test: export security tests + CI coverage reporting #43

2026-02-08T22:20:04Z

chihlasm commented

2026-02-08 22:20:04 +00:00

(Migrated from github.com)

Summary

Add 26 export security tests covering XSS prevention, edge cases, and format validation
Add coverage reporting to CI pipeline (pytest --cov flags + per-module summary)
Establishes 63% coverage baseline

Export Security Tests (26 tests)

11 XSS prevention tests: Verify html.escape() on all user-supplied fields — tree name, ticket number, client name, question, answer, notes, timestamp, scratchpad, action_performed, and a multi-vector combo test
7 edge case tests: Unicode/emoji, empty decisions, missing fields, very long content, HTML entities, newlines in scratchpad
5 format-specific tests: Markdown headers/step numbering, text headers/step numbering
3 HTML structure tests: Valid document, CSS styles, timestamp toggle

CI Coverage Reporting

pytest now runs with --cov=app --cov-report=term-missing --cov-report=json
Post-test step displays per-module coverage with warnings for modules under 80%
Baseline: 63% overall, export_service.py at 98%

Test plan

All 215 tests pass (189 existing + 26 new)
Export tests run in 0.12s (unit tests, no DB required)
Coverage report generates correctly

🤖 Generated with Claude Code

## Summary - Add 26 export security tests covering XSS prevention, edge cases, and format validation - Add coverage reporting to CI pipeline (pytest `--cov` flags + per-module summary) - Establishes 63% coverage baseline ## Export Security Tests (26 tests) - **11 XSS prevention tests**: Verify `html.escape()` on all user-supplied fields — tree name, ticket number, client name, question, answer, notes, timestamp, scratchpad, action_performed, and a multi-vector combo test - **7 edge case tests**: Unicode/emoji, empty decisions, missing fields, very long content, HTML entities, newlines in scratchpad - **5 format-specific tests**: Markdown headers/step numbering, text headers/step numbering - **3 HTML structure tests**: Valid document, CSS styles, timestamp toggle ## CI Coverage Reporting - pytest now runs with `--cov=app --cov-report=term-missing --cov-report=json` - Post-test step displays per-module coverage with warnings for modules under 80% - Baseline: 63% overall, export_service.py at 98% ## Test plan - [x] All 215 tests pass (189 existing + 26 new) - [x] Export tests run in 0.12s (unit tests, no DB required) - [x] Coverage report generates correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code)

railway-app[bot] commented

2026-02-08 22:20:23 +00:00

(Migrated from github.com)

🚅 Deployed to the patherly-pr-43 environment in selfless-grace

Service	Status	Web	Updated (UTC)
patherly	✅ Success (View Logs)		Feb 8, 2026 at 10:21 pm
hopeful-liberation	✅ Success (View Logs)		Feb 8, 2026 at 10:21 pm

🚅 Deployed to the [patherly-pr-43](https://railway.com/project/22b9b58c-271b-42e5-a10e-6fdec8d00134?environmentId=f765d612-b8f2-44d7-952e-a6d0e8bca381) environment in **[selfless-grace](https://railway.com/project/22b9b58c-271b-42e5-a10e-6fdec8d00134)** | **Service** | **Status** | **Web** | **Updated** (UTC) | | :--- | :--- | :--- | :--- | | patherly | ✅ Success ([View Logs](https://railway.com/project/22b9b58c-271b-42e5-a10e-6fdec8d00134/service/95f556ff-5264-4116-a0c2-618a2fc53ba4?id=e497e67c-f21f-48fe-ad71-0b73b8a6a616&environmentId=f765d612-b8f2-44d7-952e-a6d0e8bca381)) | | Feb 8, 2026 at 10:21 pm | | hopeful-liberation | ✅ Success ([View Logs](https://railway.com/project/22b9b58c-271b-42e5-a10e-6fdec8d00134/service/e1db2ee3-d241-4f45-abe4-c9c5fdf483d5?id=3ad0c65b-7e91-476f-9da0-6899caa2bdcd&environmentId=f765d612-b8f2-44d7-952e-a6d0e8bca381)) | | Feb 8, 2026 at 10:21 pm |

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: chihlasm/resolutionflow#43