195e0ba5c3
The just-merged production-only commits were never run through QA (they were pushed directly to the production branch), so several version markers and hardcoded test strings had drifted out of sync with each other: - package.json was bumped to 17.8.0 but package-lock.json, release-manifest.json and app-runtime.js's own VERSION constant were never updated to match - reverted to 17.7.3 since no other release artifact actually changed. - service-worker.js's cache name legitimately moved to v81-20260912-account-center-loader (real new modules need the cache bust), but release-manifest.json's pwaCache field and two release-check.mjs assertions still expected the old v78 name. - edge-security-v1774.mjs and static-security.mjs asserted the old employee role list (with "admin") and old PWA cache name that production's own commits had already changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
25 lines
2.1 KiB
JavaScript
25 lines
2.1 KiB
JavaScript
import fs from 'node:fs';
|
|
const src=fs.readFileSync('supabase/functions/caterium-create-employee/index.ts','utf8');
|
|
const importMap=fs.readFileSync('supabase/functions/caterium-create-employee/deno.json','utf8');
|
|
let bad=0;const check=(v,m)=>{console.log(`${v?'OK':'FAIL'}: ${m}`);if(!v)bad++};
|
|
check(src.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS direct import is pinned');
|
|
check(importMap.includes('npm:@supabase/supabase-js@2.116.0'),'Supabase JS import map is pinned');
|
|
check(!importMap.includes('npm:@supabase/supabase-js@2"'),'broad Supabase JS import map is removed');
|
|
check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is removed');
|
|
check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted');
|
|
check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');
|
|
check(src.includes('UUID_RE')&&src.includes('EMAIL_RE')&&src.includes('ALLOWED_ROLES'),'employee inputs are validated');
|
|
check(src.includes('["manager", "kitchen", "courier", "viewer"]'),'edge roles match database roles');
|
|
check(!src.includes('"operator"')&&!src.includes('"owner", "admin"'),'invented employee roles are not accepted');
|
|
check(src.includes('console.error("[caterium-create-employee]"'),'internal errors remain server-side');
|
|
check(src.includes('employee_create_failed'),'unexpected failures return a safe public code');
|
|
check(!src.includes('return reply({ error: e instanceof Error ? e.message'),'raw exception messages are not returned');
|
|
|
|
const adminSrc=fs.readFileSync('supabase/functions/caterium-platform-auth-admin/index.ts','utf8');
|
|
check(!adminSrc.includes("'Access-Control-Allow-Origin': '*'"),'platform-auth-admin: wildcard CORS is removed');
|
|
check(adminSrc.includes('https://app.caterium.ru')&&adminSrc.includes('WORKERS_DEV_ORIGIN'),'platform-auth-admin: production and backup origins are allowlisted');
|
|
check(adminSrc.includes('origin_not_allowed'),'platform-auth-admin: unknown browser origins fail closed');
|
|
check(adminSrc.includes("sun_is_platform_admin"),'platform-auth-admin: caller platform-admin check remains in place');
|
|
|
|
if(bad)process.exit(1);
|