feat(protect): scaffold response screening + first scaffolder tests#70
Merged
Merged
Conversation
Broaden the installed guard beyond the Supabase-tunnel path so SSR / non-tunnel responses are also screened for leaked secrets & PII: - guard.ts template: export screenResponse(response) — screens a web Response via the protection's response rules; passthrough for non-Response values and on any error (fail-open, never breaks a response). - install.ts: wire `return screenResponse(await next())` into the request middleware and add screenResponse to the guard import (fresh installs). - install.ts: resolve the templates dir for BOTH the built layout (dist/cli.js → protect/templates) and the source layout (src/protect/ → templates sibling), so runProtect is exercisable from source. This was previously dist-only. - tests/protect/install.test.ts (NEW, +5): first coverage for the scaffolder — scaffolds guard+rules, patches client.ts tunnel, wires both guards + response screening into start.ts preserving existing middleware, is idempotent, and skips an unsupported stack. Validated end-to-end by running the real shipped CLI against a genuine Lovable app copy (anchors match, idempotent, seeded demo rules enforce 11/11). 390 tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Response screening scaffolder and tests are well-structured and comprehensive. 🎯 Quality: 100% Elite · 📦 Size: Medium 📈 This month: Your 27th PR — above team average · Averaging Excellent |
Contributor
Author
|
/review |
ejntaylor
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Driven by validating the real
patchstack-connect protectinstall path against a genuine Lovable app.Validated the scaffolder end-to-end (no bug found)
Ran the real shipped CLI (
dist/cli.js protect) against a copy of theLovable Cloud Serverreference app (pristine — manual overlay removed):guard.ts+rules.jsonclient.ts(browser→Supabase tunnel) andstart.ts(both guards registered first; existingattachSupabaseAuth/errorMiddlewarepreserved)examples/protect/demo-rules.jsonas the fallback → 11/11 demo rows enforce through the guard's own config.Broaden response screening
Previously the installed guard screened responses only on the Supabase-tunnel path. Now:
guard.tsexportsscreenResponse(response)— screens a web Response via the response rules; passthrough for non-Response values and on any error (fail-open, never breaks a response).install.tswiresreturn screenResponse(await next())into the request middleware, so SSR / non-tunnel responses are screened for leaked secrets & PII too.Scaffolder now testable + tested
install.tsresolves the templates dir for both the built layout (dist/cli.js→protect/templates) and the source layout (src/protect/→templatessibling). It was dist-only, sorunProtectcouldn't run from source.tests/protect/install.test.ts(NEW, +5): first coverage for the scaffolder — scaffold, client patch, start.ts wiring incl. response screening, idempotency, unsupported-stack skip.390 tests pass, typecheck + build clean.
🤖 Generated with Claude Code