841 lines
42 KiB
JavaScript
841 lines
42 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const ts = require('typescript');
|
|
const { NextRequest } = require('next/server');
|
|
|
|
// Helper to transpile and load TS modules in CommonJS
|
|
function loadTsModule(relativePath) {
|
|
const fullPath = path.resolve(__dirname, relativePath);
|
|
const source = fs.readFileSync(fullPath, 'utf8');
|
|
const transpiled = ts.transpileModule(source, {
|
|
compilerOptions: {
|
|
module: ts.ModuleKind.CommonJS,
|
|
target: ts.ScriptTarget.ES2022,
|
|
jsx: ts.JsxEmit.React,
|
|
},
|
|
}).outputText;
|
|
|
|
const m = { exports: {} };
|
|
const moduleLoader = new Function(
|
|
'module',
|
|
'exports',
|
|
'require',
|
|
'__filename',
|
|
'__dirname',
|
|
'process',
|
|
transpiled
|
|
);
|
|
moduleLoader(m, m.exports, (reqPath) => {
|
|
if (reqPath.startsWith('.')) {
|
|
const resolved = path.resolve(path.dirname(fullPath), reqPath);
|
|
if (fs.existsSync(resolved + '.ts')) return loadTsModule(path.relative(__dirname, resolved + '.ts'));
|
|
if (fs.existsSync(resolved + '.tsx')) return loadTsModule(path.relative(__dirname, resolved + '.tsx'));
|
|
if (fs.existsSync(resolved + '/index.ts')) return loadTsModule(path.relative(__dirname, resolved + '/index.ts'));
|
|
}
|
|
return require(reqPath);
|
|
}, fullPath, path.dirname(fullPath), process);
|
|
return m.exports;
|
|
}
|
|
|
|
console.log('--- STARTING OPS-3C, OPS-3C.1, OPS-3C.2, OPS-3C.3 & OPS-4 OPERATIONS TEST SUITE ---');
|
|
|
|
// Load modules
|
|
const opsData = loadTsModule('../lib/ops-data.ts');
|
|
const {
|
|
normalizeHealthResponse,
|
|
sanitizeAuditEvent,
|
|
isValidHealthStatus,
|
|
HEALTH_COMPONENT_METADATA,
|
|
APPROVED_AUDIT_METADATA_KEYS,
|
|
isValidIncidentSeverity,
|
|
isValidIncidentStatus,
|
|
isValidStatusTransition,
|
|
sanitizeIncidentSummary,
|
|
sanitizeIncidentDetail,
|
|
sanitizeIncidentNote,
|
|
} = opsData;
|
|
|
|
// ============================================================
|
|
// 1. ISOLATED OPERATIONS SHELL & CONSUMER NAV SUPPRESSION
|
|
// ============================================================
|
|
console.log('Testing 1: Isolated Operations Shell & Consumer Nav Isolation...');
|
|
const siteHeaderSource = fs.readFileSync(path.resolve(__dirname, '../components/site-header-client.tsx'), 'utf8');
|
|
const siteFooterSource = fs.readFileSync(path.resolve(__dirname, '../components/site-footer.tsx'), 'utf8');
|
|
|
|
assert.ok(
|
|
siteHeaderSource.includes("pathname?.startsWith('/admin')") || siteHeaderSource.includes("pathname?.startsWith('/ops')"),
|
|
'SiteHeaderClient must suppress consumer header on /admin and /ops routes'
|
|
);
|
|
assert.ok(
|
|
siteFooterSource.includes("pathname?.startsWith('/admin')") || siteFooterSource.includes("pathname?.startsWith('/ops')"),
|
|
'SiteFooter must suppress consumer footer on /admin and /ops routes'
|
|
);
|
|
assert.ok(
|
|
!siteHeaderSource.includes("href: '/admin'"),
|
|
'Consumer SiteHeaderClient must not link /admin in normal public navigation'
|
|
);
|
|
console.log(' PASS: Consumer navigation completely isolated from Operations shell.');
|
|
|
|
// ============================================================
|
|
// 2. /ADMIN SAFE HANDOFF & ZERO PREVIEW QUERY AUTHENTICATION
|
|
// ============================================================
|
|
console.log('Testing 2: /admin Safe Handoff & Zero Preview Query Bypass...');
|
|
const adminPageSource = fs.readFileSync(path.resolve(__dirname, '../app/admin/page.tsx'), 'utf8');
|
|
|
|
assert.ok(
|
|
!adminPageSource.includes("preview === 'ops'") && !adminPageSource.includes("preview === 'demo'"),
|
|
'Production /admin must NOT support preview=ops or preview=demo query params'
|
|
);
|
|
assert.ok(
|
|
!adminPageSource.includes('resolvedParams.role') &&
|
|
!adminPageSource.includes('searchParams?.role') &&
|
|
!adminPageSource.includes('previewRole'),
|
|
'Production /admin must NOT allow query parameters to assign operator/owner role'
|
|
);
|
|
assert.ok(
|
|
!adminPageSource.includes('createDefaultOperationsHealth') && !adminPageSource.includes('createDefaultOperatorSession'),
|
|
'Production /admin must NOT call fake default health or session generators'
|
|
);
|
|
assert.ok(
|
|
adminPageSource.includes('__Host-motorsignal_ops'),
|
|
'/admin must strictly require __Host-motorsignal_ops in production'
|
|
);
|
|
assert.ok(
|
|
adminPageSource.includes('OperationsErrorState') && adminPageSource.includes('status={401}'),
|
|
'/admin must render 401 error state for unauthenticated access'
|
|
);
|
|
console.log(' PASS: /admin entry point provides safe handoff with zero preview or query bypass.');
|
|
|
|
// ============================================================
|
|
// 3. REAL HEALTH ENDPOINT & NORMALIZATION
|
|
// ============================================================
|
|
console.log('Testing 3: Real Health Endpoint Normalization...');
|
|
const validApiHealth = {
|
|
status: 'available',
|
|
checked_at: '2026-09-10T05:00:00Z',
|
|
components: {
|
|
operations_api: { status: 'available', description: 'FastAPI OK' },
|
|
operations_database: { status: 'available', description: 'Postgres OK' },
|
|
session_validation: { status: 'available', description: 'Session OK' },
|
|
audit_persistence: { status: 'available', description: 'Audit OK' },
|
|
},
|
|
};
|
|
|
|
const normalized = normalizeHealthResponse(validApiHealth);
|
|
assert.equal(normalized.status, 'available');
|
|
assert.equal(normalized.checked_at, '2026-09-10T05:00:00Z');
|
|
assert.equal(normalized.components.operations_api.status, 'available');
|
|
