v0.3.7-pre.006

crates/ksp-app-backfill-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-backfill-desk/tests/desktop_security.rs
-// version: 5
+// version: 6
 
 //! Security and dependency-boundary checks for the Backfill Desk scaffold.
 
@@ -137,7 +137,23 @@ fn pre_005_opens_store_facade_without_backend_or_job_dependencies() {
     }
     let dto = read_text(root.join("src/dto_common.rs").as_path());
     assert!(dto.contains("BackfillDeskOptionsDto"));
-    for forbidden in ["pub(crate) provider", "endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) token", "connection_uri"] {
+    for forbidden in ["endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) token", "connection_uri"] {
         assert!(!dto.contains(forbidden), "readiness options DTO source contains forbidden field marker {forbidden}");
     }
 }
+
+#[test]
+fn pre_006_frontend_receives_only_safe_http_route_metadata_and_no_endpoint_material() {
+    let root = app_root();
+    let dto = read_text(root.join("src/dto_common.rs").as_path());
+    assert!(dto.contains("BackfillHttpRouteOptionDto"));
+    assert!(dto.contains("pub(crate) providers"));
+    assert!(dto.contains("pub(crate) role"));
+    for forbidden in ["endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) api_key", "pub(crate) authorization"] {
+        assert!(!dto.contains(forbidden), "route DTO leaks forbidden endpoint material marker {forbidden}");
+    }
+    let frontend = read_text(root.join("frontend/ts/main.ts").as_path());
+    for forbidden in ["http://", "https://", "apiKey", "authorization", "token"] {
+        assert!(!frontend.contains(forbidden), "frontend embeds forbidden provider material marker {forbidden}");
+    }
+}