From a955d2a3d457bde8bdf90ce6efd741c5af38df3a Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Sun, 11 Oct 2026 13:53:31 +0200 Subject: [PATCH] fix(16.3): refresh CSRF coverage golden and blog scaffold layout Account token POST/DELETE routes made TestPhase10Coverage expect 32 unsafe routes; token_scopes.go is hand-authored and excluded from the scaffold pin. Co-authored-by: Cursor --- docs/examples/blog/scaffold_layout_test.go | 4 +++- modules/cabana/phase10_coverage_test.go | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/examples/blog/scaffold_layout_test.go b/docs/examples/blog/scaffold_layout_test.go index abfd9f8..0b5ee41 100644 --- a/docs/examples/blog/scaffold_layout_test.go +++ b/docs/examples/blog/scaffold_layout_test.go @@ -18,6 +18,8 @@ import ( // this plugin (without its tests, and with migration timestamps normalised). The // in-repository copy has no go.mod or go.sum because it lives in the // framework module; those two are left out of the scaffolder's set. +// token_scopes.go is hand-authored (HasTokenScopes example for personal API +// tokens) and is not a make:* output, so it is left out of the walkthrough set. func TestScaffoldLayout(t *testing.T) { // The make commands run go mod tidy; keep it on the module cache. t.Setenv("GOPROXY", "off") @@ -48,7 +50,7 @@ func TestScaffoldLayout(t *testing.T) { return rel != "go.mod" && rel != "go.sum" }) walkthrough := fileSet(t, ".", func(rel string) bool { - return !strings.HasSuffix(rel, "_test.go") + return !strings.HasSuffix(rel, "_test.go") && rel != "token_scopes.go" }) var missing, extra []string for _, f := range scaffolded { diff --git a/modules/cabana/phase10_coverage_test.go b/modules/cabana/phase10_coverage_test.go index 82d6d8a..443525d 100644 --- a/modules/cabana/phase10_coverage_test.go +++ b/modules/cabana/phase10_coverage_test.go @@ -89,10 +89,12 @@ func TestPhase10Coverage(t *testing.T) { sort.Strings(unsafe) want := []string{ "DELETE /account/avatar", + "DELETE /account/tokens/{id}", "DELETE /{vendor}/{plugin}/{controller}/{id}", "DELETE /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}", "DELETE /{vendor}/{plugin}/{controller}/{id}/relations/{name}/records/{child}/files/{field}/{file}", "POST /account/avatar", + "POST /account/tokens", "POST /auth/login", "POST /auth/logout", "POST /auth/refresh", @@ -121,7 +123,7 @@ func TestPhase10Coverage(t *testing.T) { "PUT /{vendor}/{plugin}/{controller}/{id}/relations/{name}/records/{child}/files/{field}/{file}", } if strings.Join(unsafe, "\n") != strings.Join(want, "\n") { - t.Fatalf("unsafe routes changed; extend TestPhase10CSRF (it expects 30 besides login):\n%s", strings.Join(unsafe, "\n")) + t.Fatalf("unsafe routes changed; extend TestPhase10CSRF (it expects %d):\n%s", len(want), strings.Join(unsafe, "\n")) } // The routes added in Phase 10 are safe reads: GET /lang and the shared // nested pattern serving field options, filter options and relation lists.