From 433a543f854209171d243a58a07c4cc6f315a4f5 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Sat, 10 Oct 2026 01:42:52 +0200 Subject: [PATCH] =?UTF-8?q?test(16.1):=20UAT=20item=201=20passed=20?= =?UTF-8?q?=E2=80=94=20hardened=20vhost=20installed=20on=20UAT?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../16.1-UAT.md | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md b/.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md index ee7370b..9e6bbea 100644 --- a/.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md +++ b/.planning/phases/16.1-journal-admin-urgent-fixes-relation-search-list-state-post-f/16.1-UAT.md @@ -8,22 +8,23 @@ updated: 2026-10-10T00:00:00Z ## Current Test -number: 1 -name: Install the hardened staging vhost on UAT (root) +number: 2 +name: Posts list search on UAT expected: | - As root on the UAT server: back up /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl, - install /srv/grzybyfunkcjonalne/deploy/grzybyfunkcjonalne-staging.conf over it (sha256 bce4d7f9…bd7c), - `nginx -t && systemctl reload nginx`. Afterwards public pages carry X-Content-Type-Options, - X-Frame-Options, Referrer-Policy, Permissions-Policy and Content-Security-Policy-Report-Only - exactly once; /gfadmin keeps its own enforced CSP and Referrer-Policy: same-origin and is not - behind basic auth; the public site still is. + Searching "cordyceps" in the Journal posts list returns rows. awaiting: user response ## Tests ### 1. Install the hardened staging vhost on UAT (root) expected: Security headers present exactly once on public pages, /gfadmin unchanged in access, `nginx -t` passes -result: [pending] +result: pass +evidence: | + 2026-10-09 23:05 UTC via debian@ sudo. Backup /etc/nginx/sites-available/uat.grzybyfunkcjonalne.pl.bak-20261009T230555Z; + installed sha256 bce4d7f9…bd7c; `nginx -t` ok; reloaded. curl: /, a post, /_journal, a /storage 404 and /gfadmin each carry + HSTS, nosniff, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy and CSP-Report-Only exactly once; /gfadmin keeps its + enforced CSP and Referrer-Policy same-origin, answers 200 without basic auth, locale cookie Secure; public paths still 401 + off-server. On-server smoke (loopback): smoke: ok (98 urls); 200 pages show all six headers. Winter vhost untouched. ### 2. Posts list search on UAT expected: Searching "cordyceps" at https://uat.grzybyfunkcjonalne.pl/gfadmin/golem15/journal/posts returns rows (no "The list could not be loaded") @@ -44,9 +45,9 @@ result: [pending] ## Summary total: 5 -passed: 0 +passed: 1 issues: 0 -pending: 5 +pending: 4 skipped: 0 blocked: 0