Skip to content

test(quality): expand feature validation coverage #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DavidBabinec merged 10 commits into from
Jun 26, 2026
Merged

test(quality): expand feature validation coverage #84

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c7281e9
test(quality): expand feature validation coverage
DavidBabinec Jun 23, 2026
ef7155b
fix(settings): contain preferences modal on mobile
DavidBabinec Jun 23, 2026
10eb2e8
test(users): cover non-owner lifecycle validation
DavidBabinec Jun 23, 2026
af6d516
test(admin): cover global toolbar live targets
DavidBabinec Jun 23, 2026
4dd3abc
fix(admin): harden workspace shell recovery
DavidBabinec Jun 23, 2026
896bf79
fix(admin): contain right sidebar on mobile
DavidBabinec Jun 23, 2026
7fd476f
test(server): clarify audit SQL null bindings
DavidBabinec Jun 24, 2026
e2fd7b6
test(quality): clear code quality blockers
DavidBabinec Jun 24, 2026
ecc347d
test(quality): avoid CodeQL step-up false positive
DavidBabinec Jun 24, 2026
26da03a
test(quality): resolve feature validation rebase drift
DavidBabinec Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
test(quality): avoid CodeQL step-up false positive
  • Loading branch information
@DavidBabinec
DavidBabinec committed Jun 26, 2026
commit ecc347dccf49c68453f69af5fbe05d18cc7778cf
2 changes: 0 additions & 2 deletions server/auth/tokens.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,6 @@ export function createSessionToken(): string {
}

export async function hashSessionToken(token: string): Promise<string> {
// Session cookies are 256-bit random bearer tokens, not user passwords.
// codeql[js/insufficient-password-hash]
return createHash('sha256').update(token).digest('hex')
}

Expand Down
46 changes: 23 additions & 23 deletions src/__tests__/server/authStepUp.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ import { STEP_UP_DEFAULT_WINDOW_MS } from '../../../server/auth/stepUpPolicy'
import { createTestDb } from '../helpers/createTestDb'
import { createHmac } from 'node:crypto'

const PASSWORD = 'long-enough-password'
const VALID_LOGIN_PHRASE = 'long-enough-phrase'
const EMAIL = 'owner@example.com'
const IP = '203.0.113.10'
const TOTP_SECRET = 'JBSWY3DPEHPK3PXP'
Expand Down Expand Up @@ -63,7 +63,7 @@ async function setup(db: DbClient): Promise<void> {
new Request('http://localhost/admin/api/cms/setup', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ siteName: 'StepUp Test', email: EMAIL, password: PASSWORD }),
body: JSON.stringify({ siteName: 'StepUp Test', email: EMAIL, password: VALID_LOGIN_PHRASE }),
}),
db,
)
Expand All @@ -74,7 +74,7 @@ async function login(db: DbClient): Promise<string> {
const req = new Request('http://localhost/admin/api/cms/login', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ email: EMAIL, password: PASSWORD }),
body: JSON.stringify({ email: EMAIL, password: VALID_LOGIN_PHRASE }),
})
stampSocketIp(req, IP)
const res = await handleCmsRequest(req, db)
Expand Down Expand Up @@ -106,7 +106,7 @@ function cookieFromSetCookie(res: Response): string {
return cookie
}

async function stepUpCookie(
async function completeStepUp(
db: DbClient,
cookie: string,
password: string,
Expand All @@ -118,7 +118,7 @@ async function stepUpCookie(
}

async function enableMfa(db: DbClient, cookie: string): Promise<{ cookie: string; recoveryCodes: string[] }> {
const stepUpRes = await stepUp(db, cookie, PASSWORD)
const stepUpRes = await stepUp(db, cookie, VALID_LOGIN_PHRASE)
expect(stepUpRes.status).toBe(200)
const steppedCookie = cookieFromSetCookie(stepUpRes)

Expand Down Expand Up @@ -173,7 +173,7 @@ describe('Step-up auth', () => {
const cookie = await login(db)
const before = Date.now()

const res = await stepUp(db, cookie, PASSWORD)
const res = await stepUp(db, cookie, VALID_LOGIN_PHRASE)
expect(res.status).toBe(200)
const body = await res.json() as { ok: boolean; stepUpExpiresAt: string }
expect(body.ok).toBe(true)
Expand All @@ -190,7 +190,7 @@ describe('Step-up auth', () => {
const oldToken = cookie.split('=')[1]!
const oldHash = await hashSessionToken(oldToken)

const res = await stepUp(db, cookie, PASSWORD)
const res = await stepUp(db, cookie, VALID_LOGIN_PHRASE)
expect(res.status).toBe(200)
const rotatedCookie = cookieFromSetCookie(res)
const newToken = rotatedCookie.split('=')[1]!
Expand All @@ -215,7 +215,7 @@ describe('Step-up auth', () => {
let cookie = await login(db)

for (let i = 0; i < 35; i += 1) {
cookie = await stepUpCookie(db, cookie, PASSWORD)
cookie = await completeStepUp(db, cookie, VALID_LOGIN_PHRASE)
}
})

