test(app): cover tokens, scopes, bearer auth, and audit logs#735
Merged
Conversation
Closes the coverage gaps introduced by v5 on the app side. Unit tests - `generateToken` / `hashToken` / `safeEqualHex`: guard against the "undefined"-in-token regression, verify Crockford alphabet usage, uniqueness across 1k draws, sha256 hex output, and timing-safe comparison behaviour. - `requireTokenScope`: noop on web sessions, 403 on missing permission / out-of-scope team / project / environment, and passes when scopes match or are unrestricted. E2E flows - `tokens`: POST returns plaintext once, GET never does; scopes persisted; Bearer auth works; legacy cookie auth still works but returns Deprecation / Sunset headers; read-only scope rejects a variable POST and allows the matching read; expired tokens return 401; invalid tokens return 401; DELETE revokes. - `audit-logs`: feed is structurally sound, action filtering applies, limit is enforced, invalid limits return 400. The CLI pull E2E now passes `--yes` so it stays non-interactive when the harness runs inside an AI-agent environment (std-env would otherwise prompt for confirmation and hang).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Thank you for following the naming conventions! 🙏 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
PR order
This is PR 2/4 in the v5 follow-up series. Independent from PR 1 (CLI tests); can land in any order.