v0.3.7-pre.004

crates/ksp-app-backfill-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-backfill-desk/tests/desktop_security.rs
-// version: 3
+// version: 4
 
 //! Security and dependency-boundary checks for the Backfill Desk scaffold.
 
@@ -43,7 +43,7 @@ fn read_text(path: &std::path::Path) -> String {
 }
 
 #[test]
-fn pre_002_capability_surface_is_core_plus_tracing_only() {
+fn capability_surface_remains_core_plus_tracing_while_transport_is_backend_only() {
     let root = app_root();
     let capability = read_text(root.join("capabilities/default.json").as_path());
     assert!(capability.contains("\"core:default\""));
@@ -53,16 +53,9 @@ fn pre_002_capability_surface_is_core_plus_tracing_only() {
     }
     let manifest = read_text(root.join("Cargo.toml").as_path());
     assert!(manifest.contains("tauri-plugin-tracing.workspace = true"));
-    for forbidden in [
-        "ksp-job-backfill-lib",
-        "ksp-onchain-transport-lib",
-        "ksp-store-lib",
-        "ksp-store-api",
-        "ksp-store-postgres-lib",
-        "reqwest",
-        "tokio-postgres",
-    ] {
-        assert!(!manifest.contains(forbidden), "pre.002 opens a later-layer dependency: {forbidden}");
+    assert!(manifest.contains("ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }"));
+    for forbidden in ["ksp-job-backfill-lib", "ksp-store-lib", "ksp-store-api", "ksp-store-postgres-lib", "reqwest", "tokio-postgres"] {
+        assert!(!manifest.contains(forbidden), "current Backfill Desk opens a forbidden dependency: {forbidden}");
     }
 }
 
@@ -95,7 +88,7 @@ fn pre_002_tauri_commands_remain_centralized() {
             assert_eq!(count, 0, "{} declares a Tauri command outside tauri.rs", path.display());
         }
     }
-    assert_eq!(command_count, 3);
+    assert_eq!(command_count, 4);
 }
 
 #[test]
@@ -121,15 +114,21 @@ fn pre_002_frontend_instrumentation_avoids_business_or_secret_payloads() {
 }
 
 #[test]
-fn pre_003_keeps_config_only_composition_boundary() {
+fn pre_004_opens_only_config_logging_and_onchain_transport_dependencies() {
     let root = app_root();
     let manifest = read_text(root.join("Cargo.toml").as_path());
     assert!(manifest.contains("ksp-config-lib = { path = \"../ksp-config-lib\" }"));
-    for forbidden in ["ksp-job-backfill-lib", "ksp-onchain-transport-lib", "ksp-store-lib", "ksp-store-api", "ksp-store-postgres-lib"] {
-        assert!(!manifest.contains(forbidden), "pre.003 opens a later-layer dependency: {forbidden}");
+    assert!(manifest.contains("ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }"));
+    for forbidden in ["ksp-job-backfill-lib", "ksp-store-lib", "ksp-store-api", "ksp-store-postgres-lib"] {
+        assert!(!manifest.contains(forbidden), "pre.004 opens a later-layer dependency: {forbidden}");
     }
     let bootstrap = read_text(root.join("src/bootstrap.rs").as_path());
     assert!(bootstrap.contains("LogFilterLevel::Trace"));
     assert!(!bootstrap.contains("HttpTransportPool"));
     assert!(!bootstrap.contains("Store::open"));
+    let dto = read_text(root.join("src/dto_common.rs").as_path());
+    assert!(dto.contains("BackfillDeskOptionsDto"));
+    for forbidden in ["pub(crate) provider", "endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) token"] {
+        assert!(!dto.contains(forbidden), "Transport options DTO source contains forbidden field marker {forbidden}");
+    }
 }