@mictonode/widget 0.3.23 → 0.3.24

package/lib/wallet/WalletError.ts

@@ -1,56 +1,137 @@
-import { WalletName } from './Wallet';
+import type { WalletName } from './Wallet';
 
 export type WalletErrorCategory =
   | 'rejected'
+  | 'wallet-unavailable'
+  | 'wrong-network'
+  | 'insufficient-funds'
   | 'unsupported-method'
   | 'disconnected'
-  | 'wrong-network'
   | 'unknown';
 
+export const WALLET_ERROR_MESSAGES: Record<WalletErrorCategory, string> = {
+  rejected: 'Wallet request was rejected',
+  'wallet-unavailable':
+    'Wallet extension is not installed or is unavailable',
+  'wrong-network': 'Wallet is not connected to the required network',
+  'insufficient-funds':
+    'Insufficient balance to cover the amount and network fee',
+  'unsupported-method':
+    'This wallet does not support the required signing method',
+  disconnected: 'Wallet is disconnected',
+  unknown: 'Wallet request failed',
+};
+
+const MAX_ERROR_DEPTH = 5;
+const MAX_ERROR_NODES = 24;
+const NESTED_ERROR_KEYS = ['cause', 'error', 'data', 'details'] as const;
+
+interface ProviderSignals {
+  codes: number[];
+  messages: string[];
+}
+
+function numericCode(value: unknown): number | undefined {
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (typeof value === 'string' && /^-?\d+$/.test(value.trim())) {
+    return Number(value);
+  }
+  return undefined;
+}
+
+function collectProviderSignals(root: unknown): ProviderSignals {
+  const signals: ProviderSignals = { codes: [], messages: [] };
+  const seen = new Set<object>();
+  const queue: Array<{ value: unknown; depth: number }> = [
+    { value: root, depth: 0 },
+  ];
+  let inspected = 0;
+
+  while (queue.length && inspected < MAX_ERROR_NODES) {
+    const item = queue.shift()!;
+    if (
+      typeof item.value !== 'object' ||
+      item.value === null ||
+      seen.has(item.value)
+    ) {
+      continue;
+    }
+
+    seen.add(item.value);
+    inspected += 1;
+    const record = item.value as Record<string, unknown>;
+    const code = numericCode(record.code);
+    if (code !== undefined) signals.codes.push(code);
+    if (typeof record.message === 'string') {
+      signals.messages.push(record.message);
+    }
+
+    if (item.depth >= MAX_ERROR_DEPTH) continue;
+    for (const key of NESTED_ERROR_KEYS) {
+      queue.push({ value: record[key], depth: item.depth + 1 });
+    }
+  }
+
+  if (typeof root === 'string') signals.messages.push(root);
+  return signals;
+}
+
 export class WalletUserError extends Error {
   constructor(
     public readonly category: WalletErrorCategory,
-    message: string,
+    message: string
   ) {
     super(message);
     this.name = 'WalletUserError';
   }
 }
 
-function providerCode(error: unknown): number | undefined {
-  if (typeof error !== 'object' || error === null || !('code' in error)) {
-    return undefined;
+function classifyWalletError(signals: ProviderSignals): WalletErrorCategory {
+  const text = signals.messages.join(' ');
+  const hasCode = (code: number) => signals.codes.includes(code);
+
+  if (hasCode(4001)) return 'rejected';
+  if (
+    /please install|not installed|provider is unavailable|wallet connection is unavailable|no wallet connected/i.test(
+      text
+    )
+  ) {
+    return 'wallet-unavailable';
   }
-  return typeof error.code === 'number' ? error.code : undefined;
+  if (
+    hasCode(4901) ||
+    /no chain info|wrong network|required network|unknown chain/i.test(text)
+  ) {
+    return 'wrong-network';
+  }
+  if (
+    /insufficient (?:funds|fee)|not enough (?:funds|balance)|insufficient balance/i.test(
+      text
+    )
+  ) {
+    return 'insufficient-funds';
+  }
+  if (
+    hasCode(-32601) ||
+    /method (?:is )?not supported|unsupported (?:method|signing)/i.test(text)
+  ) {
+    return 'unsupported-method';
+  }
+  if (hasCode(4900) || /wallet (?:is )?disconnected/i.test(text)) {
+    return 'disconnected';
+  }
+  return 'unknown';
 }
 
