feat: implement security, error resilience, and query optimization proposals
Security Validation (enhance-security-validation): - JWT secret validation with entropy checking and pattern detection - CSRF protection middleware with token generation/validation - Frontend CSRF token auto-injection for DELETE/PUT/PATCH requests - MIME type validation with magic bytes detection for file uploads Error Resilience (add-error-resilience): - React ErrorBoundary component with fallback UI and retry functionality - ErrorBoundaryWithI18n wrapper for internationalization support - Page-level and section-level error boundaries in App.tsx Query Performance (optimize-query-performance): - Query monitoring utility with threshold warnings - N+1 query fixes using joinedload/selectinload - Optimized project members, tasks, and subtasks endpoints Bug Fixes: - WebSocket session management (P0): Return primitives instead of ORM objects - LIKE query injection (P1): Escape special characters in search queries Tests: 543 backend tests, 56 frontend tests passing Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -239,6 +239,8 @@ class TestAttachmentAPI:
|
||||
|
||||
def test_delete_attachment(self, client, test_user_token, test_task, db):
|
||||
"""Test soft deleting an attachment."""
|
||||
from app.core.security import generate_csrf_token
|
||||
|
||||
attachment = Attachment(
|
||||
id=str(uuid.uuid4()),
|
||||
task_id=test_task.id,
|
||||
@@ -252,9 +254,15 @@ class TestAttachmentAPI:
|
||||
db.add(attachment)
|
||||
db.commit()
|
||||
|
||||
# Generate CSRF token for the user
|
||||
csrf_token = generate_csrf_token(test_task.created_by)
|
||||
|
||||
response = client.delete(
|
||||
f"/api/attachments/{attachment.id}",
|
||||
headers={"Authorization": f"Bearer {test_user_token}"},
|
||||
headers={
|
||||
"Authorization": f"Bearer {test_user_token}",
|
||||
"X-CSRF-Token": csrf_token,
|
||||
},
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
|
||||
Reference in New Issue
Block a user