ehoandClaude Opus 5
772c47ea43
BIO-012: roleInterceptor/subjectInterceptor are correctly registered only under isDevMode(), but three hand-written fetch adapters (reveal-bignummer, letter-preview, org-template's proefbrief) bypass HttpClient and set X-Role/X-Subject themselves with no guard. The readers underneath, role.ts and subject.ts, were ungated too: they read ?role=/?subject= and wrote it into sessionStorage on any navigation, in any build -- for ?subject= that value is a BSN, which is exactly what SessionStore's G1 comment promises never happens. Gate both layers: currentRole()/currentSubject() return their safe default immediately outside isDevMode() (no query-param read, no sessionStorage write), and the three adapters additionally wrap their headers in isDevMode() so a production request carries neither header at all, matching what an HttpClient request already does once the interceptors aren't registered. TE-002: reveal-bignummer's response-shape validation was a "Trust boundary" a spec could only reach by stubbing globalThis.fetch. Exported it as parseRevealed(body), matching the other 30 parse* boundaries in the repo. Same treatment for letter-preview's errorMessage and org-template's proefbrief error mapping (extracted from an inline try/catch into a named, exported function first, since it wasn't already separate). BIO-006(a): reveal-bignummer sent X-Step-Up: 'true' unconditionally, so the backend's step-up precondition constrained nothing. reveal() now takes a stepUp flag; BriefStore.revealBigNummer() -- reachable only after the UI's confirm() gesture -- is the one that supplies it, so the literal no longer lives in the transport adapter. BIO-006(b): documented in roles-and-access.md that drafter is also the backend's fallback identity (StubIdentityProvider's catch-all arm), not just the dev switcher's initial choice -- so the least-privilege consequence of it also being the only role that may reveal a BSN is visible. Doc correction, same diff: roles-and-access.md's "wired only under isDevMode()" claim was false for the three hand-written fetch paths; it now says where the gate lives (interceptor registration and the reader functions) so it doesn't go stale the same way again. CLAUDE.md's dev-only claims needed no correction -- they already noted these three calls bypass the interceptor. Every fix has a test confirmed red by temporarily reverting the source change and rerunning the suite before restoring it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
78 lines
3.0 KiB
TypeScript
78 lines
3.0 KiB
TypeScript
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
|
|
import { parseRevealed, REVEAL_FAILED, RevealBigNummerAdapter } from './reveal-bignummer.adapter';
|
|
|
|
describe('parseRevealed (TE-002 trust boundary)', () => {
|
|
it('accepts a well-formed body', () => {
|
|
const r = parseRevealed({ bigNummer: '12345678' });
|
|
expect(r.ok).toBe(true);
|
|
if (r.ok) expect(r.value).toBe('12345678');
|
|
});
|
|
|
|
// The finding's own named case: a numeric bigNummer must be rejected, not
|
|
// coerced — this is a PII reveal, not a display formatter.
|
|
it('rejects a bigNummer sent as a number', () => {
|
|
const r = parseRevealed({ bigNummer: 42 });
|
|
expect(r).toEqual({ ok: false, error: REVEAL_FAILED });
|
|
});
|
|
|
|
it('rejects a missing bigNummer field', () => {
|
|
expect(parseRevealed({}).ok).toBe(false);
|
|
});
|
|
|
|
it('rejects null and non-object bodies', () => {
|
|
expect(parseRevealed(null).ok).toBe(false);
|
|
expect(parseRevealed(undefined).ok).toBe(false);
|
|
expect(parseRevealed('12345678').ok).toBe(false);
|
|
expect(parseRevealed(42).ok).toBe(false);
|
|
});
|
|
});
|
|
|
|
// isDevMode() reads the `ngDevMode` global the Angular CLI defines away in a
|
|
// production build. There is no ambient type for it in app code, so this is
|
|
// accessed through an untyped bag rather than a `declare const`.
|
|
const globals = globalThis as Record<string, unknown>;
|
|
const originalNgDevMode = globals['ngDevMode'];
|
|
const setDevMode = (on: boolean) => {
|
|
globals['ngDevMode'] = on;
|
|
};
|
|
|
|
describe('RevealBigNummerAdapter.reveal (BIO-006a + BIO-012)', () => {
|
|
const okResponse = () =>
|
|
({ ok: true, json: () => Promise.resolve({ bigNummer: '12345678' }) }) as unknown as Response;
|
|
|
|
beforeEach(() => setDevMode(true));
|
|
afterEach(() => {
|
|
globals['ngDevMode'] = originalNgDevMode;
|
|
vi.unstubAllGlobals();
|
|
});
|
|
|
|
it('sends X-Step-Up only when the caller passes stepUp: true', async () => {
|
|
const fetchSpy = vi.fn().mockResolvedValue(okResponse());
|
|
vi.stubGlobal('fetch', fetchSpy);
|
|
|
|
await new RevealBigNummerAdapter().reveal(false);
|
|
const headersWithoutStepUp = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
|
|
expect(headersWithoutStepUp['X-Step-Up']).toBeUndefined();
|
|
|
|
await new RevealBigNummerAdapter().reveal(true);
|
|
const headersWithStepUp = fetchSpy.mock.calls[1][1].headers as Record<string, string>;
|
|
expect(headersWithStepUp['X-Step-Up']).toBe('true');
|
|
});
|
|
|
|
it('sends X-Role only under isDevMode()', async () => {
|
|
const fetchSpy = vi.fn().mockResolvedValue(okResponse());
|
|
vi.stubGlobal('fetch', fetchSpy);
|
|
|
|
setDevMode(false);
|
|
await new RevealBigNummerAdapter().reveal(true);
|
|
const prodHeaders = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
|
|
expect(prodHeaders['X-Role']).toBeUndefined();
|
|
expect(prodHeaders['X-Step-Up']).toBe('true'); // step-up is not a dev-only hatch
|
|
|
|
setDevMode(true);
|
|
await new RevealBigNummerAdapter().reveal(true);
|
|
const devHeaders = fetchSpy.mock.calls[1][1].headers as Record<string, string>;
|
|
expect(devHeaders['X-Role']).toBeDefined();
|
|
});
|
|
});
|