c50527b4c0
TODOs: - [x] Add documentation - [x] e2e tests: run security review, update knowledge, and fix issue - [x] more stringent risk rating <!-- CURSOR_SUMMARY --> --- > [!NOTE] > Introduces a new Security mode with a Security Review panel that runs reviews, edits rules, parses findings via IPC, and supports fixing issues, with tests and prompt/runtime support. > > - **UI/Preview Panel**: > - Add `security` preview mode to `previewModeAtom` and ActionHeader (Shield button). > - New `SecurityPanel` showing findings table (sorted by severity), run review, fix issue flow, and edit `SECURITY_RULES.md` dialog. > - Wire into `PreviewPanel` content switch. > - **Hooks**: > - `useSecurityReview(appId)`: fetch latest review via IPC. > - `useStreamChat`: add `onSettled` callback to invoke refreshes after streams. > - **IPC/Main**: > - `security_handlers`: `get-latest-security-review` parses `<dyad-security-finding>` from latest assistant message. > - Register handler in `ipc_host`; expose channel in `preload`. > - `ipc_client`: add `getLatestSecurityReview(appId)`. > - `chat_stream_handlers`: detect `/security-review`, use dedicated system prompt, optionally append `SECURITY_RULES.md`, suppress Supabase-not-available note in this mode. > - **Prompts**: > - Add `SECURITY_REVIEW_SYSTEM_PROMPT` with structured finding output. > - **Supabase**: > - Enhance schema query to include `rls_enabled`, split policy `using_clause`/`with_check_clause`. > - **E2E Tests**: > - New `security_review.spec.ts` plus snapshots and fixture findings; update test helper for `security` mode and findings table snapshot. > - Fake LLM server streams security findings for `/security-review` and increases batch size. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 5022d01e22a2dd929a968eeba0da592e0aeece01. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY -->
46 lines
1.5 KiB
TypeScript
46 lines
1.5 KiB
TypeScript
import { test, testSkipIfWindows } from "./helpers/test_helper";
|
|
|
|
// Skipping because snapshotting the security findings table is not
|
|
// consistent across platforms because different amounts of text
|
|
// get ellipsis'd out.
|
|
testSkipIfWindows("security review", async ({ po }) => {
|
|
await po.setUp({ autoApprove: true });
|
|
await po.sendPrompt("tc=1");
|
|
|
|
await po.selectPreviewMode("security");
|
|
|
|
await po.page
|
|
.getByRole("button", { name: "Run Security Review" })
|
|
.first()
|
|
.click();
|
|
await po.waitForChatCompletion();
|
|
await po.snapshotServerDump("all-messages");
|
|
await po.snapshotSecurityFindingsTable();
|
|
|
|
await po.page.getByRole("button", { name: "Fix Issue" }).first().click();
|
|
await po.waitForChatCompletion();
|
|
await po.snapshotMessages();
|
|
});
|
|
|
|
test("security review - edit and use knowledge", async ({ po }) => {
|
|
await po.setUp({ autoApprove: true });
|
|
await po.sendPrompt("tc=1");
|
|
|
|
await po.selectPreviewMode("security");
|
|
await po.page.getByRole("button", { name: "Edit Security Rules" }).click();
|
|
await po.page
|
|
.getByRole("textbox", { name: "# SECURITY_RULES.md\\n\\" })
|
|
.click();
|
|
await po.page
|
|
.getByRole("textbox", { name: "# SECURITY_RULES.md\\n\\" })
|
|
.fill("testing\nrules123");
|
|
await po.page.getByRole("button", { name: "Save" }).click();
|
|
|
|
await po.page
|
|
.getByRole("button", { name: "Run Security Review" })
|
|
.first()
|
|
.click();
|
|
await po.waitForChatCompletion();
|
|
await po.snapshotServerDump("all-messages");
|
|
});
|