mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases 2 Wiki Activity

fix(#411): complete 2026-02-17 remediation sweep

Browse Source 
Apply RLS context at task service boundaries, harden orchestrator/web integration and session startup behavior, re-enable targeted frontend tests, and lock vulnerable transitive dependencies so QA and security gates pass cleanly.
This commit is contained in:
Jason Woltje
2026-02-17 14:19:15 -06:00
parent 254f85369b
commit cab8d690ab
22 changed files with 605 additions and 744 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
apps/api/src/tasks/tasks.controller.spec.ts
View File

@@ -25,6 +25,8 @@ describe("TasksController", () => {
const request = context.switchToHttp().getRequest();
request.user = {
id: "550e8400-e29b-41d4-a716-446655440002",
email: "test@example.com",
name: "Test User",
workspaceId: "550e8400-e29b-41d4-a716-446655440001",
};
return true;
@@ -46,6 +48,8 @@ describe("TasksController", () => {
const mockRequest = {
user: {
id: mockUserId,
email: "test@example.com",
name: "Test User",
workspaceId: mockWorkspaceId,
},
};
@@ -132,13 +136,16 @@ describe("TasksController", () => {
mockTasksService.findAll.mockResolvedValue(paginatedResult);
const result = await controller.findAll(query, mockWorkspaceId);
const result = await controller.findAll(query, mockWorkspaceId, mockRequest.user);
expect(result).toEqual(paginatedResult);
expect(service.findAll).toHaveBeenCalledWith({
...query,
workspaceId: mockWorkspaceId,
});
expect(service.findAll).toHaveBeenCalledWith(
{
...query,
workspaceId: mockWorkspaceId,
},
mockUserId
);
});
it("should extract workspaceId from request.user if not in query", async () => {
@@ -149,12 +156,13 @@ describe("TasksController", () => {
meta: { total: 0, page: 1, limit: 50, totalPages: 0 },
});
await controller.findAll(query as any, mockWorkspaceId);
await controller.findAll(query as any, mockWorkspaceId, mockRequest.user);
expect(service.findAll).toHaveBeenCalledWith(
expect.objectContaining({
workspaceId: mockWorkspaceId,
})
}),
mockUserId
);
});
});
@@ -163,10 +171,10 @@ describe("TasksController", () => {
it("should return a task by id", async () => {
mockTasksService.findOne.mockResolvedValue(mockTask);
const result = await controller.findOne(mockTaskId, mockWorkspaceId);
const result = await controller.findOne(mockTaskId, mockWorkspaceId, mockRequest.user);
expect(result).toEqual(mockTask);
expect(service.findOne).toHaveBeenCalledWith(mockTaskId, mockWorkspaceId);
expect(service.findOne).toHaveBeenCalledWith(mockTaskId, mockWorkspaceId, mockUserId);
});
it("should throw error if workspaceId not found", async () => {
@@ -175,10 +183,10 @@ describe("TasksController", () => {
// We can test that the controller properly uses the provided workspaceId instead
mockTasksService.findOne.mockResolvedValue(mockTask);
const result = await controller.findOne(mockTaskId, mockWorkspaceId);
const result = await controller.findOne(mockTaskId, mockWorkspaceId, mockRequest.user);
expect(result).toEqual(mockTask);
expect(service.findOne).toHaveBeenCalledWith(mockTaskId, mockWorkspaceId);
expect(service.findOne).toHaveBeenCalledWith(mockTaskId, mockWorkspaceId, mockUserId);
});
});