c048766075
New AST check scans handler render functions that build site settings (getSiteSettings + doc["site_settings"]) and fails if they don't also set siteSettings["toolbar"], so admin-toolbar injection can't silently regress when a new public page type is added. - toolbar.go: AST scanner; exempts renderListingPage (auto SEO pages) and renderVersionPreview (carries its own preview banner). - check_toolbar.go: registration at Seq 280 (ID "28"). - registry_test.go: +1 expected check; golden fixtures regenerated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
38 lines
1.3 KiB
Go
38 lines
1.3 KiB
Go
package main
|
|
|
|
import "fmt"
|
|
|
|
func init() {
|
|
register(Check{
|
|
Seq: 280,
|
|
ID: "28",
|
|
Title: "Public page handlers inject admin toolbar data",
|
|
Run: func(ctx *ScanContext, rep *Reporter) {
|
|
fmt.Println("=== Check 28: Public page handlers inject admin toolbar data ===")
|
|
var violations []toolbarViolation
|
|
for _, target := range ctx.backendTargets {
|
|
for _, v := range checkToolbarInjection(target.root) {
|
|
v.file = prefixDisplayPath(target.display, v.file)
|
|
violations = append(violations, v)
|
|
}
|
|
}
|
|
if len(violations) > 0 {
|
|
fmt.Printf(" FAIL: %d public page handler(s) missing toolbar injection:\n", len(violations))
|
|
for _, v := range violations {
|
|
fmt.Printf(" %s:%d func %s — missing siteSettings[\"toolbar\"] for admin toolbar\n", v.file, v.line, v.funcName)
|
|
}
|
|
fmt.Println("\n Fix: Add auth check + toolbar injection between getSiteSettings() and doc[\"site_settings\"]:")
|
|
fmt.Println(" if claims, ok := auth.GetUserFromContext(ctx); ok && claims != nil {")
|
|
fmt.Println(" toolbarData := h.buildToolbarData(ctx, r, page, systemTemplate, pageTemplateKey)")
|
|
fmt.Println(" siteSettings[\"toolbar\"] = toolbarData")
|
|
fmt.Println(" }")
|
|
rep.Fail()
|
|
} else {
|
|
fmt.Println(" OK: All public page handlers inject admin toolbar data")
|
|
}
|
|
|
|
fmt.Println()
|
|
},
|
|
})
|
|
}
|