assert.equal(normalized.components.operations_database.status, 'available');
|
|
assert.equal(normalized.components.session_validation.status, 'available');
|
|
assert.equal(normalized.components.audit_persistence.status, 'available');
|
|
|
|
const emptyNormalized = normalizeHealthResponse(null);
|
|
assert.equal(emptyNormalized.status, 'unavailable');
|
|
assert.equal(emptyNormalized.components.operations_api.status, 'unavailable');
|
|
assert.equal(emptyNormalized.components.operations_database.status, 'unavailable');
|
|
assert.equal(emptyNormalized.components.session_validation.status, 'unavailable');
|
|
assert.equal(emptyNormalized.components.audit_persistence.status, 'unavailable');
|
|
console.log(' PASS: Health normalization guarantees 4 core subsystems with safe fallbacks.');
|
|
|
|
// ============================================================
|
|
// 4. AVAILABLE / DEGRADED / UNAVAILABLE / UNKNOWN STATES
|
|
// ============================================================
|
|
console.log('Testing 4: Component Health Status Transitions...');
|
|
assert.equal(isValidHealthStatus('available'), true);
|
|
assert.equal(isValidHealthStatus('degraded'), true);
|
|
assert.equal(isValidHealthStatus('unavailable'), true);
|
|
assert.equal(isValidHealthStatus('unknown'), true);
|
|
assert.equal(isValidHealthStatus('healthy'), false);
|
|
assert.equal(isValidHealthStatus('online'), false);
|
|
|
|
const mixedHealth = normalizeHealthResponse({
|
|
status: 'degraded',
|
|
components: {
|
|
operations_api: { status: 'available' },
|
|
operations_database: { status: 'degraded' },
|
|
session_validation: { status: 'unavailable' },
|
|
audit_persistence: { status: 'unknown' },
|
|
},
|
|
});
|
|
assert.equal(mixedHealth.components.operations_api.status, 'available');
|
|
assert.equal(mixedHealth.components.operations_database.status, 'degraded');
|
|
assert.equal(mixedHealth.components.session_validation.status, 'unavailable');
|
|
assert.equal(mixedHealth.components.audit_persistence.status, 'unknown');
|
|
console.log(' PASS: Subsystem health preserves exact 4 approved enum values.');
|
|
|
|
// ============================================================
|
|
// 5. MANUAL HEALTH REFRESH & NO AUTOMATIC POLLING
|
|
// ============================================================
|
|
console.log('Testing 5: Manual Refresh & Zero Automatic Polling...');
|
|
const overviewSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-overview.tsx'), 'utf8');
|
|
const shellSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-shell.tsx'), 'utf8');
|
|
|
|
assert.ok(
|
|
!overviewSource.includes('setInterval') && !overviewSource.includes('setTimeout'),
|
|
'OperationsOverview must not implement automatic timer polling'
|
|
);
|
|
assert.ok(
|
|
!shellSource.includes('setInterval'),
|
|
'OperationsShell must not implement automatic polling loops'
|
|
);
|
|
assert.ok(
|
|
overviewSource.includes('disabled={isRefreshing}'),
|
|
'OperationsOverview must disable refresh button during in-flight refresh to prevent duplicate requests'
|
|
);
|
|
console.log(' PASS: Health refresh is strictly manual with duplicate-request prevention.');
|
|
|
|
// ============================================================
|
|
// 6. ZERO FABRICATED HEALTH METRICS
|
|
// ============================================================
|
|
console.log('Testing 6: Zero Fabricated Metrics Audit...');
|
|
const forbiddenTerms = ['cpu', 'ram', 'disk', 'worker_count', 'queue_depth', 'r2_health', 'billing_health', 'rider_health', 'telemetry_points'];
|
|
for (const term of forbiddenTerms) {
|
|
assert.ok(
|
|
!overviewSource.toLowerCase().includes(term + ':') && !overviewSource.toLowerCase().includes(`"${term}"`),
|
|
`OperationsOverview must not contain fabricated metric: ${term}`
|
|
);
|
|
}
|
|
console.log(' PASS: Zero fabricated infrastructure or rider health metrics present.');
|
|
|
|
// ============================================================
|
|
// 7. OWNER AUDIT ACCESS VS 8. OPERATOR AUDIT DENIAL
|
|
// ============================================================
|
|
console.log('Testing 7 & 8: Owner Audit Access & Operator Denied UX...');
|
|
const auditSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-audit.tsx'), 'utf8');
|
|
|
|
assert.ok(
|
|
auditSource.includes("const isOwner = role === 'owner'") || auditSource.includes("if (!isOwner)"),
|
|
'OperationsAudit must enforce role === "owner" gate'
|
|
);
|
|
assert.ok(
|
|
auditSource.includes('You do not have authority to view Audit.') || auditSource.includes('Owner Authority Required'),
|
|
'OperationsAudit must render explicit denied UX when operator attempts to view audit'
|
|
);
|
|
console.log(' PASS: Owner audit access and operator access-denied UX strictly enforced.');
|
|
|
|
// ============================================================
|
|
// 9. AUDIT PAGINATION & BOUNDED RESULT SET
|
|
// ============================================================
|
|
console.log('Testing 9: Server Cursor Bounded Pagination...');
|
|
assert.ok(
|
|
auditSource.includes('nextCursor') && auditSource.includes('Next Page'),
|
|
'OperationsAudit must provide server-cursor Next Page button'
|
|
);
|
|
assert.ok(
|
|
!auditSource.includes('Export') && !auditSource.includes('bulk download') && !auditSource.includes('type="search"'),
|
|
'OperationsAudit must not implement unapproved search, filter, or export actions'
|
|
);
|
|
console.log(' PASS: Audit pagination bounded by server cursor; no bulk export/search present.');
|
|
|
|
// ============================================================
|
|
// 10. STRICT OPS-3B AUDIT DTO & METADATA ALLOWLIST (OPS-3C.3)
