luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(07): mark CR-01 resolved in review report

Browse Source
This commit is contained in:
Lucas Berger
2026-06-11 02:24:11 -04:00
parent fcc680e553
commit e105dce9de
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/phases/07-mobile-test-harness/07-REVIEW.md
+5 -2
View File
@@ -16,7 +16,8 @@ files_reviewed_list:
- package.json
- .gitignore
findings:
critical: 1
critical: 0
critical_resolved: 1
warning: 7
info: 4
total: 12
@@ -40,7 +41,9 @@ The dominant defect is **missing seed safety guardrails**: `global-setup.ts` iss
## Critical Issues
### CR-01: globalSetup truncates the DB with no production / test-environment guard
### CR-01: globalSetup truncates the DB with no production / test-environment guard — ✅ RESOLVED (commit fcc680e)
**Resolution:** Fail-closed guard added at the top of `global-setup.ts` (Step 0) — hard `NODE_ENV==='production'` check first, then `DEV_AUTH_BYPASS!=='true'` refusal, before opening any DB connection. README updated with the test-process env requirement. Verified: guard throws without `DEV_AUTH_BYPASS`; full 58-test suite passes with it.
**File:** `apps/pwa/e2e/global-setup.ts:50-65`
**Issue:** The setup connects using `DB_*` env vars (each defaulting silently — `DB_HOST` to `127.0.0.1`, `DB_NAME` to `familysync`, `DB_PASSWORD` to empty string) and immediately runs `SET FOREIGN_KEY_CHECKS=0` followed by four `TRUNCATE TABLE` statements. There is **no guard** that: