@hienlh/ppm 0.9.81 → 0.9.83

package/.opencode/skills/web-testing/references/security-checklists.md

@@ -1,81 +0,0 @@
-# Security Checklists
-
-## Authentication Security
-
-- [ ] Strong auth mechanism (OAuth 2.0, JWT, OIDC)
-- [ ] No basic auth or custom schemes
-- [ ] Password policy enforced (12+ chars, complexity)
-- [ ] MFA/2FA for sensitive operations
-- [ ] Account lockout after failed attempts (5-10)
-- [ ] Secure password reset (token expiration)
-- [ ] Default credentials removed/disabled
-- [ ] API keys not in code/version control
-- [ ] Session tokens cryptographically generated
-- [ ] Logout invalidates session/token
-
-## API Security
-
-- [ ] HTTPS/TLS enforced for all endpoints
-- [ ] API versioning strategy in place
-- [ ] Rate limiting implemented
-- [ ] Auth required (API key or OAuth token)
-- [ ] Input validation on all parameters
-- [ ] Output encoding/sanitization
-- [ ] CORS headers properly configured
-- [ ] Pagination limits prevent enumeration
-- [ ] Proper HTTP status codes (401 vs 403)
-- [ ] Error messages don't expose internals
-
-## Session Management
-
-- [ ] Session IDs cryptographically random
-- [ ] Cookies: HttpOnly, Secure, SameSite flags
-- [ ] Session timeout (idle + absolute)
-- [ ] Session invalidation on logout
-- [ ] Session fixation protection (regenerate on login)
-- [ ] CSRF tokens for state-changing ops
-- [ ] Session data server-side (not in cookies)
-
-## Input Validation
-
-- [ ] Whitelist validation (allow only expected)
-- [ ] Type validation (string, number, date)
-- [ ] Length validation (min/max)
-- [ ] Format validation (regex for email, URL)
-- [ ] SQL parameters use prepared statements
-- [ ] NoSQL queries use safe APIs
-- [ ] Command execution avoided/validated
-- [ ] XML external entities disabled (XXE)
-- [ ] JSON parsing safe (no eval)
-- [ ] ReDoS-safe regex patterns
-
-## Security Headers
-
-```
-Content-Security-Policy: default-src 'self'; script-src 'self'
-X-Content-Type-Options: nosniff
-X-Frame-Options: DENY
-X-XSS-Protection: 1; mode=block
-Strict-Transport-Security: max-age=31536000; includeSubDomains
-Referrer-Policy: strict-origin-when-cross-origin
-Permissions-Policy: camera=(), microphone=(), geolocation=()
-```
-
-- [ ] CSP configured (restrict resource loading)
-- [ ] X-Content-Type-Options: nosniff
-- [ ] X-Frame-Options (DENY or SAMEORIGIN)
-- [ ] HSTS enabled with appropriate max-age
-- [ ] Referrer-Policy configured
-- [ ] Permissions-Policy set
-- [ ] Server/X-Powered-By headers removed
-- [ ] CORS: No wildcard on credentialed endpoints
-
-## Verify Headers
-
-```bash
-# Check security headers
-curl -I https://example.com
-
-# Use securityheaders.com
-# Use observatory.mozilla.org
-```

