fabi/EventSnap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(e2e): de-vacuum security tests; add quota, authz-sweep, keepsake-regen coverage

Browse Source 
An audit found tests that pass on broken code. The dominant pattern: fire a security
assertion at the all-zeros UUID and accept [403, 404] — the 404 comes from the resource
LOOKUP, not the guard, so the guard can be deleted and the test still passes. Repaired to
use real resources and demand exactly 403:
  - banned-user cannot like / comment (the only coverage of those ban invariants)
  - host cannot promote a real guest (or self) to admin — asserts nobody's role changed
  - IDOR comment-delete already used a real resource; kept
Also inverted recovery.spec's "unknown name → nicht gefunden" test: that asserted the exact
account-enumeration oracle the F4 fix removed, so restoring the vuln would have made it
pass. Now: an unknown name must be byte-identical to a wrong PIN.

New coverage for paths that ran in production but in zero tests:
  - quota.spec.ts: storage quota enforcement (413 over-limit, atomic increment under two
    uploads held mid-body so both carry a stale total=0 — the real race; a naive Promise.all
    version was itself vacuous and is documented as such). Proven to fail without the guard.
  - authz-sweep.spec.ts: table-driven guest→403 / host→403 over ALL 19 privileged routes +
    anonymous + __truncate. No live hole found; the whole surface is now locked.
  - ban / unban / host-comment-delete AFTER release regenerate the keepsake (data-loss
    paths that were dead under test); comment-delete mid-build doesn't strand the ZIP.

Lower-severity de-vacuuming: 10 MB comment test hit Caddy's 502 before the real 500-char
cap (now seeds a real upload, 501→400 / 500→201, mutation-verified); XSS name payloads
shortened under the 50-char cap so they actually store+render; ui-rendering XSS test now
proves the payload rendered before asserting no <b>; export page-object locators fixed to
the real "Download" label with a positive empty-state anchor; avatar palette spread test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
fabi
2026-07-15 07:26:40 +02:00
parent e5201a9889
commit 02971f3186
13 changed files with 681 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
e2e/specs/06-export/export.spec.ts
View File

@@ -16,8 +16,40 @@ test.describe('Export — release and download', () => {
await signIn(page, g);
const exportPage = new ExportPage(page);
await exportPage.goto();
// The page shouldn't show download buttons before release.
await expect(page.getByRole('button', { name: /^herunterladen$/i })).not.toBeVisible();
// POSITIVE anchor first. An absence-only assertion ("no download button") is green on a
// blank page, a 404, or an unhydrated shell — i.e. it would pass even with the buttons
// rendered, if the locator were wrong. Pin the empty state we actually expect.
await expect(exportPage.notAvailableBanner).toBeVisible({ timeout: 10_000 });
// And only THEN the absence: no download affordance exists before release. This uses the
// real button label ("Download"), so rendering a download button here turns it red.
await expect(exportPage.downloadButtons).toHaveCount(0);
});
test('/export shows enabled download buttons once released and the jobs are done', async ({
page,
guest,
signIn,
db,
}) => {
const g = await guest('PostRelease');
await db.setExportReleased(SLUG, true);
await db.fakeExportJob(SLUG, 'zip', 'done');
await db.fakeExportJob(SLUG, 'html', 'done');
await signIn(page, g);
const exportPage = new ExportPage(page);
await exportPage.goto();
// The mirror of the test above: this is what proves the "before release" locators can
// actually SEE a download button when one exists. Without this, a typo'd locator makes
// the pre-release test unfalsifiable.
await expect(exportPage.notAvailableBanner).toHaveCount(0);
await expect(exportPage.zipDownloadButton).toBeVisible({ timeout: 10_000 });
await expect(exportPage.zipDownloadButton).toBeEnabled();
await expect(exportPage.htmlDownloadButton).toBeVisible();
await expect(exportPage.htmlDownloadButton).toBeEnabled();
});
test('export status API reflects released flag', async ({ guest, db }) => {