html-embed: upgrade create/duplicate/import gate tests from source-regex to real execution #27

New Issue

Ghost · 2026-06-20T20:31:53+03:00

Ghost commented

2026-06-20 20:31:53 +03:00

Found in security review of PR #16 (merged in 7a03321d).

Severity: medium (test quality; production code is correct).

The gate tests for the create/duplicate/import write paths assert gate presence with brittle expect(SRC).toMatch(/regex/) against the source text and a reimplemented applyGate() stand-in, instead of executing the real methods with a member role and asserting the embed is actually stripped.

Files: apps/server/src/core/page/services/page-service-html-embed-identity.spec.ts (~L80-102), apps/server/src/integrations/import/services/import-html-embed-identity.spec.ts (~L91-121).
Risk: a refactor (renamed variable, reordered logic) could break the real gate while these tests still pass.
Gate paths with no behavioral test: page.service.create(), page.service.duplicatePage(), import.service, file-import-task.service.

Fix: rewrite to execute the real methods with a non-admin/member role and assert a member's embed is stripped end-to-end, matching the quality of the existing collab/persistence/share specs.

Found in security review of PR #16 (merged in 7a03321d). **Severity: medium (test quality; production code is correct).** The gate tests for the create/duplicate/import write paths assert gate presence with brittle `expect(SRC).toMatch(/regex/)` against the source text and a reimplemented `applyGate()` stand-in, instead of executing the real methods with a member role and asserting the embed is actually stripped. - Files: `apps/server/src/core/page/services/page-service-html-embed-identity.spec.ts` (~L80-102), `apps/server/src/integrations/import/services/import-html-embed-identity.spec.ts` (~L91-121). - Risk: a refactor (renamed variable, reordered logic) could break the real gate while these tests still pass. - Gate paths with no behavioral test: `page.service.create()`, `page.service.duplicatePage()`, `import.service`, `file-import-task.service`. **Fix:** rewrite to execute the real methods with a non-admin/member role and assert a member's embed is stripped end-to-end, matching the quality of the existing collab/persistence/share specs.

Ghost referenced this issue

2026-06-20 21:53:29 +03:00

fix(html-embed): complete kill-switch on read paths (#28) + total strip helper (#30) #46

Ghost referenced this issue from a commit

2026-06-20 22:49:30 +03:00

test(html-embed): real-execution gate tests for create/duplicate/import (#27)

Ghost added the test label 2026-06-21 02:27:17 +03:00

Ghost referenced this issue

2026-06-21 02:33:10 +03:00

html-embed: клиентский гейт исполнения JS (shouldExecute) не покрыт тестами #77

Ghost referenced this issue

2026-06-21 02:33:14 +03:00