166 lines
7.2 KiB
Markdown
166 lines
7.2 KiB
Markdown
---
|
|
phase: "12.1"
|
|
plan: "04"
|
|
subsystem: cloud-browse-live-verification
|
|
status: complete
|
|
tags:
|
|
- live-test
|
|
- nextcloud
|
|
- security-gates
|
|
- documentation
|
|
- phase-close
|
|
dependency_graph:
|
|
requires:
|
|
- "12.1-01"
|
|
- "12.1-02"
|
|
- "12.1-03"
|
|
provides:
|
|
- owner-confirmed-nextcloud-fixture
|
|
- live-smoke-exact-acceptance
|
|
- rendered-flow-integration-tests
|
|
- phase-12.1-close
|
|
affects:
|
|
- backend/tests/test_nextcloud_live.py
|
|
- backend/tests/fixtures/cloud/nextcloud_expected_root.json
|
|
- frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js
|
|
- SECURITY.md
|
|
- README.md
|
|
- RUNBOOK.md
|
|
- CLAUDE.md
|
|
- backend/main.py
|
|
- frontend/package.json
|
|
tech_stack:
|
|
added: []
|
|
patterns:
|
|
- opt-in pytest marker (live_nextcloud) excluded from ordinary CI
|
|
- owner_confirmed flag in fixture guards exact-acceptance gate (T-12.1-19)
|
|
- rendered-flow test mounts real StorageBrowser and BreadcrumbBar with only API/router stubbed
|
|
key_files:
|
|
created:
|
|
- backend/tests/fixtures/cloud/nextcloud_expected_root.json
|
|
- frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js
|
|
modified:
|
|
- backend/tests/test_nextcloud_live.py
|
|
- .planning/phases/12.1-fix-nextcloud-root-listing-and-sync-visibility/12.1-VALIDATION.md
|
|
- SECURITY.md
|
|
- README.md
|
|
- RUNBOOK.md
|
|
- CLAUDE.md
|
|
- backend/main.py
|
|
- frontend/package.json
|
|
decisions:
|
|
- "owner_confirmed: true in fixture is the gate for exact-name acceptance — no inferred confirmation from live output"
|
|
- "Rendered-flow test mounts real StorageBrowser/BreadcrumbBar; only API/router stubbed (not UI components)"
|
|
- "Unexpected live provider names withheld from all artifacts, logs, and responses (T-12.1-20)"
|
|
- "Phase 13 mutations and Phase 14 byte cache are explicit exclusions from Phase 12.1 scope"
|
|
metrics:
|
|
duration: "~15 minutes (Tasks 2-4, continuation after Task 1 checkpoint)"
|
|
completed_date: "2026-06-22"
|
|
tasks_total: 4
|
|
tasks_completed: 4
|
|
files_created: 2
|
|
files_modified: 8
|
|
commits: 4
|
|
tests_added: 8
|
|
---
|
|
|
|
# Phase 12.1 Plan 04: Live Smoke, Exact Acceptance, and Phase Close Summary
|
|
|
|
Owner-confirmed Nextcloud root manifest fixture created, exact-acceptance test enabled, rendered-flow integration tests added, and Phase 12.1 closed with full validation, security, documentation, versioning, and push protocol.
|
|
|
|
## What Was Built
|
|
|
|
### Task 1 (prior session, commit 779b050)
|
|
Opt-in read-only live Nextcloud smoke test suite (`backend/tests/test_nextcloud_live.py`) with `live_nextcloud` marker excluded from ordinary CI via `pytest.ini`. Three tests: adapter metadata, sanitized root diagnostic, and connection-ID end-to-end browse as designated user.
|
|
|
|
### Task 2 (commit 1ec5158)
|
|
Owner reconciled the 3 previously unmatched fixture names. Created `backend/tests/fixtures/cloud/nextcloud_expected_root.json` with `owner_confirmed: true` — 10 items (4 folders, 6 files) with confirmed names and kinds. Added `test_nextcloud_expected_root_manifest` test enforcing exact set equality and exact kind equality against the fixture (T-12.1-19 gate).
|
|
|
|
### Task 3 (commit 6d294ea)
|
|
Added `CloudFolderRenderedFlow.test.js` — 7 integration tests mounting the real CloudFolderView with the real StorageBrowser and BreadcrumbBar (only API/router stubbed). Covers: mixed root render, opaque-reference folder navigation, breadcrumb lineage back-navigation, warning freshness with cached rows visible, fresh state, and XSS prevention. All security and regression gates ran and passed.
