golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(16.3): refresh CSRF coverage golden and blog scaffold layout

Browse Source 
Account token POST/DELETE routes made TestPhase10Coverage expect 32 unsafe
routes; token_scopes.go is hand-authored and excluded from the scaffold pin.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-10-11 13:53:31 +02:00
parent e368ae9c85
commit a955d2a3d4
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/examples/blog/scaffold_layout_test.go
View File

@@ -18,6 +18,8 @@ import (
// this plugin (without its tests, and with migration timestamps normalised). The
// in-repository copy has no go.mod or go.sum because it lives in the
// framework module; those two are left out of the scaffolder's set.
// token_scopes.go is hand-authored (HasTokenScopes example for personal API
// tokens) and is not a make:* output, so it is left out of the walkthrough set.
func TestScaffoldLayout(t *testing.T) {
// The make commands run go mod tidy; keep it on the module cache.
t.Setenv("GOPROXY", "off")
@@ -48,7 +50,7 @@ func TestScaffoldLayout(t *testing.T) {
return rel != "go.mod" && rel != "go.sum"
})
walkthrough := fileSet(t, ".", func(rel string) bool {
return !strings.HasSuffix(rel, "_test.go")
return !strings.HasSuffix(rel, "_test.go") && rel != "token_scopes.go"
})
var missing, extra []string
for _, f := range scaffolded {

4
modules/cabana/phase10_coverage_test.go
View File

@@ -89,10 +89,12 @@ func TestPhase10Coverage(t *testing.T) {
sort.Strings(unsafe)
want := []string{
"DELETE /account/avatar",
"DELETE /account/tokens/{id}",
"DELETE /{vendor}/{plugin}/{controller}/{id}",
"DELETE /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}",
"DELETE /{vendor}/{plugin}/{controller}/{id}/relations/{name}/records/{child}/files/{field}/{file}",
"POST /account/avatar",
"POST /account/tokens",
"POST /auth/login",
"POST /auth/logout",
"POST /auth/refresh",
@@ -121,7 +123,7 @@ func TestPhase10Coverage(t *testing.T) {
"PUT /{vendor}/{plugin}/{controller}/{id}/relations/{name}/records/{child}/files/{field}/{file}",
}
if strings.Join(unsafe, "\n") != strings.Join(want, "\n") {
t.Fatalf("unsafe routes changed; extend TestPhase10CSRF (it expects 30 besides login):\n%s", strings.Join(unsafe, "\n"))
t.Fatalf("unsafe routes changed; extend TestPhase10CSRF (it expects %d):\n%s", len(want), strings.Join(unsafe, "\n"))
}
// The routes added in Phase 10 are safe reads: GET /lang and the shared
// nested pattern serving field options, filter options and relation lists.