912a46603f
- 12.2-SECURITY-REVIEW.md maps T-12.2-01 to T-12.2-36 and the supply chain rows to the controls as built and their passing tests, with the parent-predicate removal check and the residual risks - 12.2-VALIDATION.md: per-task map with real task ids, all green, nyquist_compliant and wave_0_complete set - deferred-items.md: out-of-scope findings for follow-up
116 lines
11 KiB
Markdown
116 lines
11 KiB
Markdown
---
|
|
phase: "12.2"
|
|
slug: "admin-form-fields-date-file-upload-relation-editing-with-def"
|
|
# status lifecycle: draft (seeded by plan-phase) → validated (set by validate-phase §6)
|
|
# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
|
|
status: validated
|
|
nyquist_compliant: true
|
|
wave_0_complete: true
|
|
created: "2026-10-02"
|
|
---
|
|
|
|
# Phase 12.2 — Validation Strategy
|
|
|
|
> Per-phase validation contract for feedback sampling during execution.
|
|
|
|
---
|
|
|
|
## Test Infrastructure
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Framework** | go test + testify, testcontainers-go Postgres (`-short` skips DB tests); vitest 3.2.7 + @vue/test-utils + happy-dom for the admin SPA |
|
|
| **Config file** | `modules/lagoon/postgres_test.go`, `modules/cabana/auth_test.go` (TestMain); `admin/vitest.config.ts` |
|
|
| **Quick run command** | `go vet ./... && go test -short ./modules/cabana/... ./modules/lagoon/... ./modules/conga/...` (plus `npm --prefix admin test -- tests/form tests/relation` when the SPA changed) |
|
|
| **Full suite command** | `go vet ./... && go test ./... && npm --prefix admin run typecheck && npm --prefix admin test && scripts/check-admin-openapi.sh --check && scripts/check-admin-dist.sh && go test ./cmd/summer -run TestDocsTree && go run ./cmd/summer docs:build --check` |
|
|
| **Estimated runtime** | ~240 seconds (Docker up) |
|
|
|
|
---
|
|
|
|
## Sampling Rate
|
|
|
|
- **After every task commit:** Run the quick run command
|
|
- **After every plan wave:** Run the full suite command
|
|
- **Before `/gsd-verify-work`:** Full suite must be green
|
|
- **Max feedback latency:** 240 seconds
|
|
|
|
---
|
|
|
|
## Per-Task Verification Map
|
|
|
|
Each row maps one task to the commands that verify it. Every command was run green in plan 12.2-05 (2026-10-02), and the whole map is run by `bash scripts/check-phase12.2.sh --all` (all nine stages PASS). Run Go tests with FORCE_COLOR unset.
|
|
|
|
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|
|
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
|
|
| 12.2-01-T1 | 01 | 1 | SC-2, SC-4 | T-12.2-01..06 | bindings owned per admin; guarded store; purge deletes blobs after commit | unit + PG | `go test ./modules/lagoon ./modules/lagoon/attach -run '^(TestDeferred.*|TestPurgeDeferred.*|TestStore.*|TestIsAllowedImage.*)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-01-T2 | 01 | 1 | SC-1 | T-12.2-08 | N/A | unit + PG | `go test ./modules/lagoon -run '^(TestDate.*|TestTimeOfDay.*|TestFillText.*|TestValidateRequiredZero.*)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-01-T3 | 01 | 1 | SC-4 | T-12.2-07 | forged scheduled jobs skipped | unit + PG | `go test ./modules/conga ./modules/pact ./modules/lagoon -run '^(TestFrameworkSchedule.*|TestRelationHookInterfaces|TestPurgeDeferredDays|TestPurgeDeferredCommand)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-02-T1 | 02 | 2 | SC-2, SC-4 | T-12.2-09, -14, -15 | foreign key replay finds nothing; 413 past the cap | integration | `go test ./modules/cabana -run '^(TestFileuploadUpload|TestFileuploadCompile|TestFileuploadSmoke.*)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-02-T2 | 02 | 2 | SC-2, SC-4 | T-12.2-10..13, -16, -18 | parent-scoped file ids; protected download headers; commit once | integration + security | `go test ./modules/cabana -run '^(TestProtectedFile.*|TestFileupload(Remove|Caption|Reorder|AttachOneReplace|MIME)|TestDeferredCommit.