Jakub Zych 5ed920b7b1 test(02-05): cover proxy, scrub and CLI security boundaries ...

- Reject non-loopback bind/upstream, cap bodies, isolate concurrent sessions and refuse traversal
- Scrub JWT, inv_ tokens, cookies, client secrets and OAuth codes out of fixtures
- CLI discovery and replay errors exit nonzero without printing secrets

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-09-17 14:06:40 +02:00

..

testdata

feat(02-01): record and replay one route through the summer CLI

2026-09-17 12:20:22 +02:00

capture_test.go

fix(02-03): scrub PKCE and OAuth form fields by name

2026-09-17 13:43:27 +02:00

diff_contract_test.go

test(02-05): lock down every response parity class with negative tests

2026-09-17 14:03:55 +02:00

diff_test.go

feat(02-02): capture, scrub, and strictly diff stateful flows

2026-09-17 12:32:49 +02:00

diff.go

feat(02-02): capture, scrub, and strictly diff stateful flows

2026-09-17 12:32:49 +02:00

fixture.go

feat(02-02): capture named sessions through a loopback proxy

2026-09-17 12:27:57 +02:00

flow_contract_test.go

test(02-05): lock down every response parity class with negative tests

2026-09-17 14:03:55 +02:00

flow_test.go

feat(02-02): capture, scrub, and strictly diff stateful flows

2026-09-17 12:32:49 +02:00

flow.go

feat(02-02): record manifest route cases and report coverage

2026-09-17 12:36:48 +02:00

headers_test.go

feat(02-02): capture, scrub, and strictly diff stateful flows

2026-09-17 12:32:49 +02:00

manifest_contract_test.go

test(02-05): lock down every response parity class with negative tests

2026-09-17 14:03:55 +02:00

manifest_test.go

fix(02-03): re-record on --update and honor case capture rules

2026-09-17 13:00:14 +02:00

manifest.go

fix(02-03): keep a recorded seed when --update recaptures routes

2026-09-17 13:00:44 +02:00

normalize_test.go

fix(02-03): mask OAuth client_id and unix issued_at

2026-09-17 13:36:30 +02:00

normalize.go

fix(02-03): mask OAuth client_id and unix issued_at

2026-09-17 13:36:30 +02:00

proxy_security_test.go

test(02-05): cover proxy, scrub and CLI security boundaries

2026-09-17 14:06:40 +02:00

proxy_test.go

feat(02-02): capture named sessions through a loopback proxy

2026-09-17 12:27:57 +02:00

proxy.go

fix(02-03): surface reverse-proxy record failures in 502 bodies

2026-09-17 13:40:47 +02:00

record.go

feat(02-02): capture, scrub, and strictly diff stateful flows

2026-09-17 12:32:49 +02:00

replay.go

fix(02-03): expand expected placeholders after replay capture

2026-09-17 12:51:24 +02:00

report.go

feat(02-02): record manifest route cases and report coverage

2026-09-17 12:36:48 +02:00

roundtrip_test.go

feat(02-01): lock the one-route tide record and replay contract

2026-09-17 12:21:34 +02:00

rules_test.go

feat(02-02): capture named sessions through a loopback proxy

2026-09-17 12:27:57 +02:00

rules.go

feat(02-02): capture named sessions through a loopback proxy

2026-09-17 12:27:57 +02:00

variables.go

fix(02-03): scrub PKCE and OAuth form fields by name

2026-09-17 13:43:27 +02:00