 export function normalizeWalletError(error: unknown): WalletUserError {
   if (error instanceof WalletUserError) return error;
-
-  switch (providerCode(error)) {
-    case 4001:
-      return new WalletUserError('rejected', 'Wallet request was rejected');
-    case -32601:
-      return new WalletUserError(
-        'unsupported-method',
-        'This wallet does not support the required signing method',
-      );
-    case 4900:
-      return new WalletUserError('disconnected', 'Wallet is disconnected');
-    case 4901:
-      return new WalletUserError(
-        'wrong-network',
-        'Wallet is connected to the wrong network',
-      );
-    default:
-      return new WalletUserError('unknown', 'Wallet request failed');
-  }
+  const category = classifyWalletError(collectProviderSignals(error));
+  return new WalletUserError(category, WALLET_ERROR_MESSAGES[category]);
 }
 
 export function walletErrorMessage(
   error: unknown,
-  wallet?: WalletName,
+  _wallet?: WalletName
 ): string {
-  if (wallet === WalletName.Evm) return normalizeWalletError(error).message;
-  return error instanceof Error ? error.message : String(error);
+  return normalizeWalletError(error).message;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@mictonode/widget",
     "private": false,
-    "version": "0.3.23",
+    "version": "0.3.24",
     "packageManager": "yarn@1.22.22",
     "type": "module",
     "main": "dist/ping-widget.js",

package/test/components/ConnectWallet.test.ts

@@ -8,6 +8,10 @@ import {
   readWallet,
   removeWallet,
 } from '../../lib/wallet/Wallet';
+import {
+  WALLET_ERROR_MESSAGES,
+  WalletUserError,
+} from '../../lib/wallet/WalletError';
 
 const sessionMocks = vi.hoisted(() => ({
   paths: [] as string[],
@@ -251,10 +255,61 @@ describe('ConnectWallet', () => {
     );
   });
 
+  it('shows the Keplr suggestion only for a Keplr wrong-network category', async () => {
+    keplrSessionMocks.start.mockImplementationOnce(
+      async (_argument, _changed, failed) => {
+        failed(
+          new WalletUserError(
+            'wrong-network',
+            WALLET_ERROR_MESSAGES['wrong-network'],
+          ),
+        );
+      },
+    );
+
+    const wrapper = mountWallet();
+    await wrapper.get('.ping-connect-confirm').trigger('click');
+    await flushPromises();
+
+    expect(wrapper.text()).toContain(
+      WALLET_ERROR_MESSAGES['wrong-network'],
+    );
+    expect(wrapper.find('a[href*="/wallet/keplr"]').exists()).toBe(true);
+  });
+
+  it('does not show the Keplr suggestion for an EVM wrong-network error', async () => {
+    sessionMocks.connect.mockImplementationOnce(
+      async (_config, _argument, _changed, failed) => {
+        failed(
+          new WalletUserError(
+            'wrong-network',
+            WALLET_ERROR_MESSAGES['wrong-network'],
+          ),
+        );
+      },
+    );
+
+    const wrapper = mountWallet({
+      hdPath: "m/44'/60/0'/0/0",
+      evmConfig,
+    });
+    const option = wrapper
+      .findAll('li')
+      .find((item) => item.text().includes(WalletName.Evm));
+    await option?.trigger('click');
+    await wrapper.get('.ping-connect-confirm').trigger('click');
+    await flushPromises();
+
+    expect(wrapper.text()).toContain(
+      WALLET_ERROR_MESSAGES['wrong-network'],
+    );
+    expect(wrapper.find('a[href*="/wallet/keplr"]').exists()).toBe(false);
+  });
+
   it('keeps the Keplr dialog open when manual validation fails', async () => {
     keplrSessionMocks.start.mockImplementationOnce(
       async (_argument, _onChange, onError) => {
-        onError({ message: 'Keplr unavailable' });
+        onError(new Error('Please install Keplr extension'));
       },
     );
     const wrapper = mountWallet();
@@ -265,11 +320,13 @@ describe('ConnectWallet', () => {
     expect(
       (wrapper.get('#PingConnectWallet').element as HTMLInputElement).checked,
     ).toBe(true);
-    expect(wrapper.text()).toContain('Keplr unavailable');
+    expect(wrapper.text()).toContain(
+      WALLET_ERROR_MESSAGES['wallet-unavailable'],
+    );
   });
 
   it('does not reopen the Keplr dialog for a later refresh failure', async () => {
-    let reportRefreshFailure!: (error: { message: string }) => void;
+    let reportRefreshFailure!: (error: unknown) => void;
     keplrSessionMocks.start.mockImplementationOnce(
       async (_argument, _onChange, onError) => {
         reportRefreshFailure = onError;
@@ -283,13 +340,15 @@ describe('ConnectWallet', () => {
       (wrapper.get('#PingConnectWallet').element as HTMLInputElement).checked,
     ).toBe(false);
 
