fix(epoch1000): address PR review feedback for validator edition

Jotatavo · Jotatavo · commit 47e9be6f8e8b · 2026-07-10T11:56:45.000-03:00
- Fix Trillium lookup when sw_first_epoch_with_stake is missing on latest epoch row

- Add Array.isArray guard on Trillium API response

- Harden OG validator logo fetch with HTTPS host allowlist and cache cap

- Move ValidatorChecker strings to i18n
diff --git a/apps/web/src/app/api/epoch1000/og/route.tsx b/apps/web/src/app/api/epoch1000/og/route.tsx
@@ -102,10 +102,39 @@ function getSolanaLogo() {
 }
 
 const remoteImageCache = new Map<string, Promise<string | null>>();
+const MAX_REMOTE_IMAGE_CACHE = 64;
+const ALLOWED_REMOTE_IMAGE_HOSTS = new Set(["trillium.so", "s3.amazonaws.com"]);
+
+function isAllowedRemoteImageUrl(urlString: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+
+  if (url.protocol !== "https:") return false;
+  if (!ALLOWED_REMOTE_IMAGE_HOSTS.has(url.hostname)) return false;
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(url.hostname)) return false;
+  if (url.hostname === "localhost" || url.hostname.endsWith(".local")) {
+    return false;
+  }
+
+  return true;
+}
 
 function getRemoteImageDataUrl(url: string): Promise<string | null> {
+  if (!isAllowedRemoteImageUrl(url)) {
+    return Promise.resolve(null);
+  }
+
   let cached = remoteImageCache.get(url);
   if (!cached) {
+    if (remoteImageCache.size >= MAX_REMOTE_IMAGE_CACHE) {
+      const oldest = remoteImageCache.keys().next().value;
+      if (oldest) remoteImageCache.delete(oldest);
+    }
+
     cached = fetch(url)
       .then(async (res) => {
         if (!res.ok) return null;
diff --git a/apps/web/src/components/epoch1000/ValidatorChecker.tsx b/apps/web/src/components/epoch1000/ValidatorChecker.tsx
@@ -1,32 +1,38 @@
 "use client";
 
-import { useState } from "react";
+import { useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
 import { cardParams, type CheckResult } from "@/lib/epoch1000/card-params";
 import {
   isValidSolanaAddress,
   SOLANA_ADDRESS_ERROR,
 } from "@/lib/epoch1000/public-key";
 
-const LOADING_LINES = [
-  "checking...",
-  "finding first vote...",
-  "scanning validator history...",
-  "building card...",
-];
+const LOADING_LINE_KEYS = [
+  "loadingChecking",
+  "loadingFindingVote",
+  "loadingScanning",
+  "loadingBuilding",
+] as const;
 
 interface Props {
   onResult?: (_result: CheckResult | null) => void;
 }
 
 export default function ValidatorChecker({ onResult }: Props) {
+  const t = useTranslations("epoch1000.validator.checker");
   const [address, setAddress] = useState("");
   const [loading, setLoading] = useState(false);
-  const [loadingLine, setLoadingLine] = useState(LOADING_LINES[0]);
+  const [loadingLine, setLoadingLine] = useState<
+    (typeof LOADING_LINE_KEYS)[number]
+  >(LOADING_LINE_KEYS[0]);
   const [lookupError, setLookupError] = useState<string | null>(null);
   const [result, setResult] = useState<CheckResult | null>(null);
   const [showAddress, setShowAddress] = useState(true);
   const [copied, setCopied] = useState(false);
 
+  const numberFormatter = useMemo(() => new Intl.NumberFormat("en-US"), []);
+
   async function check(e: React.FormEvent) {
     e.preventDefault();
     const trimmed = address.trim();
@@ -43,7 +49,9 @@ export default function ValidatorChecker({ onResult }: Props) {
     const rotator = setInterval(
       () =>
         setLoadingLine(
-          LOADING_LINES[Math.floor(Math.random() * LOADING_LINES.length)],
+          LOADING_LINE_KEYS[
+            Math.floor(Math.random() * LOADING_LINE_KEYS.length)
+          ],
         ),
       2500,
     );
@@ -55,13 +63,13 @@ export default function ValidatorChecker({ onResult }: Props) {
       });
       const json = await res.json();
       if (!res.ok) {
-        setLookupError(json.error ?? "Lookup failed. Try again.");
+        setLookupError(json.error ?? t("lookupFailed"));
       } else {
         setResult(json as CheckResult);
         onResult?.(json as CheckResult);
       }
     } catch {
-      setLookupError("Lookup failed. Try again.");
+      setLookupError(t("lookupFailed"));
     } finally {
       clearInterval(rotator);
       setLoading(false);
@@ -74,7 +82,12 @@ export default function ValidatorChecker({ onResult }: Props) {
     : "";
   const tweet = result
     ? encodeURIComponent(
-        `I've validated ${result.epochsSurvived}${result.capped ? "+" : ""} Solana epochs - ${result.tier}.\n\n${cardUrl}`,
+        t("tweet", {
+          epochsSurvived: result.epochsSurvived,
+          capped: result.capped ? "+" : "",
+          tier: result.tier,
+          cardUrl,
+        }),
       )
     : "";
 
