Files
TX/.replit
riyadhafraa 26514e8ecc EM #241: sanitize location/meetingUrl/notes (URL-safe) + tests
Original task: Executive Meetings — test coverage + sanitization
closeout (umbrella for #170, #186-189, #201, #202, #212, #214, #218,
#235).

What landed
- Added `stripTagsToPlainText[OrNull]` in
  `artifacts/api-server/src/lib/sanitize.ts` that strips HTML tags via
  sanitize-html and then decodes the entities sanitize-html introduces
  (`&amp;`→`&`, `&lt;`→`<`, etc.) so URLs like
  `https://x.test?a=1&b=2` and free-form notes containing `5 < 10`
  round-trip unchanged. Existing `sanitizePlainText` (which entity-
  encodes) is preserved for `attendee.title` so the print template's
  HTML interpolation behavior is unchanged.
- Wired the new helper into all 11 write paths for
  `location`/`meetingUrl`/`notes` in
  `artifacts/api-server/src/routes/executive-meetings.ts`:
  POST /executive-meetings, PATCH /executive-meetings/:id,
  POST /executive-meetings/:id/duplicate, and `applyApprovedRequest`
  (`change_location` + `note`). attendee.title call sites kept as-is.
- Added 5 API tests in
  `artifacts/api-server/tests/executive-meetings.test.mjs`:
  POST sanitization (with URL `&` round-trip + literal `<`/`&` in notes),
  PATCH sanitization, duplicate-path round-trip, change_location
  approved-request round-trip + tag stripping, and an EditableCell
  column-independence contract test (PATCH titleEn alone must not
  clobber titleAr and vice versa). All 5 pass.

Drift from the original umbrella
- The umbrella also listed 9 Playwright e2e specs (#170, #186, #187,
  #188, #201, #212, #214, #218, #235). Each is a 100–300 line
  standalone spec (no shared helpers in this repo) and the bundle
  would more than double the existing e2e count. Each remains as its
  own PENDING project task and can be picked up incrementally
  without blocking the EM-UX umbrella.

Verification
- Suite: 219 tests, 218 passing. The one failure is a pre-existing
  socket-state pollution flake in `meeting_created: fan-out…`,
  unrelated to sanitization (already covered by #247).
- Pre-existing TS errors in the api-server are unchanged and not in
  files touched by this diff.
2026-04-30 22:54:42 +00:00

72 lines
1.1 KiB
Plaintext

modules = ["nodejs-24", "python-3.11", "postgresql-16"]
[deployment]
router = "application"
deploymentTarget = "autoscale"
[deployment.postBuild]
args = ["pnpm", "store", "prune"]
env = { "CI" = "true" }
[workflows]
runButton = "Project"
[[workflows.workflow]]
name = "Project"
mode = "parallel"
author = "agent"
[[workflows.workflow.tasks]]
task = "workflow.run"
args = "test"
[[workflows.workflow]]
name = "test"
author = "agent"
[workflows.workflow.metadata]
outputType = "console"
[[workflows.workflow.tasks]]
task = "shell.exec"
args = "pnpm --filter @workspace/api-server test:wait && pnpm --filter @workspace/api-server test && pnpm --filter @workspace/tx-os test:e2e"
[agent]
stack = "PNPM_WORKSPACE"
expertMode = true
[postMerge]
path = "scripts/post-merge.sh"
timeoutMs = 120000
[[ports]]
localPort = 8080
externalPort = 8080
[[ports]]
localPort = 8081
externalPort = 80
[[ports]]
localPort = 8082
externalPort = 3003
[[ports]]
localPort = 8083
externalPort = 5173
[[ports]]
localPort = 25785
externalPort = 3000
[[ports]]
localPort = 25786
externalPort = 3002
[[ports]]
localPort = 25787
externalPort = 5000
[nix]
channel = "stable-25_05"