mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Security + accessibility hardening release. Closes the highest-priority findings from a focused security audit of the v1.4.23 release: - Bearer auth fail-closed when a route declares no scope (api-handler) - Public /api/send Umami proxy now rate-limits 120 req/min/IP - Proxy nonce generation switched to btoa(...) for Edge portability - Session-expiry delete race uses deleteMany + catch (no more 500s) - POST /api/import returns the standard apiError envelope on 422 - Runtime Docker image pins Prisma 7.8 + worker deps to minors - Notifications page renders a real load-error alert - Accessibility: switch aria-labels, htmlFor pairing, mobile admin Overview link, deep-link anchors on notification settings - Chart overlays: per-chart comparisonBaseline pref, BMI/bodyFat/ sleep/steps overlay keys, TrendCard layout tolerates long labels Verification: pnpm typecheck && pnpm lint && pnpm test (2244/2244) && pnpm format:check all green.
46 lines
1.4 KiB
TypeScript
46 lines
1.4 KiB
TypeScript
import { defineConfig } from "vitest/config";
|
|
import { dirname, resolve } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const __filename = fileURLToPath(import.meta.url);
|
|
const __dirname = dirname(__filename);
|
|
|
|
export default defineConfig({
|
|
test: {
|
|
globals: true,
|
|
environment: "node",
|
|
// Default `pnpm test` keeps unit tests only — integration suite uses
|
|
// testcontainers and runs separately via `pnpm test:integration`.
|
|
exclude: [
|
|
"**/node_modules/**",
|
|
"**/dist/**",
|
|
"**/.next/**",
|
|
"tests/integration/**",
|
|
// Playwright E2E suite — driven separately via `pnpm e2e`.
|
|
"e2e/**",
|
|
// Live agent worktrees create copies of `src/` under
|
|
// `.claude/worktrees/`; vitest would otherwise pick those copies up
|
|
// and run their tests twice — possibly against stale snapshots.
|
|
".claude/worktrees/**",
|
|
],
|
|
coverage: {
|
|
provider: "v8",
|
|
// `include` enumerates the full source tree so the report shows
|
|
// per-file coverage for files never imported by a test (vitest 4
|
|
// dropped the `coverage.all` flag and uses `include` for this).
|
|
include: ["src/**/*.ts", "src/**/*.tsx"],
|
|
exclude: [
|
|
"src/generated/**",
|
|
"src/**/__tests__/**",
|
|
"src/**/*.test.ts",
|
|
"src/**/*.test.tsx",
|
|
],
|
|
},
|
|
},
|
|
resolve: {
|
|
alias: {
|
|
"@": resolve(__dirname, "src"),
|
|
},
|
|
},
|
|
});
|