Repository navigation
fix: make CI pass and fix the API bugs it uncovered - #23
Merged
Merged
Conversation
…ersions in Docker, clear PWA lint warnings - Backend CI builds/tests rush-order.backend.slnf: desktop projects target net8.0-windows and fail on Linux runners (NETSDK1100). - Dependency check restores the full solution with EnableWindowsTargeting so desktop packages are still audited. - Root Dockerfile copies Directory.Packages.props and global.json before restore; without them central package versions were missing (CS0246 on MediatR's INotification). - NuGet cache key includes Directory.Packages.props. - PWA: annotate the 5 intentional lint warnings so --max-warnings 0 passes.
- Integration tests: pass connection strings and flags via UseSetting. Program reads them while registering services, before ConfigureAppConfiguration callbacks apply, so the API was pointed at localhost:5432 instead of the Testcontainers instance. - Run test collections serially: ApiFactory and RateLimitApiFactory booted in parallel and raced on the static Serilog logger, so the entry point exited before building the host. - PWA: add robots.txt (the SPA fallback served index.html for it). - Lighthouse: errors-in-console is a warning (no backend in CI); turn off LCP-image/animation audits that are not applicable and report NaN.
- Auth responses are wrapped in the ApiResponse envelope; read tokens from "data" in AuthHelper, AuthTests, MfaTests and the multi-tenancy logins. - Stripe webhook test payload includes "object" and "api_version", which Stripe.net 46 requires to parse the event.
…er Infrastructure event handlers Anonymous endpoints (no "tid" claim) were filtered out by the global tenant query filter, so they failed with 401/404 in real use: - Guest QR ordering, self-booking, payment intent/confirm/split and rating now resolve the tenant from the table/restaurant/order (staff tokens are still restricted to their own tenant; products must belong to the table's restaurant). - Refresh token, MFA verify and password reset look users up across tenants. - Stripe webhook looks payments/orders/customers up across tenants, so payment_intent.succeeded actually marks orders as paid. - Reservation availability ignores the tenant filter (scoped by restaurantId). MediatR never scanned the Infrastructure assembly, so OrderPlaced/ OrderStatusChanged/TableStatusChanged/ProductAvailability handlers (SignalR broadcasts, order status history) never ran. Audit fields are now stamped after dispatch so entities added by handlers get them too. Kitchen role can list orders (the KDS uses GET /orders). Tests: MFA setup response unwrapped from "data"; Stripe test event includes "request"; CreateOrder unit tests cover guest ordering and tenant/restaurant mismatches.
…nt claim - Admin metrics: cast COUNT()/churn to int/float8 so Dapper can materialize the int/double records (GET /admin/tenants returned 500). - Request logging runs outside the exception handler, so handled exceptions are logged with their real status (e.g. 422) instead of 500. - Request log TenantId reads the "tid" claim the JWT actually carries. Tests: guest order creation now expects 201; flow test Stripe event carries the fields Stripe.net needs to parse it.
nleceguic
changed the title
…check passes - MailKit 4.18.1 (MimeKit), JwtBearer 8.0.31 (IdentityModel 7.1.x), Testcontainers 4.15 (SSH.NET 2026), xunit 2.9.3 (drops NETStandard 1.x System.Net.Http / RegularExpressions 4.3.0). - Explicit patched references: Azure.Identity 1.11.4 in integration tests (via Respawn) and SQLitePCLRaw.bundle_e_sqlite3 2.1.13 in desktop. - Testcontainers 4 image constructors. - PWA: npm audit fix (non-breaking) and gate the audit on production dependencies; remaining high/critical advisories are dev tooling only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
El CI llevaba meses sin poder pasar en ninguna PR. Al ponerlo en marcha, los tests de integración destaparon bugs reales de la API.
CI
rush-order.backend.slnf. Los proyectos desktop (net8.0-windows) fallaban en Linux.EnableWindowsTargeting=truepara seguir auditando el desktop.DockerfilecopiaDirectory.Packages.props/global.jsonantes del restore (CS0246INotification).robots.txtañadido.errors-in-consolecomo warning (no hay backend en CI); off las auditorías de imagen LCP que no aplican.Tests de integración
UseSetting(Program lee las claves antes de que se apliquen losConfigureAppConfiguration) y colecciones en serie (carrera en el logger estático de Serilog).data; eventos de Stripe con los campos que Stripe.net 46 necesita.Bugs de la API
tid) devolvían 401/404 por el filtro global de tenant: pedido por QR de invitado, reserva, payment intent/confirm/split, rating, refresh token, verificación MFA y reset de contraseña. Ahora el tenant se resuelve desde la mesa/restaurante/pedido; un token de staff sigue limitado a su tenant y los productos deben ser del restaurante de la mesa.GET /orders./admin/tenantsy/admin/metricsdaban 500 (Dapperbigintaint); respuestas ahora con el envelopedata.Dependencias vulnerables
dotnet list package --vulnerable: 0.npm audit fixsin cambios mayores. El audit del CI pasa a evaluar solo dependencias de producción (--omit=dev): las altas/críticas restantes son de tooling (Vite/esbuild, Vitest, Tailwind 3, LHCI) y requieren upgrades mayores o no tienen parche.Resultado
Todos los jobs en verde: Backend (96 unitarios + 40 integración, cobertura 82,1 %), PWA, Docker/Trivy, Lighthouse, Dependency check.