|
|
// ============================================================
|
|
console.log('Testing 10: Strict OPS-3B Audit DTO & Metadata Allowlist (OPS-3C.3)...');
|
|
|
|
// Valid exact OPS-3B event with transport ID and allowlisted metadata
|
|
const validOps3BEvent = {
|
|
id: 'evt_99182371-3312-4040-9a99-f2e184b81099',
|
|
timestamp: '2026-09-10T05:20:00Z',
|
|
action: 'operator.login',
|
|
result: 'success',
|
|
actor_identity: 'ops-admin@motorsignal.app',
|
|
actor_role: 'owner',
|
|
target_resource: 'ops.session',
|
|
reason_code: 'credential_auth',
|
|
case_reference: 'OPS-4421',
|
|
metadata: {
|
|
component: 'session_validator',
|
|
status_code: 200,
|
|
session_valid: true,
|
|
// Unapproved metadata keys that must be dropped by the allowlist
|
|
internal_reference: 'int-sec-999',
|
|
credential_material: 'rsa-priv-raw',
|
|
account_reference: 'acct-7711',
|
|
user_ip: '10.0.0.1',
|
|
},
|
|
};
|
|
|
|
const sanitized = sanitizeAuditEvent(validOps3BEvent);
|
|
assert.notEqual(sanitized, null);
|
|
assert.equal(sanitized.id, 'evt_99182371-3312-4040-9a99-f2e184b81099');
|
|
assert.equal(sanitized.timestamp, '2026-09-10T05:20:00Z');
|
|
assert.equal(sanitized.action, 'operator.login');
|
|
assert.equal(sanitized.result, 'success');
|
|
assert.equal(sanitized.actor_identity, 'ops-admin@motorsignal.app');
|
|
assert.equal(sanitized.actor_role, 'owner');
|
|
assert.equal(sanitized.target_resource, 'ops.session');
|
|
assert.equal(sanitized.reason_code, 'credential_auth');
|
|
assert.equal(sanitized.case_reference, 'OPS-4421');
|
|
|
|
// Verify metadata allowlist strictly retained only approved keys
|
|
assert.deepEqual(sanitized.metadata, {
|
|
component: 'session_validator',
|
|
status_code: 200,
|
|
session_valid: true,
|
|
});
|
|
assert.equal(sanitized.metadata.internal_reference, undefined);
|
|
assert.equal(sanitized.metadata.credential_material, undefined);
|
|
assert.equal(sanitized.metadata.account_reference, undefined);
|
|
assert.equal(sanitized.metadata.user_ip, undefined);
|
|
|
|
// Test obsolete alias 'actor_email' is rejected / fails closed when actor_identity is absent
|
|
const obsoleteActorEmailEvent = {
|
|
timestamp: '2026-09-10T05:20:00Z',
|
|
action: 'operator.login',
|
|
result: 'success',
|
|
actor_email: 'ops-admin@motorsignal.app', // obsolete alias
|
|
};
|
|
assert.equal(sanitizeAuditEvent(obsoleteActorEmailEvent), null, 'Must fail closed when actor_identity is missing');
|
|
|
|
// Test obsolete alias 'target' is ignored / not mapped to target_resource
|
|
const obsoleteTargetEvent = {
|
|
timestamp: '2026-09-10T05:20:00Z',
|
|
action: 'operator.login',
|
|
result: 'success',
|
|
actor_identity: 'ops-admin@motorsignal.app',
|
|
target: 'ops.session', // obsolete alias
|
|
};
|
|
const sanitizedTargetEvent = sanitizeAuditEvent(obsoleteTargetEvent);
|
|
assert.notEqual(sanitizedTargetEvent, null);
|
|
assert.equal(sanitizedTargetEvent.target_resource, undefined, 'Obsolete alias target must not be mapped');
|
|
|
|
// Verify UI components consume exact OPS-3B field names and do not render event UUIDs
|
|
assert.ok(auditSource.includes('event.actor_identity'), 'OperationsAudit must render event.actor_identity');
|
|
assert.ok(auditSource.includes('event.target_resource'), 'OperationsAudit must render event.target_resource');
|
|
assert.ok(auditSource.includes('event.reason_code'), 'OperationsAudit must render event.reason_code');
|
|
assert.ok(auditSource.includes('event.case_reference'), 'OperationsAudit must render event.case_reference');
|
|
assert.ok(!auditSource.includes('event.id') && !auditSource.includes('{event.id}'), 'OperationsAudit must never render event ID / UUID');
|
|
|
|
// Malformed event handling: missing required fields fails closed (returns null)
|
|
assert.equal(sanitizeAuditEvent(null), null);
|
|
assert.equal(sanitizeAuditEvent({}), null);
|
|
assert.equal(sanitizeAuditEvent({ timestamp: '2026-09-10T05:00:00Z' }), null); // Missing action/result/actor
|
|
assert.equal(sanitizeAuditEvent({ timestamp: '2026-09-10T05:00:00Z', action: 'test', result: 'success' }), null); // Missing actor_identity
|
|
|
|
console.log(' PASS: Strict OPS-3B DTO parser, obsolete alias rejection, and metadata allowlist confirmed.');
|
|
|
|
// ============================================================
|
|
// 11 & 12. NO RAW JSON & NO UUID / SECRET LEAKAGE
|
|
// ============================================================
|
|
console.log('Testing 11 & 12: Zero Raw JSON & Zero UUID/Secret Leakage...');
|
|
assert.ok(
|
|
!auditSource.includes('JSON.stringify(event.metadata'),
|
|
'Audit table must not dump raw JSON blobs'
|
|
);
|
|
console.log(' PASS: Zero raw JSON blobs or sensitive UUIDs/IPs/tokens leaked.');
|
|
|
|
// ============================================================
|
|
// 13 & 14. NO RETIRED ADMIN APIS & NO RIDER PRIVATE DATA
|
|
// ============================================================
|
|
console.log('Testing 13 & 14: Zero Retired APIs & Zero Rider Data...');
|
|
const opsDir = path.resolve(__dirname, '../components/ops');
|
|
const allOpsFiles = fs.readdirSync(opsDir);
|
|
|
|
for (const file of allOpsFiles) {
|
|
const content = fs.readFileSync(path.join(opsDir, file), 'utf8');
|
|
assert.ok(!content.includes('/api/admin'), `${file} must not reference /api/admin`);
|
|
assert.ok(!content.includes('/api/v1/admin'), `${file} must not reference /api/v1/admin`);
|
|
assert.ok(!content.includes('AdminConsole'), `${file} must not reference AdminConsole`);
|
|
assert.ok(!content.includes('rider_id'), `${file} must not reference rider_id`);
|
|