|
|
|
|
### Task 4 (commit 46b7ea6)
|
|
Version bumped 0.2.5 → 0.2.6 in `backend/main.py` and `frontend/package.json`. Docs updated: CLAUDE.md current state, README.md Phase 12.1 corrections and live smoke variables, RUNBOOK.md live smoke invocation and warning semantics table, SECURITY.md Phase 12.1 Plan 04 threat table and gate evidence. All gates re-verified. Atomic commit and push complete.
|
|
|
|
## Deviations from Plan
|
|
|
|
None — plan executed exactly as written after the checkpoint resolution.
|
|
|
|
The `package-lock.json` version update was skipped because the file is gitignored in this project (confirmed by `git add` rejecting it with `.gitignore` hint). Both tracked files (`backend/main.py`, `frontend/package.json`) were bumped.
|
|
|
|
## Security Evidence
|
|
|
|
| Gate | Result |
|
|
|------|--------|
|
|
| Bandit HIGH findings | 0 (10 LOW, all pre-existing) |
|
|
| npm audit high/critical | 0 vulnerabilities |
|
|
| Gitleaks new findings | 0 in Phase 12.1 files (3 pre-existing in May 2026 commits) |
|
|
| Git tracked .env files | None (only .env.example) |
|
|
| Docker Compose config | Resolves all required variables cleanly |
|
|
| Credentials in output | None — `_assert_no_secrets_in_string` asserts on every live test |
|
|
| Provider mutation/download | None — method guard + adapter method absence assertion |
|
|
| Admin/foreign-user IDOR | Blocked — 403/404 confirmed by live test |
|
|
|
|
## Test Results
|
|
|
|
| Suite | Result |
|
|
|-------|--------|
|
|
| Backend focused cloud tests | 236 pass |
|
|
| Backend full suite | 595 pass (1 pre-existing failure: test_extract_docx, unrelated) |
|
|
| Frontend full suite | 376 pass (7 new from CloudFolderRenderedFlow.test.js) |
|
|
| Frontend build | Clean |
|
|
| Live smoke (opt-in) | Skipped in CI — requires NEXTCLOUD_URL/USER/APP_PASSWORD |
|
|
|
|
## Threat Coverage
|
|
|
|
All Phase 12.1 Plan 04 threats closed:
|
|
|
|
| Threat ID | Threat | Status |
|
|
|-----------|--------|--------|
|
|
| T-12.1-16 | Credentials/URL leak through pytest | CLOSED |
|
|
| T-12.1-17 | Live smoke mutates/downloads data | CLOSED |
|
|
| T-12.1-18 | Live connection crosses user/admin boundary | CLOSED |
|
|
| T-12.1-19 | Count-only test accepts wrong root | CLOSED |
|
|
| T-12.1-20 | Unexpected provider names persisted | CLOSED |
|
|
| T-12.1-SC | Supply-chain / committed-secret regression | CLOSED |
|
|
|
|
## Phase 12.1 Phase Close
|
|
|
|
All four plans of Phase 12.1 are complete:
|
|
|
|
| Plan | Description | Commit(s) |
|
|
|------|-------------|-----------|
|
|
| 12.1-01 | Restore shared adapter contract | Prior commits |
|
|
| 12.1-02 | Truthful freshness gate | Prior commits |
|
|
| 12.1-03 | Normalized cloud browser contract | 7bb046a, dc3e172 |
|
|
| 12.1-04 | Live smoke, exact acceptance, phase close | 779b050, 1ec5158, 6d294ea, 46b7ea6 |
|
|
|
|
Phase 12.1 objectives achieved:
|
|
- Nextcloud root listing visible through DocuVault
|
|
- Owner-confirmed exact manifest in tracked fixture
|
|
- All four providers pass one contract suite
|
|
- `complete=False` cannot produce `fresh` or advance `last_refreshed_at`
|
|
- Frontend normalized to `kind` and `provider_item_id`
|
|
- Credentials and provider data remain private
|
|
- Phase 13 mutations and Phase 14 byte caching are explicit exclusions
|
|
|
|
## Known Stubs
|
|
|
|
None — all live test fixtures use confirmed names. No placeholder text or empty data flows to UI rendering.
|
|
|
|
## Threat Flags
|
|
|
|
None — no new network endpoints, auth paths, or schema changes introduced in Plan 04.
|
|
|
|
## Self-Check: PASSED
|
|
|
|
Files created:
|
|
- [x] `backend/tests/fixtures/cloud/nextcloud_expected_root.json` — exists
|
|
- [x] `frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js` — exists
|
|
|
|
Commits:
|
|
- [x] `1ec5158` — owner-confirmed expected root manifest
|
|
- [x] `6d294ea` — rendered-flow integration tests and security gate evidence
|
|
- [x] `46b7ea6` — verify live cloud browse integration (docs/version/push)
|
|
- [x] `779b050` — prior session Task 1 live smoke scaffold
|