pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

Add CSRF token middleware and update e2e tests #682

Open
pook wants to merge 64 commits from agent-task/674 into main
pull from: agent-task/674
merge into: pook:main
Conversation 0 Commits 64 Files changed 69 +6602 -94
pook commented 2026-04-11 12:03:57 -04:00
Owner
Copy link

Summary

  • CSRF middleware (double-submit cookie pattern) was already implemented in packages/api/src/middleware/csrf.ts with comprehensive unit tests
  • All e2e integration tests were missing CSRF tokens on POST/PUT/DELETE requests — they would receive 403 responses
  • Created shared csrfHeaders() helper at packages/api/tests/e2e/helpers/csrf.ts and updated all 6 e2e test files to include valid CSRF tokens
  • Stripe webhook endpoint (/billing/webhook) remains exempt since Stripe provides its own HMAC-SHA256 signature verification

Test plan

  • All 11 CSRF unit tests pass (POST/PUT/DELETE rejection, valid token acceptance, cookie security attributes, webhook exemption)
  • TypeScript type-check passes (tsc --noEmit)
  • E2E tests pass against running server with CSRF tokens included
  • Verify requests without CSRF token receive 403

🤖 Generated with Claude Code

## Summary - CSRF middleware (double-submit cookie pattern) was already implemented in `packages/api/src/middleware/csrf.ts` with comprehensive unit tests - All e2e integration tests were missing CSRF tokens on POST/PUT/DELETE requests — they would receive 403 responses - Created shared `csrfHeaders()` helper at `packages/api/tests/e2e/helpers/csrf.ts` and updated all 6 e2e test files to include valid CSRF tokens - Stripe webhook endpoint (`/billing/webhook`) remains exempt since Stripe provides its own HMAC-SHA256 signature verification ## Test plan - [x] All 11 CSRF unit tests pass (POST/PUT/DELETE rejection, valid token acceptance, cookie security attributes, webhook exemption) - [x] TypeScript type-check passes (`tsc --noEmit`) - [ ] E2E tests pass against running server with CSRF tokens included - [ ] Verify requests without CSRF token receive 403 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Add CSRF token support to all e2e integration tests
Some checks are pending
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Waiting to run
Details
5456619863 
The CSRF middleware (double-submit cookie pattern) was already implemented
and unit-tested but e2e tests were missing CSRF tokens on POST/PUT/DELETE
requests. Added a shared csrfHeaders() helper and updated all e2e test
files to include valid CSRF tokens. Webhook endpoint remains exempt since
Stripe provides its own signature verification.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat: issue #674 add-csurf-or-custom-csrf-token-middlewar (agent task liancebot674)
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
c390736325
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
Details
This pull request has changes conflicting with the target branch.
  • .forgejo/workflows/ci.yml
  • bun.lock
  • package.json
  • packages/api/src/db/schema.ts
  • packages/api/src/index.ts
  • packages/api/src/middleware/csrf.ts
  • packages/api/src/middleware/rate-limit.ts
  • packages/api/src/middleware/security-headers.ts
  • packages/api/src/routes/admin.ts
  • packages/api/src/routes/billing.ts
  • packages/api/src/routes/generate-tos.ts
  • packages/api/src/routes/generate.ts
  • packages/api/src/routes/health.ts
  • packages/api/src/routes/questionnaire.ts
  • packages/api/src/services/document-generator.ts
  • packages/api/src/services/llm.ts
  • packages/api/src/templates/index.ts
  • packages/api/tsconfig.json
  • packages/shared/src/types.ts
  • packages/web/src/app/questionnaire/page.tsx
  • packages/web/src/components/documents/DocumentList.tsx
  • packages/web/src/components/questionnaire/ReviewStep.tsx
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin agent-task/674:agent-task/674
git switch agent-task/674
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!682
No description provided.