mono
63e0457886
Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.
48 lines
2.5 KiB
Markdown
48 lines
2.5 KiB
Markdown
# Validation status: review branch, not a release
|
|
|
|
This source change is published for review. Do not deploy it as a verified
|
|
security release until the checks below have been completed.
|
|
|
|
## Completed source checks
|
|
|
|
- Independent source review of customer/issuer isolation, staff permissions,
|
|
long-lived authorization, channel policy concurrency and session refresh.
|
|
- Cross-review of editor draft isolation and customer chat lifecycle boundaries.
|
|
- Setup preview/apply permission, transaction and target review.
|
|
- Syntax parsing of changed TypeScript/TSX and JavaScript regression sources.
|
|
- JSON/YAML parsing, matching new locale keys, and Git whitespace checks.
|
|
|
|
These checks are not a replacement for compilation or executing the tests.
|
|
|
|
## Not yet validated
|
|
|
|
- Go formatting and compilation: the Go toolchain was unavailable during this
|
|
source-review pass. Run gofmt on all changed Go files before merging.
|
|
- Automated regression tests: authored but not executed.
|
|
- Full frontend typecheck, lint and build with declared dependencies: not run.
|
|
A limited attempt using unrelated available dependencies was incomplete due
|
|
to missing project packages; it is not a successful project typecheck.
|
|
- Race detector, actual MySQL CAS/unique-index behavior, and staging additive
|
|
schema upgrade/reconciliation: not run.
|
|
- Application/browser acceptance on desktop and narrow screens: not run.
|
|
- Production migration, service startup and deployment: not performed.
|
|
|
|
## Checks required before merge or release
|
|
|
|
Use the repository's declared Go and frontend package versions, isolated temporary
|
|
data, and mocked/loopback external services. Inspect test initialization first;
|
|
never point regression tests at a live database or real accounts.
|
|
|
|
1. Format all changed Go files and compile the relevant packages.
|
|
2. Run openidentity and backend security/setup tests, including concurrent identity
|
|
registration, the actual WebSocket pumps, channel CAS and transaction rollback.
|
|
Then run the package suites and race checks where supported.
|
|
3. Run the frontend typecheck, lint and build with installed locked dependencies.
|
|
4. Run the focused Node tests for customer sessions/store/realtime, message drafts,
|
|
account isolation, setup preview and dismissal navigation.
|
|
5. Validate SQLite and MySQL schema upgrades and uniqueness/CAS behavior on backups.
|
|
6. Exercise the modified UI in Russian, English and Chinese, including failures,
|
|
account/conversation switches, pending sends and expired sessions.
|
|
|
|
Do not treat an unexecuted regression test as proof that a defect is fixed.
|