From 3ec3a41effa7b805aae62e731ff4706972703508 Mon Sep 17 00:00:00 2001 From: John Smith Date: Sat, 25 Jul 2026 19:52:22 -0400 Subject: [PATCH] fix: prettier formatting on 7 test files + fix codecov SHA Prettier fixes for security/property/plugin tests. codecov/codecov-action SHA was invalid (e28ff1...), replaced with ci.yml's working SHA 04b047e. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus --- .github/workflows/cli-ci.yml | 2 +- .github/workflows/desktop-ci.yml | 2 +- .github/workflows/droplet-ci.yml | 2 +- server/test/gaps/webauthn-attestation.md | 28 +++++------ server/test/unit/acls/confused-deputy.test.ts | 10 +--- server/test/unit/auth/oidc-escalation.test.ts | 46 ++++++++++++------- .../test/unit/auth/session-fixation.test.ts | 10 +++- .../test/unit/metadata/provider-chain.test.ts | 24 ++++++++-- server/test/unit/plugins/init-order.test.ts | 29 +++--------- server/test/unit/prioritylist.test.ts | 6 ++- 10 files changed, 90 insertions(+), 69 deletions(-) diff --git a/.github/workflows/cli-ci.yml b/.github/workflows/cli-ci.yml index def6c7ce..3a28955b 100644 --- a/.github/workflows/cli-ci.yml +++ b/.github/workflows/cli-ci.yml @@ -66,7 +66,7 @@ jobs: cargo llvm-cov --all-features --workspace --codecov --output-path coverage.lcov - name: Upload coverage to Codecov - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc60cb71e0fce7b # v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5 with: files: cli/coverage.lcov fail_ci_if_error: false diff --git a/.github/workflows/desktop-ci.yml b/.github/workflows/desktop-ci.yml index 6b04b39a..2fd4576e 100644 --- a/.github/workflows/desktop-ci.yml +++ b/.github/workflows/desktop-ci.yml @@ -71,7 +71,7 @@ jobs: cargo llvm-cov --all-features --workspace --codecov --output-path coverage.lcov - name: Upload coverage to Codecov - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc60cb71e0fce7b # v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5 with: files: desktop/src-tauri/coverage.lcov fail_ci_if_error: false diff --git a/.github/workflows/droplet-ci.yml b/.github/workflows/droplet-ci.yml index 1733d445..0e0ab3a6 100644 --- a/.github/workflows/droplet-ci.yml +++ b/.github/workflows/droplet-ci.yml @@ -67,7 +67,7 @@ jobs: cargo llvm-cov --all-features --workspace --codecov --output-path coverage.lcov - name: Upload coverage to Codecov - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc60cb71e0fce7b # v5 + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5 with: files: libraries/droplet/coverage.lcov fail_ci_if_error: false diff --git a/server/test/gaps/webauthn-attestation.md b/server/test/gaps/webauthn-attestation.md index 035f6640..6c4b9873 100644 --- a/server/test/gaps/webauthn-attestation.md +++ b/server/test/gaps/webauthn-attestation.md @@ -10,24 +10,24 @@ An attacker who can submit a crafted passkey registration request can inject an ## What is validated -| Check | Status | -|----------------------|--------| -| Client data JSON | parsed & typed (arktype) | -| Challenge match | checked against provided value | +| Check | Status | +| -------------------- | --------------------------------------------- | +| Client data JSON | parsed & typed (arktype) | +| Challenge match | checked against provided value | | RPID hash | SHA-256 of domain compared to authData[0..31] | -| AAGUID presence | length check only | -| Credential ID length | bounds check | -| COSE key decode | parsed as CBOR Map | +| AAGUID presence | length check only | +| Credential ID length | bounds check | +| COSE key decode | parsed as CBOR Map | ## What is NOT validated -| Check | Status | -|----------------------|--------| -| Attestation `fmt` | read but never enforced | -| Attestation signature | never parsed or verified | -| `verificationData` | never constructed | -| Authenticator data integrity | not cryptographically verified | -| `aaguid` | not checked against any allow/block list | +| Check | Status | +| ---------------------------- | ---------------------------------------- | +| Attestation `fmt` | read but never enforced | +| Attestation signature | never parsed or verified | +| `verificationData` | never constructed | +| Authenticator data integrity | not cryptographically verified | +| `aaguid` | not checked against any allow/block