Matt
221ae5784e
Bundles the prior autonomous-session output that was sitting unstaged: - Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances) - country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk after the per-subpath dynamic-import approach silently failed in webpack) - Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index, redirects (ocr to ai, reports to dashboard, invitations to users), docs/admin-ia-proposal.md - Per-template email tester (registry + endpoint + UI on Email admin page) - Cancel-document mode picker (delete-from-Documenso vs keep-for-audit) - Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers - Customize-widgets per-region sortables at xl+ (charts/rails/feed); single flat sortable below xl when the layout stacks; per-viewport saved orders - Audit doc updates capturing each shipped item - Lint fixes: react-compiler immutability in DonutChart (reduce instead of let-reassign), set-state-in-effect disables in CountryFlag and UploadForSigning preview-bytes effect, unused 'confirm' destructures in interest contract + reservation tabs, unescaped apostrophe in test-template card copy
42 lines
1.4 KiB
TypeScript
42 lines
1.4 KiB
TypeScript
import 'dotenv/config';
|
|
import { test, expect } from '@playwright/test';
|
|
|
|
import { login, apiHeaders } from '../smoke/helpers';
|
|
|
|
/**
|
|
* Real-API spec covering attachment cross-port enforcement (Phase A PR8).
|
|
*
|
|
* The hot-path SMTP+IMAP roundtrip is exercised by smtp-system-send.spec.ts.
|
|
* This spec specifically verifies that attaching a fileId from a different
|
|
* port returns 403 *before* SMTP is touched.
|
|
*
|
|
* Requires SMTP_HOST + a second port slug (PHASE_A_OTHER_PORT_SLUG) seeded
|
|
* with a file the calling user cannot reach. Skips otherwise.
|
|
*/
|
|
|
|
const SMTP_HOST = process.env.SMTP_HOST;
|
|
const OTHER_PORT_FILE_ID = process.env.PHASE_A_CROSS_PORT_FILE_ID;
|
|
|
|
test.describe('Email attachments - port isolation', () => {
|
|
test.skip(!SMTP_HOST || !OTHER_PORT_FILE_ID, 'cross-port fixture not configured');
|
|
|
|
test.beforeEach(async ({ page }) => {
|
|
await login(page, 'super_admin');
|
|
});
|
|
|
|
test('rejects cross-port fileId with 403 before SMTP', async ({ page }) => {
|
|
const headers = await apiHeaders(page);
|
|
const res = await page.request.post('/api/v1/email/compose', {
|
|
headers,
|
|
data: {
|
|
senderType: 'system',
|
|
to: ['noop@example.test'],
|
|
subject: 'cross-port attempt',
|
|
bodyHtml: '<p>should fail before SMTP</p>',
|
|
attachments: [{ fileId: OTHER_PORT_FILE_ID! }],
|
|
},
|
|
});
|
|
expect(res.status()).toBe(403);
|
|
});
|
|
});
|