Skip to content

test(quality): expand feature validation coverage #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DavidBabinec merged 10 commits into from
Jun 26, 2026
Merged

test(quality): expand feature validation coverage #84

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c7281e9
test(quality): expand feature validation coverage
DavidBabinec Jun 23, 2026
ef7155b
fix(settings): contain preferences modal on mobile
DavidBabinec Jun 23, 2026
10eb2e8
test(users): cover non-owner lifecycle validation
DavidBabinec Jun 23, 2026
af6d516
test(admin): cover global toolbar live targets
DavidBabinec Jun 23, 2026
4dd3abc
fix(admin): harden workspace shell recovery
DavidBabinec Jun 23, 2026
896bf79
fix(admin): contain right sidebar on mobile
DavidBabinec Jun 23, 2026
7fd476f
test(server): clarify audit SQL null bindings
DavidBabinec Jun 24, 2026
e2fd7b6
test(quality): clear code quality blockers
DavidBabinec Jun 24, 2026
ecc347d
test(quality): avoid CodeQL step-up false positive
DavidBabinec Jun 24, 2026
26da03a
test(quality): resolve feature validation rebase drift
DavidBabinec Jun 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix(settings): contain preferences modal on mobile
  • Loading branch information
@DavidBabinec
DavidBabinec committed Jun 26, 2026
commit ef7155b79961456479a4a74b4eda09716127c6ef
11 changes: 8 additions & 3 deletions docs/e2e/feature-matrix.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,20 +44,25 @@ PUBLISH-002 note: `page-management.e2e.ts` schedules a newly-created active page
|---|---:|:---:|---|---|---|---|---|---|
| ADMIN-001 | P1 | ✅ | Navigation | Move between Site, Content, Plugins, Users, Account | Logged in | Admin navigation | Active page and breadcrumbs are clear | dead links, unclear active state |
| ADMIN-002 | P2 | partial | Account | Change account profile basics | Logged in | Account page | Step-up prompt appears; changes save and persist | missing feedback, validation copy |
| ADMIN-003 | P2 | ✅ | Security | Start and cancel MFA setup | Logged in | Account security | Flow is understandable and cancelable | scary copy, stuck modal |
| ADMIN-003 | P2 | partial | Admin shell | Use global toolbar actions and account menu | Logged in | Top toolbar from each workspace | Workspace links, Settings, account menu, and publish/open-live actions appear when allowed | stale active route, clipped toolbar, unavailable settings/account actions |
| ADMIN-004 | P2 | ✅ | Settings | Manage global settings and local editor preferences | Logged in | Toolbar Settings from Dashboard and narrow viewport | General, Shortcuts, Publishing, and Preferences render; preference changes persist locally; corrupt storage falls back; mobile layout stays contained | site-settings load errors, corrupt localStorage, clipped controls |
| ACCOUNT-003 | P2 | partial | Security | Change account password and verify old credentials stop working | Logged in | Account security plus login | Form validation is specific; password change requires step-up; old password is rejected and new password works | shared credential restoration, other-session revocation, autocomplete |
| AUTH-002 | P1 | partial | Auth | Complete MFA challenge after password login | MFA enabled owner | Login, enter authenticator or recovery code | Session reaches admin; recovery-code login consumes one code | pending-session escalation |
| AUTH-004 | P2 | partial | Auth | Review active devices and sign out other sessions | Two owner browser sessions | Account Active devices | Current session remains active; other sessions are revoked and redirected to login on next request | stale devices, step-up copy, individual revoke errors |
| ACCOUNT-004 | P2 | partial | Security | Enable MFA, sign in with TOTP, regenerate recovery codes, and disable MFA | Logged in | Account security plus login | MFA gates login and recovery-code controls work without leaving account locked down | clock skew, invalid-code copy, recovery-code burn/reuse |
| ACCOUNT-005 | P2 | partial | Security | Configure step-up prompt window | Logged in | Account security | Step-up window change requires confirmation, persists after reload, and can be restored | disabled-mode side effects, stale window status, mobile controls |
| AUTH-006 | P2 | partial | Auth | Review recent failed, locked, rate-limited, and successful sign-in activity | Failed, locked, rate-limited, and successful account attempts | Account sign-in history | Activity table shows the attempts, a recent failed-count badge, and suspicious activity banner | stale audit rows, proxy/IP variance, table overflow |
| ADMIN-004 | P2 | ✅ | Users | Create a non-owner user | Owner logged in | Users page | New user appears with intended role | role confusion, unsafe defaults |
| USERS-001 | P2 | ✅ | Users | Create a non-owner user | Owner logged in | Users page | New user appears with intended role | role confusion, unsafe defaults |
| USERS-002 | P2 | partial | Users | Create, edit, and delete a custom role | Owner logged in | Users Roles tab | Custom role appears with selected capabilities, updates after edit, and is removed after delete | built-in role protection, duplicate/zero-cap roles, role-in-use semantics |
| USERS-003 | P2 | partial | Users | Review the admin audit log | User-management event exists | Users Audit tab | Audit feed renders readable event titles, actor attribution, details, and timestamps | stale labels, hidden audit data, table overflow |

ADMIN-002 note: display-name editing and mobile step-up cancel/no-op are automated with the step-up prompt (canonical spreadsheet row ACCOUNT-001), and `/me` profile API edges cover step-up denial, trimmed email save, the 160-character display-name boundary, invalid payloads, and duplicate normalized email rejection in `src/__tests__/server/accountSecurity.test.ts`. Avatar upload/removal plus unsupported, oversized, and mobile layout avatar feedback are automated (canonical spreadsheet row ACCOUNT-002) in `account.e2e.ts`; empty multipart upload, idempotent missing-avatar removal, and elected storage-adapter failure are covered in `src/__tests__/server/accountSecurity.test.ts`. Browser email editing uses the same step-up-gated Profile form but stays lower-level/API-covered so the shared owner login email remains stable during the E2E suite.

ADMIN-003 note: MFA setup start/cancel is automated in `account.e2e.ts`.
ADMIN-003 note: workspace navigation and account-menu logout/login are covered by the core owner lifecycle and `auth.e2e.ts`; toolbar Settings coverage is promoted under ADMIN-004.

ADMIN-004 note: `admin-navigation.e2e.ts` opens Settings from the Dashboard non-editor route, verifies General, Shortcuts, Publishing, and Preferences sections, writes Auto-save, Auto-save delay, and UI density through real controls, verifies reload persistence, verifies corrupt localStorage fallback, and checks 390px containment. DEF-20260623-ADMIN004-01 fixed a phone-width overflow where Preferences controls extended beyond the viewport; `SettingsModal.module.css` now switches to a single-column mobile shell with stacked preference rows.

USERS-001 note: non-owner user creation and step-up protection are automated in `users.e2e.ts`; broader user edit, suspend, and delete coverage is tracked in the canonical spreadsheet.

AUTH-003 note: account-menu logout/login is covered in the core owner lifecycle, and `auth.e2e.ts` automates stale-tab session invalidation by cloning a live session into a second browser context, signing out in the first, then verifying the stale context is forced back to Admin Login on the next authenticated admin route without the stale Site route logging the module-inserter Unauthorized preference-load error. The same spec covers 390px mobile account-menu containment and sign-out reachability. `authSessionEdgeCases.test.ts` covers a repeated stale `POST /logout` returning `{ ok: true }`, clearing the cookie again, and leaving `/me` unauthorized.

Expand Down
Loading