list | ## Test evidence diff --git a/server/test/unit/acls/confused-deputy.test.ts b/server/test/unit/acls/confused-deputy.test.ts index 4d28ec96..f763a678 100644 --- a/server/test/unit/acls/confused-deputy.test.ts +++ b/server/test/unit/acls/confused-deputy.test.ts @@ -86,10 +86,7 @@ describe("allowSystemACL — confused deputy prevention (T4)", () => { mockGetSession.mockResolvedValue(authenticatedSession(adminUser.id)); prismaUserFindUnique.mockResolvedValue(adminUser); - const result = await aclManager.allowSystemACL( - makeRequest(), - systemACLs, - ); + const result = await aclManager.allowSystemACL(makeRequest(), systemACLs); expect(result).toBe(true); }); @@ -115,10 +112,7 @@ describe("allowSystemACL — confused deputy prevention (T4)", () => { mockGetSession.mockResolvedValue(undefined); prismaTokenFindUnique.mockResolvedValue(null); - const result = await aclManager.allowSystemACL( - makeRequest(), - systemACLs, - ); + const result = await aclManager.allowSystemACL(makeRequest(), systemACLs); expect(result).toBe(false); }); diff --git a/server/test/unit/auth/oidc-escalation.test.ts b/server/test/unit/auth/oidc-escalation.test.ts index aa910465..0544b2e8 100644 --- a/server/test/unit/auth/oidc-escalation.test.ts +++ b/server/test/unit/auth/oidc-escalation.test.ts @@ -117,19 +117,21 @@ function createManager(adminGroup?: string, userGroup?: string): OIDCManager { delete process.env.OIDC_USER_GROUP; } - const manager = new (OIDCManager as unknown as new ( - oidcConfiguration: { - issuer: string; - authorization_endpoint: string; - token_endpoint: string; - userinfo_endpoint: string; - jwks_uri: string; - scopes_supported: string[]; - }, - clientId: string, - clientSecret: string, - externalUrl: URL, - ) => OIDCManager)( + const manager = new ( + OIDCManager as unknown as new ( + oidcConfiguration: { + issuer: string; + authorization_endpoint: string; + token_endpoint: string; + userinfo_endpoint: string; + jwks_uri: string; + scopes_supported: string[]; + }, + clientId: string, + clientSecret: string, + externalUrl: URL, + ) => OIDCManager + )( { issuer: "https://mock-oidc.test", authorization_endpoint: "https://mock-oidc.test/auth", @@ -211,7 +213,11 @@ describe("fetchOrCreateUser – OIDC group-to-admin escalation (T2)", () => { }), ); - const result = await (manager as unknown as { fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }> }).fetchOrCreateUser(userinfo); + const result = await ( + manager as unknown as { + fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }>; + } + ).fetchOrCreateUser(userinfo); expect(result.admin).toBe(true); // Verify prisma.create was called with admin:true in connectOrCreate.create @@ -251,7 +257,11 @@ describe("fetchOrCreateUser – OIDC group-to-admin escalation (T2)", () => { }), ); - const result = await (manager as unknown as { fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }> }).fetchOrCreateUser(userinfo); + const result = await ( + manager as unknown as { + fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }>; + } + ).fetchOrCreateUser(userinfo); expect(result.admin).toBe(false); expect(mockLinkedAuthMecCreate).toHaveBeenCalledWith( @@ -290,7 +300,11 @@ describe("fetchOrCreateUser – OIDC group-to-admin escalation (T2)", () => { }), ); - const result = await (manager as unknown as { fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }> }).fetchOrCreateUser(userinfo); + const result = await ( + manager as unknown as { + fetchOrCreateUser: (info: OIDCUserInfo) => Promise<{ admin: boolean }>; + } + ).fetchOrCreateUser(userinfo); expect(result.admin).toBe(false); expect(mockLinkedAuthMecCreate).toHaveBeenCalledWith( diff --git a/server/test/unit/auth/session-fixation.test.ts b/server/test/unit/auth/session-fixation.test.ts index cfe82255..104b8eb4 100644 --- a/server/test/unit/auth/session-fixation.test.ts +++ b/server/test/unit/auth/session-fixation.test.ts @@ -96,7 +96,15 @@ describe("Session Fixation (T3)", () => { mockLinkedMFACount.mockResolvedValue(0); mockSessionFindUnique.mockResolvedValue(null); mockSessionUpsert.mockImplementation( - ({ where, create, update }: { where: { token: string }; create?: { data: object }; update?: { data: object } }) => ({ + ({ + where, + create, + update, + }: { + where: { token: string }; + create?: { data: object }; + update?: { data: object }; + }) => ({ data: { token: where.token, data: create?.data || update?.data }, }), ); diff --git a/server/test/unit/metadata/provider-chain.test.ts b/server/test/unit/metadata/provider-chain.test.ts index 602c5d2d..4a22de5a 100644 --- a/server/test/unit/metadata/provider-chain.test.ts +++ b/server/test/unit/metadata/provider-chain.test.ts @@ -186,14 +186,32 @@ describe("MetadataHandler provider chain (search)", () => { handler.addProvider(new FailingProvider(), 10); handler.addProvider( new MockSuccessProvider("ProvB", MetadataSource.Steam, [ - { id: "b1", name: "Close Match", icon: "", description: "", year: 2024 }, - { id: "b2", name: "Exact Match", icon: "", description: "", year: 2023 }, + { + id: "b1", + name: "Close Match", + icon: "", + description: "", + year: 2024, + }, + { + id: "b2", + name: "Exact Match", + icon: "", + description: "", + year: 2023, + }, ]), 5, ); handler.addProvider( new MockSuccessProvider("ProvC", MetadataSource.GiantBomb, [ - { id: "c1", name: "Mediocre Match", icon: "", description: "", year: 2022 }, + { + id: "c1", + name: "Mediocre Match", + icon: "", + description: "", + year: 2022, + }, ]), 0, ); diff --git a/server/test/unit/plugins/init-order.test.ts b/server/test/unit/plugins/init-order.test.ts index 3844debd..3b7fb8d7 100644 --- a/server/test/unit/plugins/init-order.test.ts +++ b/server/test/unit/plugins/init-order.test.ts @@ -168,9 +168,7 @@ describe("Nitro Plugin Init Order", () => { const prefixes = files.map((f) => f.slice(0, 2)); for (let i = 0; i < prefixes.length; i++) { - expect(prefixes[i]).toBe( - String(i + 1).padStart(2, "0"), - ); + expect(prefixes[i]).toBe(String(i + 1).padStart(2, "0")); } }); @@ -201,10 +199,7 @@ describe("Nitro Plugin Init Order", () => { for (const [prefix, deps] of Object.entries(depGraph)) { const currentFile = files.find((f) => f.startsWith(prefix)); - expect( - currentFile, - `Plugin ${prefix} file not found`, - ).toBeDefined(); + expect(currentFile, `Plugin ${prefix} file not found`).toBeDefined(); const currentIdx = files.indexOf(currentFile!); for (const dep of deps) { @@ -234,10 +229,7 @@ describe("Nitro Plugin Init Order", () => { it("fetchProviderIdsInOrder() returns non-empty after adding providers", () => { const handler = new MetadataHandler(); - handler.addProvider( - { source: () => "Steam", name: () => "Steam" }, - 100, - ); + handler.addProvider({ source: () => "Steam", name: () => "Steam" }, 100); const ids = handler.fetchProviderIdsInOrder(); expect(ids.length).toBeGreaterThan(0); @@ -247,14 +239,8 @@ describe("Nitro Plugin Init Order", () => { it("returns providers sorted by priority (highest first)", () => { const handler = new MetadataHandler(); - handler.addProvider( - { source: () => "LowPri", name: () => "Low" }, - 0, - ); - handler.addProvider( - { source: () => "HighPri", name: () => "High" }, - 100, - ); + handler.addProvider({ source: () => "LowPri", name: () => "Low" }, 0); + handler.addProvider({ source: () => "HighPri", name: () => "High" }, 100); const ids = handler.fetchProviderIdsInOrder(); expect(ids).toEqual(["HighPri", "LowPri"]); @@ -267,10 +253,7 @@ describe("Nitro Plugin Init Order", () => { { source: () => "Manual", name: () => "Manual" }, -1000, ); - handler.addProvider( - { source: () => "IGDB", name: () => "IGDB" }, - 50, - ); + handler.addProvider({ source: () => "IGDB", name: () => "IGDB" }, 50); const ids = handler.fetchProviderIdsInOrder(); expect(ids).not.toContain("Manual"); diff --git a/server/test/unit/prioritylist.test.ts b/server/test/unit/prioritylist.test.ts index 5b1ab13a..c9f953f7 100644 --- a/server/test/unit/prioritylist.test.ts +++ b/server/test/unit/prioritylist.test.ts @@ -166,7 +166,11 @@ describe("PriorityListIndexed (property-based)", () => { it("get() returns the same item at the same key as long as it hasn't been popped", () => { fc.assert( fc.property( - fc.uniqueArray(itemArb, { selector: (item) => item.id, minLength: 1, maxLength: 30 }), + fc.uniqueArray(itemArb, { + selector: (item) => item.id, + minLength: 1, + maxLength: 30, + }), (items: Array<{ id: string; priority: number }>) => { const list = new PriorityListIndexed("id"); for (const item of items) {