From b2f40441115ccae582770f322da49f7d8c773418 Mon Sep 17 00:00:00 2001
From: Jakub Zych <jakub@keios.eu>
Date: Thu, 15 Oct 2026 22:47:45 +0200
Subject: [PATCH] test(19.3-06): gate requires the review-fix tests

- go, docker and layers stages require the plan-06 tests by name
  (CR-01, WR-01..WR-09)
---
 scripts/check-phase19.3.sh | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/scripts/check-phase19.3.sh b/scripts/check-phase19.3.sh
index d5ca1ac..5c9e29b 100755
--- a/scripts/check-phase19.3.sh
+++ b/scripts/check-phase19.3.sh
@@ -7,6 +7,10 @@
 # module: caches, the Redis rate-limit store, Install and the site-cache
 # purge), the purge wiring in the FAQ, menu and Journal plugins, and the
 # shared purge route of the FAQ, menu and Journal Nuxt layers.
+# Plan 06 (gap closure) adds the tests of its fixes: CR-01 (cors:<profile> on
+# every response) and WR-01..WR-09 (queued purges, no redirects, allowProxied,
+# credentialed origin rules, cookie Secure and defaults, nonce-only api-docs
+# CSP, protected uploads with public_url, the Turnstile boot warning).
 #
 # Stages:
 #   go        go vet ./... and go vet -tags summercms_s3 ./modules/lagoon/...;
@@ -63,6 +67,8 @@ BOUNCER_TESTS=(
 	TestTurnstileVerifyMatrix TestTurnstileVerifyTimeout TestTurnstileFormFields
 	TestTurnstileMiddlewareTokenSources TestTurnstileMiddlewareRestoresBody
 	TestTurnstileMiddlewareStatuses TestTurnstileNeverLogsSecret
+	TestLoadCookieConfigProductionInferredSecure
+	TestZeroCookieConfigDefaults
 )
 
 SURF_TESTS=(
@@ -72,6 +78,10 @@ SURF_TESTS=(
 	TestCORSProfilePreflightRoute TestCORSProfileUnknown TestCORSProfileWithPathsRefused
 	TestCORSProfileOverlapGlobal TestCORSProfileConflictingProfilesSamePath
 	TestCORSProfileHeadersOnRefusals TestCORSProfileVaryKeptWithHandlerVary
+	TestCORSCredentialedOriginRules
+	TestCORSAnchoredPatternNoSuffixMatch
+	TestAPIDocsCSPNoHostSource
+	TestTurnstileEmptySecretWarnsAtBoot
 	TestTurnstileFactoryParams
 	TestAPIDocsOffByDefault TestAPIDocsServesPinnedPage TestAPIDocsSpecJSONOrder
 	TestAPIDocsJSONSpecInput TestAPIDocsProviderCount TestAPIDocsPathValidation
@@ -90,6 +100,7 @@ ATTACH_TESTS=(
 	TestDiskExtensionTable
 	TestPublicURLBase
 	TestPublicURLValidation
+	TestStoreProtectedNeedsPrivateBucket
 )
 
 # cooler: caches, rate-limit parity with surf.MemoryStore (miniredis),
@@ -104,6 +115,9 @@ COOLER_TESTS=(
 	TestInstallConfigErrors TestInstallPingWarning TestInstallReusesFromApp
 	TestFromAppLazy TestInstallSiteCacheValidation
 	TestSiteCachePurgeConfig TestSiteCachePurgeRequest TestSiteCacheFromApp
+	TestSiteCachePurgeNoRedirect
+	TestSiteCachePurgeAsyncCoalesced
+	TestSiteCachePurgeWaitAndClose
 )
 
 # docker stage: testcontainers suites.
@@ -117,6 +131,7 @@ DOCKER_COOLER_TESTS=(
 	TestRedisCacheDocker
 	TestSiteCacheAfterCommitOnly
 	TestSiteCacheFailureNeverFails
+	TestSiteCacheBulkCommitCoalesced
 )
 DOCKER_FAQ_TESTS=(TestFaqAdminPurgesSiteCache)
 DOCKER_MENU_TESTS=(TestMenuAdminPurgesSiteCache)
@@ -152,6 +167,8 @@ LAYER_REQUIRE=(
 	"sitePurge: purge event edge cases"
 	"sitePurge: route answers 404 when disabled or proxied and 401 for a wrong bearer"
 	"sitePurge: route purges, answers the count and logs kind and slug only"
+	"sitePurge: allowProxied lets a proxied request reach the token check"
+	"sitePurge: route accepts a proxied request with allowProxied and the right bearer"
 )
 # Files every layer ships byte for byte.
 LAYER_SHARED=(