32dfe6874a
The e2e suite had never been run during this audit. It failed 9 of 256; seven of those predated the audit's changes, established by building a stack from a clean HEAD worktree and running the same specs against it rather than guessing. Most were stale assertions rather than product defects: - quota.spec solved for a target limit using the observed uploader count, but the divisor is max(active, estimated_guest_count, 1) and that config seeds at 100 — so every limit it aimed for came out 100x small and every "within quota" upload 413'd. - rate-limit-shared-nat destructured `ticket` from a 429 body and fetched with `ticket=undefined`, turning the 429 under test into an unrelated 401. It also faked a release with no archive on disk, so the mint's pre-check 404'd and the per-day limiter was never reached; it now does a real release and asserts 200 rather than "not 429". - ddos allowed only [200,429] from ten concurrent streams, so it failed on the very defence it exercises: four tickets per session survive and the rest correctly 401. Now asserts exactly four, which a tightened cap or an inverted eviction order would catch. - auth-tampering asserted a throttled IP is refused EVEN with the correct password. That contract was deliberately removed — it let any phone on the venue NAT lock the operator out of their own admin panel, with a circular escape hatch. Inverted, plus a new check that a success does not refill an attacker's bucket. - moderation-ui assumed a ban leaves a comment "stuck on screen"; `list_for_upload` filters banned authors, so it is hidden from everyone including the host. Now pins the pair that matters — the ban hides it, and the host's permanent removal survives an unban — and the UI leg it used to own is restored as a separate test on a reachable comment. The export specs mint with `?kind=` now that a download ticket is bound to one archive, and four of them assert the mint's 404 rather than the download's: with the kind always known, the pre-check refuses up front instead of after charging a daily download for an archive that cannot be served. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
63 lines
2.5 KiB
JavaScript
63 lines
2.5 KiB
JavaScript
import js from '@eslint/js';
|
|
import ts from 'typescript-eslint';
|
|
import prettier from 'eslint-config-prettier';
|
|
import globals from 'globals';
|
|
|
|
/**
|
|
* Flat-config ESLint for the Playwright TypeScript suite. Prettier owns formatting (its config is
|
|
* last so it disables every stylistic rule). The rules kept here catch real test bugs — unused
|
|
* setup, floating promises that make a test race, `any` that hides a wrong assertion shape.
|
|
*/
|
|
export default ts.config(
|
|
js.configs.recommended,
|
|
...ts.configs.recommended,
|
|
prettier,
|
|
{
|
|
languageOptions: {
|
|
globals: { ...globals.node },
|
|
},
|
|
},
|
|
{
|
|
rules: {
|
|
'@typescript-eslint/no-unused-vars': [
|
|
'error',
|
|
{ argsIgnorePattern: '^_', varsIgnorePattern: '^_', caughtErrorsIgnorePattern: '^_' },
|
|
],
|
|
// A floating promise in a test is a real hazard: an un-awaited request or assertion can let
|
|
// the test end before it runs, passing vacuously. Keep it on.
|
|
'@typescript-eslint/no-floating-promises': 'error',
|
|
// Off for the suite: this is all test code, where `any` is the honest type for an untyped
|
|
// `res.json()` body or a `page.evaluate()` return. Threading DTO types through every
|
|
// assertion is churn that buys nothing — the assertion values are what's checked, not the
|
|
// static shape. (no-floating-promises and no-unused-vars, which catch real test bugs, stay on.)
|
|
'@typescript-eslint/no-explicit-any': 'off',
|
|
// Off: Playwright fixtures with no dependencies are declared `async ({}, use) => {}` — the
|
|
// empty destructure is required by the fixtures API, not an accident.
|
|
'no-empty-pattern': 'off',
|
|
},
|
|
},
|
|
{
|
|
languageOptions: {
|
|
parserOptions: { projectService: true },
|
|
},
|
|
},
|
|
{
|
|
ignores: [
|
|
'node_modules/',
|
|
'playwright-report/',
|
|
'test-results/',
|
|
'*.config.js',
|
|
// Standalone dev/load-test scripts, run directly with `node`. They are not part of the
|
|
// Playwright tsconfig project, so `projectService: true` cannot type them and every one of
|
|
// them failed with "was not found by the project service" — which meant `npm run lint` had
|
|
// been exiting non-zero on main, i.e. the e2e lint gate was not gating at all.
|
|
//
|
|
// Ignoring is the honest fix rather than widening the tsconfig: these are throwaway harness
|
|
// scripts, and the type-aware rules that justify the project service (no-floating-promises)
|
|
// exist to protect TEST code.
|
|
'*.mjs',
|
|
'loadtest/',
|
|
],
|
|
}
|
|
);
|