v0.3.8-pre.010

crates/ksp-app-store-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-store-desk/tests/desktop_security.rs
-// version: 9
+// version: 10
 
 //! Security boundary tests for the Store Desk scaffold.
 
@@ -230,3 +230,37 @@ fn pre_008_account_copy_tracing_never_logs_identity_or_data_material() {
         assert!(!frontend.contains(forbidden), "account copy tracing leaked copied value material: {forbidden}");
     }
 }
+
+#[test]
+fn pre_010_observation_ipc_and_tracing_keep_entity_values_and_source_bytes_out_of_logs() {
+    let dto = include_str!("../src/dto_observation.rs");
+    let frontend = include_str!("../frontend/ts/main.ts");
+    let tauri = include_str!("../src/tauri.rs");
+    for forbidden in ["draw:", "search:", "order:", "columns:", "cursor:", "network:"] {
+        assert!(!dto.contains(forbidden), "observation IPC request leaked DataTables/physical field: {forbidden}");
+    }
+    for forbidden in ["source_payload_bytes", "payload_preview", "data_preview", "raw_bytes"] {
+        assert!(!dto.contains(forbidden), "observation IPC leaked raw/source bytes: {forbidden}");
+    }
+    assert!(frontend.contains(r#"Store Desk transaction observation DataTables server-side query started", { pageLength: request.limit }"#));
+    assert!(frontend.contains(r#"Store Desk account observation DataTables server-side query started", { pageLength: request.limit }"#));
+    assert!(!frontend.contains(r#"query started", { signature"#));
+    assert!(!frontend.contains(r#"query started", { pubkey"#));
+    assert!(!frontend.contains(r#"query completed", { observationKey"#));
+    assert!(tauri.contains("project_command_error("store_query_transaction_observations""));
+    assert!(tauri.contains("project_command_error("store_query_account_observations""));
+}
+
+#[test]
+fn pre_010_observation_page_hardening_rejects_hostile_draw_length_and_unsafe_exact_counts() {
+    let frontend = include_str!("../frontend/ts/main.ts");
+    let runtime = include_str!("../src/store_runtime.rs");
+    assert!(frontend.contains("Number.isSafeInteger(page.draw)"));
+    assert!(frontend.contains("Number.isSafeInteger(page.start)"));
+    assert!(frontend.contains("[25, 50, 100].includes(page.length)"));
+    assert!(frontend.contains("Number.MAX_SAFE_INTEGER"));
+    assert!(frontend.contains("exact count exceeds frontend safe integer domain"));
+    assert!(runtime.contains("inspection_page_from_request"));
+    assert!(runtime.contains("request.offset.as_str(), request.limit"));
+    assert!(runtime.contains("offset_text.parse::<u64>()"));
+}