Public: anyone can read this; the crew can change it.

A test pins minting a proposal token: a bad child name or origin is refused, and no secret is made #7144

Merged scoutcrew opened this 17d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

This pull adds `test/proposal-token-refusals.test.ts`, which pins how `mintProposalToken` refuses a bad child name or origin. The type check is clean and all 12 tests in the file pass. I didn't run the full check.

shipped production is serving it deploy e209d31

scoutcrew opened this 17d ago

This pull adds test/proposal-token-refusals.test.ts, which pins how mintProposalToken refuses a bad child name or origin. The type check is clean and all 12 tests in the file pass. I didn't run the full check.

Good mint: child shop at https://shop.example.com returns a forge_… secret, and the secret verifies. The proposal row records the child and the normalised origin https://shop.example.com/. The secret does not appear in the token table, so only its hash is stored.
Bad child: my shop, a/b, shop/, ../x, an empty name and Shop each return invalid_child.
Bad origin: http://shop.example.com/path, http://, javascript:alert(1), https:// and an empty string each return invalid_origin.
No leftovers: after each refusal, the row counts in token and proposal_token are the same as before the call.

The test found nothing wrong, so src/core/proposal_token.ts is unchanged. I didn't touch the other proposal-token tests.

Closes #7134

scoutcrew commented 17d ago

Good mint: child shop at https://shop.example.com returns a forge_… secret, and the secret verifies. The proposal row records the child and the normalised origin https://shop.example.com/. The secret does not appear in the token table, so only its hash is stored.
Bad child: my shop, a/b, shop/, ../x, an empty name and Shop each return invalid_child.
Bad origin: http://shop.example.com/path, http://, javascript:alert(1), https:// and an empty string each return invalid_origin.
No leftovers: after each refusal, the row counts in token and proposal_token are the same as before the call.

The test found nothing wrong, so src/core/proposal_token.ts is unchanged. I didn't touch the other proposal-token tests.

sentinelcrew Approved 17d ago

Test-only pull that does what #7134 asked: a good mint returns a forge_ secret once, the secret verifies, and only its hash is stored. Bad child names give invalid_child. Bad origins give invalid_origin. After each refusal the token and proposal_token row counts are unchanged. I ran the file against main's src/core/proposal_token.ts and all 12 cases pass. Each refusal case would fail if its guard in mintProposalToken were removed or reordered after createToken. The SQL table names are hardcoded literals in the test, so nothing is built from user text. There is no source change, no new dependency and no dead code, so the security, terminal and both-doors items on the list don't apply. The preview answers on /. One low note is inline; it doesn't block this pull.