chore: OSS polish — CodeQL, CoC, coverage, auth-gap fix#35
Merged
Conversation
Runs on push to main, every PR against main, and weekly to pick up newly-disclosed CodeQL rules. Uses the 'security-and-quality' query suite for js/ts, with results surfaced in the repository Security tab. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Standard OSS contribution policy. Contact address aligned with SECURITY.md (hosting@hdnet.de). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`vitest --coverage` was already installed (@vitest/coverage-v8) but not exposed as a script; current run reports 77% statements / 78% lines across 224 tests. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`getApiKeyStatusFn` and `checkPermissionsFn` ran without any
downstream `requireScope` / `requireEnabled` check, so a request
against a non-existent (or just-removed) extension instance fell
straight through `assertInstanceContextMatches`'s silent-return.
Damage was bounded — status returned `{hasApiKey:false}` and the
permissions read is gated by the mittwald API — but the gap was
inconsistent with every other server function.
New `requireInstanceExists(db, instanceId)`:
- Reads-friendly: deliberately does NOT check the paused flag
(reads stay available so the UI can render the paused banner).
- Returns the row so callers that needed to fetch it can skip
a second query.
Also adds three `parseConsentedScopes` edge-case tests (invalid
JSON, non-array payload, non-string entries) — fails-closed
behaviour was untested.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds focused tests for previously-uncovered paths: - logger.ts (78% → 100%): dev console output, production JSON lines, key-name redaction (top-level, nested, arrays, case- insensitive), non-object extras wrapped under `value`. - webhooks/handler.ts (68% → 100%): bunny.deletePullZone happy path, bunny failure swallowed (instance still removed), no-API- key branch logs and skips bunny call. - webhooks/dedup.ts (52% → 96%): startWebhookDedupSweeper active mode under fake timers — prune fires on tick, db errors are caught, repeated calls are idempotent. - bunnycdn.ts (76% → 86%): createPullZone adoption flow (name- taken in our account → adopt; origin mismatch → throw; not-in-our-account → NAME_GLOBAL_TAKEN; non-taken errors rethrown). bunnyFetch AbortError → BUNNY_TIMEOUT. bunnyRequest empty-body 200 → undefined. Total: 224 → 253 tests, 78.2% → 85.2% lines, 76.8% → 84.0% statements. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bundle of OSS-maturity improvements to bring the extension closer to "reference-grade". Five focused commits, no production-code refactors beyond the auth-gap fix.
Commits
cidocschorenpm run coveragescript + README mention (vitest --coverage was installed but unexposed)fix(auth)requireInstanceExists(db, id)for read-only server fns. Closes a defence-in-depth gap ingetApiKeyStatusFnandcheckPermissionsFnwhereassertInstanceContextMatchessilent-returns on missing rows. Read-only: deliberately does NOT check the paused flag. Also coversparseConsentedScopesedge-cases.testlogger,webhooks/handler,webhooks/dedup, andbunnycdn(adoption flow + timeout + empty-body).Coverage delta
Files now at / near 100%
logger.ts100%,webhooks/handler.ts100%,webhooks/dedup.ts96%,crypto.ts96%,domain/pull-zone.ts91%,bunnycdn.ts86%,scope.ts81%.Out of scope (separate PRs)
feat()PR.@ts-expect-errorsites inlib/bunny-cdn-api.ts) — needs typed wrapper, own focused PR.bunnycdn.tscoverage 86% → 90%+ — diminishing returns, more HTTP-mock plumbing.Test plan
npm test— 253 / 253 greennpm run typecheck— cleannpm run code-check— clean (biome)npm run coverage— produces report, summary at the topnpm run build— clean🤖 Generated with Claude Code