-    reportRefreshFailure({ message: 'Keplr refresh unavailable' });
+    reportRefreshFailure(new Error('Please install Keplr extension'));
     await flushPromises();
 
     expect(
       (wrapper.get('#PingConnectWallet').element as HTMLInputElement).checked,
     ).toBe(false);
-    expect(wrapper.text()).toContain('Keplr refresh unavailable');
+    expect(wrapper.text()).toContain(
+      WALLET_ERROR_MESSAGES['wallet-unavailable'],
+    );
   });
 
   it('isolates a replacement wallet from stale Keplr callbacks', async () => {
@@ -561,7 +620,7 @@ describe('ConnectWallet', () => {
       $: {
         setupState: {
           connected: ConnectedWallet;
-          error: string;
+          error: WalletUserError | undefined;
         };
       };
     }).$.setupState;
@@ -572,7 +631,7 @@ describe('ConnectWallet', () => {
     await flushPromises();
 
     expect(onDisconnect).toHaveBeenCalledTimes(disconnectCount);
-    expect(setupState.error).toBe('');
+    expect(setupState.error).toBeUndefined();
     expect(setupState.connected.cosmosAddress).toBe('warden1connected');
   });
 
@@ -747,7 +806,7 @@ describe('ConnectWallet', () => {
       $: {
         setupState: {
           connected: ConnectedWallet;
-          error: string;
+          error: WalletUserError | undefined;
         };
       };
     }).$.setupState;
@@ -758,7 +817,7 @@ describe('ConnectWallet', () => {
     await flushPromises();
 
     expect(onDisconnect).toHaveBeenCalledTimes(disconnectCount);
-    expect(setupState.error).toBe('');
+    expect(setupState.error).toBeUndefined();
     expect(setupState.connected.cosmosAddress).toBe('warden1connected');
   });
 

package/test/components/TxDialogParams.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'vitest';
+import {
+  parseTxParams,
+  type TxParamsResult,
+} from '../../lib/components/TxDialog/txParams';
+
+describe('parseTxParams', () => {
+  it.each<[string | undefined, TxParamsResult]>([
+    [undefined, { value: {} }],
+    ['', { value: {} }],
+    ['   ', { value: {} }],
+    ['{"fees":[{"denom":"uatom","amount":"10"}]}', {
+      value: { fees: [{ denom: 'uatom', amount: '10' }] },
+    }],
+    ['{', { value: {}, issue: 'invalid-json' }],
+    ['null', { value: {}, issue: 'invalid-shape' }],
+    ['[]', { value: {}, issue: 'invalid-shape' }],
+    ['"memo"', { value: {}, issue: 'invalid-shape' }],
+    ['1', { value: {}, issue: 'invalid-shape' }],
+  ])('normalizes %p', (raw, expected) => {
+    expect(parseTxParams(raw)).toEqual(expected);
+  });
+});