*)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-02-T3 | 02 | 2 | SC-1 | T-12.2-17 | min/max enforced on the server (422) | integration | `go test ./modules/cabana -run '^TestDatepicker.*$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-03-T1 | 03 | 3 | SC-3 | T-12.2-26..28 | `$/` inside the plugin; D-23 refusals; FK set by the server | integration | `go test ./modules/cabana -run '^(TestRelationChild(Contract|ZeroKind|Forms|Schema)|TestRelationChildSmokeCreate)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-03-T2 | 03 | 3 | SC-3 | T-12.2-19..23 | child of another parent or a hidden parent 404; toolbar 403 before SQL; pivot whitelist | security | `go test ./modules/cabana -run '^(TestRelationChildScope.*|TestRelationChildCRUD)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-03-T3 | 03 | 3 | SC-4 | T-12.2-24, -25 | another admin's pending children 404; ineligible deferred link 422 keeps bindings | integration + security | `go test ./modules/cabana -run '^(TestRelationChildDeferred|TestRelationChildPurgeModels|TestRelationChildScopeSessionKey|TestDeferredCommitRollback)$' -count=1` | ✅ | ✅ green |
|
|
| 12.2-04-T1 | 04 | 4 | SC-2 | T-12.2-29, -31..33 | session key in headers only; protected thumbs from object URLs | SPA unit | `npm --prefix admin test -- tests/app/sessionKey.test.ts tests/form/FileuploadField.test.ts tests/smoke/deferred.smoke.test.ts` | ✅ | ✅ green |
|
|
| 12.2-04-T2 | 04 | 4 | — | T-12.2-SC | exact pin after user approval | checkpoint (decision) | `scripts/check-admin-dist.sh` (rebuild from the committed lockfile) | ✅ | ✅ green (user approved) |
|
|
| 12.2-04-T3 | 04 | 4 | SC-1 | — | N/A | SPA unit | `npm --prefix admin test -- tests/app/dateFormat.test.ts tests/form/DatepickerField.test.ts tests/list/CellValue.test.ts` | ✅ | ✅ green |
|
|
| 12.2-04-T4 | 04 | 4 | SC-3, SC-4 | T-12.2-30 | no raw-HTML sinks; child modal sends both keys | SPA unit | `npm --prefix admin test -- tests/relation` and `bash scripts/check-phase12.2.sh --hygiene` | ✅ | ✅ green |
|
|
| 12.2-05-T1 | 05 | 5 | SC-3 | T-12.2-19, -23, -24, -35 | D-15 suite through the router; fails with the parent predicate removed | security | `go test ./modules/cabana -run '^(TestRelationChildScope.*|TestProtectedFile.*)$' -count=1 -v` | ✅ | ✅ green |
|
|
| 12.2-05-T2 | 05 | 5 | SC-1..4 | all Go rows | every Go behaviour tested | unit + integration | `go vet ./... && go test ./... -count=1` | ✅ | ✅ green |
|
|
| 12.2-05-T3 | 05 | 5 | SC-5 | T-12.2-34, -35 | named security tests refused when missing or skipped; fixture test-only | gate + docs | `bash scripts/check-phase12.2.sh --all` (includes `go test ./cmd/summer -run TestDocsTree` and `go run ./cmd/summer docs:build --check`) | ✅ | ✅ green |
|
|
| 12.2-05-T4 | 05 | 5 | — | T-12.2-36 | the user tags v0.1.1; the executor never tags | checkpoint (human-action) | `git tag --list v0.1.1` (empty until the user tags) | ✅ | ⬜ awaiting user |
|
|
|
|
Earlier behaviour-to-command contract (RESEARCH.md), all rows now green:
|
|
|
|
| Area | Success criterion | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|
|
|------|-------------------|------------|-----------------|-----------|-------------------|-------------|--------|
|
|
| datepicker compile | SC-1 | — | unknown key / mode-type mismatch fails boot | unit | `go test ./modules/cabana -run TestDatepicker` | ✅ | ✅ green |
|
|
| Date / TimeOfDay / Fill | SC-1 | — | N/A | unit + PG | `go test ./modules/lagoon -run 'TestDate\|TestTimeOfDay\|TestFillText'` | ✅ | ✅ green |
|
|
| date bounds | SC-1 | — | min/max enforced server-side (422) | integration | `go test ./modules/cabana -run TestDatepickerBounds` | ✅ | ✅ green |
|
|
| attach.Store | SC-2 | upload | size/MIME/image guard, polyglot refused | unit + PG | `go test ./modules/lagoon/attach -run 'TestStore\|TestIsAllowedImage'` | ✅ | ✅ green |
