mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-13 04:06:59 +00:00
Anso
9a1c043189
* refactor(settings): replace modal with nested full-page route
Settings sections are now URL-addressable at /settings/:sectionId, rendered
nested inside EditorLayout alongside the stack sidebar. Browser back/forward
navigates between sections. Deep links (e.g. /settings/cloud-backup) load
the section directly on hard reload.
- Add react-router-dom v7; BrowserRouter wraps the full app tree
- New SettingsPage (scroll memory, Cmd+K palette), SettingsSidebar (NavLink
active styling, back-arrow), SectionGate (visibility + tier lock card)
- Rename SectionId 'appstore' to 'app-store' so slug === SectionId
- Decouple SystemSection, DeveloperSection, AppStoreSection from modal-
passed props; each fetches its own data on mount
- Replace onLabelsChanged prop chain with SENCHO_LABELS_CHANGED window event
- Drop onOpenSettings prop from UserProfileDropdown, HomeDashboard,
ConfigurationStatus; each calls useNavigate directly
- Delete SettingsModal.tsx
* fix(settings): validate sectionId against registry before property write
Prevents prototype pollution (CodeQL js/remote-property-injection #243).
URL param sectionId is checked against SETTINGS_ITEMS before being used
as a property key on scrollPositionsRef.
* fix(settings): eliminate remote property injection via Map and registry-sourced key
Two-part fix for CodeQL js/remote-property-injection:
1. currentSection is now derived from SETTINGS_ITEMS.find().id (trusted
registry data) instead of the raw sectionId URL param. The tainted
string never flows into any property access.
2. scrollPositionsRef uses Map<SectionId, number> with .get()/.set()
instead of a plain object. Map operations do not write to the prototype
chain, removing the prototype pollution vector entirely.
* test(e2e): align settings selectors with full-page route
The settings refactor (4475afd) replaced the modal with a nested route.
The new sidebar renders sub-sections as NavLinks (role link, not button)
and adds a "Filter settings" button that collides with the loose
/settings/i regex used in mfa and nodes specs.
- Use exact 'Settings' match for the profile-dropdown menu row
- Switch the Nodes sub-section selector from button to link role
67 lines
3.0 KiB
TypeScript
67 lines
3.0 KiB
TypeScript
/**
|
|
* Node management E2E tests.
|
|
* Tests the SSRF validation we added (C2 fix) is surfaced in the UI.
|
|
*/
|
|
import { test, expect } from '@playwright/test';
|
|
import { loginAs } from './helpers';
|
|
|
|
test.describe('Node management', () => {
|
|
test.beforeEach(async ({ page }) => {
|
|
await loginAs(page);
|
|
// Settings is inside the User Profile Dropdown - open it first
|
|
await page.getByRole('button', { name: /profile/i }).click();
|
|
await page.getByRole('button', { name: 'Settings', exact: true }).click();
|
|
await page.getByRole('link', { name: /^nodes$/i }).click();
|
|
});
|
|
|
|
/**
|
|
* Open the Add Node dialog and switch the type to Remote so the API URL
|
|
* field becomes visible. Returns false (and skips) if the button isn't found.
|
|
*/
|
|
async function openAddNodeAsRemote(page: import('@playwright/test').Page): Promise<boolean> {
|
|
const addBtn = page.getByRole('button', { name: /add node/i }).first();
|
|
if (!await addBtn.isVisible()) {
|
|
test.skip();
|
|
return false;
|
|
}
|
|
await addBtn.click();
|
|
// Wait for the dialog form to be ready
|
|
await expect(page.locator('#node-name')).toBeVisible({ timeout: 5_000 });
|
|
// The API URL field only renders when type === 'remote'.
|
|
// #node-type is a Radix UI combobox - click to open, then pick the option.
|
|
await page.locator('#node-type').click();
|
|
await page.getByRole('option', { name: /remote/i }).click();
|
|
// Remote nodes default to Pilot Agent mode; switch to Proxy so the api_url field renders.
|
|
await page.locator('#node-mode').click();
|
|
await page.getByRole('button', { name: /distributed api proxy/i }).click();
|
|
// Confirm the API URL field is now visible before proceeding
|
|
await expect(page.locator('#node-api-url')).toBeVisible({ timeout: 3_000 });
|
|
return true;
|
|
}
|
|
|
|
test('adding a node with localhost api_url shows a validation error', async ({ page }) => {
|
|
if (!await openAddNodeAsRemote(page)) return;
|
|
|
|
await page.locator('#node-name').fill('bad-node');
|
|
await page.locator('#node-api-url').fill('http://localhost:6379');
|
|
// api_token is required to enable the submit button; use a dummy value since we're testing URL validation
|
|
await page.locator('#node-api-token').fill('dummy-token');
|
|
// Use .last() to target the dialog submit button, not the trigger
|
|
await page.getByRole('button', { name: /add node/i }).last().click();
|
|
|
|
await expect(page.getByText(/loopback|localhost/i)).toBeVisible({ timeout: 5_000 });
|
|
});
|
|
|
|
test('adding a node with an invalid URL shows an error', async ({ page }) => {
|
|
if (!await openAddNodeAsRemote(page)) return;
|
|
|
|
await page.locator('#node-name').fill('bad-url-node');
|
|
await page.locator('#node-api-url').fill('not-a-url-at-all');
|
|
// api_token is required to enable the submit button; use a dummy value since we're testing URL validation
|
|
await page.locator('#node-api-token').fill('dummy-token');
|
|
await page.getByRole('button', { name: /add node/i }).last().click();
|
|
|
|
await expect(page.getByText(/valid url|invalid url/i)).toBeVisible({ timeout: 5_000 });
|
|
});
|
|
});
|