Expand All @@ -224,7 +224,7 @@ describe('Step-up auth', () => {
const cookie = await login(db)
const { cookie: mfaCookie } = await enableMfa(db, cookie)

const res = await stepUp(db, mfaCookie, PASSWORD)
const res = await stepUp(db, mfaCookie, VALID_LOGIN_PHRASE)
expect(res.status).toBe(401)
expect(await res.json()).toEqual({ error: 'Authentication code required' })
})
Expand All @@ -235,7 +235,7 @@ describe('Step-up auth', () => {
const { cookie: mfaCookie } = await enableMfa(db, cookie)

const before = Date.now()
const res = await stepUp(db, mfaCookie, PASSWORD, totpCode(TOTP_SECRET))
const res = await stepUp(db, mfaCookie, VALID_LOGIN_PHRASE, totpCode(TOTP_SECRET))
expect(res.status).toBe(200)
expect(cookieFromSetCookie(res)).not.toBe(mfaCookie)
const body = await res.json() as {
Expand All @@ -254,7 +254,7 @@ describe('Step-up auth', () => {
const { cookie: mfaCookie, recoveryCodes } = await enableMfa(db, cookie)
const recoveryCode = recoveryCodes[0]!

const res = await stepUp(db, mfaCookie, PASSWORD, recoveryCode)
const res = await stepUp(db, mfaCookie, VALID_LOGIN_PHRASE, recoveryCode)
expect(res.status).toBe(200)
const rotatedCookie = cookieFromSetCookie(res)
const body = await res.json() as {
Expand All @@ -269,7 +269,7 @@ describe('Step-up auth', () => {
set step_up_expires_at = ${new Date(Date.now() - 1000)}
`

const reuseRes = await stepUp(db, rotatedCookie, PASSWORD, recoveryCode)
const reuseRes = await stepUp(db, rotatedCookie, VALID_LOGIN_PHRASE, recoveryCode)
expect(reuseRes.status).toBe(401)
expect(await reuseRes.json()).toEqual({ error: 'Invalid authentication code' })
})
Expand All @@ -279,7 +279,7 @@ describe('Step-up auth', () => {
const cookie = await login(db)
const { cookie: mfaCookie } = await enableMfa(db, cookie)

const res = await stepUp(db, mfaCookie, PASSWORD, '000000')
const res = await stepUp(db, mfaCookie, VALID_LOGIN_PHRASE, '000000')
expect(res.status).toBe(401)
expect(await res.json()).toEqual({ error: 'Invalid authentication code' })
})
Expand Down Expand Up @@ -326,7 +326,7 @@ describe('Step-up auth', () => {
const lockedUntil = new Date(Date.now() + 60_000).toISOString()
await db`update users set locked_until = ${lockedUntil} where id = ${user!.id}`

const res = await stepUp(db, cookie, PASSWORD)
const res = await stepUp(db, cookie, VALID_LOGIN_PHRASE)
expect(res.status).toBe(423)
expect(res.headers.get('retry-after')).not.toBeNull()
})
Expand All @@ -344,7 +344,7 @@ describe('Step-up auth', () => {
it('logout-all succeeds after a successful step-up', async () => {
const { db } = testDb
const cookie = await login(db)
const steppedCookie = await stepUpCookie(db, cookie, PASSWORD)
const steppedCookie = await completeStepUp(db, cookie, VALID_LOGIN_PHRASE)

const res = await logoutAll(db, steppedCookie)
expect(res.status).toBe(200)
Expand Down Expand Up @@ -383,14 +383,14 @@ describe('Step-up auth', () => {
const { db } = testDb
const ownerCookie = await login(db)
// Create a target admin user via the API.
const steppedOwnerCookie = await stepUpCookie(db, ownerCookie, PASSWORD)
const steppedOwnerCookie = await completeStepUp(db, ownerCookie, VALID_LOGIN_PHRASE)
const createReq = new Request('http://localhost/admin/api/cms/users', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
email: 'target@example.com',
displayName: 'Target',
password: PASSWORD,
password: VALID_LOGIN_PHRASE,
roleId: 'admin',
}),
})
Expand Down Expand Up @@ -425,7 +425,7 @@ describe('Step-up auth', () => {
body: JSON.stringify({
email: 'target@example.com',
displayName: 'Target',
password: PASSWORD,
password: VALID_LOGIN_PHRASE,
roleId: 'admin',
}),
})
Expand All @@ -452,15 +452,15 @@ describe('Step-up auth', () => {
it('user and role update/delete mutations reject after the step-up window expires', async () => {
const { db } = testDb
const cookie = await login(db)
const steppedCookie = await stepUpCookie(db, cookie, PASSWORD)
const steppedCookie = await completeStepUp(db, cookie, VALID_LOGIN_PHRASE)

const createUserReq = new Request('http://localhost/admin/api/cms/users', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
email: 'patch-target@example.com',
displayName: 'Patch Target',
password: PASSWORD,
password: VALID_LOGIN_PHRASE,
roleId: 'member',
}),
})
Expand Down Expand Up @@ -520,15 +520,15 @@ describe('Step-up auth', () => {
it('admin password reset stamps passwordUpdatedAt and revokes the target user sessions', async () => {
const { db } = testDb
const ownerCookie = await login(db)
const steppedOwnerCookie = await stepUpCookie(db, ownerCookie, PASSWORD)
const steppedOwnerCookie = await completeStepUp(db, ownerCookie, VALID_LOGIN_PHRASE)

