From 18fb4dcc9200798856c6d2b9e2adc5b0c7559f54 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nathan=20=F0=9F=94=B6=20Tarbert?= <66887028+NathanTarbert@users.noreply.github.com> Date: Tue, 15 Sep 2026 15:34:12 -0400 Subject: [PATCH] chore(web): point removed issue references at live ones Two strings in the templates screen sent readers to an issue that no longer exists. They now point at #279, which tracks the same gap: saved overrides never reach outgoing email. The middleware comment and its test described the ordering guarantee by issue number rather than by behaviour, so they now state it directly. Same for the template test docblocks and describe names. --- apps/web/src/__tests__/middleware-security.test.ts | 4 ++-- apps/web/src/__tests__/templates-api.test.ts | 4 ++-- apps/web/src/__tests__/templates-page.test.tsx | 12 ++++++------ apps/web/src/app/settings/templates/page.tsx | 4 ++-- apps/web/src/middleware.ts | 2 +- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/apps/web/src/__tests__/middleware-security.test.ts b/apps/web/src/__tests__/middleware-security.test.ts index 063216a..d704330 100644 --- a/apps/web/src/__tests__/middleware-security.test.ts +++ b/apps/web/src/__tests__/middleware-security.test.ts @@ -9,7 +9,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'; * use the REAL csrf module so the assertions are about the middleware's actual * behaviour rather than about a stub. * - * Covers outpost#225 item 1: a convenience early-return (static assets / any path + * Covers the ordering guarantee: a convenience early-return (static assets / any path * containing a dot) sat above both the auth check and the CSRF check, so * `PATCH /api/accounts/x.json` reached the handler with neither applied. */ @@ -66,7 +66,7 @@ function responseStub(type: string) { return { type, cookies: { set: vi.fn() } }; } -describe('middleware security ordering (outpost#225)', () => { +describe('middleware security ordering', () => { beforeEach(() => { mockGetToken.mockReset(); mockNext.mockReset(); diff --git a/apps/web/src/__tests__/templates-api.test.ts b/apps/web/src/__tests__/templates-api.test.ts index fb5a23f..9408d0d 100644 --- a/apps/web/src/__tests__/templates-api.test.ts +++ b/apps/web/src/__tests__/templates-api.test.ts @@ -2,7 +2,7 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'; import type { NextRequest } from 'next/server'; /** - * Template routes: persistence and preview fidelity (outpost#226). + * Template routes: persistence and preview fidelity. * * Before this suite, all three write paths were stubs. `PUT` validated its input * and returned a success body without touching the database, while the UI reported @@ -84,7 +84,7 @@ function routeParams(slug: string) { return { params: Promise.resolve({ slug }) }; } -describe('template persistence and preview (outpost#226)', () => { +describe('template persistence and preview', () => { beforeEach(() => { mockGetServerSession.mockReset(); mockGetServerSession.mockResolvedValue(ADMIN_SESSION); diff --git a/apps/web/src/__tests__/templates-page.test.tsx b/apps/web/src/__tests__/templates-page.test.tsx index bab8d3f..b119c93 100644 --- a/apps/web/src/__tests__/templates-page.test.tsx +++ b/apps/web/src/__tests__/templates-page.test.tsx @@ -3,7 +3,7 @@ import { render, screen, fireEvent, waitFor } from '@testing-library/react'; import TemplatesPage from '@/app/settings/templates/page'; /** - * Template editor: preview containment and draft fidelity (outpost#226). + * Template editor: preview containment and draft fidelity. * * The preview rendered author-authored HTML through `dangerouslySetInnerHTML` with no * sanitisation. Templates are dashboard-editable, so that is a STORED sink — whatever @@ -80,7 +80,7 @@ async function openPreview() { await waitFor(() => expect(screen.getByTitle(/preview/i)).toBeTruthy()); } -describe('template preview containment (outpost#226)', () => { +describe('template preview containment', () => { beforeEach(() => { mockApiFetch.mockReset(); routeApiFetch(); @@ -123,7 +123,7 @@ describe('template preview containment (outpost#226)', () => { }); }); -describe('the editor reports what the server actually said (outpost#226)', () => { +describe('the editor reports what the server actually said', () => { beforeEach(() => { mockApiFetch.mockReset(); }); @@ -187,7 +187,7 @@ describe('the editor reports what the server actually said (outpost#226)', () => // "Template saved successfully" was true about the row and false about the thing // the author cared about. These pin the honest copy, because the dishonest version // is the shorter and more natural string to write. -describe('the editor does not claim more than a save delivers (outpost#226)', () => { +describe('the editor does not claim more than a save delivers', () => { beforeEach(() => { mockApiFetch.mockReset(); }); @@ -224,7 +224,7 @@ describe('the editor does not claim more than a save delivers (outpost#226)', () }); }); -describe('reset gives the author feedback (outpost#226)', () => { +describe('reset gives the author feedback', () => { beforeEach(() => { mockApiFetch.mockReset(); }); @@ -261,7 +261,7 @@ describe('reset gives the author feedback (outpost#226)', () => { }); }); -describe('preview shows the unsaved draft (outpost#226)', () => { +describe('preview shows the unsaved draft', () => { beforeEach(() => { mockApiFetch.mockReset(); routeApiFetch(); diff --git a/apps/web/src/app/settings/templates/page.tsx b/apps/web/src/app/settings/templates/page.tsx index 2b23342..fee9d63 100644 --- a/apps/web/src/app/settings/templates/page.tsx +++ b/apps/web/src/app/settings/templates/page.tsx @@ -135,7 +135,7 @@ export default function TemplatesPage() { // shape as the rest of this screen's history. Wiring the lookup is // tracked separately, and per outpost#253 would not make an edited // template reach an invitee today either. - setSuccess('Saved. Not yet used for outgoing email — see outpost#226.'); + setSuccess('Saved. Not yet used for outgoing email — see outpost#279.'); } catch (err) { setError(err instanceof Error ? err.message : 'Save failed'); } finally { @@ -174,7 +174,7 @@ export default function TemplatesPage() {
diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts index c3bf9e7..ba51bd2 100644 --- a/apps/web/src/middleware.ts +++ b/apps/web/src/middleware.ts @@ -11,7 +11,7 @@ const PUBLIC_PATHS = ['/login', '/api/auth', '/setup', '/api/setup', '/api/healt * This replaces a bare `pathname.includes('.')` check. That heuristic treated ANY * dotted path as a static asset, and because it ran ahead of the auth and CSRF * checks below, `PATCH /api/accounts/x.json` reached the handler with neither - * applied (outpost#225). + * applied. * * Deliberately an allowlist of extensions rather than "has a dot": a request path * is attacker-controlled, so anything that decides "skip the security checks" has