style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -3,7 +3,7 @@ phase: 07-mobile-test-harness
|
||||
plan: 04
|
||||
type: execute
|
||||
wave: 3
|
||||
depends_on: ["07-01", "07-02"]
|
||||
depends_on: ['07-01', '07-02']
|
||||
files_modified:
|
||||
- apps/pwa/e2e/calendar.spec.ts
|
||||
- apps/pwa/e2e/lists.spec.ts
|
||||
@@ -17,23 +17,23 @@ must_haves:
|
||||
- "On both profiles, /calendar error state (API mocked to 500) shows the 'Couldn't load events' heading and a Retry button >=44px, with no horizontal overflow"
|
||||
- "On both profiles, /lists renders the populated (seeded) list: the 'E2E Grocery List' card is visible and ListsEmptyState 'No lists yet' is NOT present"
|
||||
- "On both profiles, /lists empty state (after seed teardown) shows 'No lists yet' + 'Tap + to create...'"
|
||||
- "The authed PWA is reached via DEV_AUTH_BYPASS — no Authelia login page, no OIDC mock — and the run produces no SW-sourced responses"
|
||||
- 'The authed PWA is reached via DEV_AUTH_BYPASS — no Authelia login page, no OIDC mock — and the run produces no SW-sourced responses'
|
||||
artifacts:
|
||||
- path: "apps/pwa/e2e/calendar.spec.ts"
|
||||
provides: "Calendar populated + empty + error states (UI-SPEC Rules 4/5) + auth-bypass precondition assertion"
|
||||
- path: 'apps/pwa/e2e/calendar.spec.ts'
|
||||
provides: 'Calendar populated + empty + error states (UI-SPEC Rules 4/5) + auth-bypass precondition assertion'
|
||||
contains: "Couldn't load events"
|
||||
- path: "apps/pwa/e2e/lists.spec.ts"
|
||||
provides: "Lists populated + empty states (UI-SPEC Rules 4/5)"
|
||||
contains: "No lists yet"
|
||||
- path: 'apps/pwa/e2e/lists.spec.ts'
|
||||
provides: 'Lists populated + empty states (UI-SPEC Rules 4/5)'
|
||||
contains: 'No lists yet'
|
||||
key_links:
|
||||
- from: "apps/pwa/e2e/calendar.spec.ts"
|
||||
- from: 'apps/pwa/e2e/calendar.spec.ts'
|
||||
to: "page.route('/api/events*') fulfill 500"
|
||||
via: "error-state simulation registered before goto"
|
||||
pattern: "page.route"
|
||||
- from: "apps/pwa/e2e/lists.spec.ts"
|
||||
via: 'error-state simulation registered before goto'
|
||||
pattern: 'page.route'
|
||||
- from: 'apps/pwa/e2e/lists.spec.ts'
|
||||
to: "seeded 'E2E Grocery List' card (role=listitem / link 'Open list: ...')"
|
||||
via: "getByRole / getByText on seeded data"
|
||||
pattern: "E2E Grocery List"
|
||||
via: 'getByRole / getByText on seeded data'
|
||||
pattern: 'E2E Grocery List'
|
||||
---
|
||||
|
||||
<objective>
|
||||
@@ -132,20 +132,22 @@ Output: `apps/pwa/e2e/calendar.spec.ts`, `apps/pwa/e2e/lists.spec.ts`.
|
||||
</tasks>
|
||||
|
||||
<threat_model>
|
||||
|
||||
## Trust Boundaries
|
||||
|
||||
| Boundary | Description |
|
||||
|----------|-------------|
|
||||
| spec → dev PWA/API | Playwright drives the authed PWA via DEV_AUTH_BYPASS; read-only assertions + in-process page.route mocks; no real form writes |
|
||||
| harness → production | the auth posture asserted here (dev bypass) must never be the production posture |
|
||||
| Boundary | Description |
|
||||
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
|
||||
| spec → dev PWA/API | Playwright drives the authed PWA via DEV_AUTH_BYPASS; read-only assertions + in-process page.route mocks; no real form writes |
|
||||
| harness → production | the auth posture asserted here (dev bypass) must never be the production posture |
|
||||
|
||||
## STRIDE Threat Register
|
||||
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
|-----------|----------|-----------|-------------|-----------------|
|
||||
| T-07-09 | Elevation of Privilege | DEV_AUTH_BYPASS reaching production | mitigate | The spec asserts the authed PWA was reached via the bypass on the DEV stack only; the bypass is API-side and guarded by `NODE_ENV !== 'production'` (devBypass.ts). Production compose must not set it (documented in Plan 02 README). The spec does not enable the bypass; it depends on the dev stack having it. |
|
||||
| T-07-10 | Spoofing | OIDC/auth mocking masking a broken auth path | accept (designed out) | No OIDC mock is used (D-01) — auth comes from the real dev-bypass middleware; the auth-precondition test asserts genuine authed content, not a faked session. |
|
||||
| T-07-11 | Tampering | page.route mocks leaking between tests | mitigate | Every `page.route` (events 500, lists empty) is paired with `page.unroute` (or `{ times }`) so the mock does not bleed into the populated/auth tests; the shared seeded DB is never mutated by a spec (empty state is network-simulated, not a DB delete). |
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
| --------- | ---------------------- | -------------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| T-07-09 | Elevation of Privilege | DEV_AUTH_BYPASS reaching production | mitigate | The spec asserts the authed PWA was reached via the bypass on the DEV stack only; the bypass is API-side and guarded by `NODE_ENV !== 'production'` (devBypass.ts). Production compose must not set it (documented in Plan 02 README). The spec does not enable the bypass; it depends on the dev stack having it. |
|
||||
| T-07-10 | Spoofing | OIDC/auth mocking masking a broken auth path | accept (designed out) | No OIDC mock is used (D-01) — auth comes from the real dev-bypass middleware; the auth-precondition test asserts genuine authed content, not a faked session. |
|
||||
| T-07-11 | Tampering | page.route mocks leaking between tests | mitigate | Every `page.route` (events 500, lists empty) is paired with `page.unroute` (or `{ times }`) so the mock does not bleed into the populated/auth tests; the shared seeded DB is never mutated by a spec (empty state is network-simulated, not a DB delete). |
|
||||
|
||||
</threat_model>
|
||||
|
||||
<verification>
|
||||
@@ -156,10 +158,11 @@ Output: `apps/pwa/e2e/calendar.spec.ts`, `apps/pwa/e2e/lists.spec.ts`.
|
||||
</verification>
|
||||
|
||||
<success_criteria>
|
||||
|
||||
- calendar.spec.ts + lists.spec.ts cover populated / empty / error states on both profiles (UI-SPEC Rules 4/5).
|
||||
- TEST-02 precondition (authed reach via DEV_AUTH_BYPASS, no OIDC mock, no SW controller) asserted at runtime.
|
||||
- Mocks are scoped and unrouted; seeded data is left intact.
|
||||
</success_criteria>
|
||||
</success_criteria>
|
||||
|
||||
<output>
|
||||
Create `.planning/phases/07-mobile-test-harness/07-04-SUMMARY.md` when done.
|
||||
|
||||
Reference in New Issue
Block a user