github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-07-22 12:06:11 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2671] [MERGED] test(e2e): close high-value coverage gaps in security + sharing flows #10111

New Issue
Closed
opened 2026-04-23 09:24:56 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 09:24:56 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2671
Author: @tink-bot
Created: 4/21/2026
Status: ✅ Merged
Merged: 4/21/2026
Merged by: @kolaente

Base: main ← Head: feat-e2e-coverage-gaps

📝 Commits (10+)

  • 49ba7e9 test(e2e): add user settings nav helper
  • 102935e test(e2e): add SessionFactory with sha256 token hashing
  • 49a791b test(e2e): add WebhookFactory
  • da8b457 test(e2e): add TotpFactory with fixed seed
  • 03b937e test(e2e): add otplib dev dep for TOTP tests
  • 420b836 test(e2e): cover TOTP enrollment flow
  • 4ae3ded test(e2e): cover TOTP disable flow
  • f8c7b42 test(e2e): assert wrong TOTP passcode is rejected
  • c3bd16a test(e2e): cover caldav token creation end-to-end
  • e488e16 test(e2e): cover caldav token deletion

📊 Changes

18 files changed (+820 additions, -0 deletions)

View changed files

📝 frontend/package.json (+1 -0)
📝 frontend/pnpm-lock.yaml (+59 -0)
➕ frontend/tests/e2e/project/webhooks.spec.ts (+51 -0)
📝 frontend/tests/e2e/sharing/linkShare.spec.ts (+113 -0)
📝 frontend/tests/e2e/sharing/team.spec.ts (+80 -0)
➕ frontend/tests/e2e/task/recurrence.spec.ts (+79 -0)
📝 frontend/tests/e2e/task/task.spec.ts (+89 -0)
📝 frontend/tests/e2e/user/email-confirmation.spec.ts (+15 -0)
➕ frontend/tests/e2e/user/settings/caldav.spec.ts (+57 -0)
➕ frontend/tests/e2e/user/settings/data-export.spec.ts (+27 -0)
➕ frontend/tests/e2e/user/settings/deletion.spec.ts (+55 -0)
➕ frontend/tests/e2e/user/settings/sessions.spec.ts (+58 -0)
➕ frontend/tests/e2e/user/settings/totp.spec.ts (+48 -0)
➕ frontend/tests/factories/session.ts (+26 -0)
➕ frontend/tests/factories/team_project.ts (+18 -0)
➕ frontend/tests/factories/totp.ts (+18 -0)
➕ frontend/tests/factories/webhook.ts (+20 -0)
➕ frontend/tests/support/userSettings.ts (+6 -0)

📄 Description

Closes large gaps in E2E coverage around user security/account flows, task power-user depth, and sharing permission boundaries. 810 lines of new test code across 18 files, backed by 4 new factories and 1 support helper.

What's covered

  • User settings: TOTP enroll/disable/reject, CalDAV token create/delete, email change rejection, session list + revoke + current-session guard, account deletion request/cancel, data export request/reject.
  • Project webhooks: URL validation, events-required validation, create + delete.
  • Task depth: attachment delete (owner + read-only guard), recurrence preset buttons, regenerate-on-complete, monthly mode UI.
  • Sharing: team permission tiers (READ / READ_WRITE / revoke) and link-share password protection + permission tiers.

Test infrastructure added

  • SessionFactory (SHA-256 token hashing), WebhookFactory, TotpFactory, TeamProjectFactory
  • gotoUserSettings nav helper
  • otplib@^12 as dev dep for deterministic TOTP codes

