bbdfae09a0
The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).
Rules keep the ones that catch real TEST bugs and drop the noise:
- no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
- no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
`api` arg, an unused JPEG_MAGIC import), all removed.
- no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
a page.evaluate() return.
- no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.
Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.
Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
45 lines
1.8 KiB
TypeScript
45 lines
1.8 KiB
TypeScript
/**
|
|
* Security fix F1: a plain host must not be able to demote a *peer host*. Before the
|
|
* fix, `set_role` only blocked `target == admin`, so a host could demote another host
|
|
* to guest and then ban / PIN-reset (→ account takeover via /recover) them, because the
|
|
* ban/pin-reset peer guards key off the target's *current* role. This proves the
|
|
* demotion itself is now blocked for non-admins, while admins and guest-management
|
|
* still work.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { BASE } from '../../helpers/env';
|
|
|
|
function patchRole(token: string, userId: string, role: string) {
|
|
return fetch(`${BASE}/api/v1/host/users/${userId}/role`, {
|
|
method: 'PATCH',
|
|
headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ role }),
|
|
});
|
|
}
|
|
|
|
test.describe('AuthZ — host cannot demote a peer host (F1)', () => {
|
|
test('host→host demotion is 403; admin may demote; host may still manage guests', async ({
|
|
host,
|
|
guest,
|
|
adminToken,
|
|
api,
|
|
}) => {
|
|
// A second host (the victim) and an ordinary guest.
|
|
const peer = await guest('PeerHost');
|
|
await api.setRole(adminToken, peer.userId, 'host');
|
|
const plain = await guest('PlainGuest');
|
|
|
|
// Attacker host tries to demote the peer host — must be refused.
|
|
const attack = await patchRole(host.jwt, peer.userId, 'guest');
|
|
expect(attack.status, 'a host must not be able to demote a peer host').toBe(403);
|
|
|
|
// An admin may still demote a host.
|
|
const byAdmin = await patchRole(adminToken, peer.userId, 'guest');
|
|
expect(byAdmin.status).toBe(204);
|
|
|
|
// A host may still manage guests (promote one to host).
|
|
const promote = await patchRole(host.jwt, plain.userId, 'host');
|
|
expect(promote.status).toBe(204);
|
|
});
|
|
});
|