switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Feat v0.7.0 shell contract + surface audit + rebrand

Browse Source 
Two-slot shell topbar (home, left, center, bell, user menu) with SDK API
(setLeft/setSlot/setTitle/hide/show). All 4 primary surfaces migrated:
Settings and Team Admin to Pattern B (flat tabs), Admin to Pattern C
(category tabs + sidebar), Docs to Pattern A (default).

Backend WS events: package.changed (broadcast), auth.changed (targeted),
notification.all_read. User menu re-fetches on package/auth changes.
Bell syncs read state across tabs.

Error handling pass with .sw-inline-error CSS primitive. Empty state
guidance for Admin Workflows/Groups. Announcement global dismiss via
localStorage. Rebrand assets deployed (both b/e icon variants, wordmarks,
full icon library). Docs outline scroll-to-heading fix.

Bug fixes: ICD security assertion tightened, workflow-demo error surfacing,
signoff display names, hello-dashboard + team-admin/groups.js deleted.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jeffrey Smith
2026-04-01 20:08:57 +00:00
parent 1236220302
commit 1fbd836c5c
150 changed files with 3250 additions and 533 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
packages/icd-test-runner/js/tier-security.js
View File

@@ -542,16 +542,22 @@
await T.test('security', 'input-validation', '[P0] path traversal in surface archive', async function () {
var blob = new Blob([JSON.stringify({ id: '../../../etc/evil', title: 'Path Traversal Test' })], { type: 'application/json' });
var d;
try {
var d = await T.apiUpload('/admin/packages/install', blob, 'evil.surface');
T.assert(d._status === 400 || d._status === 409,
d = await T.apiUpload('/admin/packages/install', blob, 'evil.surface');
T.assert(d._status === 400 || d._status === 422,
'path traversal surface accepted! got ' + d._status);
} catch (e) {
if (e.message.indexOf('502') !== -1) {
throw new Error('INCONCLUSIVE (502): proxy returned 502 on surface upload');
}
T.assert(e.message.indexOf('400') !== -1 || e.message.indexOf('409') !== -1 || e.message.indexOf('415') !== -1,
T.assert(e.message.indexOf('400') !== -1 || e.message.indexOf('422') !== -1 || e.message.indexOf('415') !== -1,
'unexpected error: ' + e.message);
} finally {
// Cleanup: if the evil package was somehow installed, delete it
if (d && (d._status === 200 || d._status === 201) && d.id) {
T.registerCleanup(function () { return T.safeDelete('/admin/packages/' + d.id); });
}
}
});