assert.ok(!/\bvin\b/i.test(content), `${file} must not reference VIN`);
|
|
assert.ok(!content.includes('telemetry_points'), `${file} must not reference telemetry_points`);
|
|
}
|
|
console.log(' PASS: All Operations components free of retired admin APIs and rider data.');
|
|
|
|
// ============================================================
|
|
// 15. OPERATORS CLEAN PLACEHOLDER
|
|
// ============================================================
|
|
console.log('Testing 15: Operators Clean Placeholder...');
|
|
const operatorsSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-operators.tsx'), 'utf8');
|
|
|
|
assert.ok(
|
|
operatorsSource.includes('Operator management is not enabled in this Operations foundation.'),
|
|
'Operators component must display exact placeholder notice'
|
|
);
|
|
assert.ok(
|
|
!operatorsSource.includes('Add Operator') && !operatorsSource.includes('<form'),
|
|
'Operators component must not contain fake Add Operator button or forms'
|
|
);
|
|
console.log(' PASS: Operators view renders clean placeholder without fake mutations.');
|
|
|
|
// ============================================================
|
|
// 16. MY SESSION VIEW
|
|
// ============================================================
|
|
console.log('Testing 16: My Session View...');
|
|
const sessionSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-session.tsx'), 'utf8');
|
|
|
|
assert.ok(
|
|
sessionSource.includes('Verified Identity') &&
|
|
sessionSource.includes('Operations Role') &&
|
|
sessionSource.includes('Session Status') &&
|
|
sessionSource.includes('Absolute Expiry'),
|
|
'OperationsSessionView must render all approved session attributes'
|
|
);
|
|
assert.ok(
|
|
sessionSource.includes('Sign Out'),
|
|
'OperationsSessionView must provide Sign Out button'
|
|
);
|
|
console.log(' PASS: Session view displays approved metadata and Sign Out action.');
|
|
|
|
// ============================================================
|
|
// 17. BACKEND SESSION REVOCATION ON LOGOUT (OPS-3C.2)
|
|
// ============================================================
|
|
console.log('Testing 17: Backend Session Revocation on Logout (OPS-3C.2)...');
|
|
const logoutRouteSource = fs.readFileSync(path.resolve(__dirname, '../app/api/ops/auth/logout/route.ts'), 'utf8');
|
|
|
|
assert.ok(
|
|
logoutRouteSource.includes('DELETE') && logoutRouteSource.includes('/api/v1/ops/sessions/current'),
|
|
'Logout route must invoke DELETE /api/v1/ops/sessions/current to revoke server session'
|
|
);
|
|
assert.ok(
|
|
logoutRouteSource.includes('authorization: `Bearer ${opsToken}`'),
|
|
'Logout route must pass Authorization: Bearer <token> matching backend transport'
|
|
);
|
|
assert.ok(
|
|
logoutRouteSource.includes('__Host-motorsignal_ops') && logoutRouteSource.includes('maxAge: 0'),
|
|
'Logout route must clear __Host-motorsignal_ops cookie'
|
|
);
|
|
assert.ok(
|
|
!logoutRouteSource.includes('motorsignal_access_token') && !logoutRouteSource.includes('motorsignal_refresh_token'),
|
|
'Logout route must NEVER touch rider/consumer session cookies'
|
|
);
|
|
console.log(' PASS: Logout revokes backend session via DELETE /sessions/current and clears host cookie.');
|
|
|
|
// ============================================================
|
|
// 18. TWO-STEP BOOTSTRAP: ZERO AUDIT FOR OPERATOR (OPS-3C.2)
|
|
// ============================================================
|
|
console.log('Testing 18: Two-Step Bootstrap & Operator Zero Audit Request (OPS-3C.2)...');
|
|
|
|
// Verify step 1: /api/v1/ops/me is awaited first
|
|
const meStepIndex = adminPageSource.indexOf('/api/v1/ops/me');
|
|
const healthStepIndex = adminPageSource.indexOf('/api/v1/ops/health');
|
|
assert.ok(meStepIndex !== -1 && healthStepIndex !== -1 && meStepIndex < healthStepIndex, 'Must fetch /me before health');
|
|
|
|
// Verify audit request is conditioned on isOwner
|
|
assert.ok(
|
|
adminPageSource.includes('isOwner') &&
|
|
adminPageSource.includes("fetch(`${baseUrl}/api/v1/ops/audit-events`") &&
|
|
adminPageSource.includes('Promise.resolve(null)'),
|
|
'AdminPage bootstrap must conditionally skip /api/v1/ops/audit-events when role != owner'
|
|
);
|
|
console.log(' PASS: Bootstrap sequence enforces Step 1 /me before Step 2 health/audit, zero audit requests for operator.');
|
|
|
|
// ============================================================
|
|
// 19. RESPONSIVENESS & 390PX LAYOUT AUDIT
|
|
// ============================================================
|
|
console.log('Testing 19: Responsive Layout Classes (Desktop, Tablet, 390px)...');
|
|
assert.ok(
|
|
shellSource.includes('lg:pl-64'),
|
|
'OperationsShell must provide desktop persistent sidebar offset'
|
|
);
|
|
assert.ok(
|
|
overviewSource.includes('grid-cols-1') && overviewSource.includes('sm:grid-cols-2') && overviewSource.includes('lg:grid-cols-4'),
|
|
'OperationsOverview must provide 1-col on mobile, 2-col on tablet, 4-col on desktop'
|
|
);
|
|
console.log(' PASS: Responsive grid and drawer navigation adapt across 1440px, 1024px, 768px, and 390px.');
|
|
|
|
// ============================================================
|
|
// 20. SECURITY UX & RUNTIME AUDIT
|
|
console.log('Testing 20: Security UX & Third-Party Runtime Audit...');
|
|
const currentOpsFiles = fs.readdirSync(opsDir);
|
|
for (const file of currentOpsFiles) {
|
|
const content = fs.readFileSync(path.join(opsDir, file), 'utf8');
|
|
assert.ok(!content.includes('localStorage'), `${file} must not use localStorage`);
|
|
assert.ok(!content.includes('sessionStorage'), `${file} must not use sessionStorage`);
|
|
assert.ok(!content.includes('dangerouslySetInnerHTML'), `${file} must not use dangerouslySetInnerHTML`);
