11/11 Regression tests for the facelift/security/CKEditor/jQuery stack - #645
Open
mcfrank wants to merge 1 commit into
Open
11/11 Regression tests for the facelift/security/CKEditor/jQuery stack#645mcfrank wants to merge 1 commit into
mcfrank wants to merge 1 commit into
Conversation
The big stack was heavy on templates and client behavior — the areas with
the thinnest automated coverage. This adds fast, network-free tests around
the parts we changed by hand.
Tier 1
- sanitize_richtext: 10 tests locking in the XSS control (script, onclick,
javascript:, onerror, iframe/style stripped; Markdown + legacy HTML +
mailto/http preserved). It's a security filter with no test before now.
- Page-render smoke: About, Documentation, and /health/ (public), plus an
authenticated pass over dashboard, study detail, add-study, profile, and
instruments — the broad net for template regressions across the facelift.
- Env parsing: _parse_env_list / _parse_env_admins and is_true, including
the DEBUG=False bug (bool("False") is True) the refactor fixed.
Tier 2
- Study rich-text round-trip: the waiver/end-message are stored verbatim in
the new TextField and rendered to participants Markdown-formatted and
sanitized (ties the CKEditor removal end to end).
- CAT browser-mode hardest/easiest: the local bank computation that replaced
the R call selects from 'yes' items by the easiness rule.
Also wires the phase-5 browser-CAT tests into cat_forms/tests/__init__.py —
they were never imported there, so they had not been part of the default
suite. Discovery here is by __init__ re-export (files are not named
test_*.py), so each new test module is registered the same way.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final PR of the stack (targets the CAT-tests branch; merge last). Adds fast, network-free coverage around the parts of the stack we changed and verified by hand.
Tier 1 — the "changed it but nothing tested it" holes
sanitize_richtext(10 tests) — locks in the XSS control:<script>,onclick,javascript:,onerror,iframe/stylestripped; Markdown, legacy HTML, and mailto/http links preserved. It's a security filter that had no test./health/(public) + an authenticated pass over dashboard, study detail, add-study, profile, instruments. The broad net for the ~20 templates the facelift touched (About/Documentation had no test)._parse_env_list/_parse_env_adminsandis_true, incl. theDEBUG=Falsebug (bool("False")isTrue) the refactor fixed.Tier 2
TextField, rendered to participants Markdown-formatted and sanitized (ties the CKEditor removal end to end).yesitems by the easiness rule.Also: a discovery-gap fix
cat_forms/tests/__init__.pynever importedbrowser_engine, so the jsCat browser-CAT tests (added in #622) were never in the default suite — they only ran when invoked by explicit path. Now wired in. Discovery here is by__init__re-export (files aren't namedtest_*.py), so each new module must be registered there — worth knowing as a footgun.Verification
Full no-label suite: 255 tests OK (up from 222 — new tests + the now-discovered browser-CAT tests), all seven new markers confirmed present in the run. Tier 3 (making the excluded Selenium suite actually run — the real guard for the jQuery migration) remains, best folded into CI/CD (#639).
🤖 Generated with Claude Code