From d265e0277718f4b8f8c3fedd5a9d0c5d3dafe8f2 Mon Sep 17 00:00:00 2001 From: bponders12-cell Date: Tue, 1 Sep 2026 18:12:18 -0400 Subject: [PATCH] TEST: align Phase 2E R2 audit with hardened contracts --- test/r2_security_audit_test.dart | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/test/r2_security_audit_test.dart b/test/r2_security_audit_test.dart index 1b77695..d855f6f 100644 --- a/test/r2_security_audit_test.dart +++ b/test/r2_security_audit_test.dart @@ -170,7 +170,7 @@ void main() { }); // 4. Malformed Remote Ride ID / Path Traversal Attack Rejection - test('Security 4: Malicious remoteRideId is rejected with HTTP 400 permanent failure', () async { + test('Security 4: Malicious remoteRideId is rejected as HTTP 400 permanent failure', () async { final mockClient = http_testing.MockClient((request) async { final rideId = request.headers['X-Remote-Ride-Id']; if (rideId == null || rideId.contains('..') || rideId.contains('/')) { @@ -242,8 +242,8 @@ void main() { expect(computed.length, equals(64)); }); - // 8. Outbox Backward Compatibility & Composite Key Isolation - test('Security 8: Outbox preserves composite key \${localRideId}_\${providerId}', () async { + // 8. Outbox Composite Key Isolation + test('Security 8: Outbox preserves provider-scoped composite idempotency key', () async { final outbox = SyncOutbox(prefs); await outbox.enqueue(501, 'firebase'); @@ -252,8 +252,9 @@ void main() { expect(outbox.count, equals(2)); expect(outbox.getItem(501, 'firebase'), isNotNull); expect(outbox.getItem(501, 'github'), isNotNull); - expect(outbox.getItem(501, 'firebase')!.key, equals('501_firebase')); - expect(outbox.getItem(501, 'github')!.key, equals('501_github')); + expect(outbox.getItem(501, 'firebase')!.key, equals('firebase:501')); + expect(outbox.getItem(501, 'github')!.key, equals('github:501')); + expect(outbox.getItem(501, 'firebase')!.key, isNot(equals(outbox.getItem(501, 'github')!.key))); }); // 9. Multi-Provider SyncManager Resilience