|
|
assert.ok(!content.includes('cdn.tailwindcss.com'), `${file} must not reference external CDN`);
|
|
assert.ok(!content.includes('google-analytics'), `${file} must not reference analytics`);
|
|
}
|
|
console.log(' PASS: Zero localStorage/sessionStorage auth, zero dangerouslySetInnerHTML, zero third-party CDNs.');
|
|
|
|
// ============================================================
|
|
// 21. INCIDENTS NAVIGATION PLACEMENT & ROLE VISIBILITY (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 21: Incidents Navigation Placement & Role Accessibility...');
|
|
const sidebarSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-sidebar.tsx'), 'utf8');
|
|
assert.ok(
|
|
sidebarSource.includes("id: 'incidents'") && sidebarSource.includes("label: 'Incidents'"),
|
|
'OperationsSidebar must include Incidents navigation item'
|
|
);
|
|
|
|
// Order check: Overview -> Incidents -> Audit -> Operators -> My Session
|
|
const overviewIdx = sidebarSource.indexOf("id: 'overview'");
|
|
const incidentsIdx = sidebarSource.indexOf("id: 'incidents'");
|
|
const auditIdx = sidebarSource.indexOf("id: 'audit'");
|
|
const operatorsIdx = sidebarSource.indexOf("id: 'operators'");
|
|
const sessionIdx = sidebarSource.indexOf("id: 'session'");
|
|
assert.ok(
|
|
overviewIdx < incidentsIdx && incidentsIdx < auditIdx && auditIdx < operatorsIdx && operatorsIdx < sessionIdx,
|
|
'Navigation items must be strictly ordered: Overview -> Incidents -> Audit -> Operators -> My Session'
|
|
);
|
|
|
|
// Incidents has no role gate badge in sidebar (accessible to both operator and owner)
|
|
const incidentsSection = sidebarSource.substring(incidentsIdx, auditIdx);
|
|
assert.ok(
|
|
!incidentsSection.includes("badge: isOwner ? 'OWNER' : 'RESTRICTED'"),
|
|
'Incidents must be accessible to both operator and owner without restricted badge'
|
|
);
|
|
console.log(' PASS: Incidents placed at position 2, accessible to operator and owner.');
|
|
|
|
// ============================================================
|
|
// 22. CASE REFERENCE FORMAT & IMMUTABILITY (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 22: Case Reference Server Generation & Pattern Validation...');
|
|
const sampleCaseRef = 'OPS-2026-000001';
|
|
const caseRefRegex = /^OPS-\d{4}-\d{6}$/;
|
|
assert.ok(caseRefRegex.test(sampleCaseRef), 'Case reference must match OPS-YYYY-NNNNNN');
|
|
assert.ok(!caseRefRegex.test('INC-1234'), 'Invalid format must be rejected');
|
|
assert.ok(!caseRefRegex.test('OPS-2026-1'), 'Unpadded sequence must be rejected');
|
|
|
|
// Ensure Create Incident form does not provide a case reference input field
|
|
const createIncidentSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-create-incident.tsx'), 'utf8');
|
|
assert.ok(
|
|
!createIncidentSource.includes('case_reference') || !createIncidentSource.includes('input type="text" name="case_reference"'),
|
|
'Create Incident form must NOT accept a client-generated case reference'
|
|
);
|
|
console.log(' PASS: Case references strictly conform to OPS-YYYY-NNNNNN immutable pattern.');
|
|
|
|
// ============================================================
|
|
// 23. INTERNAL UUID ISOLATION (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 23: Internal Database UUID Isolation in Frontend & Sanitizers...');
|
|
const rawBackendIncident = {
|
|
id: '3fa85f64-5717-4562-b3fc-2c963f66afa6',
|
|
case_reference: 'OPS-2026-000042',
|
|
title: 'Database connection pool saturation',
|
|
summary: 'Connection exhaustion under high concurrent load',
|
|
severity: 'high',
|
|
status: 'investigating',
|
|
created_at: '2026-09-10T08:00:00Z',
|
|
updated_at: '2026-09-10T08:15:00Z',
|
|
created_by_operator_id: 'e4d9b1c2-3f4a-5b6c-7d8e-9f0a1b2c3d4e',
|
|
created_by_identity: 'operator@motorsignal.com',
|
|
closed_at: null,
|
|
closed_by_operator_id: null,
|
|
closed_by_identity: null,
|
|
resolution: null,
|
|
};
|
|
|
|
const sanitizedSummary = sanitizeIncidentSummary(rawBackendIncident);
|
|
assert.ok(sanitizedSummary !== null);
|
|
assert.equal(sanitizedSummary.case_reference, 'OPS-2026-000042');
|
|
assert.equal(sanitizedSummary.title, 'Database connection pool saturation');
|
|
assert.equal(sanitizedSummary.severity, 'high');
|
|
assert.equal(sanitizedSummary.status, 'investigating');
|
|
assert.equal(sanitizedSummary.id, undefined, 'Summary DTO must not contain database UUID');
|
|
|
|
const sanitizedDetail = sanitizeIncidentDetail(rawBackendIncident);
|
|
assert.ok(sanitizedDetail !== null);
|
|
assert.equal(sanitizedDetail.case_reference, 'OPS-2026-000042');
|
|
assert.equal(sanitizedDetail.created_by_identity, 'operator@motorsignal.com');
|
|
assert.equal(sanitizedDetail.id, undefined, 'Detail DTO must not contain database UUID');
|
|
assert.equal(sanitizedDetail.created_by_operator_id, undefined, 'Detail DTO must not contain operator UUID');
|
|
console.log(' PASS: Database UUIDs strictly stripped from all Incident DTOs.');
|
|
|
|
// ============================================================
|
|
// 24. INCIDENT SEVERITY ENUMS (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 24: Incident Severity Enums...');
|
|
assert.equal(isValidIncidentSeverity('low'), true);
|
|
assert.equal(isValidIncidentSeverity('medium'), true);
|
|
assert.equal(isValidIncidentSeverity('high'), true);
|
|
assert.equal(isValidIncidentSeverity('critical'), true);
|
|
assert.equal(isValidIncidentSeverity('p0'), false);
|
|
assert.equal(isValidIncidentSeverity('urgent'), false);
|
|
assert.equal(isValidIncidentSeverity('blocker'), false);
|
|
console.log(' PASS: Incident severity strictly locked to low, medium, high, critical.');
