docs(agents): capture CSRF and e2e-cleanup learnings from #652 - #663
Merged
Conversation
Three additions to internal/web/AGENTS.md, all learned the hard way in the #652 investigation: - "CSRF errors" pointer now names the actual failure class: a persistent 403 means the POST carries no token; JS-built forms read it from data-csrf on main[data-bulk-scope]. - Test-infrastructure section states that setupFullTestApp strips the CSRF middleware (the gap that let #652 ship) and points to setupCSRFBulkTestApp for the real chain. - Integration-test list gains the cleanup rule: delete through the app, not via direct ldapdelete — the 30s cache keeps a ghost that poisons later tests. Two pre-existing over-length bullets in the same section are re-wrapped because the markdownlint hook (MD013, 120 cols) blocks any commit touching the file. Assisted-by: claude-code:claude-fable-5 Agent-Session: https://claude.ai/code/session_01D41i7TcscCHnuQ22AJzr4S Agent-Host: 0493f0 Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
github-actions
Bot
added
the
documentation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #663 +/- ##
=======================================
Coverage 74.21% 74.21%
=======================================
Files 36 36
Lines 3157 3157
=======================================
Hits 2343 2343
Misses 814 814
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
- Qualify the test-file reference: the cleanup pattern lives in internal/e2e/bulk_toolbar_csrf_test.go, not next to the near-namesake bulk_csrf_test.go in internal/web/. - "session token" -> "per-session CSRF token" so nobody conflates it with the auth session cookie. - internal/AGENTS.md gains a pointer to the e2e cleanup rule: agents working in internal/e2e/ load that file, not internal/web/AGENTS.md, under closest-file precedence. - Pre-existing markdownlint debt in the touched file settled because the hook blocks any commit otherwise: over-length bullets re-wrapped (MD013), two bare directory-tree fences get a text language (MD040). Assisted-by: claude-code:claude-fable-5 Agent-Session: https://claude.ai/code/session_01D41i7TcscCHnuQ22AJzr4S Agent-Host: 0493f0 Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
CybotTM
marked this pull request as ready for review
August 26, 2026 06:09
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Automated approval for maintainer PR
All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation follow-up from the #652 investigation (retro outcome). Three additions to
internal/web/AGENTS.md, each a fact that cost real debugging time because it lived only in test comments and PR text:csrf_token; JS-built forms read the session token fromdata-csrfonmain[data-bulk-scope], server-rendered forms embed a hidden input.setupFullTestAppregisters routes without the CSRF middleware — the exact coverage gap that let Potential Bug: CSRF token validation failed #652 ship — and points tosetupCSRFBulkTestAppfor exercising the production chain.ldapdelete— the 30s directory cache keeps a ghost that poisons later tests (seen in CI as a cascading failure ofTestAddRemoveGroupMembership).Two pre-existing over-length bullets in the same section are re-wrapped because the markdownlint hook (MD013, 120 columns) blocks any commit touching the file.
Assisted by claude-code:claude-fable-5 — Session