test(examples): runnable anonymous-sessions example + tiered tests - #2814
test(examples): runnable anonymous-sessions example + tiered tests#2814tusharpandey13 wants to merge 1 commit into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| import { | ||
| SYNTHETIC_ACCESS_TOKEN, | ||
| SYNTHETIC_ACCESS_TOKEN_RENEWED, | ||
| SYNTHETIC_DOMAIN, | ||
| SYNTHETIC_METADATA, | ||
| SYNTHETIC_SESSION_TOKEN, | ||
| WIRE_CREATE_RESPONSE, | ||
| WIRE_LOGOUT_WITH_SESSION_TOKEN_ERROR, | ||
| WIRE_RENEW_RESPONSE, | ||
| WIRE_RENEW_WITH_METADATA_ERROR | ||
| } from "./fixtures/synthetic-tokens"; |
![semgrepcode-auth0[bot]](https://avatars.githubusercontent.com/in/977730?s=60&v=4){kind=small}
| natural-compare@1.4.0: | ||
| resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} | ||
|
|
||
| next@16.2.5: |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 2177 lists a dependency (next) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of next are vulnerable to Server-Side Request Forgery (SSRF). This Next.js config defines a rewrites()/redirects() rule whose destination builds an external hostname from a dynamic :param segment. Because the segment is not constrained to hostname-safe characters, an attacker can inject a value (e.g. containing a dot) that escapes the intended hostname suffix, causing Next.js to proxy the request server-side to an arbitrary host (SSRF) or redirect the client to an attacker-controlled destination (open redirect). Constrain each dynamic segment used in a destination hostname to hostname-safe characters (e.g. [a-z0-9-]+), or upgrade Next.js.
References: GHSA
To resolve this comment:
Check if you define a rewrites() or redirects() rule in next.config.js whose destination hostname is assembled from a dynamic :param segment.
- If you're affected, upgrade this dependency to at least version 16.2.11 at examples/with-anonymous-sessions/pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| natural-compare@1.4.0: | ||
| resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} | ||
|
|
||
| next@16.2.5: |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 2177 lists a dependency (next) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of next are vulnerable to Excessive Iteration. Next.js App Router validates multi-page-application (MPA) form submissions by iterating over every $ACTION_REF_-prefixed form field without an upper bound, decoding a bound-argument descriptor for each one. An attacker can POST a form containing a large number of these fields, forcing excessive CPU usage that blocks processing of further requests in the same process, resulting in a denial of service. Declaring any Server Action ("use server") registers it in the server module map and arms this handler.
References: GHSA
To resolve this comment:
Check if you are using the App Router with at least one Server Action.
- If you're affected, upgrade this dependency to at least version 16.2.11 at examples/with-anonymous-sessions/pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==} | ||
| engines: {node: '>= 0.4'} | ||
|
|
||
| sharp@0.34.5: |
There was a problem hiding this comment.
High severity vulnerability introduced by a package you're using:
Line 2526 lists a dependency (sharp) with a known High severity vulnerability. Fixing requires upgrading or replacing the dependency.
ℹ️ Why this matters
Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component. sharp bundles a vulnerable version of the native libvips library, inheriting four memory-safety flaws: an integer overflow leading to a heap-based buffer overflow in the VIPS loader (vipsload, CVE-2026-33327), an integer overflow in the GIF loader (gifload, CVE-2026-33328) causing a denial of service on 32-bit hosts only, a heap-based buffer overflow in the TIFF loader (tiffload, CVE-2026-35591) when handling JPEG or JPEG2000-encoded tiles, and an out-of-bounds read in the EXIF directory decoder (CVE-2026-35590). An attacker who can supply a crafted image can crash the process or corrupt heap memory. Because sharp selects the libvips loader by sniffing the input bytes, no call site can be shown to be safe, and the EXIF flaw is reachable from the JPEG, TIFF, WebP, PNG and HEIF loaders as well. Upgrade to sharp 0.35.0 or later, which bundles libvips 8.18.3. Blocking the affected loaders with sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }) is only a partial stopgap and does not mitigate the EXIF out-of-bounds read (CVE-2026-35590), for which no workaround exists.
References: GHSA
To resolve this comment:
Upgrade this dependency to at least version 0.35.0 at examples/with-anonymous-sessions/pnpm-lock.yaml.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Anonymous-sessions example: browser e2e (Playwright) resultsBrowser-tier coverage for Local run (Chromium)Passing:
Gated (skip without a tenant test user):
Notes
No real secrets in any spec or fixture: gated tests read credentials from a git-ignored |
Offline e2e tier added (mock-backed, tenant-free)Follow-up to the browser-tier discussion: the example now ships a deterministic offline Playwright suite that exercises the full anonymous-session flow through the real SDK, mocking only the Auth0 network hop. How it worksA test-only Run: Coverage (17 tests, all run unconditionally)
Example bug found + fixed
Honest scope
Reviewed via a multi-lens quorum (mock fidelity, test quality, prod-safety); all findings applied. No real secrets (synthetic token-shaped values only). Not wired into CI. |
…ests Add examples/with-anonymous-sessions/, a runnable example consuming the local SDK that demonstrates the full anonymous-session flow: guest session creation with metadata, Server Component and client-hook reads, login-to-link, and logout. Tiered test suite: - Unit/MSW: wire-contract and client-hook coverage. - Browser (Playwright): the session-fixation strip end-to-end and the logout and error-banner UI run without credentials; the live login-to-link callback runs against a tenant test user. - Offline mock tier (pnpm test:e2e:offline): 17 deterministic tests covering the full lifecycle, error-code mappings, renewal, and set-once retention through the real SDK against a mocked Auth0 network hop, no tenant required. COVERAGE.md documents the tier-by-tier matrix and disclosed gaps. The mock, its scenario-control route, and the gated seam are marked test-only with a production checklist in the README. No real secrets; synthetic tokens only. Not wired into CI. Depends on the anonymous-sessions SDK implementation (stacked base). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
be98137 to
c58504c
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## feat/anon-sessions-impl #2814 +/- ##
========================================================
Coverage 87.74% 87.74%
========================================================
Files 84 84
Lines 12253 12253
Branches 2540 2540
========================================================
Hits 10751 10751
Misses 1455 1455
Partials 47 47 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
3 participants
Summary
Stacked PR (2/2): example + tests. Adds
examples/with-anonymous-sessions/, a runnable example consuming the local SDK that demonstrates the full anonymous-session flow. Stacked on top of the SDK implementation PR (#2797); review and merge that one first.What it demonstrates
createAnonymousSession()behind aPOST /api/anon/createroute.useAnonymousSession()) side by side.anonymousSessionLinkedas a?linked=truebanner).Tests
pnpm test:e2e).pnpm test:e2e:offline): 17 deterministic tests covering the full lifecycle (create, read, logout, error-code mappings, renewal, set-once retention) through the real SDK against a mocked Auth0 network hop. No tenant required. It does not prove the real/anonymous/tokenwire contract; the live tier does.COVERAGE.mddocuments the tier-by-tier matrix and disclosed gaps.Notes
customFetchseam are marked test-only, with a production checklist in the README and a warning in.env.example.