|
|
|
|
// ============================================================
|
|
// 25. INCIDENT STATUS ENUMS (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 25: Incident Status Enums...');
|
|
assert.equal(isValidIncidentStatus('open'), true);
|
|
assert.equal(isValidIncidentStatus('investigating'), true);
|
|
assert.equal(isValidIncidentStatus('monitoring'), true);
|
|
assert.equal(isValidIncidentStatus('resolved'), true);
|
|
assert.equal(isValidIncidentStatus('closed'), true);
|
|
assert.equal(isValidIncidentStatus('archived'), true);
|
|
assert.equal(isValidIncidentStatus('pending'), false);
|
|
assert.equal(isValidIncidentStatus('in_progress'), false);
|
|
assert.equal(isValidIncidentStatus('deleted'), false);
|
|
console.log(' PASS: Incident status strictly locked to 6 approved lifecycle states.');
|
|
|
|
// ============================================================
|
|
// 26. STATUS TRANSITION STATE MACHINE & ROLE MATRIX (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 26: Status Transition State Machine & Role Restrictions...');
|
|
|
|
// Operator transitions
|
|
assert.equal(isValidStatusTransition('open', 'investigating', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('open', 'resolved', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('open', 'closed', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('investigating', 'monitoring', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('investigating', 'resolved', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('investigating', 'closed', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('monitoring', 'investigating', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('monitoring', 'resolved', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('monitoring', 'closed', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('resolved', 'investigating', 'operator'), true);
|
|
assert.equal(isValidStatusTransition('resolved', 'closed', 'operator'), true);
|
|
|
|
// Forbidden operator transitions
|
|
assert.equal(isValidStatusTransition('closed', 'investigating', 'operator'), false, 'Operator cannot reopen closed incident');
|
|
assert.equal(isValidStatusTransition('open', 'archived', 'operator'), false, 'Operator cannot archive incident');
|
|
assert.equal(isValidStatusTransition('investigating', 'archived', 'operator'), false, 'Operator cannot archive incident');
|
|
assert.equal(isValidStatusTransition('closed', 'archived', 'operator'), false, 'Operator cannot archive incident');
|
|
|
|
// Owner capabilities
|
|
assert.equal(isValidStatusTransition('closed', 'investigating', 'owner'), true, 'Owner can reopen closed incident');
|
|
assert.equal(isValidStatusTransition('open', 'archived', 'owner'), true, 'Owner can archive incident');
|
|
assert.equal(isValidStatusTransition('investigating', 'archived', 'owner'), true, 'Owner can archive incident');
|
|
assert.equal(isValidStatusTransition('closed', 'archived', 'owner'), true, 'Owner can archive incident');
|
|
|
|
// Terminal archived state
|
|
assert.equal(isValidStatusTransition('archived', 'open', 'owner'), false, 'Archived incident cannot transition to open');
|
|
assert.equal(isValidStatusTransition('archived', 'investigating', 'owner'), false, 'Archived incident cannot transition to investigating');
|
|
assert.equal(isValidStatusTransition('archived', 'closed', 'owner'), false, 'Archived incident cannot transition to closed');
|
|
console.log(' PASS: State machine guarantees strict role boundaries (Reopen/Archive = Owner Only).');
|
|
|
|
// ============================================================
|
|
// 27. APPEND-ONLY NOTES VALIDATION (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 27: Append-Only Notes Sanitization & Plain Text Contract...');
|
|
const rawNote = {
|
|
id: '7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e',
|
|
incident_id: '3fa85f64-5717-4562-b3fc-2c963f66afa6',
|
|
created_at: '2026-09-10T08:20:00Z',
|
|
created_by_operator_id: 'e4d9b1c2-3f4a-5b6c-7d8e-9f0a1b2c3d4e',
|
|
created_by_identity: 'operator@motorsignal.com',
|
|
body: 'Scaled up replica count from 2 to 6. Ingress latency normalized to 14ms.',
|
|
};
|
|
|
|
const sanitizedNote = sanitizeIncidentNote(rawNote);
|
|
assert.ok(sanitizedNote !== null);
|
|
assert.equal(sanitizedNote.created_by_identity, 'operator@motorsignal.com');
|
|
assert.equal(sanitizedNote.body, 'Scaled up replica count from 2 to 6. Ingress latency normalized to 14ms.');
|
|
assert.equal(sanitizedNote.id, undefined, 'Note DTO must not expose internal note UUID');
|
|
assert.equal(sanitizedNote.incident_id, undefined, 'Note DTO must not expose incident UUID');
|
|
assert.equal(sanitizedNote.created_by_operator_id, undefined, 'Note DTO must not expose operator UUID');
|
|
|
|
// Fail closed on invalid note
|
|
assert.equal(sanitizeIncidentNote(null), null);
|
|
assert.equal(sanitizeIncidentNote({ body: 'test' }), null, 'Missing created_by_identity must fail closed');
|
|
assert.equal(sanitizeIncidentNote({ created_by_identity: 'op', body: '' }), null, 'Empty body must fail closed');
|
|
console.log(' PASS: Notes DTOs strictly validated and internal UUIDs sanitized.');
|
|
|
|
// ============================================================
|
|
// 28. NO EDIT / NO DELETE FOR NOTES (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 28: No Note Edit or Deletion Endpoints in Codebase...');
|
|
const incidentNotesRoutePath = path.resolve(__dirname, '../app/api/ops/incidents/[caseRef]/notes/route.ts');
|
|
const incidentNotesRouteSource = fs.readFileSync(incidentNotesRoutePath, 'utf8');
