mirror of
https://github.com/screentinker/screentinker.git
synced 2026-06-17 03:32:32 -06:00
2ad9f54b8e
A dedicated public-API suite (boots the real server as a subprocess) so CI green proves the token layer, not just the pre-existing tests: - Partition firewall, derived from the SAME config/api-surface.js server.js mounts from: every JWT-only router 401s a token; a public-surface snapshot fails if any router is added to the token door; known-privileged routers asserted JWT-only. - Threat model: role-strip gates, workspace-binding both directions (token ignores X-Workspace-Id, JWT honors it), the scope ladder, the render bypass, token lifecycle, and JWT no-regression. - Device WS round-trip via socket.io-client (added as a devDep): valid device_token registers + receives its playlist; wrong token rejected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| admin-users.test.js | ||
| ai-design.test.js | ||
| api.test.js | ||
| branding.test.js | ||
| config-paths.test.js | ||
| operator-permissions.test.js | ||
| schedule-eval.test.js | ||
| schema-check.test.js | ||
| security-fixes.test.js | ||
| tenant-cascade-migration.test.js | ||
| tizen-eval-drift.test.js | ||
| user-deletion.test.js | ||
| widget-render-xss.test.js | ||