Notes discovered along the way

  • Found a real UX bug in LinkSharingAuth.vue: wrong password sets errorMessage but hides the surrounding <Card> via v-if, so users see nothing. Test was adapted to assert observable outcomes (HTTP >=400 + URL unchanged) instead.
  • otplib v13 has incompatible API and secret-length rules; pinned to v12.
  • settings.spec.ts:4/43/91 have 3 failures that pre-date this branch (avatar upload + name update). Not regressions.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2671 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 4/21/2026 **Status:** ✅ Merged **Merged:** 4/21/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `feat-e2e-coverage-gaps` --- ### 📝 Commits (10+) - [`49ba7e9`](https://github.com/go-vikunja/vikunja/commit/49ba7e9b2bb3d4ed4e18cd59284d5901a89c575d) test(e2e): add user settings nav helper - [`102935e`](https://github.com/go-vikunja/vikunja/commit/102935e5a27fcce719113241ae7bcc176731b919) test(e2e): add SessionFactory with sha256 token hashing - [`49a791b`](https://github.com/go-vikunja/vikunja/commit/49a791bea9df85f988eee00b868a71c2170f2819) test(e2e): add WebhookFactory - [`da8b457`](https://github.com/go-vikunja/vikunja/commit/da8b457806c347d7d58af6b6f309e5119ea8233c) test(e2e): add TotpFactory with fixed seed - [`03b937e`](https://github.com/go-vikunja/vikunja/commit/03b937eab60f8ce8af2a4290158403614a249b32) test(e2e): add otplib dev dep for TOTP tests - [`420b836`](https://github.com/go-vikunja/vikunja/commit/420b83665e16268068ebe4b34305ae4d82b19717) test(e2e): cover TOTP enrollment flow - [`4ae3ded`](https://github.com/go-vikunja/vikunja/commit/4ae3dedc88731e86af1c69acfa72e8c277151291) test(e2e): cover TOTP disable flow - [`f8c7b42`](https://github.com/go-vikunja/vikunja/commit/f8c7b42a6fb7486233ee61098ab5693317e64b0e) test(e2e): assert wrong TOTP passcode is rejected - [`c3bd16a`](https://github.com/go-vikunja/vikunja/commit/c3bd16a7795cc53cde1448ab015760e80c0dabce) test(e2e): cover caldav token creation end-to-end - [`e488e16`](https://github.com/go-vikunja/vikunja/commit/e488e16102d7775dd15c17d4495542533361be01) test(e2e): cover caldav token deletion ### 📊 Changes **18 files changed** (+820 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `frontend/package.json` (+1 -0) 📝 `frontend/pnpm-lock.yaml` (+59 -0) ➕ `frontend/tests/e2e/project/webhooks.spec.ts` (+51 -0) 📝 `frontend/tests/e2e/sharing/linkShare.spec.ts` (+113 -0) 📝 `frontend/tests/e2e/sharing/team.spec.ts` (+80 -0) ➕ `frontend/tests/e2e/task/recurrence.spec.ts` (+79 -0) 📝 `frontend/tests/e2e/task/task.spec.ts` (+89 -0) 📝 `frontend/tests/e2e/user/email-confirmation.spec.ts` (+15 -0) ➕ `frontend/tests/e2e/user/settings/caldav.spec.ts` (+57 -0) ➕ `frontend/tests/e2e/user/settings/data-export.spec.ts` (+27 -0) ➕ `frontend/tests/e2e/user/settings/deletion.spec.ts` (+55 -0) ➕ `frontend/tests/e2e/user/settings/sessions.spec.ts` (+58 -0) ➕ `frontend/tests/e2e/user/settings/totp.spec.ts` (+48 -0) ➕ `frontend/tests/factories/session.ts` (+26 -0) ➕ `frontend/tests/factories/team_project.ts` (+18 -0) ➕ `frontend/tests/factories/totp.ts` (+18 -0) ➕ `frontend/tests/factories/webhook.ts` (+20 -0) ➕ `frontend/tests/support/userSettings.ts` (+6 -0) </details> ### 📄 Description Closes large gaps in E2E coverage around user security/account flows, task power-user depth, and sharing permission boundaries. 810 lines of new test code across 18 files, backed by 4 new factories and 1 support helper. ### What's covered - **User settings:** TOTP enroll/disable/reject, CalDAV token create/delete, email change rejection, session list + revoke + current-session guard, account deletion request/cancel, data export request/reject. - **Project webhooks:** URL validation, events-required validation, create + delete. - **Task depth:** attachment delete (owner + read-only guard), recurrence preset buttons, regenerate-on-complete, monthly mode UI. - **Sharing:** team permission tiers (READ / READ_WRITE / revoke) and link-share password protection + permission tiers. ### Test infrastructure added - `SessionFactory` (SHA-256 token hashing), `WebhookFactory`, `TotpFactory`, `TeamProjectFactory` - `gotoUserSettings` nav helper - `otplib@^12` as dev dep for deterministic TOTP codes ### Notes discovered along the way - Found a real UX bug in `LinkSharingAuth.vue`: wrong password sets `errorMessage` but hides the surrounding `<Card>` via `v-if`, so users see nothing. Test was adapted to assert observable outcomes (HTTP >=400 + URL unchanged) instead. - otplib v13 has incompatible API and secret-length rules; pinned to v12. - `settings.spec.ts:4/43/91` have 3 failures that pre-date this branch (avatar upload + name update). Not regressions. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 09:24:56 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#10111