Enforce backend authentication, add /health, drift guardrail, and lint gate - #10
Merged
Merged
Conversation
…t on tests
Security (priority-1 finding: the backend was publicly reachable):
- package.json: drop the "[production]": { auth: false } override that
disabled CAP's auth middleware in production; production now uses xsuaa,
development uses a mocked user so the suite stays runnable.
- z2ui5-service.cds: @(requires: 'authenticated-user') on both rootService
(the z2ui5 roundtrip action) and AdminService (the draft table + Northwind
proxy) — the serialized-state draft table is no longer anonymously
readable, and the mutating roundtrip is no longer anonymously callable. In
BTP the approuter authenticates via xsuaa and forwards the JWT
(HTML5.ForwardAuthToken), so the roundtrip still runs under the real user.
- xs-security.json: add a User scope + role template (was empty).
Deployment:
- server.js: implement GET /health (public, cheap 200) — mta.yaml already
declares it as the CF readiness-check endpoint but nothing served it.
CI:
- update_cap.yml: commit the refreshed run/input/core mirror only AFTER
assemble + the app's jest suite pass, so a broken upstream core can no
longer land on main permanently while the publish is (correctly) gated.
Tests: starter/northwind updated to authenticate; new starter case asserts
the roundtrip and the draft table reject unauthenticated access (401).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018FTxX214GdPJZXvz88Mbq8
…docs - assemble-cap.js: add the stale core-lock drift guard — fail the build with an actionable message when the mirrored core's dependencies diverge from the frozen "core" entry in src/package-lock.json (the biggest latent break: it would otherwise surface only as an out-of-sync `npm ci` downstream). Also guard the pre-merge lockfile JSON.parse for symmetry with the later block. New guardrail test covers the drift case; the base fixture now carries the core's declared deps like the real lock. - ESLint flat config + `npm run lint` + CI gate over the build scripts, the builder tests and the CAP app source (src/srv, src/test). - dependabot: watch the npm ecosystem in /src (the app lock was untended). - server.js: document the auth boundary — data endpoints (POST roundtrip + OData) are @requires-protected; the GET/HEAD routes serve only the static shell + CSRF ack and are intentionally public. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018FTxX214GdPJZXvz88Mbq8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security, deployment, and CI hardening for the CAP app skeleton.
Security (headline: the backend was publicly reachable)
"[production]": { "auth": false }— production now uses xsuaa; development uses a mocked user so the suite stays runnable.@(requires: 'authenticated-user')on bothrootService(the z2ui5 roundtrip action) andAdminService(the draft table + Northwind proxy) — the serialized-state draft table is no longer anonymously readable and the mutating roundtrip is no longer anonymously callable. In BTP the approuter authenticates via xsuaa and forwards the JWT.xs-security.json: add aUserscope + role template (was empty).server.js: the GET/HEAD routes serve only the static shell + CSRF ack and are intentionally public.Deployment & CI
GET /health—mta.yamldeclared it as the CF readiness endpoint but nothing served it.update_cap.yml: commit the refreshed core mirror only after assemble + the app's jest suite pass, so a broken upstream core can't land onmainpermanently.corelock entry (the biggest latent break); also guard the pre-merge lockfile parse.Tooling
/src(the app lock was untended).Tests
Starter/Northwind updated to authenticate; new case asserts the roundtrip and the draft table reject unauthenticated access (401). New guardrail test covers the core-lock drift case. App suite (18) + builder suite (13) green.
🤖 Generated with Claude Code
Generated by Claude Code