package/.opencode/skills/web-testing/references/security-testing-overview.md

@@ -1,92 +0,0 @@
-# Security Testing Overview
-
-## OWASP Top 10 (2024)
-
-| Rank | Vulnerability | Testing Method |
-|------|--------------|----------------|
-| A01 | Broken Access Control | Test unauthorized actions across roles |
-| A02 | Cryptographic Failures | Check HTTPS, encryption algorithms |
-| A03 | Injection (SQL/NoSQL/Cmd) | Test with payloads (see vulnerability-payloads.md) |
-| A04 | Insecure Design | Threat modeling, abuse case testing |
-| A05 | Security Misconfiguration | Default creds, open ports, headers |
-| A06 | Vulnerable Components | npm audit, Snyk scanning |
-| A07 | Auth Failures | Brute force, session hijacking |
-| A08 | Integrity Failures | Deserialization, CI/CD security |
-| A09 | Logging Failures | Verify security event logging |
-| A10 | SSRF | Test internal URL access |
-
-## Security Testing Types
-
-### SAST (Static Analysis)
-- **When**: Early development, pre-commit
-- **Tools**: SonarQube, CodeQL, Semgrep
-- **Focus**: Code flaws without execution
-- **Limitation**: High false positives
-
-### DAST (Dynamic Analysis)
-- **When**: QA/staging, running application
-- **Tools**: OWASP ZAP, Burp Suite, Nuclei
-- **Focus**: Runtime vulnerabilities
-- **Limitation**: Requires running app
-
-### SCA (Dependency Scanning)
-- **Tools**: npm audit, Snyk, Dependabot
-- **Focus**: Known CVEs in dependencies
-- **Automation**: CI/CD integration
-
-### Secret Detection
-- **Tools**: detect-secrets, GitGuardian
-- **Focus**: API keys, passwords in code
-- **Implementation**: Pre-commit hooks
-
-## Quick Security Scan
-
-```bash
-# Dependency vulnerabilities
-npm audit
-npx snyk test
-
-# OWASP ZAP baseline scan
-docker run -t ghcr.io/zaproxy/zaproxy:stable \
-  zap-baseline.py -t https://example.com
-
-# Nuclei template scan
-nuclei -u https://example.com -t cves/
-
-# Check security headers
-curl -I https://example.com | grep -i "security\|content-security\|x-"
-```
-
-## Penetration Testing Phases
-
-1. **Reconnaissance**: DNS, WHOIS, tech fingerprinting
-2. **Scanning**: Port scan, service enumeration
-3. **Vulnerability Assessment**: Automated + manual testing
-4. **Exploitation**: Verify findings, demonstrate impact
-5. **Reporting**: CVSS scores, remediation guidance
-
-## Tools Comparison
-
-| Tool | Type | Cost | Best For |
-|------|------|------|----------|
-| OWASP ZAP | DAST | Free | CI/CD, learning |
-| Burp Suite | DAST | Paid | Enterprise, detailed |
-| Nuclei | DAST | Free | Custom checks |
-| npm audit | SCA | Free | Node.js deps |
-| Snyk | SCA | Free/Paid | Multi-language |
-
-## CI/CD Integration
-
-```yaml
-# Security scanning in pipeline
-- name: Dependency Scan
-  run: npm audit --audit-level=high
-
-- name: SAST Scan
-  uses: github/codeql-action/analyze@v3
-
-- name: DAST Scan
-  run: |
-    docker run -v $(pwd):/zap/wrk:rw ghcr.io/zaproxy/zaproxy:stable \
-      zap-api-scan.py -t http://localhost:3000/openapi.json -f openapi
-```

package/.opencode/skills/web-testing/references/shadow-dom-testing.md

@@ -1,70 +0,0 @@
-# Shadow DOM & Web Components Testing
-
-## Challenges
-
-- CSS encapsulation breaks selectors
-- Elements hidden from DOM queries
-- XPath doesn't penetrate shadow boundaries
-
-## Tool Support
-
-| Tool | Support | Method |
-|------|---------|--------|
-| Playwright | Native | `>>` piercing selector |
-| Cypress | Good | `.shadow()` command |
-| Selenium | Limited | JS execution |
-| Axe | v5.7+ | API support |
-
-## Playwright Shadow Piercing
-
-```javascript
-const input = page.locator('my-component >> .internal-input');
-const button = page.locator('comp-a >> comp-b >> button');
-const el = page.locator('custom-element >> button:has-text("Click me")');
-```
-
-## Cypress Shadow DOM
-
-```javascript
-cy.get('my-component').shadow().find('.internal-button').click();
-
-// Enable globally: { includeShadowDom: true }
-```
-
-## Selenium Workaround
-
-```javascript
-const shadowHost = driver.findElement(By.css('my-component'));
-const shadowRoot = driver.executeScript('return arguments[0].shadowRoot', shadowHost);
-const button = shadowRoot.findElement(By.css('button'));
-```
-
-## Page Object Pattern
-
-```typescript
-export class MyComponentPO {
-  constructor(private page: Page) {}
-
-  async fillEmail(email: string) {
-    await this.page.locator('my-form >> input[type="email"]').fill(email);
-  }
-
-  async submit() {
-    await this.page.locator('my-form >> button[type="submit"]').click();
-  }
-}
-```
-
-## Best Practices
-
-1. Request `open` shadow roots when possible
-2. Encapsulate shadow traversal in page objects
-3. Avoid deep nesting (increases complexity)
-
-## Debugging
-
-```javascript
-const contents = await page.evaluate(() => {
-  return document.querySelector('my-component').shadowRoot.innerHTML;
-});
-```

