Repository navigation
test(web): cover same-origin checks on kit and collection writes - #159
Merged
Merged
Conversation
The session path of kit and collection writes already refuses a foreign Origin through resolveLimitedScopedActor. Pin it per route group: a foreign Origin or same-site fetch is 403 cross_origin and writes nothing, while same-origin, header-less and API-key writes pass. Collections also cover PATCH and DELETE. Kit origin cases move to their own file to keep kit-revisions under 200 lines. Closes #113 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YPFjLezDdYaFNQwfYGjQvq
…-route Assert status and error code for every collection and kit write route, so a write later classified as a read cannot drop the check silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YPFjLezDdYaFNQwfYGjQvq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #113.
Summary
The production check this issue asks for already landed in #103:
resolveLimitedScopedActor(apps/web/app/lib/releases/release-state-http.ts) refuses a foreignOrigin/ non-same-originSec-Fetch-Sitewith403 cross_originwhenever neitherAuthorizationnorX-Admin-Secretis present (the session-cookie path). BothserveKit(kit-http.ts) andserveCollection(collection-http.ts, viaresolveLimitedActor) call it for every non-GET request, because their routers classify access by HTTP method. What was missing was test coverage per route group, which this PR adds:apps/web/tests/collections/collections-origin.test.ts(new): a foreign Origin, a sibling subdomain orSec-Fetch-Site: same-siteis 403cross_originon create, PATCH, DELETE,revisions,membersandclone, and nothing is written. Same-origin, header-less and API-key-with-foreign-Origin writes pass.apps/web/tests/personal-kits/kit-origin.test.ts(new): the existing kit origin case moved here (to keepkit-revisions.test.tsunder the 200-LOC cap), plus every write sub-route (proposals,proposals/validate,preview-update,activate,rollback,rebase,conflicts/:id/resolve,revisions/:id/{reject,review,quarantine}) is 403cross_origin, and header-less session and API-key writes pass.No production code changes.
Verification
pnpm typecheck: passes.npx vitest run(full suite): 142 files, 2687 passed, 3 skipped.crossOriginRefusalmocked tonull, the "refuses" tests fail (expected 201 to be 403). I applied its low-severity suggestions (status assertions, per-sub-route coverage).Docs impact
None.
CLAUDE.md("Same-origin on cookie mutations"),docs/api-reference.md#collectionsanddocs/personal-kits-api.mdalready document403 cross_originfor these routes.Generated by Claude Code