4 Commits

Include renames

Author	SHA1	Message	Date
Lucas BergerandClaude Opus 4.8	b6490feff4	fix(19): satisfy CI fast-checks + secret scan ... Lint (eslint --max-warnings 0): - index.ts: disable no-unsafe-argument on the type-only Context mismatch when delegating to the OIDC handler inside the local-session skip wrapper - localAuth.ts: handleLogout is sync (no await) — drop async (require-await) - devBypass.ts: disable detect-possible-timing-attacks on the public well-known dev-placeholder string compare (not a secret comparison) - remove dead code / unused bindings flagged by no-unused-vars: makeTestApp (localSession.test), makeUnauthContext + BrowserContext import (login.spec), unused memberId (admin.test), unused txSelectCount counter (me.test) - localAuthMiddleware.test / me.test: fix unused + reflow-detached eslint-disable directives Format: prettier --write across the 20 Phase-19 files that were never formatted. Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key regex hit on "credential atomically, 409-equivalent"). Neither is a real secret. Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks), PWA 266/266, API 452/452. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 23:05:15 -04:00
Lucas BergerandClaude Opus 4.8	7354f3ec4f	fix(12): unblock CI security + harness jobs ... security/gitleaks: allowlist apps/api/tests/routes/setup.test.ts — synthetic VAPID test pair (verified absent from .env), same class as existing fixture allowlist entries. security/audit: waive GHSA-88fw-hqm2-52qc (hono CORS) — not exploitable, the app uses no hono cors() middleware; newly-published vs pinned hono 4.12.23. harness/e2e: seed app_config.setup_complete='true' + a dev-admin credential in global-setup so the Phase-12 setup gate no longer redirects every spec to /setup (was causing all 95 e2e failures) and no onboarding banner renders. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-16 18:24:10 -04:00
Lucas Berger	fba22b445b	chore(16-04): allowlist crypto.test.ts synthetic AES test key in gitleaks config ... - Add 4th [[allowlists]] block for apps/api/tests/broker/crypto.test.ts - Human-verified: TEST_KEY in Vitest beforeAll is a synthetic AES-256-GCM fixture, not a real credential - Original 3 allowlists (VAPID fixture, .env.example, .env.spike) intact	2026-06-13 08:14:26 -04:00
Lucas Berger	2f1592cc45	chore(16-04): add gitleaks config with fixture + env allowlists ... - Add .gitleaks.toml inheriting default ruleset via [extend] useDefault = true - Allowlist apps/api/tests/fixtures/vapid.ts (test-only VAPID keypair) - Allowlist .env.example (intentional placeholder template) - Allowlist apps/api/.env.spike (dev/spike values)	2026-06-13 05:27:54 -04:00