fix: prettier formatting on 7 test files + fix codecov SHA

Prettier fixes for security/property/plugin tests. codecov/codecov-action SHA was invalid (e28ff1...), replaced with ci.yml's working SHA 04b047e.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.github/workflows/cli-ci.yml

@@ -66,7 +66,7 @@ jobs:
           cargo llvm-cov --all-features --workspace --codecov --output-path coverage.lcov
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc60cb71e0fce7b # v5
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
         with:
           files: cli/coverage.lcov
           fail_ci_if_error: false

.github/workflows/desktop-ci.yml

@@ -71,7 +71,7 @@ jobs:
           cargo llvm-cov --all-features --workspace --codecov --output-path coverage.lcov
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc60cb71e0fce7b # v5
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
         with:
           files: desktop/src-tauri/coverage.lcov
           fail_ci_if_error: false

.github/workflows/droplet-ci.yml

@@ -67,7 +67,7 @@ jobs:
           cargo llvm-cov --all-features --workspace --codecov --output-path coverage.lcov
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc60cb71e0fce7b # v5
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
         with:
           files: libraries/droplet/coverage.lcov
           fail_ci_if_error: false

server/test/gaps/webauthn-attestation.md

@@ -10,24 +10,24 @@ An attacker who can submit a crafted passkey registration request can inject an
 
 ## What is validated
 
-| Check                | Status |
-|----------------------|--------|
-| Client data JSON     | parsed & typed (arktype) |
-| Challenge match      | checked against provided value |
+| Check                | Status                                        |
+| -------------------- | --------------------------------------------- |
+| Client data JSON     | parsed & typed (arktype)                      |
+| Challenge match      | checked against provided value                |
 | RPID hash            | SHA-256 of domain compared to authData[0..31] |
-| AAGUID presence      | length check only |
-| Credential ID length | bounds check |
-| COSE key decode      | parsed as CBOR Map |
+| AAGUID presence      | length check only                             |
+| Credential ID length | bounds check                                  |
+| COSE key decode      | parsed as CBOR Map                            |
 
 ## What is NOT validated
 
-| Check                | Status |
-|----------------------|--------|
-| Attestation `fmt`    | read but never enforced |
-| Attestation signature | never parsed or verified |
-| `verificationData`   | never constructed |
-| Authenticator data integrity | not cryptographically verified |
-| `aaguid`             | not checked against any allow/block list |
+| Check                        | Status                                   |
+| ---------------------------- | ---------------------------------------- |
+| Attestation `fmt`            | read but never enforced                  |
+| Attestation signature        | never parsed or verified                 |
+| `verificationData`           | never constructed                        |
+| Authenticator data integrity | not cryptographically verified           |
+| `aaguid`                     | not checked against any allow/block list |
 
 ## Test evidence
 

server/test/unit/acls/confused-deputy.test.ts

@@ -86,10 +86,7 @@ describe("allowSystemACL — confused deputy prevention (T4)", () => {
     mockGetSession.mockResolvedValue(authenticatedSession(adminUser.id));
     prismaUserFindUnique.mockResolvedValue(adminUser);
 
-    const result = await aclManager.allowSystemACL(
-      makeRequest(),
-      systemACLs,
-    );
+    const result = await aclManager.allowSystemACL(makeRequest(), systemACLs);
 
     expect(result).toBe(true);
   });
@@ -115,10 +112,7 @@ describe("allowSystemACL — confused deputy prevention (T4)", () => {
     mockGetSession.mockResolvedValue(undefined);
     prismaTokenFindUnique.mockResolvedValue(null);
 
-    const result = await aclManager.allowSystemACL(
-      makeRequest(),
-      systemACLs,
-    );
+    const result = await aclManager.allowSystemACL(makeRequest(), systemACLs);
 
     expect(result).toBe(false);
   });

server/test/unit/auth/oidc-escalation.test.ts

@@ -117,19 +117,21 @@ function createManager(adminGroup?: string, userGroup?: string): OIDCManager {
     delete process.env.OIDC_USER_GROUP;
   }
 
