mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 20:26:33 +00:00
kevinveenbirkenbachandClaude Opus 4.8
7d9ce08202
The baserow (infinito_sso.py) and bookwyrm (header_auth.py) trusted-header bridges now read identity only from the X-Forwarded-* headers nginx overwrites from the oauth2-proxy auth response. The client-injectable X-Auth-Request-*/Remote-User/X-Forwarded-Name variants are dropped, closing an authenticated-user header-injection escalation (including a groups->superuser path) in the claim-less edge case where X-Forwarded-* would be empty. Add SSO security e2e tests (test-oidc-security.js) to both roles: forged-header gate bounce, trusted-header bridge endpoint gating, SSO-disabled inertness, and injected-header re-identification of an authenticated session. Wire the new spec into baserow's playwright.spec.js. Update the bookwyrm header_auth unit test: precedence now uses two listed headers, plus a regression guard asserting proxy-uncontrolled headers are ignored. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Tests 🧪
All automated tests for Infinito.Nexus live here.
| Directory | Type | Guide |
|---|---|---|
unit/ |
Unit tests (isolated, no I/O) | unit.md |
integration/ |
Integration tests (real component boundaries) | integration.md |
external/ |
Opt-in live third-party checks, excluded from make test |
external.md |
e2e/ |
End-to-end Playwright tests | playwright.md |
regression/ |
Regression guard rules | regression.md |
lint/ |
Structural lint checks | lint.md |
Run each suite via the make targets documented in the linked guides.