From 06d27ab1ce4b6b9b8a47783bc3c9bda18f92d602 Mon Sep 17 00:00:00 2001
From: tom <tom@ohhhh.me>
Date: Fri, 19 Dec 2025 17:50:59 +0100
Subject: [PATCH 1/2] pass the `x-csrf-token` to the call to the admin API

---
 lib/api/useApiFetch.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/api/useApiFetch.tsx b/lib/api/useApiFetch.tsx
index afd614c714..37379e1df9 100644
--- a/lib/api/useApiFetch.tsx
+++ b/lib/api/useApiFetch.tsx
@@ -44,10 +44,10 @@ export default function useApiFetch() {
     const headers = pickBy({
       'x-endpoint': isNeedProxy() ? api.endpoint : undefined,
       Authorization: [ 'admin', 'contractInfo' ].includes(apiName) ? apiToken : undefined,
+      'x-csrf-token': [ 'general', 'admin' ].includes(apiName) && withBody && csrfToken ? csrfToken : undefined,
       ...(apiName === 'general' ? {
         'api-v2-temp-token': apiTempToken,
         'show-scam-tokens': showScamTokens ? 'true' : undefined,
-        'x-csrf-token': withBody && csrfToken ? csrfToken : undefined,
       } : {}),
       ...resource.headers,
       ...fetchParams?.headers,

From 158177d97c663a56f5968efc2edf7da477521fb9 Mon Sep 17 00:00:00 2001
From: tom <tom@ohhhh.me>
Date: Mon, 22 Dec 2025 08:52:25 +0100
Subject: [PATCH 2/2] fix tokens test

---
 ui/pages/Tokens.pw.tsx | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/ui/pages/Tokens.pw.tsx b/ui/pages/Tokens.pw.tsx
index 7d74876429..8923790eac 100644
--- a/ui/pages/Tokens.pw.tsx
+++ b/ui/pages/Tokens.pw.tsx
@@ -41,7 +41,7 @@ test.skip('base view +@mobile +@dark-mode', async({ render, mockApiResponse }) =
   await expect(component).toHaveScreenshot();
 });
 
-test('with search +@mobile +@dark-mode', async({ render, mockApiResponse }) => {
+test('with search +@mobile +@dark-mode', async({ page, render, mockApiResponse }) => {
   const filteredTokens = {
     items: [
       tokens.tokenInfoERC20a, tokens.tokenInfoERC20b, tokens.tokenInfoERC20c,
@@ -50,7 +50,7 @@ test('with search +@mobile +@dark-mode', async({ render, mockApiResponse }) => {
   };
 
   await mockApiResponse('general:tokens', allTokens);
-  await mockApiResponse('general:tokens', filteredTokens, { queryParams: { q: 'foo' } });
+  const filteredTokensApiUrl = await mockApiResponse('general:tokens', filteredTokens, { queryParams: { q: 'foo' } });
 
   const component = await render(
     <div>
@@ -59,10 +59,12 @@ test('with search +@mobile +@dark-mode', async({ render, mockApiResponse }) => {
     </div>,
   );
 
+  const requestPromise = page.waitForRequest(filteredTokensApiUrl);
   await component.getByRole('textbox', { name: 'Token name or symbol' }).focus();
   await component.getByRole('textbox', { name: 'Token name or symbol' }).fill('foo');
   await component.getByRole('textbox', { name: 'Token name or symbol' }).blur();
 
+  await requestPromise;
   await expect(component).toHaveScreenshot({ maxDiffPixels: 20 });
 });
 
@@ -95,7 +97,7 @@ test.describe('bridged tokens', () => {
   test('base view', async({ render, page, mockApiResponse, mockEnvs }) => {
     await mockEnvs(ENVS_MAP.bridgedTokens);
     await mockApiResponse('general:tokens_bridged', bridgedTokens);
-    await mockApiResponse('general:tokens_bridged', bridgedFilteredTokens, { queryParams: { chain_ids: '99' } });
+    const bridgedFilteredTokensApiUrl = await mockApiResponse('general:tokens_bridged', bridgedFilteredTokens, { queryParams: { chain_ids: '99' } });
 
     const component = await render(
       <div>
@@ -108,9 +110,12 @@ test.describe('bridged tokens', () => {
     await expect(component).toHaveScreenshot();
 
     await component.getByRole('button', { name: /filter/i }).click();
+    const requestPromise = page.waitForRequest(bridgedFilteredTokensApiUrl);
     await page.locator('label').filter({ hasText: /poa/i }).click();
     await page.click('body');
 
+    await requestPromise;
+
     await expect(component).toHaveScreenshot();
   });
 });