|
|
|
|
assert.ok(
|
|
incidentNotesRouteSource.includes('export async function GET') &&
|
|
incidentNotesRouteSource.includes('export async function POST'),
|
|
'Notes route must implement GET and POST'
|
|
);
|
|
assert.ok(
|
|
!incidentNotesRouteSource.includes('export async function PUT') &&
|
|
!incidentNotesRouteSource.includes('export async function PATCH') &&
|
|
!incidentNotesRouteSource.includes('export async function DELETE'),
|
|
'Notes route must strictly FORBID PUT, PATCH, and DELETE (append-only contract)'
|
|
);
|
|
console.log(' PASS: Notes are strictly append-only with zero edit or delete endpoints.');
|
|
|
|
// ============================================================
|
|
// 29. NEXT.JS PROXY ROUTES AUTH BOUNDARY (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 29: Next.js API Incidents Proxy Routes Auth Enforcement...');
|
|
const incidentsRouteSource = fs.readFileSync(path.resolve(__dirname, '../app/api/ops/incidents/route.ts'), 'utf8');
|
|
const incidentDetailRouteSource = fs.readFileSync(path.resolve(__dirname, '../app/api/ops/incidents/[caseRef]/route.ts'), 'utf8');
|
|
|
|
assert.ok(
|
|
incidentsRouteSource.includes('__Host-motorsignal_ops') &&
|
|
incidentDetailRouteSource.includes('__Host-motorsignal_ops') &&
|
|
incidentNotesRouteSource.includes('__Host-motorsignal_ops'),
|
|
'All incidents API proxy routes must enforce __Host-motorsignal_ops session token'
|
|
);
|
|
assert.ok(
|
|
!incidentsRouteSource.includes('preview=') &&
|
|
!incidentDetailRouteSource.includes('preview='),
|
|
'Proxy routes must have zero preview query authentication bypass'
|
|
);
|
|
console.log(' PASS: All incident proxy routes require verified Operations host session.');
|
|
|
|
// ============================================================
|
|
// 30. ACCESSIBLE CONFIRMATION MODAL CONTRACT (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 30: Incident Modal Accessibility & Resolution Validation...');
|
|
const modalSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-incident-modal.tsx'), 'utf8');
|
|
assert.ok(modalSource.includes('aria-modal="true"'), 'Modal must declare aria-modal="true"');
|
|
assert.ok(modalSource.includes('role="dialog"'), 'Modal must declare role="dialog"');
|
|
assert.ok(modalSource.includes("e.key === 'Escape'"), 'Modal must handle Escape key');
|
|
assert.ok(
|
|
modalSource.includes('caseReference'),
|
|
'Modal must render case reference string'
|
|
);
|
|
assert.ok(
|
|
modalSource.includes('resolution.trim()'),
|
|
'Modal must validate that resolution text is non-empty before close'
|
|
);
|
|
console.log(' PASS: Modal provides accessible dialog semantics, Escape key handling, and resolution validation.');
|
|
|
|
// ============================================================
|
|
// 31. DENSE INCIDENT LIST UI CONTRACT (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 31: Dense Incident List Table & Mobile Stacked Cards...');
|
|
const listSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-incidents-list.tsx'), 'utf8');
|
|
assert.ok(listSource.includes('hidden md:block'), 'List must render table on desktop');
|
|
assert.ok(listSource.includes('md:hidden'), 'List must render stacked cards on mobile');
|
|
assert.ok(listSource.includes('CASE'), 'Table must contain CASE column');
|
|
assert.ok(listSource.includes('TITLE'), 'Table must contain TITLE column');
|
|
assert.ok(listSource.includes('SEVERITY'), 'Table must contain SEVERITY column');
|
|
assert.ok(listSource.includes('STATUS'), 'Table must contain STATUS column');
|
|
assert.ok(listSource.includes('UPDATED'), 'Table must contain UPDATED column');
|
|
assert.ok(listSource.includes('CREATED'), 'Table must contain CREATED column');
|
|
console.log(' PASS: List provides dense desktop table and mobile stacked card layout.');
|
|
|
|
// ============================================================
|
|
// 32. INCIDENT DETAIL UI SECTIONS (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 32: Incident Detail UI Structure & Plain-Text Notes...');
|
|
const detailSource = fs.readFileSync(path.resolve(__dirname, '../components/ops/operations-incident-detail.tsx'), 'utf8');
|
|
assert.ok(detailSource.includes('Operational Timeline'), 'Detail must include Operational Timeline');
|
|
assert.ok(detailSource.includes('Operator Notes'), 'Detail must include Operator Notes');
|
|
assert.ok(detailSource.includes('Incident Summary'), 'Detail must include Incident Summary');
|
|
assert.ok(detailSource.includes('Resolution Record') || detailSource.includes('resolution'), 'Detail must support resolution section');
|
|
assert.ok(detailSource.includes('whitespace-pre-wrap'), 'Notes and summaries must preserve plain text formatting');
|
|
console.log(' PASS: Incident Detail UI includes all required operational sections.');
|
|
|
|
// ============================================================
|
|
// 33. ZERO POLLING VERIFICATION (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 33: Zero Polling Verification Across Operations UI...');
|
|
for (const file of currentOpsFiles) {
|
|
const content = fs.readFileSync(path.join(opsDir, file), 'utf8');
|
|
assert.ok(!content.includes('setInterval'), `${file} must NOT contain setInterval polling`);
|
|
assert.ok(!content.includes('setTimeout(') || content.includes('setTimeout(() => setMutationSuccess') || content.includes('setTimeout(() =>'), `${file} must only use setTimeout for UI transitions, not polling`);
|
|
}
|
|
console.log(' PASS: Zero automatic background polling across all Operations components.');
|
|
|
|
// ============================================================
|
|
