fix(dogfood 2026-06-19): surface invalid CSRF origin error + guard test (ISSUE-001/003)#155
Merged
Merged
Conversation
…st (ISSUE-001/003) Resolve the current dogfood run's findings (ISSUE-001/002/003) per .omc/plans/fix-dogfood-findings-2026-06-19.md (Option A, evidence-scoped). ISSUE-003 (CSRF origin): add `novalidate` to the csrf-origin-form so an invalid origin reaches the `?/updateCsrfOrigin` action and renders the inline `csrfOriginError`, instead of the browser silently blocking submit on the `type="url"` input. Matches the existing `openai-settings-form` idiom (connections/+page.svelte). The input type, enhance handler, and the server-side Zod `.url()` validation are unchanged and remain authoritative. ISSUE-001 (unauth action TypeError): no production change required - the inline `!locals.user` guards on the wrapped [identifier] actions already return a clean 401; the dogfood-logged TypeErrors were stale (pre-ISSUE-006). Add a regression test asserting toggleLogo, updateShareMode, and regenerateToken return 401 (not 500) when unauthenticated, and 400-not-401 for an authenticated user, with the verified deref-sweep audit in the header. ISSUE-002 (clients.plex.tv signin warning): closed as environmental - no Plex web SDK or users/signin reference exists in the source; no suppressor added. Verification: bun run check (0 errors), biome check (clean), bun run test (2164 pass / 0 fail, coverage thresholds held).
🤖 Augment PR SummarySummary: This PR addresses recent dogfood findings by making invalid CSRF-origin input failures visible to the user and by adding a regression test to prevent unauthenticated form actions from throwing. Changes:
Technical Notes: Keeps the 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the three findings from the current dogfood run (ISSUE-001/002/003) per the consensus-approved plan
.omc/plans/fix-dogfood-findings-2026-06-19.md(Option A, evidence-scoped). The guiding principle was to fix what the code actually does: of the three reported findings, only one was a live code defect, one was already fixed (stale logs), and one was not sourced in this app.Changes
ISSUE-003 (Low) - invalid CSRF origin now surfaces an app-level error
Added the
novalidateattribute to<form id="csrf-origin-form">insrc/routes/admin/settings/security/+page.svelte.Previously, the
type="url"input triggered native browser validation that silently blocked submit, so the server-side validation never fired and the user saw no feedback. Withnovalidate, an invalid origin reaches the?/updateCsrfOriginaction, which returnsfail(400, { fieldErrors: { csrfOrigin: ['Invalid URL format'] } }), and the existingcsrfOriginErrorblock renders the message inline.This matches the established
openai-settings-formidiom inconnections/+page.svelterather than downgrading the input totype="text". Thetype="url"semantics (keyboard/autofill), theuse:enhancehandler, and the server-side Zod.url()schema are all unchanged and remain authoritative. An inline comment documents why the attribute is present, to prevent a future regression.ISSUE-001 (Low) - unauthenticated action TypeError (already fixed; test gap closed)
No production code change. The dogfood-logged
TypeError: ...'locals.user.id'was stale (pre-ISSUE-006 build). A fulllocals.userdereference sweep confirms every user-facing surface self-guards before dereferencing the user: the wrapped[identifier]actions already return a cleanfail(401)via their inline!locals.userguards.To lock this in, this PR adds
tests/unit/wrapped/identifier-actions-auth-guard.test.ts(mirroring the existingdashboard/settings-auth-guard.test.ts), which asserts thattoggleLogo,updateShareMode, andregenerateToken:locals.useris undefined, andThe verified deref-sweep audit table is reproduced in the test-file header. Removing any guard now fails CI.
ISSUE-002 (Low) - Plex signin console warning (closed as environmental)
No code change. The
clients.plex.tv/api/v2/users/signin400 is not sourced in this application: there is no Plex web SDK inpackage.json/node_modules, and nousers/signinorclients.plex.tvreference anywhere insrc(the only Plex client call isplex-login.ts->plex.tv/api/v2/pins). It is third-party browser/extension noise. No console-warning suppressor was added, since the app does not own this request.Verification
bun run check- 0 errors, 0 warningsbunx biome check(touched files) - cleanbun run test(full suite) - 2164 pass / 0 fail, exit 0 (80% line/function coverage thresholds held)Notes
The documentation addendum for this run lives in
dogfood-output/report.md, which is gitignored (local QA artifact), so it is not part of this diff. The committed deliverables are the form fix and the new regression test.