-  const manager = new (OIDCManager as unknown as new (
-    oidcConfiguration: {
-      issuer: string;
-      authorization_endpoint: string;
-      token_endpoint: string;
-      userinfo_endpoint: string;
-      jwks_uri: string;
-      scopes_supported: string[];
-    },
-    clientId: string,
-    clientSecret: string,
-    externalUrl: URL,
-  ) => OIDCManager)(
+  const manager = new (
+    OIDCManager as unknown as new (
+      oidcConfiguration: {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        userinfo_endpoint: string;
+        jwks_uri: string;
+        scopes_supported: string[];
+      },
+      clientId: string,
+      clientSecret: string,
+      externalUrl: URL,
+    ) => OIDCManager
+  )(
     {
       issuer: "https://mock-oidc.test",
       authorization_endpoint: "https://mock-oidc.test/auth",
@@ -211,7 +213,11 @@ describe("fetchOrCreateUser – OIDC group-to-admin escalation (T2)", () => {
       }),
     );
 
-    const result = await (manager as unknown as { fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }> }).fetchOrCreateUser(userinfo);
+    const result = await (
+      manager as unknown as {
+        fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }>;
+      }
+    ).fetchOrCreateUser(userinfo);
 
     expect(result.admin).toBe(true);
     // Verify prisma.create was called with admin:true in connectOrCreate.create
@@ -251,7 +257,11 @@ describe("fetchOrCreateUser – OIDC group-to-admin escalation (T2)", () => {
       }),
     );
 
-    const result = await (manager as unknown as { fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }> }).fetchOrCreateUser(userinfo);
+    const result = await (
+      manager as unknown as {
+        fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }>;
+      }
+    ).fetchOrCreateUser(userinfo);
 
     expect(result.admin).toBe(false);
     expect(mockLinkedAuthMecCreate).toHaveBeenCalledWith(
@@ -290,7 +300,11 @@ describe("fetchOrCreateUser – OIDC group-to-admin escalation (T2)", () => {
       }),
     );
 
-    const result = await (manager as unknown as { fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }> }).fetchOrCreateUser(userinfo);
+    const result = await (
+      manager as unknown as {
+        fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }>;
+      }
+    ).fetchOrCreateUser(userinfo);
 
     expect(result.admin).toBe(false);
     expect(mockLinkedAuthMecCreate).toHaveBeenCalledWith(

server/test/unit/auth/session-fixation.test.ts

@@ -96,7 +96,15 @@ describe("Session Fixation (T3)", () => {
     mockLinkedMFACount.mockResolvedValue(0);
     mockSessionFindUnique.mockResolvedValue(null);
     mockSessionUpsert.mockImplementation(
-      ({ where, create, update }: { where: { token: string }; create?: { data: object }; update?: { data: object } }) => ({
+      ({
+        where,
+        create,
+        update,
+      }: {
+        where: { token: string };
+        create?: { data: object };
+        update?: { data: object };
+      }) => ({
         data: { token: where.token, data: create?.data || update?.data },
       }),
     );

server/test/unit/metadata/provider-chain.test.ts

@@ -186,14 +186,32 @@ describe("MetadataHandler provider chain (search)", () => {
     handler.addProvider(new FailingProvider(), 10);
     handler.addProvider(
       new MockSuccessProvider("ProvB", MetadataSource.Steam, [
-        { id: "b1", name: "Close Match", icon: "", description: "", year: 2024 },
-        { id: "b2", name: "Exact Match", icon: "", description: "", year: 2023 },
+        {
+          id: "b1",
+          name: "Close Match",
+          icon: "",
+          description: "",
+          year: 2024,
+        },
+        {
+          id: "b2",
+          name: "Exact Match",
+          icon: "",
+          description: "",
+          year: 2023,
+        },
       ]),
       5,
     );
     handler.addProvider(
       new MockSuccessProvider("ProvC", MetadataSource.GiantBomb, [
-        { id: "c1", name: "Mediocre Match", icon: "", description: "", year: 2022 },
+        {
+          id: "c1",
+          name: "Mediocre Match",
+          icon: "",
+          description: "",
+          year: 2022,
+        },
       ]),
       0,
     );

