sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

DC-083: mark license-manager.js done in backlog
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Hermes
2026-08-12 16:11:26 -07:00
parent a468e0f480
commit 77a94d55d2
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DC-PRODUCTION-GRADE-BACKLOG.md
+2 -1
View File
@@ -145,9 +145,10 @@
- **impact:** Any execSync with interpolation is a potential RCE. This is the same class of bug P0-2 already fixed — finish the job.
### DC-083: 30 source files have zero test coverage
- **status:** in-progress (license-manager.js — revenue path — claimed by hermes 2026-08-12)
- **status:** partial (license-manager.js done; 29 files remain — claimed by hermes 2026-08-12)
- **details:** The test gap scan found 30 source files with NO corresponding test file, including critical paths: `license-manager.js` (534 lines, the entire revenue validation path), `config-schema.js`, `middleware.js` (the auth/rate-limit/CORS stack), `startup-validator.js`, all 7 DNS provider modules (`technitium.js`, `cloudflare.js`, `rfc2136.js`, `manual.js`, `base.js`, `registry.js`, `email.js`), `docker-maintenance.js`, `config/migrations.js`, `event-workers.js`, `keychain-manager.js`, `event-store.js`, `host-registry.js`. Fix: prioritize license-manager.js (revenue path) and middleware.js (security stack) first, then work through the rest. Effort: ~8 hr (can be done incrementally, 2-3 files per PR).
- **impact:** license-manager.js validates Pro licenses — an untested bug there could silently break activation for every paying customer.
- **result:** license-manager.js (534 LOC) — the entire revenue validation path — now has dedicated test coverage via `__tests__/license-manager.test.js` (77 tests, codex-graded B). Tests exercise the REAL crypto flow end-to-end: `generateCode(TEST_SECRET)` → `activate(code)` → `_validateOffline(code)` → `verifyCode(secret, code)` → credential store + config persistence. Unlike `license-tier-enforcement.test.js` (which stubs `_validateOffline`), these tests validate actual HMAC signatures, forge version-2 payloads, test online validation paths via `jest.isolateModules`, and cover every public+private method including load/deactivate/getStatus/hasFeature/isPro/isExpired/daysRemaining/getMachineFingerprint/requirePremium/loadSecret/_validateOffline/_updateConfig/_maskCode. Full lifecycle integration tests verify activate→status→deactivate→status and load-after-activate restore across simulated restarts. Full suite: 1738/1738 pass (was 1661, +77 new). Zero new ESLint warnings. 29 files remain uncovered (next priority: middleware.js security stack).
### DC-084: No .dockerignore — test files and .git leak into Docker image
- **status:** already done (.dockerignore)