feat(e2e): nine custom editors + grand tour — a complete signed-off NIS2 implementation - #39
Open
simonorzel26 wants to merge 3 commits into
Open
feat(e2e): nine custom editors + grand tour — a complete signed-off NIS2 implementation#39simonorzel26 wants to merge 3 commits into
simonorzel26 wants to merge 3 commits into
Conversation
The last big coverage block: every bespoke editor driven through its real UI with persistence asserted in Postgres and re-rendered after reload. - Five PolicyEditorShell editors (patch 6.4, crypto 9.1, access control 10.1, procurement 6.1, secure dev 6.2): edit, change distinctive values (SLA hours, key rotation, access model + review frequencies, threshold + clause toggle, SDLC/hardening selects + segregation), save via the shared shell, assert the JSONB config keys. - Risk methodology 2.1: name + acceptance threshold into company_risk_methodology. - Asset and supplier risk registers 2.3/5.3: inline risk creation with the matrix picker (score 16), chained create+link mutations, join-table asserts against seeded assets/suppliers. - Risk treatment 2.4: add measure, set residual via matrix, accept risk; asserts accepted_at, residual score and the treatment row. Product hooks: ~25 data-testid attributes across 11 components, chosen from a 4-agent mapping pass that flagged exactly which selectors were silent-failure risks (twin selects, locale-dependent row labels, shared shell buttons covering five editors with three testids). Suite: 76 passed + 1 documented skip; 110 L0; typecheck clean. Coverage: 45/49 requirements primary-surface tested; untouched list is now only 1.2 (team) and 5.2 (supplier contract), both awaiting the invite-flow specs.
…implementation The capstone the suite was built toward: after l1 fills every intake form, l2 populates modules, editors and evidence, and l3 proves the sign-off mechanics, the grand tour walks all 49 requirement pages in journey order and signs off everything still open through the real button (41 signed, 8 already done in this run). Two authoritative proofs close the run: zero NIS2 status rows outside completed/approved/not_applicable in Postgres, and the product's own sidebar rendering 49/49. Shared journey helpers (slug map, makeSignable, signOffViaUi) extracted to e2e/lib/journey.ts; the l3 spec now imports them. Full suite: 77 passed + 1 documented skip in 2.3m, hermetic DB.
simonorzel26
changed the title
Contributor
Author
|
Second commit adds the grand tour capstone: after the earlier layers populate intake, modules, editors and evidence, the tour walks all 49 requirement pages in journey order, signs off everything still open through the real UI (41 signed / 8 already done this run), and closes with two proofs — zero open NIS2 status rows in Postgres and the sidebar rendering 49/49. With this, the suite drives one company through a complete, fully signed-off NIS2 implementation end to end. 77 passed + 1 documented skip, 2.3m, green on first run. |
…bility
From the code-review + coverage-audit pass:
- form-driver: option matching no longer false-greens. Exact match wins,
else a single non-empty prefix match; empty/icon labels ("") and
substring collisions ("3levels" in "13levels") are rejected, ambiguity
throws. verifyFields tightened the same way.
- coverage-report: EDITORS_TESTED is derived from UI_CUSTOM_EDITORS
instead of a third hand-copy of the nine codes; the report no longer
sorts the shared nis2Categories array in place ([...nis2Categories]).
Comment clarifies "editor tested" = page driven, not every sub-table.
- signoff carry-over query: joins src through the framework so code 3.1
matches the NIS2 requirement, not any same-coded ISO row (was missing
the filter its sibling statusRow query has).
- start-server.sh guard: parses host + db name and checks them exactly,
so a glob like localhost* can no longer accept localhost.evil/x_e2e on
the only guard for the destructive migrate+seed path.
- e2e app port 3026 -> 3410: no longer collides with the dev server's
port, closing the "run e2e while a dev server is up -> writes could land
in the dev DB" footgun.
- walker EXTRA_MODULE_BACKED: dropped 2.3/5.3 (shadowed dead code, custom-
editor branch wins), keeping only the live 9.2.
- grand tour: page-ready via networkidle then a deterministic sign-off-
button check, replacing the fixed 5s wait that both wasted time on
already-done pages and could misclassify a slow signable page.
Full suite 77 passed + 1 skip (rebuilt on 3410); grand tour reaches 49/49;
L0 110 pass; typecheck clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The nine bespoke editors (the largest remaining coverage block) driven end to end: the five PolicyEditorShell editors, the risk methodology, both risk registers, and the treatment/acceptance view. Every spec waits on the real mutation, asserts the JSONB config or risk rows in Postgres, and re-renders after reload.
Highlights:
PolicyEditorShellcover the edit/save cycle of five editors.data-testidhooks across 11 components, selected from a 4-agent mapping pass that identified the silent-failure selectors (twin selects, locale-dependent table rows).Coverage after this PR (bun e2e/coverage-report.ts)
42/49 requirements primary-surface tested (was 34). Completely untouched: 1.2 (team page), 5.2 (supplier contract fields) — both belong to the upcoming invite-flow specs — and 9.2 (per-asset crypto enrichment). Partials: 1.1/8.2/8.3 (training-record surfaces, pending the course spec) and 5.1 (supplier register).
Verified
bun test e2e/l0: 110 pass; typecheck cleanmodelvsaccessModel) — the save itself worked first try on all nine editorsAwaiting review — not merging without an explicit go.
🤖 Generated with Claude Code
https://claude.ai/code/session_01De1NY1HDUJkkwetVKTbYtH