iven
|
c37c7218c2
|
test(saas): add 36 security/validation/permission tests (184 total, 0 failures)
CI / Lint & TypeCheck (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
CI / Build Frontend (push) Has been cancelled
CI / Rust Check (push) Has been cancelled
CI / Security Scan (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
New test files:
- auth_security_test.rs (12): account lockout DB state, lockout reset,
password version invalidation, disabled account, refresh token
revocation, boundary validation (username/password), role enforcement,
TOTP 2FA flow
- account_security_test.rs (9): role management, privilege escalation
prevention, account disable/enable, cross-account access control,
operation logs
- relay_validation_test.rs (8): input validation (missing fields, empty
messages, invalid roles), disabled provider, model listing, task
isolation
- permission_matrix_test.rs (7): super_admin full access, user allowed/
forbidden endpoints, public endpoints, unauthenticated rejection,
API token lifecycle
Discovered: account lockout runtime check broken — handlers.rs:213
parse_from_rfc3339 fails on PostgreSQL TIMESTAMPTZ::TEXT format,
silently skipping lockout. DB state is correct but login not rejected.
|
2026-04-10 08:11:02 +08:00 |
|