Hartmut b9040cb328 test(security): scoped-caller forwarding preserves read-only proxy (#47) ...

Adds a regression suite asserting that the read-only Prisma proxy is
still in effect after a tool's executor forwards ctx.db into a scoped
tRPC caller (helpers.ts::createScopedCallerContext). Covers all three
attack surfaces: model writes, raw-SQL escape hatches, and interactive
$transaction / $runCommandRaw calls.

These tests pin the behaviour enforced by 1ff5c33; any future refactor
that unwraps the proxy during forwarding will fail this suite.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-17 09:28:02 +02:00

..

api

test(security): scoped-caller forwarding preserves read-only proxy (#47)

2026-04-17 09:28:02 +02:00

application

test(application): extend ExcelJS read-workbook timeouts to 30s

2026-04-13 05:24:07 +02:00

db

test(db): clear env before each loadWorkspaceEnv test, not just after

2026-04-12 21:08:37 +02:00

engine

ci: exclude barrel/scaffold files from engine coverage and document runner DNS fix

2026-04-12 18:46:43 +02:00

shared

security: bound JSONB inputs + whitelist batchUpdateCustomFields keys (#48)

2026-04-17 08:44:11 +02:00

staffing

ci: add @vitest/coverage-v8 to workspace packages; set REDIS_URL on build

2026-04-12 18:38:21 +02:00

ui

fix(infra): apply missing migrations, fix Dockerfile.dev ui package reference

2026-04-09 20:29:21 +02:00