From 29efa95b5dfe02a835b452058533026494dbb527 Mon Sep 17 00:00:00 2001 From: pavlov346346-source Date: Fri, 11 Sep 2026 09:57:23 +0300 Subject: [PATCH 1/2] security: pin employee edge import map --- supabase/functions/caterium-create-employee/deno.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/supabase/functions/caterium-create-employee/deno.json b/supabase/functions/caterium-create-employee/deno.json index 15d0809..110d6f5 100644 --- a/supabase/functions/caterium-create-employee/deno.json +++ b/supabase/functions/caterium-create-employee/deno.json @@ -1,5 +1,5 @@ { "imports": { - "@supabase/supabase-js": "npm:@supabase/supabase-js@2" + "@supabase/supabase-js": "npm:@supabase/supabase-js@2.116.0" } } From bca7408f90a7100019dece47a8067cc1ff0d41c9 Mon Sep 17 00:00:00 2001 From: pavlov346346-source Date: Fri, 11 Sep 2026 09:57:33 +0300 Subject: [PATCH 2/2] test: enforce exact employee edge import pin --- tests/edge-security-v1774.mjs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/edge-security-v1774.mjs b/tests/edge-security-v1774.mjs index 08b4f34..5f048f2 100644 --- a/tests/edge-security-v1774.mjs +++ b/tests/edge-security-v1774.mjs @@ -1,7 +1,10 @@ import fs from 'node:fs'; const src=fs.readFileSync('supabase/functions/caterium-create-employee/index.ts','utf8'); +const importMap=fs.readFileSync('supabase/functions/caterium-create-employee/deno.json','utf8'); let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++}; -check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS is pinned'); +check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS direct import is pinned'); +check(importMap.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS import map is pinned'); +check(!importMap.includes('npm:@supabase/supabase-js@2"'),'broad Supabase JS import map is removed'); check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is removed'); check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted'); check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');