event.target.value)} | ||
| onBlur={onResolveName} |
There was a problem hiding this comment.
[nitpick] The onBlur event for ERC-20 name resolution may not be ideal for accessibility. Consider adding a dedicated 'Resolve Name' button or using debounced onChange to avoid triggering on every focus change.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…oway/tokenAssets into chore/project-hardening
1 participant
Project Hardening Final Completion Report
Executive Summary
Change Overview
Shared Platform Foundations
docs/02-APP-project-hardening/tasks/completed/shared-utilities-alignment.md: Establishedsrc/shared/{env,evm,api}.tsplus image helpers that work in both browser and Edge contexts, backed by Vitest suites and updated build aliases.docs/02-APP-project-hardening/tasks/completed/developer-experience-upgrades.md: Introduced repository-wide lint/test commands (now served by Biome + Vitest) and refreshed contributor guidance so every surface imports the shared utilities consistently.Upload Pipeline
docs/02-APP-project-hardening/tasks/completed/upload-workflow-refactor.md: Replaced the monolithic upload route withuseUploadFormand focused presentation components (TokenAssetCard,ChainAssetCard,PreviewPanel,ReviewDialog), added cancellable ERC-20 lookups, and centralized preview generation insrc/lib/imagePreview.ts.docs/02-APP-project-hardening/tasks/completed/upload-api-hardening.md: Rebuiltapp/api/upload.tsaround_lib/uploadhelpers, enforced PNG/EVM validation, unified GitHub PR creation for direct vs fork flows, and expanded test coverage for parsing and imaging utilities.Auth & OAuth Hardening
docs/02-APP-project-hardening/tasks/completed/auth-flow-hardening.md: Delivered theuseGithubAuthhook, React Query profile caching, crypto-grade state generation, and inline status messaging so the UI no longer blocks on modal dialogs.docs/02-APP-project-hardening/tasks/completed/github-oauth-callback-debugging.md&docs/02-APP-project-hardening/tasks/completed/github-oauth-callback-remediation-notes.md: Added structured diagnostics, base URL resolution guards, explicit redirect handling, and SPA rewrite fixes; documented the remediation timeline for historical context.docs/02-APP-project-hardening/tasks/completed/edge-runtime-review.md: Confirmedcallback.ts,erc20-name.ts, andupload.tsoperate cleanly on Edge, recommended explicit 302 responses, and validated the shared helpers for runtime parity.ERC-20 Name Service
docs/02-APP-project-hardening/tasks/completed/erc20-name-lookup.md: Centralized ABI decoding + address validation insrc/shared/erc20.ts, added configurable in-memory caching with structured error responses, and aligned client abort handling with the new API contract.Developer Tooling & Frontend Platform
biome.json(root) and updated package scripts replace ESLint/Prettier with Biome, harmonizing lint + format commands across worktrees; seedocs/02-APP-project-hardening/tasks/completed/developer-experience-upgrades.mdfor the rollout details.docs/02-APP-project-hardening/tasks/completed/frontend-platform-upgrades.md: Tracks the follow-on UX/tooling backlog (GitHub button loading state, upstream PR targeting); branch work closed out the Biome migration portion.Validation & Outstanding Actions
bun typecheck,bun lint(Biome),bun build, andbun run test/bun run validatereported clean runs across tasks.vercel devconfirming cross-tab token sync (auth-flow-hardening.md).upload-api-hardening.md).upload-workflow-refactor.md).erc20-name-lookup.md).Reviewer Guidance
app/api/auth/github/callback.ts,src/hooks/useGithubAuth.ts, andsrc/components/GithubSignIn.tsxfor consistent state handling, logging guards, and inline UX updates.src/features/upload/useUploadForm.ts,src/lib/imagePreview.ts, andapp/api/_lib/upload.tstogether; confirm FormData keys align with API parsing and that previews revoke object URLs correctly.src/shared/{env,evm,erc20,api}.tsplus associated tests to verify runtime-agnostic logic and env resolution fallbacks.biome.json, updated package scripts, and any pre-commit hooks to understand the new lint/format expectations.docs/02-APP-project-hardening/tasks/completed/for rationale, validation logs, and remaining follow-up items.Risk & Monitoring Notes
edge-runtime-review.md.GITHUB_OAUTH_DEBUGis enabled—ensure the flag is tuned appropriately per environment to avoid noisy production logs.Source Document Index