From dd3ac3510fcae5ae8586f2a1cf35216c0978a389 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 4 Jun 2026 13:26:19 +0200 Subject: [PATCH] test(ssrf): lock the pre-existing moodLog and ntfy host pins Extend the SSRF pin inventory to also assert the requirePublicHost pins already present on the user/operator-supplied moodLog push/sync webhooks and the ntfy sender, so the full set of overridable-host egress points is CI-guarded and a future edit that drops one reds here. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/lib/__tests__/ssrf-pin-inventory.test.ts | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/lib/__tests__/ssrf-pin-inventory.test.ts b/src/lib/__tests__/ssrf-pin-inventory.test.ts index 0b2dce059..edc8498c4 100644 --- a/src/lib/__tests__/ssrf-pin-inventory.test.ts +++ b/src/lib/__tests__/ssrf-pin-inventory.test.ts @@ -35,6 +35,23 @@ describe("SSRF requirePublicHost pin inventory", () => { expect(read("geo.ts")).toMatch(/requirePublicHost:\s*true/); }); + // v1.11.2 product-lead M2 (optional) — lock the PRE-EXISTING user/operator + // webhook pins too, so the full inventory is CI-guarded and a future edit + // that drops one of these reds here rather than shipping silently. + it("moodLog push pins the user-supplied webhook outbound", () => { + expect(read("moodlog/push.ts")).toMatch(/requirePublicHost:\s*true/); + }); + + it("moodLog sync pins the user-supplied webhook outbound", () => { + expect(read("moodlog/sync.ts")).toMatch(/requirePublicHost:\s*true/); + }); + + it("ntfy sender pins the user/operator-supplied server outbound", () => { + expect(read("notifications/senders/ntfy.ts")).toMatch( + /requirePublicHost:\s*true/, + ); + }); + it("local AI client keeps the pin CONDITIONAL (LAN escape hatch)", () => { const src = read("ai/local-client.ts"); // Must carry the conditional form …