test: cover movePage server-side cycle guard (#67) #102

New Issue

Ghost · 2026-06-21T05:05:38+03:00

Ghost commented

2026-06-21 05:05:38 +03:00

PR #101 (commit 212bcea4, closes #67) added a server-side cycle guard in movePage — apps/server/src/core/page/services/page.service.ts (~L991-1007) — to stop MCP/REST/agent callers bypassing the client-side check.

Gap: no spec covers either branch. page.service.spec.ts is a should be defined smoke test only; nothing references movePage/"own subtree".

Needed (would fail on pre-fix code): unit test mocking pageRepo.findById + getPageBreadCrumbs:

self-move (parentPageId === pageId) throws BadRequestException before any updatePage;
destination whose breadcrumb chain contains pageId throws;
a legitimate move (pageId absent from ancestors) proceeds to updatePage.

Found in code review of PR #101.

PR #101 (commit 212bcea4, closes #67) added a server-side cycle guard in `movePage` — apps/server/src/core/page/services/page.service.ts (~L991-1007) — to stop MCP/REST/agent callers bypassing the client-side check. **Gap:** no spec covers either branch. `page.service.spec.ts` is a `should be defined` smoke test only; nothing references `movePage`/"own subtree". **Needed** (would fail on pre-fix code): unit test mocking `pageRepo.findById` + `getPageBreadCrumbs`: - self-move (`parentPageId === pageId`) throws `BadRequestException` **before** any `updatePage`; - destination whose breadcrumb chain contains `pageId` throws; - a legitimate move (pageId absent from ancestors) proceeds to `updatePage`. _Found in code review of PR #101._

Ghost added the test security labels 2026-06-21 05:05:38 +03:00

vvzvlad referenced this issue from a commit

2026-06-21 05:24:26 +03:00

fix(review): address PR #101 review findings (dead DI, docs)

Ghost referenced this issue from a commit

2026-06-21 05:49:35 +03:00

test(page): cover movePage server-side cycle guard (#102)

Ghost referenced this issue

2026-06-21 05:51:20 +03:00

fix: review/red-team batch 2 — 30 issues (security, ws, page-templates, html-embed, mcp, tests, docs) #101

Ghost referenced this issue

2026-06-21 05:53:55 +03:00