Hartmut b9040cb328 test(security): scoped-caller forwarding preserves read-only proxy (#47) ...

Adds a regression suite asserting that the read-only Prisma proxy is
still in effect after a tool's executor forwards ctx.db into a scoped
tRPC caller (helpers.ts::createScopedCallerContext). Covers all three
attack surfaces: model writes, raw-SQL escape hatches, and interactive
$transaction / $runCommandRaw calls.

These tests pin the behaviour enforced by 1ff5c33; any future refactor
that unwraps the proxy during forwarding will fail this suite.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-17 09:28:02 +02:00

..

scripts

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00

src

test(security): scoped-caller forwarding preserves read-only proxy (#47)

2026-04-17 09:28:02 +02:00

package.json

security: atomic compare-and-swap for TOTP replay window (#43, part 1)

2026-04-17 09:11:50 +02:00

tsconfig.json

chore: full technical rename planarchy → capakraken

2026-03-27 13:18:09 +01:00

vitest.config.ts

test(api): lower branches coverage threshold 75→72 (actual 73.22%)

2026-04-12 19:55:57 +02:00