package/test/components/TxDialogSecurity.test.ts

@@ -0,0 +1,154 @@
+import { flushPromises, mount } from '@vue/test-utils';
+import { defineComponent } from 'vue';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import TxDialog from '../../lib/components/TxDialog/index.vue';
+import {
+  getAccount,
+  getBalance,
+  getLatestBlock,
+  getStakingParam,
+} from '../../lib/utils/http';
+import { createSessionClient } from '../../lib/wallet/SessionClient';
+
+const sessionClient = vi.hoisted(() => ({
+  simulate: vi.fn(),
+  sign: vi.fn(),
+  broadcastTx: vi.fn(),
+}));
+
+vi.mock('../../lib/utils/http', () => ({
+  getAccount: vi.fn(),
+  getBalance: vi.fn(),
+  getBalanceMetadata: vi.fn(),
+  getIBCDenomMetadata: vi.fn(),
+  getLatestBlock: vi.fn(),
+  getStakingParam: vi.fn(),
+  getTxByHash: vi.fn(),
+}));
+
+vi.mock('../../lib/wallet/SessionClient', () => ({
+  createSessionClient: vi.fn(() => sessionClient),
+}));
+
+vi.mock('../../lib/wallet/Wallet', () => ({
+  isEvmChain: vi.fn(() => false),
+  readWallet: vi.fn(() => ({ wallet: 'Keplr' })),
+}));
+
+vi.mock('@ping-pub/chain-registry-client', () => ({
+  default: class ChainRegistryClient {},
+}));
+
+const SendStub = defineComponent({
+  name: 'Send',
+  props: { params: { type: Object, default: () => ({}) } },
+  setup(_props, { expose }) {
+    expose({
+      initial: vi.fn(),
+      isValid: { ok: true, error: '' },
+      msgs: [{ typeUrl: '/cosmos.bank.v1beta1.MsgSend', value: {} }],
+    });
+  },
+  template: '<div data-test="send-params">{{ params }}</div>',
+});
+
+describe('TxDialog parameter boundary', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it.each(['{', 'null', '[]', '"memo"'])(
+    'renders but blocks transaction work for invalid params %p',
+    async (params) => {
+      const wrapper = mount(TxDialog, {
+        props: {
+          endpoint: 'https://rest.example',
+          params,
+          sender: 'cosmos1sender',
+          type: 'send',
+        },
+        global: {
+          stubs: { Send: SendStub },
+        },
+      });
+
+      await wrapper.get('input.modal-toggle').setValue(true);
+      await flushPromises();
+      await wrapper.get('button.btn-primary').trigger('click');
+
+      expect(wrapper.text()).toContain('Transaction parameters are invalid');
+      expect(getAccount).not.toHaveBeenCalled();
+      expect(getBalance).not.toHaveBeenCalled();
+      expect(createSessionClient).not.toHaveBeenCalled();
+      expect(sessionClient.simulate).not.toHaveBeenCalled();
+      expect(sessionClient.sign).not.toHaveBeenCalled();
+      expect(sessionClient.broadcastTx).not.toHaveBeenCalled();
+    },
+  );
+
+  it('normalizes nested provider rejection details during signing', async () => {
+    vi.mocked(getBalance).mockResolvedValueOnce({
+      balances: [{ amount: '1000000', denom: 'factory/chain/token' }],
+    });
+    vi.mocked(getAccount).mockResolvedValueOnce({
+      account: { account_number: '1', sequence: '1' },
+    });
+    vi.mocked(getLatestBlock).mockResolvedValueOnce({
+      block: { header: { chain_id: 'cosmoshub-4' } },
+    });
+    vi.mocked(getStakingParam).mockResolvedValueOnce({
+      params: { bond_denom: 'factory/chain/token' },
+    });
+    sessionClient.simulate.mockResolvedValueOnce(200000);
+    sessionClient.sign.mockRejectedValueOnce({
+      cause: {
+        code: '4001',
+        message: 'provider internal trace',
+      },
+    });
+
+    const wrapper = mount(TxDialog, {
+      props: {
+        endpoint: 'https://rest.example',
+        params: '{}',
+        sender: 'cosmos1sender',
+        type: 'send',
+      },
+      global: { stubs: { Send: SendStub } },
+    });
+
+    await wrapper.get('input.modal-toggle').setValue(true);
+    await flushPromises();
+    await wrapper.get('button.btn-primary').trigger('click');
+    await flushPromises();
+
+    expect(wrapper.text()).toContain('Wallet request was rejected');
+    expect(wrapper.text()).not.toContain('provider internal trace');
+  });
+
+  it('preserves local fee-denom validation without creating a wallet client', async () => {
+    vi.mocked(getBalance).mockResolvedValueOnce({ balances: [] });
+    vi.mocked(getLatestBlock).mockResolvedValueOnce({
+      block: { header: { chain_id: 'cosmoshub-4' } },
+    });
+    vi.mocked(getStakingParam).mockResolvedValueOnce({
+      params: { bond_denom: '' },
+    });
+
+    const wrapper = mount(TxDialog, {
+      props: {
+        endpoint: 'https://rest.example',
+        params: '{}',
+        sender: 'cosmos1sender',
+        type: 'send',
+      },
+      global: { stubs: { Send: SendStub } },
+    });
+
+    await wrapper.get('input.modal-toggle').setValue(true);
+    await flushPromises();
+    await wrapper.get('button.btn-primary').trigger('click');
+
+    expect(wrapper.text()).toContain('Fee Denom is empty');
+    expect(wrapper.text()).not.toContain('Wallet request failed');
+    expect(createSessionClient).not.toHaveBeenCalled();
+  });
+});

package/test/wallet/WalletError.test.ts

@@ -1,32 +1,56 @@
 import { describe, expect, it } from 'vitest';
-import { WalletName } from '../../lib/wallet/Wallet';
 import {
   normalizeWalletError,
-  walletErrorMessage,
+  WALLET_ERROR_MESSAGES,
+  WalletUserError,
 } from '../../lib/wallet/WalletError';
 
