mono/agent-desk-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
63e045788623e88f7fd7b44102e649e08f4c1f1c
agent-desk-ng/docs/hardening/VALIDATION.md
mono 63e0457886 fix: harden identity, live access, drafts and setup (review only) 
Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.
2026-10-16 12:15:20 +00:00

2.5 KiB
Raw Blame History

Validation status: review branch, not a release

This source change is published for review. Do not deploy it as a verified security release until the checks below have been completed.

Completed source checks

  • Independent source review of customer/issuer isolation, staff permissions, long-lived authorization, channel policy concurrency and session refresh.
  • Cross-review of editor draft isolation and customer chat lifecycle boundaries.
  • Setup preview/apply permission, transaction and target review.
  • Syntax parsing of changed TypeScript/TSX and JavaScript regression sources.
  • JSON/YAML parsing, matching new locale keys, and Git whitespace checks.

These checks are not a replacement for compilation or executing the tests.

Not yet validated

  • Go formatting and compilation: the Go toolchain was unavailable during this source-review pass. Run gofmt on all changed Go files before merging.
  • Automated regression tests: authored but not executed.
  • Full frontend typecheck, lint and build with declared dependencies: not run. A limited attempt using unrelated available dependencies was incomplete due to missing project packages; it is not a successful project typecheck.
  • Race detector, actual MySQL CAS/unique-index behavior, and staging additive schema upgrade/reconciliation: not run.
  • Application/browser acceptance on desktop and narrow screens: not run.
  • Production migration, service startup and deployment: not performed.

Checks required before merge or release

Use the repository's declared Go and frontend package versions, isolated temporary data, and mocked/loopback external services. Inspect test initialization first; never point regression tests at a live database or real accounts.

  1. Format all changed Go files and compile the relevant packages.
  2. Run openidentity and backend security/setup tests, including concurrent identity registration, the actual WebSocket pumps, channel CAS and transaction rollback. Then run the package suites and race checks where supported.
  3. Run the frontend typecheck, lint and build with installed locked dependencies.
  4. Run the focused Node tests for customer sessions/store/realtime, message drafts, account isolation, setup preview and dismissal navigation.
  5. Validate SQLite and MySQL schema upgrades and uniqueness/CAS behavior on backups.
  6. Exercise the modified UI in Russian, English and Chinese, including failures, account/conversation switches, pending sends and expired sessions.

Do not treat an unexecuted regression test as proof that a defect is fixed.