From bda18f9e2d863e0a9e764ff795c76db593ba5222 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 11 Sep 2026 09:35:17 +0200 Subject: [PATCH] test(profile): the edge proxy is not a profile submitter The demo allowlist names a path and a method as data, which reads to the submitter matcher exactly like a request expression. proxy.ts submits nothing and has no answer to read, so it is excluded by name. --- .../profile-rejection-surface-guard.test.ts | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/src/__tests__/profile-rejection-surface-guard.test.ts b/src/__tests__/profile-rejection-surface-guard.test.ts index 7bed465fd..e18fec0d0 100644 --- a/src/__tests__/profile-rejection-surface-guard.test.ts +++ b/src/__tests__/profile-rejection-surface-guard.test.ts @@ -31,12 +31,19 @@ const SRC = join(process.cwd(), "src"); const PROFILE_ROUTES = ["/api/auth/profile", "/api/user/profile"]; function sourceFiles(): string[] { - return walkSourceFiles(SRC, { floor: 3000 }) - .filter((p) => !p.startsWith("generated/")) - .filter((p) => !p.startsWith("app/api/")) - .filter((p) => !p.includes("__tests__")) - .filter((p) => !p.endsWith(".test.ts") && !p.endsWith(".test.tsx")) - .sort(); + return ( + walkSourceFiles(SRC, { floor: 3000 }) + .filter((p) => !p.startsWith("generated/")) + .filter((p) => !p.startsWith("app/api/")) + // v1.39 (Wave C, C6) — the edge proxy names routes and methods as DATA + // (the demo-mode mutation allowlist is a list of path/method pairs), and + // a pair reads to the matcher below exactly like a request expression. It + // submits nothing and has no answer to read. + .filter((p) => p !== "proxy.ts") + .filter((p) => !p.includes("__tests__")) + .filter((p) => !p.endsWith(".test.ts") && !p.endsWith(".test.tsx")) + .sort() + ); } function read(rel: string): string {