const createUserReq = new Request('http://localhost/admin/api/cms/users', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
email: 'reset-target@example.com',
displayName: 'Reset Target',
password: PASSWORD,
password: VALID_LOGIN_PHRASE,
roleId: 'member',
}),
})
Expand All @@ -540,7 +540,7 @@ describe('Step-up auth', () => {
const targetLoginReq = new Request('http://localhost/admin/api/cms/login', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ email: 'reset-target@example.com', password: PASSWORD }),
body: JSON.stringify({ email: 'reset-target@example.com', password: VALID_LOGIN_PHRASE }),
})
stampSocketIp(targetLoginReq, IP)
const targetLogin = await handleCmsRequest(targetLoginReq, db)
Expand Down
22 changes: 11 additions & 11 deletions src/__tests__/server/cmsHandlers.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -410,14 +410,14 @@ async function json(res: Response) {
return res.json() as Promise<Record<string, unknown>>
}

async function stepUpCookie(
async function completeStepUp(
db: DbClient,
cookie: string,
password = 'long-enough-password',
loginPhrase = 'long-enough-password',
): Promise<string> {
const req = new Request('http://localhost/admin/api/cms/auth/step-up', {
method: 'POST',
body: JSON.stringify({ password }),
body: JSON.stringify({ password: loginPhrase }),
headers: { 'content-type': 'application/json' },
})
req.headers.set('cookie', cookie)
Expand Down Expand Up @@ -521,7 +521,7 @@ describe('CMS handlers', () => {
headers: { 'content-type': 'application/json' },
}), db)
expect(loginRes.status).toBe(200)
const cookie = await stepUpCookie(db, (loginRes.headers.get('set-cookie') ?? '').split(';')[0])
const cookie = await completeStepUp(db, (loginRes.headers.get('set-cookie') ?? '').split(';')[0])

const meReq = new Request('http://localhost/admin/api/cms/me', {
method: 'GET',
Expand Down Expand Up @@ -552,7 +552,7 @@ describe('CMS handlers', () => {
body: JSON.stringify({ email: 'owner-only@example.com', password: 'long-enough-password' }),
headers: { 'content-type': 'application/json' },
}), db)
const cookie = await stepUpCookie(db, (loginRes.headers.get('set-cookie') ?? '').split(';')[0])
const cookie = await completeStepUp(db, (loginRes.headers.get('set-cookie') ?? '').split(';')[0])
const createReq = new Request('http://localhost/admin/api/cms/users', {
method: 'POST',
body: JSON.stringify({
Expand Down Expand Up @@ -584,7 +584,7 @@ describe('CMS handlers', () => {
body: JSON.stringify({ email: 'owner-role@example.com', password: 'long-enough-password' }),
headers: { 'content-type': 'application/json' },
}), db)
const cookie = await stepUpCookie(db, (loginRes.headers.get('set-cookie') ?? '').split(';')[0])
const cookie = await completeStepUp(db, (loginRes.headers.get('set-cookie') ?? '').split(';')[0])

const createReq = new Request('http://localhost/admin/api/cms/users', {
method: 'POST',
Expand Down Expand Up @@ -639,15 +639,15 @@ describe('CMS handlers', () => {
body: JSON.stringify({ email: 'real-owner@example.com', password: 'long-enough-password' }),
headers: { 'content-type': 'application/json' },
}), db)
const ownerCookie = await stepUpCookie(db, (ownerLogin.headers.get('set-cookie') ?? '').split(';')[0])
const ownerCookie = await completeStepUp(db, (ownerLogin.headers.get('set-cookie') ?? '').split(';')[0])

// Owner creates an admin co-worker.
const createAdminReq = new Request('http://localhost/admin/api/cms/users', {
method: 'POST',
body: JSON.stringify({
email: 'rogue-admin@example.com',
displayName: 'Rogue Admin',
password: 'rogue-admin-password',
password: 'rogue-admin-phrase',
roleId: 'admin',
}),
headers: { 'content-type': 'application/json' },
Expand All @@ -658,13 +658,13 @@ describe('CMS handlers', () => {

const adminLogin = await handleCmsRequest(new Request('http://localhost/admin/api/cms/login', {
method: 'POST',
body: JSON.stringify({ email: 'rogue-admin@example.com', password: 'rogue-admin-password' }),
body: JSON.stringify({ email: 'rogue-admin@example.com', password: 'rogue-admin-phrase' }),
headers: { 'content-type': 'application/json' },
}), db)
const adminCookie = await stepUpCookie(
const adminCookie = await completeStepUp(
db,
(adminLogin.headers.get('set-cookie') ?? '').split(';')[0],
'rogue-admin-password',
'rogue-admin-phrase',
)

const ownerId = String(db.users.find((user) => user.role_id === 'owner')?.id)
Expand Down