mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 17:46:06 +00:00
yusufipk
0187db5dc7
Second pass over the suite, driven by the inventory in the gaps document. Nine agents wrote suites in parallel against private databases, then a tenth read all of it adversarially and five of its findings were fixed. unit + component 2076 -> 2079 (+888 over the round) api 647 -> 1015 e2e 18 -> 29 What was closed: - lib/route-access.ts, the page-level authorization layer, went from zero tests to 48. Every API route was guarded and none of the pages were. - The five media proxy routes now have a real 2xx beside every 403. The blocker was the positive control, solved by stubbing r2Client.send() and leaving lib/r2-media-proxy.ts itself real. - Every remaining server-side lib module: invitations, email verification, the upload tokens, the logger, request origin, the whole R2 and Bunny lifecycle, notifications and admin stats. - Six video-page hooks, and the chunking arithmetic extracted out of lib/client/r2-video-upload.ts as a pure module. - Five end-to-end flows: workspace members, bulk operations, the admin area, player interaction and failure recovery. Three things about the harness itself turned out to be wrong: - Two @/lib/r2 stubs in tests/setup/api.ts had the wrong return shape, so every route reaching finalizeR2VideoUpload silently took the "not a valid video" branch and no test noticed. - The auth matrix asserted only "not 2xx", which two entries satisfied without their guard existing. It now requires 401 or 403, which makes both load-bearing, and all 60 routes pass the stricter form. - Both admin API routes had no positive control anywhere: replacing their guard with an unconditional refusal left the entire suite green. Found by the adversarial review, now covered. Process: - bun run test:mutation runs StrykerJS over the authorization and validation modules. Diagnostic, not a gate, weekly in CI rather than on a push. - playwright.config.ts gains an opt-in webkit project for the player spec. - AGENTS.md now requires a batch of new tests to be reviewed by somebody who did not write them. Only two production files change, both deliberate: lib/auth.ts loses a verbatim copy of its own permission formulas, and lib/client/r2-video-upload.ts calls the extracted arithmetic. No behaviour change in either.
123 lines
4.0 KiB
JSON
123 lines
4.0 KiB
JSON
{
|
|
"name": "openframe",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"prebuild": "bun run typecheck",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"start:docker": "sh ./scripts/docker-entrypoint.sh",
|
|
"lint": "eslint --max-warnings=0",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check .",
|
|
"typecheck": "tsc --noEmit",
|
|
"check": "bun run lint && bun run format:check && bun run typecheck",
|
|
"test": "vitest run --project unit --project component",
|
|
"test:watch": "vitest --project unit --project component",
|
|
"test:api": "vitest run --project api",
|
|
"test:e2e": "playwright test",
|
|
"test:all": "bun run test && bun run test:api && bun run test:e2e",
|
|
"test:coverage": "vitest run --project unit --coverage",
|
|
"test:mutation": "node node_modules/@stryker-mutator/core/bin/stryker.js run",
|
|
"verify": "bun run check && bun run test",
|
|
"test:db:up": "podman compose -f docker-compose.test.yml up -d --wait postgres-test",
|
|
"test:db:down": "podman compose -f docker-compose.test.yml down -v",
|
|
"test:db:bootstrap": "bun run scripts/test-db-bootstrap.ts",
|
|
"prepare": "husky",
|
|
"postinstall": "prisma generate",
|
|
"db:generate": "prisma generate",
|
|
"db:push": "prisma db push",
|
|
"db:migrate": "prisma migrate deploy",
|
|
"db:seed": "prisma db seed",
|
|
"db:setup": "bun run db:generate && bun run db:migrate",
|
|
"self-host:bootstrap": "bun run scripts/self-host-bootstrap.ts",
|
|
"r2:configure-cors": "bun run scripts/configure-r2-cors.ts",
|
|
"r2:cleanup-orphans:dry": "bun run scripts/r2-orphan-cleanup.ts --dry-run",
|
|
"r2:cleanup-orphans": "bun run scripts/r2-orphan-cleanup.ts",
|
|
"bunny:cleanup-orphans:dry": "bun run scripts/bunny-orphan-cleanup.ts --dry-run",
|
|
"bunny:cleanup-orphans": "bun run scripts/bunny-orphan-cleanup.ts"
|
|
},
|
|
"dependencies": {
|
|
"@auth/prisma-adapter": "^2.11.1",
|
|
"@aws-sdk/client-s3": "3.1054.0",
|
|
"@aws-sdk/s3-request-presigner": "3.1054.0",
|
|
"@prisma/adapter-pg": "^7.3.0",
|
|
"@prisma/client": "^7.3.0",
|
|
"bcryptjs": "^3.0.3",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"date-fns": "^4.1.0",
|
|
"gsap": "^3.14.2",
|
|
"hls.js": "^1.6.15",
|
|
"lucide-react": "^0.563.0",
|
|
"next": "16.2.11",
|
|
"next-auth": "^5.0.0-beta.30",
|
|
"next-themes": "^0.4.6",
|
|
"nodemailer": "^9.0.1",
|
|
"pg": "^8.18.0",
|
|
"prisma": "^7.3.0",
|
|
"radix-ui": "^1.4.3",
|
|
"react": "19.2.3",
|
|
"react-dom": "19.2.3",
|
|
"react-window": "^2.2.7",
|
|
"sharp": "^0.35.3",
|
|
"sonner": "^2.0.7",
|
|
"stripe": "^20.4.1",
|
|
"tailwind-merge": "^3.4.0",
|
|
"tus-js-client": "^4.3.1",
|
|
"tw-animate-css": "^1.4.0"
|
|
},
|
|
"devDependencies": {
|
|
"@commitlint/cli": "^19.8.1",
|
|
"@commitlint/config-conventional": "^19.8.1",
|
|
"@playwright/test": "1.61.1",
|
|
"@stryker-mutator/core": "^9.6.1",
|
|
"@stryker-mutator/vitest-runner": "^9.6.1",
|
|
"@tailwindcss/postcss": "^4",
|
|
"@testing-library/jest-dom": "^7.0.0",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/bcryptjs": "^3.0.0",
|
|
"@types/node": "^20",
|
|
"@types/nodemailer": "^7.0.9",
|
|
"@types/pg": "^8.16.0",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@vitejs/plugin-react": "^6.0.4",
|
|
"@vitest/coverage-v8": "^4.1.10",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.1.6",
|
|
"eslint-config-prettier": "^10.1.5",
|
|
"husky": "^9.1.7",
|
|
"jsdom": "^29.1.1",
|
|
"lint-staged": "^15.5.1",
|
|
"prettier": "^3.5.3",
|
|
"shadcn": "^3.8.3",
|
|
"tailwindcss": "^4",
|
|
"typescript": "^5",
|
|
"vite-tsconfig-paths": "^6.1.1",
|
|
"vitest": "^4.1.10"
|
|
},
|
|
"lint-staged": {
|
|
"*.{js,jsx,ts,tsx}": [
|
|
"eslint --max-warnings=0 --fix",
|
|
"prettier --write"
|
|
],
|
|
"*.{json,css,md,yml,yaml,mdx}": [
|
|
"prettier --write"
|
|
]
|
|
},
|
|
"overrides": {
|
|
"sharp": "^0.35.3"
|
|
},
|
|
"ignoreScripts": [
|
|
"sharp",
|
|
"unrs-resolver"
|
|
],
|
|
"trustedDependencies": [
|
|
"sharp",
|
|
"unrs-resolver"
|
|
]
|
|
}
|