v0.2.12-pre.006

crates/ksp-app-solprices-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-solprices-desk/tests/desktop_security.rs
-// version: 5
+// version: 6
 
 //! Security, ownership and frontend instrumentation canaries for SOL Prices Desk.
 
@@ -69,7 +69,7 @@ fn pre_002_frontend_has_no_network_persistence_or_native_dialog_surface() {
 }
 
 #[test]
-fn pre_005_tauri_commands_remain_centralized_and_only_single_refresh_is_present() {
+fn pre_005_tauri_commands_remain_centralized_and_single_refresh_is_preserved() {
     let root = app_root();
     let mut rust_files = std::vec::Vec::new();
     collect_files(root.join("src").as_path(), "rs", &mut rust_files);
@@ -85,10 +85,8 @@ fn pre_005_tauri_commands_remain_centralized_and_only_single_refresh_is_present(
         if path.file_name().and_then(std::ffi::OsStr::to_str) != std::option::Option::Some("tauri.rs") {
             assert!(!source.contains("tauri::generate_handler!"), "{} registers Tauri handlers outside tauri.rs", path.display());
         }
-        assert!(!source.contains("refresh_market_prices"), "{} advances multi-refresh before pre.006", path.display());
-        assert!(!source.contains("refresh_all_market_prices"), "{} advances global refresh before pre.006", path.display());
     }
-    assert_eq!(command_count, 5);
+    assert!(command_count >= 5);
     let tauri = read_text(root.join("src/tauri.rs").as_path());
     assert!(tauri.contains("refresh_market_price"));
 }
@@ -114,3 +112,33 @@ fn pre_005_frontend_refresh_interactions_are_logged_without_business_values() {
         assert!(!main.contains(forbidden), "main frontend logging must not serialize business/secret values: {forbidden}");
     }
 }
+
+#[test]
+fn pre_006_selected_and_global_refresh_commands_are_centralized_and_bounded() {
+    let root = app_root();
+    let tauri = read_text(root.join("src/tauri.rs").as_path());
+    assert_eq!(tauri.matches("#[tauri::command]").count(), 7);
+    assert!(tauri.contains("refresh_market_price"));
+    assert!(tauri.contains("refresh_market_prices"));
+    assert!(tauri.contains("refresh_all_market_prices"));
+    let runtime = read_text(root.join("src/market_price_runtime.rs").as_path());
+    assert!(runtime.contains("ERROR_CODE_MARKET_PRICE_REFRESH_CONFLICT"));
+    assert!(runtime.contains("ERROR_CODE_MARKET_PRICE_SELECTION_INVALID"));
+    assert!(runtime.contains("refresh_many(provider_ids.as_slice()).await"));
+    assert!(runtime.contains("refresh_all().await"));
+    assert!(!runtime.contains("tokio::time::sleep"));
+}
+
+#[test]
+fn pre_006_frontend_batch_controls_are_logged_without_price_or_provider_payloads() {
+    let root = app_root();
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    assert!(main.contains("SOL Prices Desk market-price selection control changed"));
+    assert!(main.contains("SOL Prices Desk selected market-price refresh control clicked"));
+    assert!(main.contains("SOL Prices Desk global market-price refresh control clicked"));
+    assert!(main.contains("requestedCount: result.requestedCount"));
+    assert!(main.contains("refreshedCount: result.refreshedCount"));
+    for forbidden in ["JSON.stringify(result)", "JSON.stringify(currentMarketPriceRows)", "price: provider.price", "apiKey", "authorization"] {
+        assert!(!main.contains(forbidden), "batch frontend logging must not serialize price/provider/secret values: {forbidden}");
+    }
+}