|
|
| fileupload routes | SC-2 | upload | MaxBytesReader 413, maxFiles, deferred bind | integration | `go test ./modules/cabana -run TestFileupload` | ✅ | ✅ green |
|
|
| protected file download | SC-2 | IDOR | 404 for other parent / other admin's pending file; nosniff | security | `go test ./modules/cabana -run TestProtectedFile` | ✅ | ✅ green |
|
|
| relation child CRUD | SC-3 | mass assign | toolbarButtons gate, pivot whitelist | integration | `go test ./modules/cabana -run TestRelationChild` | ✅ | ✅ green |
|
|
| parent scoping (D-15) | SC-3 | IDOR | child of another parent → 404 | security | `go test ./modules/cabana -run TestRelationChildScope` | ✅ | ✅ green |
|
|
| deferred commit | SC-4 | session replay | foreign admin key ignored; rollback keeps bindings; double submit serialized | integration | `go test ./modules/cabana -run TestDeferredCommit` | ✅ | ✅ green |
|
|
| purge | SC-4 | storage DoS | expired bindings + orphans removed, blobs after commit | integration | `go test ./modules/lagoon -run TestPurgeDeferred` | ✅ | ✅ green |
|
|
| framework schedule | SC-4 | — | N/A | unit | `go test ./modules/conga -run TestFrameworkSchedule` | ✅ | ✅ green |
|
|
| route inventory + OpenAPI | SC-3/4 | — | every route permission-checked | contract | `go test ./modules/cabana -run 'TestPhase09PermissionMatrix\|TestPhase09ContractInventory\|TestPhase10OpenAPIConformance'` | ✅ | ✅ green |
|
|
| SPA fields + modals | SC-1/2/3 | — | session key header sent | SPA unit | `npm --prefix admin test -- tests/form tests/relation tests/app tests/list` | ✅ | ✅ green |
|
|
| docs checker | SC-5 | — | N/A | docs | `go test ./cmd/summer -run TestDocsTree && go run ./cmd/summer docs:build --check` | ✅ | ✅ green |
|
|
|
|
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
|
|
|
|
---
|
|
|
|
## Wave 0 Requirements
|
|
|
|
- [x] `modules/cabana/testdata/deferred` fixture plugin `acme.deferred` (`phase122_fixture_test.go`): parent model (attach owner and attach relations), hasMany child with a nullable FK, belongsToMany with a pivot form, `config_relation.yaml` using `manage.form` and `pivot.form` (12.2-05 Task 1)
|
|
- [x] `phase09Routes` in `modules/cabana/security_coverage_test.go` extended in the same commit as each new route (plans 02 and 03)
|
|
- [x] `admin/tests/fixtures/` entries for the new schema fields and file list: `deferred.form-schema.json` (plan 04), `deferred.relation-schema.json` and `deferred.files.json` (12.2-05)
|
|
|
|
*No framework install needed.*
|
|
|
|
---
|
|
|
|
## Manual-Only Verifications
|
|
|
|
| Behavior | Requirement | Why Manual | Test Instructions |
|
|
|----------|-------------|------------|-------------------|
|
|
| Datepicker keyboard / a11y and visual fit with Direction C | SC-1 | Visual and interaction quality | Open a form with each mode in the admin SPA; navigate the calendar by keyboard; check against UI-SPEC |
|
|
| Drag reorder and upload progress feel | SC-2 | Pointer interaction | Upload several images to an attachMany field on an unsaved record, reorder, save, reload |
|
|
| Child and pivot modal flow | SC-3, SC-4 | Visual flow across modals | On the create screen add children with an uploaded image and a link with pivot details, save; then edit a child, edit pivot details and delete a child on the saved record |
|
|
|
|
---
|
|
|
|
## Validation Sign-Off
|
|
|
|
- [x] All tasks have `<automated>` verify or Wave 0 dependencies
|
|
- [x] Sampling continuity: no 3 consecutive tasks without automated verify
|
|
- [x] Wave 0 covers all MISSING references
|
|
- [x] No watch-mode flags
|
|
- [x] Feedback latency < 240s (`check-phase12.2.sh --all` about 200 s with Docker up)
|
|
- [x] `nyquist_compliant` set to true in the frontmatter
|
|
|
|
**Approval:** automated map green in plan 12.2-05 (2026-10-02). The manual-only rows wait for `/gsd-verify-work 12.2`.
|