jacobh2
88197060de
Re-checked every item of the audit's own outcome section against the tree.
Most held, but five items marked fixed had residual gaps — one of them a
live IDOR — and the deferred list was untouched.
Security:
- Analytics IDOR: /api/analytics/{ws}/overview and /projection took
child_id as an unchecked query param, and get_overview called
get_days_left_at_age_4 without workspace_id, so the ownership guard
never ran. Any member could read another workspace's child projection.
Fixed at both layers.
- Scraper: session ids no longer logged at INFO; a persist-callback
failure's raw exception text and the FK maintenance banner's scraped
text no longer reach the poll client.
- Email is now case-normalised at the API boundary, with migration 009
lowercasing existing rows (aborts naming colliding rows rather than
failing opaquely on the UNIQUE constraint).
Frontend correctness:
- usePlanProposal/usePlanSync gained the stale-response guard the other
hooks already had.
- PlanSyncProvider no longer fires POST /plan/sync before auth resolves
off a blindly-read localStorage workspaceId.
- Busy flags are cleared unconditionally across all 16 useLatestRequest
consumers. setBusy(true) was unconditional while the clear was guarded
by isCurrent, so a superseded call stranded its flag forever — under
StrictMode this hung every in-app navigation behind the PageSkeleton.
isCurrent decides which response's data wins, never whether a call
releases the flag it raised.
Performance:
- Calendar no longer blanks on a mutation, and a multi-day save issues N
writes plus one background refetch instead of 2N requests.
- take_pl_on_red_days moved onto GET /auth/context, dropping a redundant
GET /workspace/:id from every cold load.
CI and repo hygiene: least-privilege permissions block, actions pinned to
commit SHAs, npm ci, uv sync --locked, failure-only artifact upload,
dependabot; dead frontend/out.js removed; CSP added to the nginx template
(repeated into the location blocks that set their own add_header, since
nginx does not merge them across levels).
Left deferred by decision: refresh-token revocation, the phase-2 contract
change, M4, M5, L2, and H12's cross-route cache. Details and the smaller
follow-ups browser verification turned up are in the audit report.
Backend 901 passed, coverage 92%. Frontend 1322 tests, coverage
98.17/94.79/92.14/98.17.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PngVF38MLpdkgXcByKfdW6
120 lines
3.6 KiB
YAML
120 lines
3.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# ---------------------------------------------------------------------------
|
|
# Backend: ruff lint + pytest with coverage gate (rises as junior tests land)
|
|
# ---------------------------------------------------------------------------
|
|
backend:
|
|
name: Backend (Python)
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: backend
|
|
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
- uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
|
|
with:
|
|
version: "latest"
|
|
|
|
- name: Install dependencies
|
|
run: uv sync --locked
|
|
|
|
- name: Lint (ruff)
|
|
run: uv run ruff check .
|
|
|
|
- name: Format check (ruff)
|
|
run: uv run ruff format --check .
|
|
|
|
- name: Test with coverage
|
|
# Measured ~81%; set threshold 1-2pp below to catch regressions.
|
|
run: uv run pytest --cov=app --cov-report=term-missing --cov-fail-under=80
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Frontend: ESLint + Vitest with 90% coverage gate
|
|
# ---------------------------------------------------------------------------
|
|
frontend:
|
|
name: Frontend (TypeScript)
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Type check
|
|
run: npm run typecheck
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Test with coverage
|
|
run: npm run coverage
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# E2E (Playwright): browser-driven checks the unit suites can't catch —
|
|
# see frontend/e2e/ for what each spec guards against. NOT a required/
|
|
# blocking gate yet (continue-on-error): it should run and report for a
|
|
# while before it can fail anyone's merge. Promoting it: drop
|
|
# `continue-on-error`, add this job to the branch protection's required
|
|
# checks, and confirm several consecutive green runs first.
|
|
# ---------------------------------------------------------------------------
|
|
e2e:
|
|
name: E2E (Playwright)
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true
|
|
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
- uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5
|
|
with:
|
|
version: "latest"
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: "20"
|
|
|
|
- name: Install backend dependencies
|
|
working-directory: backend
|
|
run: uv sync --locked
|
|
|
|
- name: Install frontend dependencies
|
|
working-directory: frontend
|
|
run: npm ci
|
|
|
|
- name: Install Playwright browsers
|
|
working-directory: frontend
|
|
run: npx playwright install --with-deps chromium
|
|
|
|
- name: Run Playwright E2E suite
|
|
working-directory: frontend
|
|
run: npm run e2e
|
|
|
|
- name: Upload Playwright report
|
|
if: failure()
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: playwright-report
|
|
path: frontend/playwright-report/
|
|
retention-days: 7
|