v0.2.12-pre.003

crates/ksp-app-solprices-desk/tests/desktop_security.rs

@@ -1,7 +1,7 @@
 // file: crates/ksp-app-solprices-desk/tests/desktop_security.rs
-// version: 1
+// version: 2
 
-//! Security and ownership canaries for the non-functional SOL Prices Desk scaffold.
+//! Security, ownership and frontend instrumentation canaries for SOL Prices Desk.
 
 fn app_root() -> std::path::PathBuf {
     return std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
@@ -69,7 +69,7 @@ fn pre_002_frontend_has_no_network_persistence_or_native_dialog_surface() {
 }
 
 #[test]
-fn pre_002_tauri_commands_remain_centralized_and_price_runtime_is_absent() {
+fn pre_003_tauri_commands_remain_centralized_and_refresh_runtime_is_absent() {
     let root = app_root();
     let mut rust_files = std::vec::Vec::new();
     collect_files(root.join("src").as_path(), "rs", &mut rust_files);
@@ -82,8 +82,25 @@ fn pre_002_tauri_commands_remain_centralized_and_price_runtime_is_absent() {
         } else {
             assert_eq!(count, 0, "{} declares a Tauri command outside tauri.rs", path.display());
         }
-        assert!(!source.contains("MarketPriceService"), "{} advances market-price runtime before pre.003", path.display());
+        assert!(!source.contains("MarketPriceRuntime"), "{} advances application price-state runtime before pre.004", path.display());
         assert!(!source.contains("refresh_market_price"), "{} advances refresh commands before their planned tranche", path.display());
     }
     assert_eq!(command_count, 3);
 }
+
+#[test]
+fn pre_003_frontend_control_interactions_are_logged_without_business_values() {
+    let root = app_root();
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    let invoke = read_text(root.join("frontend/ts/invoke.ts").as_path());
+    assert!(main.contains(r#"button.addEventListener("click""#));
+    assert!(main.contains("SOL Prices Desk navigation control clicked"));
+    assert!(main.contains("frontendDebug"));
+    assert!(main.contains("SOL Prices Desk view activated"));
+    assert!(invoke.contains("Frontend IPC command requested"));
+    assert!(invoke.contains("Frontend IPC command completed"));
+    assert!(invoke.contains("frontendTrace"));
+    for forbidden in ["JSON.stringify(status)", "JSON.stringify(payload)", "apiKey", "authorization"] {
+        assert!(!main.contains(forbidden), "main frontend logging must not serialize business/secret values: {forbidden}");
+    }
+}