feat: harden community production foundation through story 1.5

2026-08-14 00:21:59 +03:00
parent c30461cc92
commit f6fc2e5c9b
161 changed files with 16758 additions and 2515 deletions
@@ -28,3 +28,47 @@ test('secrets page exposes stable secret management hooks', async ({ page }) =>
  await expect(page.locator('[data-testid="secret-submit-button"]')).toBeVisible();
  await expect(page.locator('html')).toHaveAttribute('data-crank-bootstrap-state', 'ready');
 });
+
+test('API errors retain only bounded canonical support identities', async ({ page }) => {
+  await login(page);
+  await page.route('**/api/admin/workspaces/correlation-*/operations', async (route) => {
+    var hostile = route.request().url().includes('correlation-hostile');
+    await route.fulfill({
+      status: 503,
+      contentType: 'application/json',
+      headers: hostile
+        ? { 'x-request-id': 'reflected;attacker', 'x-trace-id': 'NOT-A-TRACE' }
+        : {
+            'x-request-id': '01J5SAFELOCALREQUEST',
+            'x-trace-id': '0123456789abcdef0123456789abcdef',
+          },
+      body: JSON.stringify({ error: { message: 'safe failure' } }),
+    });
+  });
+
+  var safe = await page.evaluate(async () => {
+    try {
+      await window.CrankApi.listOperations('correlation-safe');
+      return null;
+    } catch (error) {
+      return { requestId: error.requestId, traceId: error.traceId };
+    }
+  });
+  expect(safe).toEqual({
+    requestId: '01J5SAFELOCALREQUEST',
+    traceId: '0123456789abcdef0123456789abcdef',
+  });
+
+  var hostile = await page.evaluate(async () => {
+    try {
+      await window.CrankApi.listOperations('correlation-hostile');
+      return null;
+    } catch (error) {
+      return {
+        hasRequestId: Object.prototype.hasOwnProperty.call(error, 'requestId'),
+        hasTraceId: Object.prototype.hasOwnProperty.call(error, 'traceId'),
+      };
+    }
+  });
+  expect(hostile).toEqual({ hasRequestId: false, hasTraceId: false });
+});