From e105dce9de12a48510fad2182e8502c741897c50 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Thu, 11 Jun 2026 02:24:11 -0400 Subject: [PATCH] docs(07): mark CR-01 resolved in review report --- .planning/phases/07-mobile-test-harness/07-REVIEW.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.planning/phases/07-mobile-test-harness/07-REVIEW.md b/.planning/phases/07-mobile-test-harness/07-REVIEW.md index 972bccf..595ae0b 100644 --- a/.planning/phases/07-mobile-test-harness/07-REVIEW.md +++ b/.planning/phases/07-mobile-test-harness/07-REVIEW.md @@ -16,7 +16,8 @@ files_reviewed_list: - package.json - .gitignore findings: - critical: 1 + critical: 0 + critical_resolved: 1 warning: 7 info: 4 total: 12 @@ -40,7 +41,9 @@ The dominant defect is **missing seed safety guardrails**: `global-setup.ts` iss ## Critical Issues -### CR-01: globalSetup truncates the DB with no production / test-environment guard +### CR-01: globalSetup truncates the DB with no production / test-environment guard — ✅ RESOLVED (commit fcc680e) + +**Resolution:** Fail-closed guard added at the top of `global-setup.ts` (Step 0) — hard `NODE_ENV==='production'` check first, then `DEV_AUTH_BYPASS!=='true'` refusal, before opening any DB connection. README updated with the test-process env requirement. Verified: guard throws without `DEV_AUTH_BYPASS`; full 58-test suite passes with it. **File:** `apps/pwa/e2e/global-setup.ts:50-65` **Issue:** The setup connects using `DB_*` env vars (each defaulting silently — `DB_HOST` to `127.0.0.1`, `DB_NAME` to `familysync`, `DB_PASSWORD` to empty string) and immediately runs `SET FOREIGN_KEY_CHECKS=0` followed by four `TRUNCATE TABLE` statements. There is **no guard** that: