@cubis/foundry 0.3.63 → 0.3.64

package/workflows/skills/flutter-security-reviewer/POWER.md

@@ -1,204 +0,0 @@
----
-name: "flutter-security-reviewer"
-displayName: "Flutter/Dart Security Reviewer"
-description: "Review Flutter/Dart code for security vulnerabilities: secure storage, network hardening, log redaction, and data protection"
-keywords:
-  [
-    "security",
-    "flutter security",
-    "dart security",
-    "secure storage",
-    "encryption",
-    "log redaction",
-    "network security",
-    "data protection",
-    "pii",
-    "sensitive data",
-    "authentication",
-    "authorization",
-  ]
----
-
-# Flutter/Dart Security Reviewer
-
-## Overview
-
-This power helps you identify and fix security vulnerabilities in mobile and web applications, focusing on secure storage, network hardening, log redaction, and sensitive data handling.
-
-## When to Use
-
-- Reviewing code that handles authentication tokens
-- Implementing secure storage for sensitive data
-- Adding logging/analytics that might expose PII
-- Reviewing network requests for security issues
-- Implementing biometric authentication
-- Handling user passwords or credentials
-- Processing payment information
-- Storing user preferences that contain sensitive data
-- Implementing session management
-- Any code that touches user data
-
-## Review Output Format
-
-When reviewing, output exactly:
-
-1. **Threat summary** (what could go wrong; 3-6 bullets)
-2. **Findings** grouped by severity (CRITICAL/HIGH/MED/LOW)
-3. **Concrete mitigations** (specific code-level steps)
-4. **Security regression tests/checks** (what to verify)
-5. **Logging & privacy audit** (PII, tokens, crash reports)
-
-## Severity Definitions
-
-- **CRITICAL**: Token/session compromise, auth bypass, remote code/data exposure, storing secrets insecurely, PII leakage
-- **HIGH**: Weak access control, insecure defaults, sensitive data in logs, missing TLS assumptions
-- **MED**: Hardening gaps (timeouts, retry abuse, overly broad permissions)
-- **LOW**: Best-practice improvements
-
----
-
-## 1) Authentication & Session Security
-
-### Tokens
-
-**CRITICAL:**
-- Tokens in logs, analytics events, crash reports
-- Tokens stored in plain SharedPreferences without justification
-
-**Recommendations:**
-- Prefer secure storage for tokens (platform-backed) where possible
-- If SharedPreferences must be used, ensure:
-  - Short-lived access tokens + refresh tokens handled carefully
-  - Minimal token surface; never log
-
-### Route Guards
-- Ensure router guards cannot be bypassed by deep links
-- Guard decisions must use authoritative session provider state
-- Avoid redirect loops (secure + usability)
-
----
-
-## 2) Network Security
-
-### Checklist
-- [ ] Use HTTPS in UAT/Prod baseUrl
-- [ ] Reasonable timeouts (connect/receive)
-- [ ] Avoid disabling cert validation
-- [ ] Do not accept all certs in production
-- [ ] Interceptors must not log sensitive headers or body fields
-
-### Retry Policy
-- Avoid retrying non-idempotent requests unless safe
-- Backoff + max attempts
-
-### Device ↔ Gateway Security
-- Prefer server-side validation and proper auth
-- Never "security-by-obscurity" headers
-
----
-
-## 3) Local Data Protection
-
-**CRITICAL:**
-- Storing PII or tokens unencrypted without threat model
-
-**Guidance:**
-- Store only what's needed offline
-- Encrypt sensitive cached blobs if possible, or avoid caching them
-- Apply TTL to cached session/profile data
-- Clear data on logout
-
----
-
