David/kanban-dev-webapp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kanban-dev-webapp/tests/integration
History
Dave 2401dbd68f test(ai): settings page never exposes the API key 
Three tests cover the storage and access boundary:

- A client manager cannot list the settings collection at all (rules are
  superuser-only — verified by the rejection, not by silent skip).
- The settings page HTML returned to the owner does not contain the key
  value, even when the key is freshly set to a unique sentinel.
- A client manager gets 404 on /admin/settings (admin layout gates on
  role, not on session presence).

helpers.ts gained ownerEmail / ownerPassword — needed by the settings test
and reusable for any owner-only integration test going forward.
2026-09-16 15:59:49 +02:00
..
activity-log.test.ts test(permissions): integration coverage for the client write boundary 2026-09-16 09:46:58 +02:00
admin.test.ts test(admin): board invariants, owner-only writes, deactivation 2026-09-16 11:31:38 +02:00
ai-settings.test.ts test(ai): settings page never exposes the API key 2026-09-16 15:59:49 +02:00
client-permissions.test.ts test(permissions): integration coverage for the client write boundary 2026-09-16 09:46:58 +02:00
helpers.ts test(ai): settings page never exposes the API key 2026-09-16 15:59:49 +02:00
ingest.test.ts test(ingest): webhook and cron endpoint protection 2026-09-16 11:50:20 +02:00
linking.test.ts test(metrics): cached figures agree with stored commits + vitest stubs 2026-09-16 15:19:32 +02:00
metrics.test.ts test(metrics): cached figures agree with stored commits + vitest stubs 2026-09-16 15:19:32 +02:00
owner-actions.test.ts test(actions): cover audit-log immunity and request flags 2026-09-16 11:06:38 +02:00
user-rules.test.ts fix(security): lock the users collection against privilege escalation 2026-09-16 11:18:13 +02:00