Skip to content

test(wallet-context): regression coverage for malformed persisted session JSON - #1171

Merged
K1NGD4VID merged 3 commits into
LabsCrypt:mainfrom
Ajibose:test/wallet-context-malformed-session-json
Sep 2, 2026
Merged

test(wallet-context): regression coverage for malformed persisted session JSON#1171
K1NGD4VID merged 3 commits into
LabsCrypt:mainfrom
Ajibose:test/wallet-context-malformed-session-json

Conversation

@Ajibose

@Ajibose Ajibose commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Closes #1082

Summary

A previous attempt at this issue (#1082) added a .trim() call to readStoredSession and a matching regression test. That PR was correctly closed on review: readStoredSession in frontend/src/context/wallet-context.tsx already wraps JSON.parse in a try/catch, validates the parsed shape via isWalletSession, and removes the bad localStorage key on both a parse failure and a shape-validation failure — so the hardening called for in #1082 was already in place on main. The .trim() addition was actually a small regression: a whitespace-only stored value would short-circuit on !raw and return null without clearing the stored key, which is worse than the existing catch-all behavior.

This PR makes no production code changes. It only adds the regression tests that were missing, per the maintainer's note that "a tiny test-only PR is welcome."

What's implemented

  • No changes to frontend/src/context/wallet-context.tsx. The existing readStoredSession implementation already satisfies the acceptance criteria in [Backend] frontend/src/context/wallet-context.tsx reducer has no error boundary for malformed persisted session JSON #1082:

    • Hydrate/parse is wrapped in try/catch, falling back to a clean disconnected/idle state via the reducer's hydrate action with session: null.
    • The invalid stored value is removed from localStorage in both the catch block and the isWalletSession shape-validation failure branch, so the app doesn't loop on the same bad data.
  • frontend/src/context/wallet-context.test.tsx: added two regression tests that were previously missing coverage:

    1. should recover from syntactically invalid stored JSON without crashing — seeds localStorage with a string that fails JSON.parse ('{not valid json,,,'), renders the WalletProvider, and asserts hydration completes without throwing, status is idle, session is null, errorMessage is null, and the bad key is removed from localStorage.
    2. should discard a stored session that parses to a non-object value — seeds localStorage with valid JSON that parses to a primitive ("just-a-string") rather than an object, and asserts the same clean-hydration/clear-storage behavior via the isWalletSession guard.

    The existing suite already covered a valid session, an object with an invalid shape, and mocked !== false, but had no case where JSON.parse itself throws (the actual "malformed JSON" scenario from the issue title) or where parsing succeeds but yields a non-object. These two tests close that gap.

Files changed

  • Modified (tests only): frontend/src/context/wallet-context.test.tsx
  • No production files modified.

How to test

cd frontend
npm install
npm run test -- src/context/wallet-context.test.tsx

All 9 tests in the file pass, including the 2 new ones. Also ran the full frontend suite (npm run test) — 208/208 tests pass — and npm run lint, which reports only pre-existing warnings unrelated to this change.

… session JSON

readStoredSession already wraps JSON.parse in try/catch, validates shape via
isWalletSession, and clears the bad localStorage key on failure, so no
production code changes are needed. This adds the missing regression tests:
syntactically invalid JSON (JSON.parse throws) and JSON that parses to a
non-object value, both asserting hydration completes cleanly and the stale
key is removed.

Refs LabsCrypt#1082
@Ajibose
Ajibose force-pushed the test/wallet-context-malformed-session-json branch from fddcc8d to 08c0017 Compare September 1, 2026 17:26
…finding

prisma@7.10.0 pulls in mysql2@3.15.3 as an optional driver dependency
(unused at runtime — this project only targets Postgres), which is
flagged by `npm audit` for GHSA-3f6p-5ww8-9rcr (auth plugin downgrade
leaking plaintext credentials). Add an npm override, following the
existing pattern used for postcss/sharp/react in this file, to force
mysql2 to a patched version.

`npm audit --omit=dev --audit-level=high` now reports 0 vulnerabilities.
@K1NGD4VID
K1NGD4VID merged commit bcc28d6 into LabsCrypt:main Sep 2, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Backend] frontend/src/context/wallet-context.tsx reducer has no error boundary for malformed persisted session JSON

2 participants