caterium/caterium-app
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #23 from pavlov346346-source/fix/edge-import-pin-v1774

Browse Source 
Pin employee Edge import map
This commit is contained in:
pavlov346346-source 2026-09-11 09:59:51 +03:00 committed by GitHub
commit 9290cc0103
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
supabase/functions/caterium-create-employee/deno.json
View File

@ -1,5 +1,5 @@
{
"imports": {
"@supabase/supabase-js": "npm:@supabase/supabase-js@2"
"@supabase/supabase-js": "npm:@supabase/supabase-js@2.116.0"
}
}

5
tests/edge-security-v1774.mjs
View File

@ -1,7 +1,10 @@
import fs from 'node:fs';
const src=fs.readFileSync('supabase/functions/caterium-create-employee/index.ts','utf8');
const importMap=fs.readFileSync('supabase/functions/caterium-create-employee/deno.json','utf8');
let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++};
check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS is pinned');
check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS direct import is pinned');
check(importMap.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS import map is pinned');
check(!importMap.includes('npm:@supabase/supabase-js@2"'),'broad Supabase JS import map is removed');
check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is removed');
check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted');
check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');