Hartmut/CapaKraken
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

security: close audit findings #19–#23 and harden Docker setup (#24)

Browse Source 
#19 MFA QR code: render locally via qrcode package, remove external qrserver.com request
#20 Webhook SSRF: add ssrf-guard.ts with DNS-verified IP blocklist; enforce on create/update/test/dispatch
#21 /api/perf: fail-closed when CRON_SECRET missing; remove query-string token auth
#22 CSP: remove unsafe-eval and unsafe-inline from script-src in production builds
#23 Active session registry: forward jti into session object; validate against ActiveSession on every tRPC request

#24 Docker: add missing packages/application to Dockerfile.dev; fix pnpm-lock.yaml glob;
    run db:migrate:deploy on container start so a fresh checkout boots without manual steps

Also: fix pre-existing TS error in e2e/allocations.spec.ts (args.length literal type overlap)

Co-Authored-By: claude-flow <ruv@ruv.net>
This commit is contained in:
Hartmut Nörenberg
2026-04-01 18:19:21 +02:00
parent fd75628e9d
commit 0e119cfe73
17 changed files with 675 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/e2e/allocations.spec.ts
+85 -16
View File
@@ -1,25 +1,80 @@
import { expect, test } from "@playwright/test";
import { expect, test, type Page } from "@playwright/test";
const FIXED_BROWSER_NOW = "2026-04-01T12:00:00.000Z";
async function freezeBrowserTime(page: Page) {
await page.addInitScript((fixedIso) => {
const fixedTime = new Date(fixedIso).valueOf();
const RealDate = Date;
class MockDate extends RealDate {
constructor(...args: ConstructorParameters<DateConstructor>) {
if ((args as unknown[]).length === 0) {
super(fixedTime);
return;
}
super(...args);
}
static now() {
return fixedTime;
}
}
MockDate.UTC = RealDate.UTC;
MockDate.parse = RealDate.parse;
MockDate.prototype = RealDate.prototype;
// @ts-expect-error override Date in the browser for deterministic client-side filtering
window.Date = MockDate;
}, FIXED_BROWSER_NOW);
}
async function signIn(page: Page, email: string, password: string) {
await page.goto("/auth/signin");
await page.fill('input[type="email"]', email);
await page.fill('input[type="password"]', password);
await page.click('button[type="submit"]');
await expect(page).toHaveURL(/\/(dashboard|resources)/);
}
test.describe("Allocations", () => {
test.beforeEach(async ({ page }) => {
await page.goto("/auth/signin");
await page.fill('input[type="email"]', "admin@capakraken.dev");
await page.fill('input[type="password"]', "admin123");
await page.click('button[type="submit"]');
await expect(page).toHaveURL(/\/(dashboard|resources)/);
await freezeBrowserTime(page);
await signIn(page, "admin@capakraken.dev", "admin123");
await page.goto("/allocations");
});
test("allocation list loads with table", async ({ page }) => {
test("seeded assignments stay visibly rendered on first load", async ({ page }) => {
await page.waitForLoadState("networkidle");
// The page title should be visible
await expect(
page.locator("h1").filter({ hasText: /Allocations|Planning/i }),
).toBeVisible({ timeout: 10000 });
// Table or empty state should be present
await expect(
page.locator("table").or(page.locator("text=No allocations")),
).toBeVisible({ timeout: 10000 });
await expect(page.getByTestId("allocations-table")).toBeVisible({ timeout: 10000 });
await expect(page.getByTestId("allocations-empty-state")).toHaveCount(0);
await expect(page.getByTestId("allocation-group-header").first()).toBeVisible({ timeout: 10000 });
await expect(page.getByTestId("allocation-row").first()).toBeVisible({ timeout: 10000 });
expect(await page.getByTestId("allocation-row").count()).toBeGreaterThan(0);
});
test("explicitly restrictive filters show a visible empty state and can be reset", async ({ page }) => {
await page.waitForLoadState("networkidle");
const projectFilter = page.getByPlaceholder("Filter by project…");
await projectFilter.click();
await projectFilter.fill("PAG25G");
await page.getByRole("button", { name: /PAG25G/i }).click();
await expect(page.getByTestId("allocations-empty-state")).toBeVisible({ timeout: 10000 });
await expect(page.getByText(/hidden by the active project filters/i)).toBeVisible();
const resetButton = page.getByRole("button", { name: "Show all assignments" });
await expect(resetButton).toBeVisible();
await resetButton.click();
await expect(projectFilter).toHaveValue("");
await expect(page.getByTestId("allocations-empty-state")).toHaveCount(0);
await expect(page.getByTestId("allocation-row").first()).toBeVisible({ timeout: 10000 });
});
test("new planning entry modal opens", async ({ page }) => {
@@ -27,10 +82,8 @@ test.describe("Allocations", () => {
const newBtn = page.locator("button", { hasText: /New Planning Entry/i });
await expect(newBtn).toBeVisible({ timeout: 10000 });
await newBtn.click();
// Modal should appear with form fields
await expect(
page.locator("[role='dialog']").or(page.locator("text=Create").or(page.locator("text=Project"))),
).toBeVisible({ timeout: 5000 });
await expect(page.getByTestId("allocation-modal")).toBeVisible({ timeout: 5000 });
await expect(page.getByRole("heading", { name: /New (Assignment|Open Demand)/i })).toBeVisible();
await page.keyboard.press("Escape");
});
@@ -61,4 +114,20 @@ test.describe("Allocations", () => {
await page.keyboard.press("Escape");
}
});
test("viewer sees a visible access error instead of an empty allocations page", async ({ browser }) => {
const page = await browser.newPage();
await freezeBrowserTime(page);
await signIn(page, "viewer@capakraken.dev", "viewer123");
await page.goto("/allocations");
await page.waitForLoadState("networkidle");
const accessError = page.getByTestId("allocations-access-error");
await expect(accessError).toBeVisible({ timeout: 10000 });
await expect(accessError).toContainText(/do not have permission to view allocations/i);
await expect(page.getByTestId("allocation-row")).toHaveCount(0);
await expect(page.getByTestId("allocations-empty-state")).toHaveCount(0);
await page.close();
});
});