-## 4) Input Validation & Injection Safety
-
-- [ ] Validate all user inputs before sending to API
-- [ ] Avoid string interpolation for SQL queries: use parameters
-- [ ] Avoid trusting client-only checks (roles, orgId); server must enforce
-
----
-
-## 5) Privacy, Logging, Analytics
-
-**CRITICAL:**
-- PII in logs (`name`, `phone`, `location`, identifiers)
-- Tokens/headers in logs
-- Crashlytics sending PII
-
-**Guidance:**
-- Redact: Authorization headers, cookies, IDs if sensitive
-- Provide `toSafeLog()` helpers
-- Ensure debug logging is disabled/limited in release builds
-
----
-
-## 6) Dependency & Supply Chain Hygiene
-
-- [ ] Check new packages are reputable and maintained
-- [ ] Avoid adding packages that request broad permissions without need
-- [ ] Pin versions as appropriate; review changelogs for security fixes
-
----
-
-## 7) Security Review Checklist for PRs
-
-### Always Search For
-- `print(`, `debugPrint(`, logging interceptors
-- `Authorization`, `token`, `refresh`, `secret`, `apiKey`
-- `badCertificateCallback`, `HttpClient` overrides
-- Persistent storage of user/session data
-
-### Enforce
-- [ ] No secrets in repo
-- [ ] No insecure network overrides in production
-- [ ] Logout clears sensitive local data
-- [ ] Access control enforced server-side (don't trust client role/org headers alone)
-
----
-
-## Quick Reference
-
-### Secure Storage (DO)
-
-```dart
-// ✅ Use flutter_secure_storage for tokens
-final storage = FlutterSecureStorage();
-await storage.write(key: 'auth_token', value: token);
-```
-
-### Secure Storage (DON'T)
-
-```dart
-// ❌ Never store tokens in SharedPreferences
-final prefs = await SharedPreferences.getInstance();
-prefs.setString('auth_token', token); // INSECURE!
-
-// ❌ Never hardcode secrets
-const apiKey = 'sk_live_abc123'; // NEVER DO THIS
-```
-
-### Log Redaction
-
-```dart
-// ❌ Bad - logs sensitive data
-logger.info('User login: ${user.email}, password: ${password}');
-
-// ✅ Good - no sensitive data in logs
-logger.info('User login successful: userId=${user.id}');
-```
-
----
-
-## Steering Files
-
-| File                        | Load When                              |
-| --------------------------- | -------------------------------------- |
-| `secure_storage_policy.md`  | What to store where                    |
-| `network_hardening.md`      | Network security best practices        |
-| `log_redaction.md`          | How to redact sensitive data from logs |
-| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
-| `secret-scanning.md`        | Finding hardcoded secrets              |
-
-## Templates
-
-- `security_review_response.md` - Security review report template

package/workflows/skills/flutter-test-master/POWER.md

@@ -1,525 +0,0 @@
----
-name: "flutter-test-master"
-displayName: "Flutter Test Master"
-description: "Comprehensive Flutter testing guide covering unit tests, widget tests, integration tests, golden tests, and Riverpod provider testing with mocktail"
-keywords:
-  [
-    "flutter",
-    "test",
-    "testing",
-    "unit test",
-    "widget test",
-    "integration test",
-    "golden test",
-    "riverpod",
-    "mocktail",
-    "tdd",
-  ]
-author: "OneUp HR Team"
----
-
-# Flutter Test Master
-
-## Overview
-
-Master Flutter testing with comprehensive patterns for unit tests, widget tests, integration tests, golden tests, and Riverpod provider testing. This power provides battle-tested patterns, best practices, and ready-to-use templates for building robust test suites.
