Nick SzaunigandClaude Opus 5.5
10cbe9bf2d
Backend - Backup covers every Prisma model (bundle v3); a guard test fails for any new model that is neither backed up nor explicitly excluded. Unsealed bundles may only add rows to 27 legacy master/field tables and never overwrite; counters, ledgers, settings, roles etc. need a sealed file. Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB) with warnings in log and UI; replaced document files are removed after commit. - Post-commit side effects (automation, calendar sync, webhooks) run via runAfterCommit and never turn a committed write into a 500, so retries with the same Idempotency-Key no longer create duplicates. - Calendar outbox is multi-replica safe: per-entry claims with stale takeover, revision-based settle, new Graph event only on 404/410, transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID validation for groupId, "run now" in background and resets FAILED. - Automation tasks are deduplicated under a row lock on the rule. - Update DTOs follow one null rule: omitted = unchanged, null clears a nullable field, null on a required field is a 400. - Varroa mites/day is recomputed on correction; withdrawal status is checked against the harvest date (?at=), bounded colonyIds; inspection create is audited; updates re-enqueue calendar entries. - Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS and QUEENLESS colonies as living. - Prisma errors and body-parser errors are logged without query values or request bodies. - Migration 20261012100000_calendar_sync_claims; schema index name aligned with the existing database object. Frontend - Sticky save bar sticks again (no scroll container ancestors, card uses overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms, sticky desktop sidebar. - Inspections record yes / no / not checked instead of silent defaults. - All living colonies are selectable; shared RecordSelect, EnumSelect, ChoiceGroup and TriStateField replace per-page copies; selects show names instead of ids; labels point at real controls. - Emptied optional fields are sent as null (emptyToNull) so every field can be cleared; dates default to the local day and are sent via toApiDate. - Harvest withdrawal warning uses the harvest date; backup page warns when a backup outgrows the import limit and lists skipped tables. Build and docs - Docker builds fail unless lint, typecheck and unit tests pass. - ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md for the backbone (api/worker/job roles, domain event outbox) and the feature roadmap T3-T7. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
76 lines
2.4 KiB
TypeScript
76 lines
2.4 KiB
TypeScript
import { INestApplication } from '@nestjs/common';
|
|
import * as bcrypt from 'bcryptjs';
|
|
import request from 'supertest';
|
|
import { App } from 'supertest/types';
|
|
import { PrismaService } from '../src/prisma/prisma.service';
|
|
import { createTestApp } from './utils/create-test-app';
|
|
import { login } from './utils/api';
|
|
|
|
interface ScheduleBody {
|
|
importLimitBytes: number;
|
|
lastBackupExceedsImportLimit: boolean;
|
|
}
|
|
|
|
const IMPORT_LIMIT_BYTES = 2048;
|
|
|
|
/**
|
|
* BACKUP_MAX_IMPORT_BYTES is the one limit for both sides: the upload of
|
|
* POST /backup/import is cut off at it, and GET /backup/schedule reports it
|
|
* so the UI can tell when a backup has outgrown it.
|
|
*/
|
|
describe('Backup import limit (e2e)', () => {
|
|
let app: INestApplication<App>;
|
|
const originalLimit = process.env.BACKUP_MAX_IMPORT_BYTES;
|
|
const suffix = `${Date.now()}-${Math.round(Math.random() * 1e6)}`;
|
|
const password = 'SuperSecret123!';
|
|
let token: string;
|
|
|
|
beforeAll(async () => {
|
|
process.env.BACKUP_MAX_IMPORT_BYTES = String(IMPORT_LIMIT_BYTES);
|
|
app = await createTestApp();
|
|
await app.get(PrismaService).user.create({
|
|
data: {
|
|
email: `backup-limit-${suffix}@example.com`,
|
|
passwordHash: await bcrypt.hash(password, 12),
|
|
name: 'Backup Admin',
|
|
role: { connect: { key: 'ADMIN' } },
|
|
},
|
|
});
|
|
token = (await login(app, `backup-limit-${suffix}@example.com`, password))
|
|
.accessToken;
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await app.close();
|
|
if (originalLimit === undefined) {
|
|
delete process.env.BACKUP_MAX_IMPORT_BYTES;
|
|
} else {
|
|
process.env.BACKUP_MAX_IMPORT_BYTES = originalLimit;
|
|
}
|
|
});
|
|
|
|
it('reports the configured import limit in the schedule status', async () => {
|
|
const response = await request(app.getHttpServer())
|
|
.get('/api/v1/backup/schedule')
|
|
.set('Authorization', `Bearer ${token}`)
|
|
.expect(200);
|
|
|
|
expect((response.body as ScheduleBody).importLimitBytes).toBe(
|
|
IMPORT_LIMIT_BYTES,
|
|
);
|
|
});
|
|
|
|
it('refuses an upload larger than the import limit before reading it in', async () => {
|
|
const tooLarge = Buffer.from(
|
|
JSON.stringify({ padding: 'x'.repeat(IMPORT_LIMIT_BYTES) }),
|
|
);
|
|
|
|
await request(app.getHttpServer())
|
|
.post('/api/v1/backup/import')
|
|
.set('Authorization', `Bearer ${token}`)
|
|
.field('password', password)
|
|
.attach('file', tooLarge, 'apicore-backup.json')
|
|
.expect(413);
|
|
});
|
|
});
|