- Updated toast locator strategies to prioritize role="status" for success/info toasts and role="alert" for error toasts across various test files.
- Increased timeouts and added retry logic in tests to improve reliability under load, particularly for settings and user management tests.
- Refactored emergency server health checks to use Playwright's request context for better isolation and error handling.
- Simplified rate limit and WAF enforcement tests by documenting expected behaviors and removing redundant checks.
- Improved user management tests by temporarily disabling checks for user status badges until UI updates are made.
- Added a new implementation report for the Cerberus TC-2 test fix detailing the changes made to handle the break glass protocol's dual-route structure.
- Modified `scripts/cerberus_integration.sh` to replace naive byte-position checking with route-aware verification.
- Introduced a hard requirement for jq, including error handling for its absence.
- Implemented emergency route detection using exact path matching.
- Enhanced defensive programming practices with JSON validation, route structure checks, and numeric validations.
- Improved logging and output for better debugging and clarity.
- Verified handler order within main routes while skipping emergency routes.
- Updated test results and compliance with specifications in the implementation report.
- Added a reset of the models.Setting struct before querying for settings in both the Manager and Cerberus components to avoid ID leakage from previous queries.
- Introduced new functions in Cerberus for checking admin authentication and admin whitelist status.
- Enhanced middleware logic to allow admin users to bypass ACL checks if their IP is whitelisted.
- Added tests to verify the behavior of the middleware with respect to ACLs and admin whitelisting.
- Created a new utility for checking if an IP is in a CIDR list.
- Updated various services to use `Where` clause for fetching records by ID instead of directly passing the ID to `First`, ensuring consistency in query patterns.
- Added comprehensive tests for settings queries to demonstrate and verify the fix for ID leakage issues.
- Introduced a new document detailing the remediation plan for E2E security enforcement failures, including root cause analysis and proposed fixes for identified issues.
- Updated the implementation README to include the GORM Security Scanner documentation.
- Replaced the existing GitHub Actions E2E Trigger Investigation Plan with a comprehensive GORM ID Leak Security Vulnerability Fix plan, outlining the critical security bug, its impact, and a structured implementation plan for remediation.
- Revised the QA report to reflect the status of the GORM security fixes, highlighting the critical vulnerabilities found during the Docker image scan and the necessary actions to address them.
- Introduced a new script `scan-gorm-security.sh` to detect GORM security issues and common mistakes.
- Added a pre-commit hook `gorm-security-check.sh` to run the security scanner before commits.
- Enhanced `go-test-coverage.sh` to capture and display test failure summaries.
Jeremy
renovate[bot]
GitHub Actions