-
-## Available Steering Files
-
-- **unit-testing.md** - Unit test patterns for pure Dart logic and repositories
-- **widget-testing.md** - Widget test patterns with WidgetTester, finders, and matchers
-- **riverpod-testing.md** - Riverpod provider testing with ProviderContainer and mocking
-- **integration-testing.md** - E2E tests on real devices/emulators with login automation (Patrol)
-- **golden-testing.md** - Golden (snapshot) tests for UI regression detection
-- **property-testing.md** - Property-based testing with Glados for exhaustive coverage
-- **test-utilities.md** - Common test utilities, helpers, and setup patterns
-
-## Testing Pyramid
-
-Follow the testing pyramid principle for optimal coverage:
-
-```
-          /\
-         /  \  Integration/E2E (few - on device)
-        /----\
-       /      \  Widget Tests (some)
-      /--------\
-     /          \  Unit Tests (many)
-    /------------\
-```
-
-| Test Type   | Speed    | Scope                 | When to Use                              |
-| ----------- | -------- | --------------------- | ---------------------------------------- |
-| Unit        | Fast     | Single function/class | Business logic, utilities, models        |
-| Widget      | Medium   | Single widget         | UI components, user interactions         |
-| Integration | Slow     | Full app on device    | Critical user journeys (login, checkout) |
-| Golden      | Medium   | Visual snapshot       | UI regression detection                  |
-| Property    | Variable | Exhaustive inputs     | Edge cases, invariants                   |
-
-## Quick Start
-
-### 1. Project Setup
-
-```yaml
-# pubspec.yaml
-dev_dependencies:
-  flutter_test:
-    sdk: flutter
-  integration_test:
-    sdk: flutter
-  mocktail: ^1.0.3
-  glados: ^0.3.0 # Property-based testing
-  patrol: ^3.13.0 # E2E testing on real devices
-```
-
-### 2. Test File Structure
-
-```
-test/
-├── core/
-│   ├── network/
-│   │   └── api_client_test.dart
-│   └── utils/
-│       └── date_utils_test.dart
-├── features/
-│   └── <feature>/
-│       ├── data/
-│       │   └── <feature>_repository_test.dart
-│       ├── <feature>_controller_test.dart
-│       └── views/
-│           └── <feature>_view_test.dart
-├── helpers/
-│   ├── mocks.dart
-│   ├── test_helpers.dart
-│   └── pump_app.dart
-└── widget_test.dart
-```
-
-### 3. Running Tests
-
-```bash
-# Run all tests
-flutter test
-
-# Run specific test file
-flutter test test/features/auth/auth_test.dart
-
-# Run with coverage
-flutter test --coverage
-
-# Run tests matching pattern
-flutter test --name "should login"
-
-# Update golden files
-flutter test --update-goldens
-
-# Run integration tests on device/emulator
-flutter test integration_test/app_test.dart
-
-# Run with Patrol (E2E)
-patrol test
-```
-
-## Core Testing Patterns
-
-### Given-When-Then Structure
-
-```dart
-test('should return user when login succeeds', () async {
-  // Given (Arrange)
-  final mockRepo = MockAuthRepository();
-  when(() => mockRepo.login(any(), any()))
-      .thenAnswer((_) async => User(id: '1', name: 'John'));
-
-  // When (Act)
-  final result = await mockRepo.login('email', 'password');
-
-  // Then (Assert)
-  expect(result.name, equals('John'));
-  verify(() => mockRepo.login('email', 'password')).called(1);
-});
-```
-
-### Test Naming Convention
-
-```dart
-// Pattern: should_[expected behavior]_when_[condition]
-test('should return empty list when no items exist', () { ... });
-test('should throw AuthException when credentials invalid', () { ... });
-test('should update state when mutation succeeds', () { ... });
-```
-
-## Unit Testing Essentials
-
-### Testing Pure Functions
-
-```dart
-import 'package:flutter_test/flutter_test.dart';
-
-void main() {
-  group('DateUtils', () {
-    test('should format date correctly', () {
-      final date = DateTime(2024, 1, 15);
-      expect(formatDate(date), equals('Jan 15, 2024'));
-    });
-
-    test('should return true for same day', () {