 describe('normalizeWalletError', () => {
   it.each([
     [{ code: 4001 }, 'rejected'],
+    [{ code: '4001' }, 'rejected'],
     [{ code: -32601 }, 'unsupported-method'],
     [{ code: 4900 }, 'disconnected'],
     [{ code: 4901 }, 'wrong-network'],
-  ])('maps provider error %#', (input, category) => {
-    expect(normalizeWalletError(input).category).toBe(category);
+    [{ message: 'Please install Keplr extension' }, 'wallet-unavailable'],
+    [{ message: 'No chain info for cosmoshub-4' }, 'wrong-network'],
+    [{ message: 'insufficient funds for fee' }, 'insufficient-funds'],
+    [{ message: 'provider is unavailable' }, 'wallet-unavailable'],
+    [{ message: 'method is not supported' }, 'unsupported-method'],
+    [{ message: 'wallet disconnected' }, 'disconnected'],
+    [{ message: 'RPC stack trace: secret' }, 'unknown'],
+  ] as const)('maps %o to %s', (error, category) => {
+    expect(normalizeWalletError(error)).toEqual(
+      new WalletUserError(category, WALLET_ERROR_MESSAGES[category])
+    );
   });
 
-  it('does not expose unknown provider payloads', () => {
-    expect(normalizeWalletError({ secret: 'typed data' }).message).toBe(
-      'Wallet request failed',
+  it('preserves an existing WalletUserError', () => {
+    const error = new WalletUserError(
+      'wrong-network',
+      WALLET_ERROR_MESSAGES['wrong-network']
     );
+    expect(normalizeWalletError(error)).toBe(error);
   });
 
-  it('uses safe EVM copy while preserving legacy errors', () => {
-    expect(walletErrorMessage({ code: -32601 }, WalletName.Evm)).toBe(
-      'This wallet does not support the required signing method',
-    );
-    expect(
-      walletErrorMessage(new Error('Insufficient fee'), WalletName.Keplr),
-    ).toBe('Insufficient fee');
+  it('gives a nested rejection code precedence and survives cycles', () => {
+    const error: {
+      message: string;
+      cause?: unknown;
+    } = { message: 'insufficient funds' };
+    const cause: { code: string; details?: unknown } = { code: '4001' };
+    error.cause = cause;
+    cause.details = error;
+
+    expect(normalizeWalletError(error).category).toBe('rejected');
+  });
+
+  it('does not traverse beyond the fixed node budget', () => {
+    let error: Record<string, unknown> = { code: 4900 };
+    for (let index = 0; index < 30; index += 1) {
+      error = { cause: error };
+    }
+
+    expect(normalizeWalletError(error).category).toBe('unknown');
   });
 });

package/test/wallet/WalletSecurity.test.ts

@@ -1,30 +1,35 @@
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { readFileSync, readdirSync } from 'node:fs';
+import { extname, join } from 'node:path';
 import { Registry } from '@cosmjs/proto-signing';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { createWallet, WalletName } from '../../lib/wallet/Wallet';
 import { MetamaskWallet } from '../../lib/wallet/wallets/MetamaskWallet';
 import { MetamaskSnapWallet } from '../../lib/wallet/wallets/MetamaskSnapWallet';
 
-const walletSources = [
-  'LeapWallet.ts',
-  'MetamaskWallet.ts',
-  'OKXWallet.ts',
-  'UnisatWallet.ts',
-];
+function sourceFiles(directory: string): string[] {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) return sourceFiles(path);
+    return ['.ts', '.tsx', '.vue', '.js'].includes(extname(entry.name)) ? [path] : [];
+  });
+}
 
 describe('wallet security hygiene', () => {
   beforeEach(() => {
     localStorage.clear();
   });
 
-  it.each(walletSources)('does not log wallet or signing data in %s', (file) => {
-    const source = readFileSync(
-      resolve(process.cwd(), 'lib', 'wallet', 'wallets', file),
-      'utf8'
-    );
+  it('contains no console.log or console.debug calls in production source', () => {
+    const findings = sourceFiles(join(process.cwd(), 'lib')).flatMap((path) => {
+      const lines = readFileSync(path, 'utf8').split(/\r?\n/);
+      return lines.flatMap((line, index) =>
+        /\bconsole\.(?:log|debug)\s*\(/.test(line)
+          ? [`${path}:${index + 1}: ${line.trim()}`]
+          : []
+      );
+    });
 
-    expect(source).not.toMatch(/\bconsole\.log\s*\(/);
+    expect(findings).toEqual([]);
   });
 
   it('falls back to a fresh MetaMask request when its account cache is malformed', async () => {

package/dist/features-82db0d52.js

@@ -1,8 +0,0 @@
-import { R as r, a } from "./ReownAuthentication-bba89dc5.js";
-import "./ConstantsUtil-f9dc60b6.js";
-import "./main-3b573cfc.js";
-import "./abis-96fed285.js";
-export {
-  r as ReownAuthentication,
-  a as ReownAuthenticationMessenger
-};