@@ -99,12 +112,13 @@ export default function ValidatorChecker({ onResult }: Props) {
     <section id="checker" className="flex flex-col gap-6">
       <div>
         <h2 className="font-bold tracking-tight text-3xl sm:text-4xl">
-          Check <span className="text-sol-gradient">validator</span>
+          {t.rich("heading", {
+            gradient: (chunks) => (
+              <span className="text-sol-gradient">{chunks}</span>
+            ),
+          })}
         </h2>
-        <p className="mt-2 text-sm text-ep-dim">
-          Enter a vote account to find your first validating epoch and share
-          your survivor card. No connect, no signature.
-        </p>
+        <p className="mt-2 text-sm text-ep-dim">{t("description")}</p>
       </div>
 
       <form onSubmit={check} className="flex flex-col sm:flex-row gap-3">
@@ -114,10 +128,10 @@ export default function ValidatorChecker({ onResult }: Props) {
             setAddress(e.target.value);
             setLookupError(null);
           }}
-          placeholder="vote account address"
+          placeholder={t("placeholder")}
           spellCheck={false}
           autoComplete="off"
-          aria-label="Validator vote account address"
+          aria-label={t("inputAriaLabel")}
           aria-invalid={validationError ? true : undefined}
           aria-describedby={
             displayedError ? "epoch1000-validator-error" : undefined
@@ -129,13 +143,13 @@ export default function ValidatorChecker({ onResult }: Props) {
           disabled={loading || !isAddressValid}
           className="!bg-ep-ink text-ep-void font-semibold rounded-full px-7 py-3 text-sm disabled:opacity-40 disabled:cursor-not-allowed hover:!bg-ep-dim transition"
         >
-          {loading ? "Checking..." : "Check"}
+          {loading ? t("submitLoading") : t("submit")}
         </button>
       </form>
 
       {loading && (
         <p className="text-sm text-ep-dust animate-pulse" aria-live="polite">
-          {loadingLine}
+          {t(loadingLine)}
         </p>
       )}
 
@@ -154,7 +168,10 @@ export default function ValidatorChecker({ onResult }: Props) {
           <img
             key={params}
             src={`/api/epoch1000/og?${params}`}
-            alt={`Validator card: first seen epoch ${result.firstEpoch}, validated ${result.epochsSurvived} epochs`}
+            alt={t("imageAlt", {
+              firstEpoch: result.firstEpoch,
+              epochsSurvived: result.epochsSurvived,
+            })}
             className="w-full rounded-lg border border-ep-edge"
             width={1200}
             height={630}
@@ -168,41 +185,43 @@ export default function ValidatorChecker({ onResult }: Props) {
                 onChange={(e) => setShowAddress(e.target.checked)}
                 className="accent-[#14f195]"
               />
-              Show vote account
+              {t("showVoteAccount")}
             </label>
             <a
               href={`https://twitter.com/intent/tweet?text=${tweet}`}
               target="_blank"
               rel="noopener noreferrer"
               className="bg-ep-ink text-ep-void font-semibold rounded-full px-5 py-2 hover:bg-ep-dim transition"
             >
-              Share
+              {t("share")}
             </a>
             <button
               onClick={copyLink}
               className="border border-ep-edge rounded-full px-5 py-2 text-ep-dim hover:text-ep-ink transition"
             >
-              {copied ? "Copied" : "Copy link"}
+              {copied ? t("copied") : t("copyLink")}
             </button>
             <a
               href={`/api/epoch1000/og?${params}`}
               download={`epoch1000-validator-${result.firstEpoch}.png`}
               className="border border-ep-edge rounded-full px-5 py-2 text-ep-dim hover:text-ep-ink transition"
             >
-              PNG
+              {t("png")}
             </a>
           </div>
 