-      final date1 = DateTime(2024, 1, 15, 10, 30);
-      final date2 = DateTime(2024, 1, 15, 14, 45);
-      expect(isSameDay(date1, date2), isTrue);
-    });
-  });
-}
-```
-
-### Testing with Mocktail
-
-```dart
-import 'package:flutter_test/flutter_test.dart';
-import 'package:mocktail/mocktail.dart';
-
-// Create mock class
-class MockUserRepository extends Mock implements UserRepository {}
-
-void main() {
-  late MockUserRepository mockRepo;
-
-  setUp(() {
-    mockRepo = MockUserRepository();
-  });
-
-  test('should return user from repository', () async {
-    // Arrange
-    when(() => mockRepo.getUser('123'))
-        .thenAnswer((_) async => Result.success(User(id: '123', name: 'John')));
-
-    // Act
-    final result = await mockRepo.getUser('123');
-
-    // Assert
-    expect(result.isSuccess, isTrue);
-    verify(() => mockRepo.getUser('123')).called(1);
-  });
-}
-```
-
-## Widget Testing Essentials
-
-### Basic Widget Test
-
-```dart
-import 'package:flutter/material.dart';
-import 'package:flutter_test/flutter_test.dart';
-
-void main() {
-  testWidgets('should display title text', (tester) async {
-    // Arrange & Act
-    await tester.pumpWidget(
-      const MaterialApp(
-        home: MyWidget(title: 'Hello'),
-      ),
-    );
-
-    // Assert
-    expect(find.text('Hello'), findsOneWidget);
-  });
-
-  testWidgets('should navigate on button tap', (tester) async {
-    await tester.pumpWidget(const MaterialApp(home: LoginScreen()));
-
-    // Find and tap button
-    await tester.tap(find.byType(ElevatedButton));
-    await tester.pumpAndSettle();
-
-    // Verify navigation
-    expect(find.byType(HomeScreen), findsOneWidget);
-  });
-}
-```
-
-### Common Finders
-
-```dart
-// By type
-find.byType(ElevatedButton)
-find.byType(TextField)
-
-// By text
-find.text('Submit')
-find.textContaining('Hello')
-
-// By key
-find.byKey(const Key('login_button'))
-
-// By icon
-find.byIcon(Icons.add)
-
-// By widget predicate
-find.byWidgetPredicate((widget) => widget is Text && widget.data == 'Hello')
-
-// Descendant finder
-find.descendant(
-  of: find.byType(Card),
-  matching: find.text('Title'),
-)
-```
-
-### Common Matchers
-
-```dart
-// Widget count
-expect(find.byType(ListTile), findsNWidgets(3));
-expect(find.text('Error'), findsNothing);
-expect(find.byType(CircularProgressIndicator), findsOneWidget);
-
-// Widget properties
-expect(
-  tester.widget<Text>(find.text('Hello')).style?.color,
-  equals(Colors.red),
-);
-```
-
-## Riverpod Testing
-
-### Unit Testing Providers
-
-```dart
-import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:flutter_test/flutter_test.dart';
-
-void main() {
-  test('should return initial state', () {
-    final container = ProviderContainer();
-    addTearDown(container.dispose);
-
-    final state = container.read(counterProvider);
-    expect(state, equals(0));
-  });
-
-  test('should increment counter', () {
-    final container = ProviderContainer();
-    addTearDown(container.dispose);
-
-    container.read(counterProvider.notifier).increment();
-    expect(container.read(counterProvider), equals(1));
-  });
-}
-```
-
-### Widget Testing with Riverpod
-
-```dart
-import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:flutter_test/flutter_test.dart';
-
-void main() {
-  testWidgets('should display user name', (tester) async {
-    await tester.pumpWidget(
-      ProviderScope(
-        overrides: [
-          userProvider.overrideWith((ref) => User(name: 'John')),
-        ],
-        child: const MaterialApp(home: ProfileScreen()),
-      ),
-    );
-
-    expect(find.text('John'), findsOneWidget);
-  });
-}
-```
-
-### Mocking Async Providers
-
-```dart
-testWidgets('should show loading then data', (tester) async {
-  await tester.pumpWidget(
-    ProviderScope(
-      overrides: [
-        userProvider.overrideWith(
-          (ref) => AsyncValue.data(User(name: 'John')),
-        ),
-      ],
-      child: const MaterialApp(home: ProfileScreen()),