package/.opencode/skills/web-testing/references/test-data-management.md

@@ -1,131 +0,0 @@
-# Test Data Management
-
-## Faker.js (Dynamic Data Generation)
-
-```typescript
-import { faker } from '@faker-js/faker';
-
-// Reproducible data (seeding)
-faker.seed(123);
-
-const user = {
-  id: faker.string.uuid(),
-  name: faker.person.fullName(),
-  email: faker.internet.email(),
-  avatar: faker.image.avatar(),
-  createdAt: faker.date.past(),
-};
-```
-
-## Factory Pattern (Fishery)
-
-```typescript
-import { Factory } from 'fishery';
-import { faker } from '@faker-js/faker';
-
-// Define factory
-const userFactory = Factory.define<User>(() => ({
-  id: faker.string.uuid(),
-  name: faker.person.fullName(),
-  email: faker.internet.email(),
-  role: 'user',
-}));
-
-// Usage
-const user = userFactory.build();
-const admin = userFactory.build({ role: 'admin' });
-const users = userFactory.buildList(5);
-```
-
-## Factory with Associations
-
-```typescript
-const postFactory = Factory.define<Post>(({ associations }) => ({
-  id: faker.string.uuid(),
-  title: faker.lorem.sentence(),
-  author: associations.author || userFactory.build(),
-}));
-
-const post = postFactory.build({
-  author: userFactory.build({ role: 'admin' }),
-});
-```
-
-## Fixtures (Static Baseline Data)
-
-```typescript
-// fixtures/users.ts
-export const testUsers = {
-  admin: {
-    id: 'admin-001',
-    email: 'admin@test.com',
-    role: 'admin',
-  },
-  member: {
-    id: 'member-001',
-    email: 'member@test.com',
-    role: 'member',
-  },
-};
-
-// In tests
-import { testUsers } from './fixtures/users';
-```
-
-## Combined Pattern (Fixtures + Factories)
-
-```typescript
-// Baseline fixtures for known states
-const baseUser = testUsers.admin;
-
-// Factory for dynamic variations
-const dynamicUser = userFactory.build({
-  ...baseUser,
-  email: faker.internet.email(), // Override specific fields
-});
-```
-
-## Database Seeding
-
-```typescript
-// seed.ts
-async function seedTestData(db: Database, workerIndex: number) {
-  // Worker-isolated data
-  const prefix = `w${workerIndex}`;
-
-  await db.users.insertMany([
-    { id: `${prefix}-user-1`, email: `user1-${prefix}@test.com` },
-    { id: `${prefix}-user-2`, email: `user2-${prefix}@test.com` },
-  ]);
-}
-
-async function clearTestData(db: Database, workerIndex: number) {
-  const prefix = `w${workerIndex}`;
-  await db.users.deleteMany({ id: { $regex: `^${prefix}` } });
-}
-```
-
-## Best Practices
-
-- **Reproducibility:** Seed Faker for consistent test data
-- **Isolation:** Prefix data with worker index for parallelism
-- **Cleanup:** Always clean up in afterEach/afterAll
-- **Minimal data:** Only create what's needed for test
-- **Type safety:** Type your factories
-
-## Anti-Patterns
-
-```typescript
-// BAD: Hardcoded values
-const user = { email: 'test@test.com' }; // Collisions!
-
-// GOOD: Dynamic generation
-const user = { email: faker.internet.email() };
-
-// BAD: Shared mutable state
-let globalUser;
-beforeAll(() => { globalUser = createUser(); });
-
-// GOOD: Fresh data per test
-beforeEach(() => { user = userFactory.build(); });
-```