           <p className="text-xs text-ep-dust">
-            First seen:{" "}
+            {t("firstSeen")}{" "}
             <a
               href={`https://solscan.io/account/${result.address}`}
               target="_blank"
               rel="noopener noreferrer"
               className="underline decoration-ep-edge underline-offset-4 hover:text-ep-dim"
             >
-              epoch {result.firstEpoch} · slot{" "}
-              {result.firstSlot.toLocaleString("en-US")}
+              {t("firstSeenEpoch", {
+                epoch: result.firstEpoch,
+                slot: numberFormatter.format(result.firstSlot),
+              })}
             </a>
           </p>
         </div>
diff --git a/apps/web/src/lib/epoch1000/validator-cache.ts b/apps/web/src/lib/epoch1000/validator-cache.ts
@@ -6,7 +6,7 @@ import {
 
 export const VALIDATOR_LOOKUP_CACHE_REVALIDATE_SECONDS = 60;
 
-const CACHE_KEY_VERSION = "epoch1000-validator-first-tx-v2";
+const CACHE_KEY_VERSION = "epoch1000-validator-first-tx-v3";
 const CACHE_TAG = "epoch1000-validator-lookup";
 const LOCAL_CACHE_MAX_ENTRIES = 1_000;
 
diff --git a/apps/web/src/lib/epoch1000/vote-account.ts b/apps/web/src/lib/epoch1000/vote-account.ts
@@ -25,18 +25,32 @@ export async function findValidatorFirstTransaction(
   if (res.status === 404) return null;
   if (!res.ok) throw new Error(`Trillium API failed: ${res.status}`);
 
-  const records = (await res.json()) as TrilliumValidatorReward[];
-  const record = records.find(
+  const payload: unknown = await res.json();
+  if (!Array.isArray(payload)) return null;
+
+  const records = payload as TrilliumValidatorReward[];
+  const matches = records.filter(
     (entry) => entry.vote_account_pubkey === voteAccount,
   );
-  if (!record || record.sw_first_epoch_with_stake == null) return null;
+  if (matches.length === 0) return null;
+
+  // Trillium returns per-epoch rows; sw_first_epoch_with_stake is only on some.
+  const recordWithFirstEpoch = matches.find(
+    (entry) => entry.sw_first_epoch_with_stake != null,
+  );
+  if (!recordWithFirstEpoch) return null;
+
+  const latestRecord = matches[0];
 
   return {
     signature: "",
-    slot: record.sw_first_epoch_with_stake * SLOTS_PER_EPOCH,
+    slot: recordWithFirstEpoch.sw_first_epoch_with_stake * SLOTS_PER_EPOCH,
     blockTime: null,
     capped: false,
     scanned: 0,
-    logoUrl: record.icon_url?.trim() || null,
+    logoUrl:
+      latestRecord?.icon_url?.trim() ||
+      recordWithFirstEpoch.icon_url?.trim() ||
+      null,
   };
 }
diff --git a/packages/i18n/messages/web/en/common.json b/packages/i18n/messages/web/en/common.json
@@ -7799,6 +7799,28 @@
         "subtitle": "(Validator Edition)",
         "description": "A live celebration of Solana mainnet reaching 1,000 epochs. Track the countdown, then check when your validator first started securing the network."
       },
+      "checker": {
+        "heading": "Check <gradient>validator</gradient>",
+        "description": "Enter a vote account to find your first validating epoch and share your survivor card. No connect, no signature.",
+        "placeholder": "vote account address",
+        "inputAriaLabel": "Validator vote account address",
+        "submit": "Check",
+        "submitLoading": "Checking...",
+        "loadingChecking": "checking...",
+        "loadingFindingVote": "finding first vote...",
+        "loadingScanning": "scanning validator history...",
+        "loadingBuilding": "building card...",
+        "showVoteAccount": "Show vote account",
+        "share": "Share",
+        "copyLink": "Copy link",
+        "copied": "Copied",
+        "png": "PNG",
+        "firstSeen": "First seen:",
+        "firstSeenEpoch": "epoch {epoch} · slot {slot}",
+        "imageAlt": "Validator card: first seen epoch {firstEpoch}, validated {epochsSurvived} epochs",
+        "tweet": "I've validated {epochsSurvived}{capped} Solana epochs - {tier}.\n\n{cardUrl}",
+        "lookupFailed": "Lookup failed. Try again."
+      },
       "card": {
         "meta": {
           "title": "I've been validating Solana for {survived} epochs",
