chore/port-solidtime-audit-fixes #1
Reference in New Issue
Block a user
No description provided.
Delete Branch "chore/port-solidtime-audit-fixes"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
A manifest written as `{...} satisfies FeatureManifest` (or the combined `as const satisfies` idiom) parsed to null, silently no-oping the error-level conformance rules. unwrapAsConst now strips TSAsExpression and TSSatisfiesExpression in a loop. The file also carried a verbatim second copy of its own parser for parseManifestFully; both public entry points now share one implementation. The template's field set (audits, rateLimit, requiresConsent) is preserved. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>usecase-must-be-wired returned {} when the manifest parsed to null, silently disabling the error-level gate when the manifest existed but could not be read. It now reports unparseableManifest on Program in that case; a genuinely missing manifest stays a no-op (that is feature-must-have-manifest's job). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>- turbo/generators/config.ts used require() inside the reader generator action (no-require-imports); use the top-level node:fs imports - auth authentication.service.ts used a literal self-assertion ("users" as "users"); prefer-as-const - apps/cms lacked web-next's next-env.d.ts triple-slash-reference override, and the committed next-env.d.ts now references .next/types/routes.d.ts Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>Three generator fixes: - templates/feature/vitest.config.ts.hbs lacked an include for .test.{ts,tsx}; the node base only includes .test.ts, so scaffolded UI component tests never executed - gen event consume emitted an unguarded bus.subscribe although ctx.bus is optional in BindContext — now wrapped in if (bus) {} - e2e repo clones now exclude /dist and /.next build outputs, and every dep-stripping e2e strips the scaffolded package from EVERY workspace package.json via globSync instead of a hardcoded dependent list that drifts as packages gain or drop the dependency Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>pnpm fallow failed on 14 dead-code issues, 200 clone groups (4.3% > 3.0% threshold) and one cognitive-complexity breach. Changes: - duplicates.ignore covers convention-mandated boilerplate only (test files, stories, fixtures/factories/seeds, binders, symbols, feature manifests, vitest configs, mock/repo twins, sentry init twins, compliance emitters, rule-meta boilerplate) at threshold 3.0 - usedClassMembers: validateSession (interface-implemented, not yet called); ignoreExports: Next's generateMetadata convention export + the __getInstrumentationForTests test knob - duplicate-exports off: client/server RSC twins export the same component name by design - @trpc/client + @trpc/react-query added to ignoreDependencies (peer resolution for feature ./ui hooks); *.test.mjs marked dynamically loaded (node:test files fallow saw as unreachable) - delete packages/auth/src/ui/query.ts (empty export{} placeholder shadowed by ui/index.ts, genuinely dead) - extract checkDepTrace/decisionError from checkLibraryDecisions (cognitive 32 > 30) — behavior unchanged, tests pass Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>The tRPC createContext was () => ({}) — the mounted dsr/consent routers 401'd every call and the dsr singleton stub threw (audit finding A11). createTrpcContext now accepts an app resolveUser hook; web-next resolves the session cookie through the auth feature's validateSession (denylist included) plus a role snapshot, and threads bindProductionDsr/Consent (or dev-seed) bindings into every request. The dsr router resolves its binding from ctx.dsrBinding per request instead of a throwing proxy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>