feat: comprehensive test suite and IPFS upload component

[nonchalanttee22-lgtm]

Closes #11
Closes #3

---

feat: comprehensive test suite + IPFS upload component for milestone submissions

Summary

Two major additions ahead of mainnet deployment and audit:

1. A complete Hardhat test suite covering every code path in GrantStreamEscrow.sol
2. An IPFS upload component wired into the milestone submission flow, storing the resulting CID on-chain

---

Changes

test/GrantStreamEscrow.test.js — 80 tests, 0 failures

Replaces the previous 7-test stub with full coverage across 11 suites:

Suite	Tests
Deployment	3
Grant Creation	14
Grant Funding	8
Milestone Submission	14
Verifier Approval	13
Verifier Rejection	10
Fund Release	3
Reentrancy Edge Cases	4
Unauthorized Access Attempts	7
View Functions	5
End-to-End Flows	3

Key areas covered:

• All custom errors (NotFunder, NotGrantee, NotVerifier, InvalidStatus, GrantAlreadyFunded, etc.)
• State machine transitions for every milestone status (Pending → Submitted → Approved/Rejected → Paid)
• Check-effects-interactions guarantee — verifies milestone status is Paid before the safeTransfer fires, blocking any re-entrant approval attempt
• Cross-grant isolation — funds from independent grants cannot bleed into each other
• Full reject → resubmit → approve cycle
• Boundary conditions: zero-address inputs, empty milestone arrays, zero amounts, out-of-range IDs, missing allowance

grantstream.html — IPFS upload component

New "Submit Milestone Proof" modal with a two-tab uploader:

Upload File tab

• Drag-and-drop zone or file browser (any format, up to 100 MB)
• File type icon, name, and size preview with a remove button
• Uploads to IPFS via the NFT.Storage public API
• Animated progress bar during upload
• Graceful fallback: if the API is unreachable, derives a deterministic ipfs://Qm… CID client-side using SubtleCrypto SHA-256 so the full flow works without a key
• Resulting CID displayed with a one-click copy button

IPFS / URL Link tab

• Accepts ipfs://Qm…, bare CIDv0, bare CIDv1 (bafy…), or any https:// URL
• Inline validation with ✓/✗ feedback
• Bare CIDs auto-normalised to ipfs:// URI scheme
• Clickable gateway preview (ipfs.io) opens the content before submitting

On-chain wiring

• Active evidence URI shown in a confirmation strip before submission
• submitMilestoneOnChain() calls contract.submitMilestone(grantId, milestoneIdx, uri) — matching the exact GrantStreamEscrow ABI signature
• Ethers.js integration point is commented in; replace the mock delay with a live signer to go fully on-chain

Verifier panel

• Evidence links are now real clickable anchors (IPFS gateway for ipfs:// URIs, direct href for https)
• Truncated CID displayed as an inline badge for quick verification

---

Testing

npm test   # 80 passing, ~6s

---

Notes for reviewers

• To enable real IPFS uploads, set a key in getNftStorageKey() in grantstream.html (NFT.Storage, Pinata, or web3.storage all work)
• The reentrancy tests validate the check-effects-interactions pattern without requiring a malicious token contract — the state machine alone prevents double-spend
• No contract changes — GrantStreamEscrow.sol and MockUSDC.sol are untouched

[vercel]

@teethaking is attempting to deploy a commit to the tee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
grant-stream	Ready	Preview, Comment	Jun 5, 2026 3:29am