// 34. ZERO RIDER DATA CROSSOVER (OPS-4)
|
|
// ============================================================
|
|
console.log('Testing 34: Zero Rider Data Crossover in Operations Incidents...');
|
|
for (const file of currentOpsFiles) {
|
|
const content = fs.readFileSync(path.join(opsDir, file), 'utf8');
|
|
assert.ok(!content.includes('telemetry_points'), `${file} must not reference telemetry`);
|
|
assert.ok(!content.includes('user_id'), `${file} must not expose consumer user_id`);
|
|
assert.ok(!content.includes('vehicle_id'), `${file} must not reference vehicle_id`);
|
|
assert.ok(!/\bvin\b/i.test(content), `${file} must not reference VIN`);
|
|
assert.ok(!content.includes('/api/v1/rides') && !content.includes('/api/rides'), `${file} must not query consumer rides`);
|
|
}
|
|
console.log(' PASS: Operations Incident system strictly isolated from rider and vehicle data.');
|
|
|
|
// ============================================================
|
|
// ============================================================
|
|
// 36. CSRF & SAME-ORIGIN VALIDATION ON MUTATIONS (OPS-4.2)
|
|
// ============================================================
|
|
console.log('Testing 36: CSRF & Same-Origin Enforcement on State-Changing Incident Proxy Routes (OPS-4.2)...');
|
|
const incidentsRouteSrc = fs.readFileSync(path.resolve(__dirname, '../app/api/ops/incidents/route.ts'), 'utf8');
|
|
const incidentDetailRouteSrc = fs.readFileSync(path.resolve(__dirname, '../app/api/ops/incidents/[caseRef]/route.ts'), 'utf8');
|
|
const incidentNotesRouteSrc = fs.readFileSync(path.resolve(__dirname, '../app/api/ops/incidents/[caseRef]/notes/route.ts'), 'utf8');
|
|
|
|
assert.ok(
|
|
incidentsRouteSrc.includes('hasValidOrigin(request)') && incidentsRouteSrc.includes("detail: 'Invalid request origin.'"),
|
|
'POST /api/ops/incidents must enforce hasValidOrigin and reject with 403 on invalid origin'
|
|
);
|
|
assert.ok(
|
|
incidentDetailRouteSrc.includes('hasValidOrigin(request)') && incidentDetailRouteSrc.includes("detail: 'Invalid request origin.'"),
|
|
'PATCH /api/ops/incidents/[caseRef] must enforce hasValidOrigin and reject with 403 on invalid origin'
|
|
);
|
|
assert.ok(
|
|
incidentNotesRouteSrc.includes('hasValidOrigin(request)') && incidentNotesRouteSrc.includes("detail: 'Invalid request origin.'"),
|
|
'POST /api/ops/incidents/[caseRef]/notes must enforce hasValidOrigin and reject with 403 on invalid origin'
|
|
);
|
|
console.log(' PASS: All 3 state-changing incident proxy routes enforce same-origin CSRF protection.');
|
|
|
|
// ============================================================
|
|
// 37. SAME-ORIGIN HELPER BEHAVIOR FOR OPS MUTATIONS (OPS-4.2)
|
|
// ============================================================
|
|
console.log('Testing 37: hasValidOrigin Security Matrix (OPS-4.2)...');
|
|
const requestOriginModule = loadTsModule('../lib/request-origin.ts');
|
|
const { hasValidOrigin } = requestOriginModule;
|
|
|
|
// Mock NextRequest objects
|
|
function createMockRequest(headers) {
|
|
return {
|
|
headers: {
|
|
get: (k) => headers[k.toLowerCase()] || null,
|
|
},
|
|
nextUrl: {
|
|
protocol: 'https:',
|
|
},
|
|
};
|
|
}
|
|
|
|
// Same origin
|
|
assert.equal(
|
|
hasValidOrigin(createMockRequest({
|
|
origin: 'https://motorsignal.app',
|
|
host: 'motorsignal.app',
|
|
'x-forwarded-proto': 'https',
|
|
})),
|
|
true,
|
|
'Valid same-origin request must pass'
|
|
);
|
|
|
|
// Cross origin attacker
|
|
assert.equal(
|
|
hasValidOrigin(createMockRequest({
|
|
origin: 'https://evil-attacker.com',
|
|
host: 'motorsignal.app',
|
|
'x-forwarded-proto': 'https',
|
|
})),
|
|
false,
|
|
'Cross-origin attacker origin must be rejected'
|
|
);
|
|
|
|
// Missing origin header
|
|
assert.equal(
|
|
hasValidOrigin(createMockRequest({
|
|
host: 'motorsignal.app',
|
|
'x-forwarded-proto': 'https',
|
|
})),
|
|
false,
|
|
'Missing origin header must be rejected on mutations'
|
|
);
|
|
|
|
// Protocol mismatch (http origin to https host)
|
|
assert.equal(
|
|
hasValidOrigin(createMockRequest({
|
|
origin: 'http://motorsignal.app',
|
|
host: 'motorsignal.app',
|
|
'x-forwarded-proto': 'https',
|
|
})),
|
|
false,
|
|
'Protocol downgrade/mismatch must be rejected'
|
|
);
|
|
|
|
console.log(' PASS: hasValidOrigin rejects cross-origin, missing-origin, and protocol-mismatched requests.');
|
|
|
|
// ============================================================
|
|
// 38. GET PROXY ROUTES UNAFFECTED (OPS-4.2)
|
|
// ============================================================
|
|
console.log('Testing 38: GET Proxy Routes Unaffected by Origin Barrier (OPS-4.2)...');
|
|
// Ensure GET handlers do not block on origin
|
|
const getIncidentMatch = incidentsRouteSrc.match(/export async function GET[\s\S]*?export async function POST/);
|
|
assert.ok(getIncidentMatch && !getIncidentMatch[0].includes('hasValidOrigin'), 'GET incidents must not require origin');
|
|
|
|
const getDetailMatch = incidentDetailRouteSrc.match(/export async function GET[\s\S]*?export async function PATCH/);
|
|
assert.ok(getDetailMatch && !getDetailMatch[0].includes('hasValidOrigin'), 'GET incident detail must not require origin');
|
|
|
|
const getNotesMatch = incidentNotesRouteSrc.match(/export async function GET[\s\S]*?export async function POST/);
|
|
assert.ok(getNotesMatch && !getNotesMatch[0].includes('hasValidOrigin'), 'GET notes must not require origin');
|
|
|
|
console.log(' PASS: Read-only GET operations are unaffected while mutations require valid origin.');
|
|
|
|
console.log('--- ALL OPS-3C, OPS-3C.1, OPS-3C.2, OPS-3C.3, OPS-4 & OPS-4.2 TESTS PASSED (38/38) ---');
|