naeel
d8613c7112
test: stress tests expanded to 191 (concurrency, boundary IPs, CIDR masks, auth attacks, unicode, session, massive parallel)
2026-05-31 10:18:33 +03:00
naeel
a24634199b
test: stress tests — concurrency, races, edge cases (32 pass) + bump 0.5.0
2026-05-31 10:10:48 +03:00
naeel
ed5b3c8367
feat: comprehensive API tests (104 pass) + fix: validation errors → 400, comment length limit
2026-05-30 19:44:37 +03:00
naeel
09bb56c6f4
test: long comment, limit=0, invalid limit (59/59 pass)
2026-05-30 17:22:18 +03:00
naeel
7d2b6a309f
test: export content, empty comment, deleted not in export (53/53 pass)
2026-05-30 17:20:41 +03:00
naeel
1e330a4395
test: IPv6, boundary CIDR, race condition, rate-limiter (49/49 pass)
2026-05-30 17:18:56 +03:00
naeel
91d18afe10
test: IDOR + admin ACL + audit ACL sections (45/45 pass)
2026-05-30 17:14:19 +03:00
naeel
1f5c0d8623
test: XSS + rate-limiter sections (40/40 pass)
2026-05-30 17:11:42 +03:00
naeel
8ab7eed629
test: limit + audit_log sections (38/38 pass)
2026-05-30 17:09:50 +03:00
naeel
e97c36f19f
feat: integration tests CRUD 34/34 (supertest + real DB)
2026-05-30 17:06:42 +03:00
naeel
a5170a062c
security: fix 7 vulnerabilities from Opus code review
...
- [A01] /export: mount after auth.middleware, filter by company for non-admin
- [A02] OIDC: verify issuer, audience, select key by kid; preload JWKS at startup
- [A07] session fixation: session.regenerate() in POST /login, GET /callback, POST /dev-login
- [A10] open redirect: safeReturn() helper validates returnTo (blocks //evil.com, https:// etc)
- [A05] CSRF: getSessionIdentifier uses req.sessionID instead of dead req.cookies.jwt
- [A05] fail-fast: reject default SESSION_SECRET / CSRF_SECRET in NODE_ENV=production
- [A05] DEV_MODE=true blocked in production
Tests: 68 PASS, 0 FAIL (was 50, added 18 new security-focused tests)
2026-05-30 15:25:57 +03:00
naeel
86ca944c52
feat: Authorization Code Flow (KK) + session middleware + dev-login
...
- src/auth.js: OIDC mode (KC_CLIENT_ID/KC_CLIENT_SECRET), session-based
middleware, legacy jwt-cookie migration, httpGet/httpPost без внешних зав.
- src/routes/auth.js: GET /callback (OIDC), GET+POST /dev-login (backdoor),
session-based login/logout для обоих режимов
- server.js: express-session (8h, httpOnly, sameSite lax), trust proxy в prod
- views/dev-login.ejs: форма с пресетами MOCK_USERS + произвольные поля
- views/login.ejs: ссылка на /dev-login если devLoginEnabled
- tests: +5 тестов (session middleware), 50 PASS / 0 FAIL
Env-переменные:
KC_CLIENT_ID, KC_CLIENT_SECRET, KC_BASE_URL, APP_URL — OIDC режим
SESSION_SECRET — секрет сессии
DEV_MODE=true — /dev-login без пароля
DEV_SECRET=xyz — /dev-login с ?key=xyz
2026-05-30 14:37:29 +03:00
naeel
6de5631451
test: добавлен tests/run-tests.js (45 тестов без БД)
2026-05-30 13:59:21 +03:00
naeel