pixelfed

Commit Graph

Author	SHA1	Message	Date
Your Name	9f81a5b425	test: un-skip Passport scope tests now that middleware is fixed All v1 admin route security tests now pass with proper assertions after the CheckForAnyScope → CheckTokenForAnyScope fix.	1 month ago
Your Name	579a581de8	test: add admin access and API scope security tests (360 total) Security/AdminAccessTest: verifies non-admin users are blocked from all admin web routes (dashboard, users, reports, settings, instances, curated onboarding) and admin API endpoints. Security/ApiScopeSecurityTest: verifies read-only tokens cannot write (follow, favourite, delete, mute, block), write tokens can read+write, cross-user access is denied, and private statuses are protected. BUG FOUND: CheckForAnyScope middleware (referenced in v1/admin routes) was removed in Passport 13. All /api/v1/admin/* routes throw BindingResolutionException. 6 tests skipped pending fix.	1 month ago

Author

SHA1

Message

Date

Your Name

9f81a5b425

test: un-skip Passport scope tests now that middleware is fixed

All v1 admin route security tests now pass with proper assertions
after the CheckForAnyScope → CheckTokenForAnyScope fix.

Your Name

579a581de8

test: add admin access and API scope security tests (360 total)

Security/AdminAccessTest: verifies non-admin users are blocked from
  all admin web routes (dashboard, users, reports, settings, instances,
  curated onboarding) and admin API endpoints.

Security/ApiScopeSecurityTest: verifies read-only tokens cannot write
  (follow, favourite, delete, mute, block), write tokens can read+write,
  cross-user access is denied, and private statuses are protected.

BUG FOUND: CheckForAnyScope middleware (referenced in v1/admin routes)
  was removed in Passport 13. All /api/v1/admin/* routes throw
  BindingResolutionException. 6 tests skipped pending fix.

2 Commits (5a364be58b9a72cd1da694b076ac511f495b25e4)