498b4e256b
C1: reset_user_pin wrote to a non-existent column (pin_failed_attempts);
the real column is failed_pin_attempts, so every PIN reset 500'd. Fixed
the column name; new e2e (pin-reset.spec.ts) proves a reset returns a
usable PIN and the target can recover with it.
C2: config.rs::validate_secrets now rejects placeholder-ish secrets
(change_me/dev_secret/placeholder), enforces len>=32 in prod, and
requires a real ADMIN_PASSWORD_HASH. docker-compose.yml sets
APP_ENV=production so the guard actually runs. Corrected the false
"fixed" claim in SECURITY-BACKLOG.md. .env.example documents the rule.
Riders in these files (documented here since git can't split hunks):
- host.rs also carries the event-scoped ban_user fix and the
close_event/open_event no-op broadcast guard (medium).
- docker-compose.yml also adds ORIGIN (H6), app/frontend healthchecks with
Caddy waiting on health, and per-service memory limits (medium).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
44 lines
1.5 KiB
TypeScript
44 lines
1.5 KiB
TypeScript
/**
|
|
* Regression for the review's C1: `reset_user_pin` wrote to a non-existent
|
|
* column (`pin_failed_attempts` vs the real `failed_pin_attempts`), so the
|
|
* endpoint 500'd every time and never returned a PIN — the feature had never
|
|
* worked against a real DB and no test caught it. These specs pin the contract:
|
|
* a successful reset returns a fresh 4-digit PIN, and the target can recover
|
|
* with it.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
|
|
test.describe('Host — reset guest PIN (C1)', () => {
|
|
test('resetting a guest PIN returns a fresh 4-digit PIN', async ({ api, host, guest }) => {
|
|
const target = await guest('ResetMe');
|
|
|
|
const { status, body } = await api.resetUserPin(host.jwt, target.userId);
|
|
|
|
expect(status).toBe(200);
|
|
expect(body.pin).toMatch(/^\d{4}$/);
|
|
});
|
|
|
|
test('the target can recover with the newly reset PIN (and not the old one)', async ({
|
|
api,
|
|
host,
|
|
guest,
|
|
}) => {
|
|
const target = await guest('RecoverWithNewPin');
|
|
|
|
const { body } = await api.resetUserPin(host.jwt, target.userId);
|
|
const newPin = body.pin!;
|
|
|
|
// New PIN works.
|
|
await api.recover(target.displayName, newPin, { expectedStatus: [200] });
|
|
|
|
// Old PIN no longer works (overwritten). 401 = wrong PIN.
|
|
if (target.pin !== newPin) {
|
|
await api.recover(target.displayName, target.pin, { expectedStatus: [401] });
|
|
}
|
|
});
|
|
|
|
test('a host cannot reset their own PIN via this endpoint', async ({ api, host }) => {
|
|
await api.resetUserPin(host.jwt, host.userId, { expectedStatus: [400] });
|
|
});
|
|
});
|