-    ),
-  );
-
-  await tester.pumpAndSettle();
-  expect(find.text('John'), findsOneWidget);
-});
-```
-
-## Property-Based Testing with Glados
-
-### Basic Property Test
-
-```dart
-import 'package:glados/glados.dart';
-
-void main() {
-  Glados(any.int).test('absolute value is non-negative', (value) {
-    expect(value.abs(), greaterThanOrEqualTo(0));
-  });
-
-  Glados2(any.int, any.int).test('addition is commutative', (a, b) {
-    expect(a + b, equals(b + a));
-  });
-}
-```
-
-### Custom Generators
-
-```dart
-extension AnyUser on Any {
-  Generator<User> get user => combine2(
-    any.letterOrDigits,
-    any.positiveInt,
-    (name, age) => User(name: name, age: age),
-  );
-}
-
-void main() {
-  Glados(any.user).test('user name is not empty', (user) {
-    expect(user.name.isNotEmpty, isTrue);
-  });
-}
-```
-
-## Integration Testing (E2E on Device)
-
-For full app testing on real devices/emulators with login automation, use **Patrol**:
-
-```dart
-// integration_test/app_test.dart
-import 'package:patrol/patrol.dart';
-
-void main() {
-  patrolTest('Login and navigate to home', ($) async {
-    await $.pumpWidgetAndSettle(createApp());
-
-    // Enter credentials (from environment variables)
-    await $(#email_field).enterText('test@example.com');
-    await $(#password_field).enterText('password123');
-    await $(#login_button).tap();
-
-    // Wait for home screen
-    await $.pumpAndSettle(timeout: const Duration(seconds: 10));
-    expect($(#home_screen), findsOneWidget);
-  });
-}
-```
-
-Run with credentials:
-
-```bash
-patrol test --dart-define=TEST_EMAIL=user@test.com --dart-define=TEST_PASSWORD=pass123
-```
-
-See **integration-testing.md** steering file for full patterns including:
-
-- Page Object pattern (Robots)
-- Native permission handling
-- CI/CD integration
-- Test configuration
-
-## Best Practices
-
-### DO ✅
-
-- Write tests BEFORE fixing bugs (TDD for bug fixes)
-- Use descriptive test names with given-when-then
-- Keep tests independent and isolated
-- Mock external dependencies
-- Test edge cases and error scenarios
-- Use `setUp` and `tearDown` for common setup
-- Group related tests with `group()`
-
-### DON'T ❌
-
-- Don't test implementation details
-- Don't share state between tests
-- Don't use real network calls in unit tests
-- Don't test third-party code
-- Don't write flaky tests (avoid `sleep()`)
-- Don't ignore failing tests
-
-## Troubleshooting
-
-### Common Issues
-
-**Test hangs or times out:**
-
-```dart
-// Use pumpAndSettle with timeout
-await tester.pumpAndSettle(const Duration(seconds: 5));
-
-// Or pump specific frames
-await tester.pump(const Duration(milliseconds: 100));
-```
-
-**Widget not found:**
-
-```dart
-// Ensure widget is pumped
-await tester.pumpWidget(widget);
-await tester.pumpAndSettle(); // Wait for animations
-
-// Check if widget is in tree
-debugDumpApp(); // Prints widget tree
-```
-
-**Provider not found:**
-
-```dart
-// Wrap with ProviderScope
-await tester.pumpWidget(
-  ProviderScope(
-    child: MaterialApp(home: MyWidget()),
-  ),
-);
-```
-
-**Golden test fails on CI:**
-
-```dart
-// Use font configuration
-await loadAppFonts();
-
-// Or skip on CI
-testWidgets('golden test', (tester) async {
-  // ...
-}, skip: Platform.environment.containsKey('CI'));
-```
-
-## Commands Reference
-
-```bash
-# Run all tests
-flutter test
-
-# Run with verbose output
-flutter test --reporter expanded
-
-# Run specific file
-flutter test test/path/to/test.dart
-
-# Run tests matching name
-flutter test --name "login"
-
-# Generate coverage report
-flutter test --coverage
-genhtml coverage/lcov.info -o coverage/html
-
-# Update golden files
-flutter test --update-goldens
-
-# Run tests in random order
-flutter test --test-randomize-ordering-seed random
-
-# Integration tests on device
-flutter test integration_test/app_test.dart
-
-# Patrol E2E tests
-patrol test
-patrol test -d <device_id>
-patrol test --dart-define=TEST_EMAIL=user@test.com
-```