feat(mindspace): enforce PostgreSQL user data delivery

2026-07-13 15:29:29 +08:00
parent b33c943b69
commit a6620fb719
57 changed files with 2779 additions and 164 deletions
@@ -1,11 +1,49 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 import {
+  assessPageDataAuthenticationContract,
  buildSmokeInsertRow,
  extractInjectedPageIdFromHtml,
  normalizePageDataApiBase,
 } from './page-data-delivery-assess.mjs';

+test('password pages must authenticate with the server before data reads', () => {
+  assert.deepEqual(
+    assessPageDataAuthenticationContract({
+      policy: { accessMode: 'password' },
+      html: '<script>if (pwd === ADMIN_PASSWORD) loadData()</script>',
+    }),
+    [
+      'password_page_missing_server_authentication',
+      'password_page_uses_client_side_password_gate',
+    ],
+  );
+  assert.deepEqual(
+    assessPageDataAuthenticationContract({
+      policy: { accessMode: 'password' },
+      html: '<script>client.authenticate(password).then(loadData)</script>',
+    }),
+    [],
+  );
+  assert.deepEqual(
+    assessPageDataAuthenticationContract({
+      policy: { accessMode: 'password' },
+      html: '<script>if (passwordInput.value !== "88888888") return; client.authenticate(passwordInput.value)</script>',
+    }),
+    ['password_page_uses_client_side_password_gate'],
+  );
+});
+
+test('public pages cannot use a client-side password gate as authorization', () => {
+  assert.deepEqual(
+    assessPageDataAuthenticationContract({
+      policy: { accessMode: 'public' },
+      html: '<script>if (pwd === DIARY_PASSWORD) client.insertRow("diary_entries", row)</script>',
+    }),
+    ['public_page_uses_client_side_password_gate'],
+  );
+});
+
 test('extractInjectedPageIdFromHtml reads injected pageId', () => {
  const html = `<html><head>
 <meta name="mindspace-page-data-page-id" content="page-abc">