<!-- Generated from models/_canonical by scripts/build-model-variants.js. Edit the canonical source, not this file. Behavioural profile for Claude: scripts/model-profiles.json -->

<critical_constraints> FORBIDDEN: Truncating code or writing placeholders such as "// ... existing code ..." or "# rest unchanged". Every edit is complete and applies as written. FORBIDDEN: Reporting a check as passed without showing the command and its output. REQUIRED: Reason through the rules below before the first edit; when two rules conflict, the one stated first wins. </critical_constraints>

---

#Purpose

Rules for testing security as part of the normal suite, not as an annual audit.

The framing that matters: a functional test proves the feature works; a security test proves it cannot be misused. Both are needed, and only the second catches the user who deliberately sends the wrong thing.

Reviewing a change by hand is Security/security-review. This package is about tests that run automatically.

---

#The layers, and what each actually catches

Automated tools do not find broken access control, which is the most common and most damaging category → Security/owasp. That gap is filled by tests you write.

---

#Abuse-case tests

The highest-value security tests in any suite. Write them exactly like functional tests, but assert that the wrong thing is refused.

js
test("a user cannot read another tenant's invoice", async () => {
  const { token: attacker } = await createUser({ tenant: "org_a" });
  const victim = await createInvoice({ tenant: "org_b" });

  const res = await request(app)
    .get(`/api/invoices/${victim.id}`)
    .set("Authorization", `Bearer ${attacker}`);

  expect(res.status).toBe(404);          // 404, not 403 — no existence oracle
});

test("role cannot be escalated through the profile endpoint", async () => {
  const { token, id } = await createUser({ role: "member" });

  await request(app)
    .patch(`/api/users/${id}`)
    .set("Authorization", `Bearer ${token}`)
    .send({ name: "New", role: "admin" });        // mass-assignment attempt

  const user = await db.user.findUnique({ where: { id } });
  expect(user.role).toBe("member");               // the field was ignored
});

Write one abuse test for each of these, per resource:

• Another tenant's object by id (IDOR)
• A privileged field in an update body (mass assignment)
• A missing or expired token
• A token for a different audience
• A nested or bulk operation where only the parent is authorised
• A GET that should have been a POST

---

#Wiring the tools into CI

yaml
- name: Dependencies
  run: npm audit --omit=dev --audit-level=high

- name: Static analysis
  run: semgrep --config=p/owasp-top-ten --error --severity=ERROR

- name: Secrets
  run: gitleaks detect --no-banner --redact

- name: Container
  run: trivy image --exit-code 1 --severity HIGH,CRITICAL "$IMAGE"

• Fail the build on high and critical. A scan that only reports is a scan nobody reads.
• Scan on every pull request, not nightly. A dependency introduced on Monday should not ship because the scan runs on Friday.
• Every suppression needs an owner and an expiry. A permanent unowned exception is how a known CVE stays shipped for two years.
• Tune the rules. A tool producing 400 findings, 390 of them irrelevant, trains everyone to ignore all 400.

---

Useful rule packs to start from rather than writing your own: p/owasp-top-ten, p/nodejs, p/react, p/secrets for semgrep; the security-extended suite for CodeQL; and --severity HIGH,CRITICAL with --ignore-unfixed for trivy so the build is not blocked by a CVE with no available patch.

#Testing the security controls themselves

Controls decay silently. Assert them:

js
test("security headers are present on every response", async () => {
  const res = await request(app).get("/");

  expect(res.headers["content-security-policy"]).toBeDefined();
  expect(res.headers["strict-transport-security"]).toMatch(/max-age=\d{7,}/);
  expect(res.headers["x-content-type-options"]).toBe("nosniff");
  expect(res.headers["x-powered-by"]).toBeUndefined();
});

test("login is rate limited per account", async () => {
  const attempts = await Promise.all(
    Array.from({ length: 20 }, () =>
      request(app).post("/login").send({ email: "a@example.com", password: "wrong" })
    )
  );
  expect(attempts.some((r) => r.status === 429)).toBe(true);
});

Also assert: session cookies carry HttpOnly and Secure; errors do not include a stack trace; an unauthenticated request to a protected route returns 401.

---

#Anti-patterns

---

#Checklist

• Dependency, SAST, secret and container scans run on every pull request
• Each gates the build on high and critical severity
• Suppressions carry an owner and an expiry
• Abuse tests cover IDOR, mass assignment and cross-tenant access per resource
• Unauthorised object access asserts 404, not 403
• Missing, expired and wrong-audience tokens are all tested
• Nested and bulk operations are tested for partial authorisation
• Security headers are asserted in the test suite
• Rate limiting on authentication routes is asserted
• Error responses are asserted to contain no stack trace
• No real credential appears in any fixture