test(coverage): add SSRF + auth-token route tests; wire coverage gate to CI#86
Merged
Merged
Conversation
… to CI Cover the highest-severity untested paths flagged by the 2026-06-27 audit (CRITICAL SSRF guard plus HIGH token/webhook/policy routes) and enforce coverage in CI. Tests: - tests/unit/safe-fetch.test.ts: lib/net/safe-fetch.ts assertPublicUrl (literal IPv4/IPv6, IPv4-mapped, cloud-metadata, DNS resolve/failure), safeFetch transport, and the real pinnedLookup DNS-pinning plus fail-closed re-validation (anti DNS-rebinding). Drives safe-fetch.ts to 97%+ statements. - tests/unit/tokens-route.test.ts: GET/POST /api/tokens session-only auth (dsat_ Bearer rejected), name validation, dsat_ prefix on mint. - tests/unit/tokens-id-route.test.ts: DELETE /api/tokens/[id] IDOR userId scoping, revokedAt idempotency. - tests/unit/webhooks-route.test.ts: SSRF rejection wiring, event validation, 401/400/201. - tests/unit/policies-route.test.ts: PolicyType/Severity enum validation, service delegation, auth guard. Coverage enforcement: - vitest.config.ts: include app/api/**/*.ts; ratchet global floor (37/32/40/37, about 2 points below baseline) plus per-file floors for safe-fetch.ts and the tokens, webhooks, and policies routes. - .github/workflows/ci.yml: test job runs npm run test:coverage so thresholds gate every PR. - .gitignore: ignore the generated coverage/ dir. lib/net/safe-fetch.ts: export pinnedLookup (testability only, no behavior change) so its defence-in-depth fail-closed branch is unit-testable. Refs: tc-audit-2026-06-27 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
LanNguyenSi
added a commit
that referenced
this pull request
Jun 29, 2026
… repo-bundle/policy-service lib (#87) Closes residual HIGH route-handler + MED lib gaps after #86: 36 tests across 6 targets, each asserting success + every failure/edge branch (12 security/ validation guard mutations killed). Per-file coverage thresholds added. Refs: tc-audit-2026-06-27 (depsight test-coverage umbrella) Co-authored-by: Lan Nguyen Si <nguyen-si@publicplan.de> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
5 tasks
LanNguyenSi
added a commit
that referenced
this pull request
Jun 30, 2026
…p gates (#88) * test(coverage): cover remaining 18 API route handlers + per-file gates Adds unit tests for every previously-untested app/api route handler, closing the depsight route-handler HIGH/MED surface after #86/#87: dependabot trio, ci/sync, repos/sync, pr-scan, export, sbom, me, health, deps, license, ci/analytics/[repoId], ci/analytics/cross-repo, history, overview, policies/evaluate, repos. 117 new tests (411 -> 528 suite). Each route covers all auth/ownership/IDOR/validation/error branches with value-level assertions (exact prisma where clauses incl userId, exact status + body). Per-file coverage thresholds added (S/F/L 95, branch floors ~5-8 below measured), negative-control verified. Refs: tc-audit-2026-06-27 * test(coverage): fold reviewer findings: assert ownership/IDOR boundaries Adversarial mutation-verify (34 mutations, 30 killed, 4 survived) found inert ownership assertions; this folds the fixes (each re-mutation-killed independently): - dependabot/check: assert prisma.repo.findMany is scoped to { userId, tracked:true }; removing userId was a cross-tenant IDOR that 100% line coverage masked (HIGH). - export: assert the primary loadRepoExportData(userId, repoId) call on the happy path (MED). - ci/analytics/[repoId]: mock owned repo.id distinct from the path param and assert analytics keyed on the ownership-verified id, not the raw param (LOW). Refs: tc-audit-2026-06-27 --------- Co-authored-by: Lan Nguyen Si <nguyen-si@publicplan.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the CRITICAL and HIGH test-coverage gaps in depsight flagged by the 2026-06-27 audit, and turns CI coverage from measured-but-unenforced into a real gate.
Why
depsight had a solid lib/ unit suite, but its sole SSRF guard (lib/net/safe-fetch.ts) was only ever mocked, and 26 of 27 API route handlers were untested. CI ran tests without coverage, so the declared coverage config never gated anything.
Tests added (343 total, all green, mutation-verified)
Coverage enforcement
Verification
Deferred to follow-ups
Refs: tc-audit-2026-06-27