naeel
15b458eb35
v0.5.11: зачистка мёртвого кода + новые интеграционные тесты
...
Удалено:
- src/routes/*.js (5 файлов) — старая монолитная архитектура
- views/dev-login.ejs — старый dev-логин
- tests/debug-session.js — тесты старой архитектуры
Добавлено:
- safeReturn в src/auth.js
- Новые интеграционные тесты tests/integration.js (67 тестов, UI+API)
Обновлено:
- tests/run-tests.js — убраны старые require, добавлены новые модули
- tests/tz-compliance.js — /exp → /api/v1/entries/export
- server.js — убран require('./src/routes/exp')
2026-06-02 18:04:33 +03:00
naeel
4694b7e8a6
v0.5.11: версия + фикс теста MOCK_USERS.length 3→4
2026-06-02 17:49:07 +03:00
naeel
66a52d9363
v0.5.9: fix tests IDs, revert dotenv abs paths, deploy-vm doc
2026-06-02 14:20:16 +03:00
naeel
b91b78ab04
v0.5.8: distinct MOCK_USERS (WZ88888=АЛЬФА, WZ77777=БЕТА)
2026-06-02 11:36:53 +03:00
naeel
8ea10f1e37
v0.5.4: fix multi-company API — client_id validation, export isolation, 121 tests PASS
2026-06-02 11:20:51 +03:00
naeel
59ad0fa67e
v0.5.5: fix export client_id + multi-company tests (section O)
2026-06-02 11:17:23 +03:00
naeel
1e581b3208
test: helpers.js — безопасные тестовые CIDR, проверка коллизий, удаление аудита + fix compliance
2026-05-31 13:17:21 +03:00
naeel
10ef2011be
fix: pre-cleanup удаляет только тестовые CIDR, не все записи
2026-05-31 13:06:21 +03:00
naeel
d1d591299e
fix: compliance cleanup — add 86.0.0.0/24, 87.0.0.1/32 to cleanup list
2026-05-31 13:04:32 +03:00
naeel
64da1f9834
test: compliance fix mask overlap + test results log (340 pass, 0 fail)
2026-05-31 12:58:20 +03:00
naeel
5e1ce80003
test: ТЗ compliance — 45 API-тестов + полный отчёт о соответствии
2026-05-31 10:26:28 +03:00
naeel
d8613c7112
test: stress tests expanded to 191 (concurrency, boundary IPs, CIDR masks, auth attacks, unicode, session, massive parallel)
2026-05-31 10:18:33 +03:00
naeel
a24634199b
test: stress tests — concurrency, races, edge cases (32 pass) + bump 0.5.0
2026-05-31 10:10:48 +03:00
naeel
ed5b3c8367
feat: comprehensive API tests (104 pass) + fix: validation errors → 400, comment length limit
2026-05-30 19:44:37 +03:00
naeel
09bb56c6f4
test: long comment, limit=0, invalid limit (59/59 pass)
2026-05-30 17:22:18 +03:00
naeel
7d2b6a309f
test: export content, empty comment, deleted not in export (53/53 pass)
2026-05-30 17:20:41 +03:00
naeel
1e330a4395
test: IPv6, boundary CIDR, race condition, rate-limiter (49/49 pass)
2026-05-30 17:18:56 +03:00
naeel
91d18afe10
test: IDOR + admin ACL + audit ACL sections (45/45 pass)
2026-05-30 17:14:19 +03:00
naeel
1f5c0d8623
test: XSS + rate-limiter sections (40/40 pass)
2026-05-30 17:11:42 +03:00
naeel
8ab7eed629
test: limit + audit_log sections (38/38 pass)
2026-05-30 17:09:50 +03:00
naeel
e97c36f19f
feat: integration tests CRUD 34/34 (supertest + real DB)
2026-05-30 17:06:42 +03:00
naeel
a5170a062c
security: fix 7 vulnerabilities from Opus code review
...
- [A01] /export: mount after auth.middleware, filter by company for non-admin
- [A02] OIDC: verify issuer, audience, select key by kid; preload JWKS at startup
- [A07] session fixation: session.regenerate() in POST /login, GET /callback, POST /dev-login
- [A10] open redirect: safeReturn() helper validates returnTo (blocks //evil.com, https:// etc)
- [A05] CSRF: getSessionIdentifier uses req.sessionID instead of dead req.cookies.jwt
- [A05] fail-fast: reject default SESSION_SECRET / CSRF_SECRET in NODE_ENV=production
- [A05] DEV_MODE=true blocked in production
Tests: 68 PASS, 0 FAIL (was 50, added 18 new security-focused tests)
2026-05-30 15:25:57 +03:00
naeel
86ca944c52
feat: Authorization Code Flow (KK) + session middleware + dev-login
...
- src/auth.js: OIDC mode (KC_CLIENT_ID/KC_CLIENT_SECRET), session-based
middleware, legacy jwt-cookie migration, httpGet/httpPost без внешних зав.
- src/routes/auth.js: GET /callback (OIDC), GET+POST /dev-login (backdoor),
session-based login/logout для обоих режимов
- server.js: express-session (8h, httpOnly, sameSite lax), trust proxy в prod
- views/dev-login.ejs: форма с пресетами MOCK_USERS + произвольные поля
- views/login.ejs: ссылка на /dev-login если devLoginEnabled
- tests: +5 тестов (session middleware), 50 PASS / 0 FAIL
Env-переменные:
KC_CLIENT_ID, KC_CLIENT_SECRET, KC_BASE_URL, APP_URL — OIDC режим
SESSION_SECRET — секрет сессии
DEV_MODE=true — /dev-login без пароля
DEV_SECRET=xyz — /dev-login с ?key=xyz
2026-05-30 14:37:29 +03:00
naeel
6de5631451
test: добавлен tests/run-tests.js (45 тестов без БД)
2026-05-30 13:59:21 +03:00
naeel