server/test/unit/plugins/init-order.test.ts

@@ -168,9 +168,7 @@ describe("Nitro Plugin Init Order", () => {
 
       const prefixes = files.map((f) => f.slice(0, 2));
       for (let i = 0; i < prefixes.length; i++) {
-        expect(prefixes[i]).toBe(
-          String(i + 1).padStart(2, "0"),
-        );
+        expect(prefixes[i]).toBe(String(i + 1).padStart(2, "0"));
       }
     });
 
@@ -201,10 +199,7 @@ describe("Nitro Plugin Init Order", () => {
 
       for (const [prefix, deps] of Object.entries(depGraph)) {
         const currentFile = files.find((f) => f.startsWith(prefix));
-        expect(
-          currentFile,
-          `Plugin ${prefix} file not found`,
-        ).toBeDefined();
+        expect(currentFile, `Plugin ${prefix} file not found`).toBeDefined();
         const currentIdx = files.indexOf(currentFile!);
 
         for (const dep of deps) {
@@ -234,10 +229,7 @@ describe("Nitro Plugin Init Order", () => {
     it("fetchProviderIdsInOrder() returns non-empty after adding providers", () => {
       const handler = new MetadataHandler();
 
-      handler.addProvider(
-        { source: () => "Steam", name: () => "Steam" },
-        100,
-      );
+      handler.addProvider({ source: () => "Steam", name: () => "Steam" }, 100);
 
       const ids = handler.fetchProviderIdsInOrder();
       expect(ids.length).toBeGreaterThan(0);
@@ -247,14 +239,8 @@ describe("Nitro Plugin Init Order", () => {
     it("returns providers sorted by priority (highest first)", () => {
       const handler = new MetadataHandler();
 
-      handler.addProvider(
-        { source: () => "LowPri", name: () => "Low" },
-        0,
-      );
-      handler.addProvider(
-        { source: () => "HighPri", name: () => "High" },
-        100,
-      );
+      handler.addProvider({ source: () => "LowPri", name: () => "Low" }, 0);
+      handler.addProvider({ source: () => "HighPri", name: () => "High" }, 100);
 
       const ids = handler.fetchProviderIdsInOrder();
       expect(ids).toEqual(["HighPri", "LowPri"]);
@@ -267,10 +253,7 @@ describe("Nitro Plugin Init Order", () => {
         { source: () => "Manual", name: () => "Manual" },
         -1000,
       );
-      handler.addProvider(
-        { source: () => "IGDB", name: () => "IGDB" },
-        50,
-      );
+      handler.addProvider({ source: () => "IGDB", name: () => "IGDB" }, 50);
 
       const ids = handler.fetchProviderIdsInOrder();
       expect(ids).not.toContain("Manual");

server/test/unit/prioritylist.test.ts

@@ -166,7 +166,11 @@ describe("PriorityListIndexed (property-based)", () => {
   it("get() returns the same item at the same key as long as it hasn't been popped", () => {
     fc.assert(
       fc.property(
-        fc.uniqueArray(itemArb, { selector: (item) => item.id, minLength: 1, maxLength: 30 }),
+        fc.uniqueArray(itemArb, {
+          selector: (item) => item.id,
+          minLength: 1,
+          maxLength: 30,
+        }),
         (items: Array<{ id: string; priority: number }>) => {
           const list = new PriorityListIndexed<TaggedWithPriority>("id");
           for (const item of items) {