a7a1595cbf
- make quick/check/mutation from cj/security-baseline (Makefile unchanged, settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint security rules, Forgejo workflow - tests/security: generic baseline tests plus app config and role tests against createApp() with an in-memory database - extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests - fix gaps found by the tests: reject unknown fields on project create, answer malformed JSON with 400 instead of 500, set nosniff on the API - npm audit fix (next 16.4.1 and others, no high/critical left) - clear ESLint errors, safeFileName without control-character regex - per-project ownership stays an open, documented gap (idorGap -> TODO) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
904 B
JavaScript
33 lines
904 B
JavaScript
import { readdirSync } from "node:fs";
|
|
import { spawnSync } from "node:child_process";
|
|
import path from "node:path";
|
|
|
|
// tests/*.test.ts plus die Sicherheits-Baseline unter tests/security/.
|
|
const testDirectories = ["tests", path.join("tests", "security")];
|
|
const testFiles = testDirectories
|
|
.flatMap((directory) =>
|
|
readdirSync(path.resolve(directory), { withFileTypes: true })
|
|
.filter((entry) => entry.isFile() && entry.name.endsWith(".test.ts"))
|
|
.map((entry) => path.join(directory, entry.name))
|
|
)
|
|
.sort();
|
|
|
|
if (testFiles.length === 0) {
|
|
throw new Error("No TypeScript test files found.");
|
|
}
|
|
|
|
const watch = process.argv.includes("--watch");
|
|
const result = spawnSync(
|
|
process.execPath,
|
|
[
|
|
"--import",
|
|
"tsx",
|
|
"--test",
|
|
"--test-concurrency=1",
|
|
...(watch ? ["--watch"] : []),
|
|
...testFiles,
|
|
],
|
|
{ stdio: "inherit" }
|
|
);
|
|
|
|
process.exit(result.status ?? 1);
|