fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -0,0 +1,27 @@
+import { defineConfig } from "@playwright/test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import base from "./playwright.config";
+
+// Separate API-only suite: real authentication/controllers/exporter, inert child processes.
+const stubRoot = process.env.PDF_STUB_ROOT ??= fs.mkdtempSync(path.join(os.tmpdir(), "jobjakt-pdf-admission-"));
+const executable = path.resolve("../JobTrackerApi.Tests/bin/Release/net9.0/PdfBrowserStub", process.platform === "win32" ? "PdfBrowserStub.exe" : "PdfBrowserStub");
+if (!fs.existsSync(executable)) throw new Error("Build JobTrackerApi.Tests in Release before the PDF admission suite.");
+const backend = (base.webServer as Array<{ env: Record<string, string>; command: string }>)[0];
+
+export default defineConfig({
+  testDir: "./pdf-tests", workers: 1, retries: 0, timeout: 60_000,
+  webServer: {
+    ...backend,
+    env: {
+      ...backend.env,
+      CV_PDF_BROWSER_PATH: executable, PDF_STUB_ROOT: stubRoot,
+      CvExports__MaxConcurrentRenders: "2", CvExports__RenderTimeoutSeconds: "20",
+      Auth__GoogleClientId: "", Auth__MicrosoftClientId: "", Email__Enabled: "false",
+      Ai__BaseUrl: "http://127.0.0.1:1", Stripe__SecretKey: "", Backups__Enabled: "false",
+      Workers__AiOperationsEnabled: "false", Workers__RulesEnabled: "false",
+      Workers__FollowUpRemindersEnabled: "false", Workers__DailyExportEnabled: "false", Workers__JobEnrichmentEnabled: "false",
+    },
+  },
+});