v0.2.12-pre.007

crates/ksp-app-solprices-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-solprices-desk/tests/desktop_security.rs
-// version: 6
+// version: 7
 
 //! Security, ownership and frontend instrumentation canaries for SOL Prices Desk.
 
@@ -142,3 +142,47 @@ fn pre_006_frontend_batch_controls_are_logged_without_price_or_provider_payloads
         assert!(!main.contains(forbidden), "batch frontend logging must not serialize price/provider/secret values: {forbidden}");
     }
 }
+
+#[test]
+fn pre_007_all_frontend_controls_and_backend_command_failures_are_instrumented_safely() {
+    let root = app_root();
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    for required in [
+        "SOL Prices Desk navigation control clicked",
+        "SOL Prices Desk market-price selection control changed",
+        "SOL Prices Desk select-all providers control changed",
+        "SOL Prices Desk clear provider selection control clicked",
+        "SOL Prices Desk market-price refresh control clicked",
+        "SOL Prices Desk selected market-price refresh control clicked",
+        "SOL Prices Desk global market-price refresh control clicked",
+    ] {
+        assert!(main.contains(required), "pre.007 frontend control instrumentation is missing {required}");
+    }
+    for forbidden in [
+        "JSON.stringify(currentMarketPriceRows)",
+        "JSON.stringify(result)",
+        "price: provider.price",
+        "providerTimestampUnixMillis:",
+        "receivedAtUnixMillis:",
+        "retryAtUnixMillis:",
+        "apiKey",
+        "authorization",
+    ] {
+        assert!(!main.contains(forbidden), "pre.007 frontend instrumentation must not log business/secret values: {forbidden}");
+    }
+    let tauri = read_text(root.join("src/tauri.rs").as_path());
+    assert!(tauri.contains("fn project_command_error"));
+    assert!(tauri.contains("error_domain = error.code().domain()"));
+    assert!(tauri.contains("error_code = error.code().code()"));
+    assert!(tauri.contains("SOL Prices Desk Tauri command failed"));
+    assert!(!tauri.contains("error_message = error"));
+}
+
+#[test]
+fn pre_007_remains_manual_without_browser_persistence_or_price_scheduler() {
+    let root = app_root();
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    for forbidden in ["setInterval(", "setTimeout(", "requestAnimationFrame(", "localStorage", "sessionStorage", "fetch(", "XMLHttpRequest"] {
+        assert!(!main.contains(forbidden), "pre.007 must remain manual and backend-owned: {forbidden}");
+    }
+}