package/.opencode/skills/web-testing/references/test-flakiness-mitigation.md

@@ -1,86 +0,0 @@
-# Test Flakiness Mitigation
-
-## Root Causes
-
-- Timing mismatches (hard waits)
-- Non-isolated tests (shared state)
-- Network instability
-- Animation timing
-
-## Explicit Waits (Not Hard Waits)
-
-```javascript
-// BAD: Hard wait
-await new Promise(r => setTimeout(r, 500));
-
-// GOOD: Wait for condition
-await page.waitForSelector('.success', { timeout: 10000 });
-await expect(page.locator('.count')).toContainText('5');
-
-// BEST: Playwright auto-wait
-await page.getByRole('button', { name: /submit/i }).click();
-```
-
-## Wait Timeout Guidelines
-
-| Scenario | Timeout |
-|----------|---------|
-| Page load | 10-15s |
-| Element visibility | 5-10s |
-| API responses | 30-60s |
-
-## Retry Strategies
-
-```javascript
-// Playwright built-in
-test.describe.configure({ retries: 3 });
-
-// Per-test
-test('flaky test', async ({ page }) => { /* */ }, { retries: 3 });
-
-// Exponential backoff
-async function retryWithBackoff(fn, maxRetries = 3) {
-  for (let i = 0; i < maxRetries; i++) {
-    try { return await fn(); }
-    catch (e) {
-      if (i === maxRetries - 1) throw e;
-      await new Promise(r => setTimeout(r, Math.pow(2, i) * 1000));
-    }
-  }
-}
-```
-
-## Test Isolation
-
-```javascript
-// BAD: Dependent tests
-let userId;
-test('create', async () => { userId = await createUser(); });
-test('load', async () => { await loadUser(userId); }); // Depends on previous!
-
-// GOOD: Independent
-test('create and load', async ({ page }) => {
-  const userId = await createUser(page);
-  await loadUser(page, userId);
-});
-```
-
-## Disable Animations
-
-```css
-* { animation-duration: 0s !important; transition-duration: 0s !important; }
-```
-
-## Network Stability
-
-```javascript
-await page.route('**/external-api/**', route =>
-  route.fulfill({ status: 200, body: '{}' })
-);
-```
-
-## Flakiness Detection
-
-```bash
-npx playwright test --repeat-each=5
-```

package/.opencode/skills/web-testing/references/testing-pyramid-strategy.md

@@ -1,76 +0,0 @@
-# Testing Strategy Models
-
-## Model Comparison
-
-| Model | Structure | Best For |
-|-------|-----------|----------|
-| Pyramid | Unit 70% > Integration 20% > E2E 10% | Monoliths, logic-heavy |
-| Trophy (Dodds) | Static > Integration (largest) > Unit > E2E | Modern SPAs |
-| Honeycomb (Spotify) | Contract-centric cells | Microservices |
-| Diamond | Balanced unit/integration | Domain services |
-
-## Testing Trophy (Recommended for SPAs)
-
-```
-         E2E (minimal)
-        /------------\
-       / Integration  \   <-- Largest portion
-      /----------------\
-     /   Unit Tests     \
-    /--------------------\
-   /   Static Analysis    \  <-- Foundation
-  /________________________\
-```
-
-**Philosophy:** "The more your tests resemble how software is used, the more confidence they give you." - Kent C. Dodds
-
-**Key Principles:**
-- Test behavior, not implementation
-- Minimize mocking
-- Prioritize integration tests
-- Use accessible queries (getByRole first)
-
-## Testing Honeycomb (Microservices)
-
-Contract testing at center, interconnected cells for:
-- Unit tests (implementation details)
-- Integration tests (service boundaries)
-- Contract tests (API agreements)
-- E2E tests (critical paths only)
-
-## Ratios by Context
-
-| Context | Unit | Integration | E2E |
-|---------|------|-------------|-----|
-| Classic Pyramid | 70% | 20% | 10% |
-| Testing Trophy | 30% | 50% | 10% |
-| API-heavy | 75% | 15% | 10% |
-| Microservices | 40% | 40% | 20% |
-
-## Priority Matrix
-
-| Priority | Category | Examples |
-|----------|----------|----------|
-| P0 | Core flows | Signup, login, checkout, payment |
-| P1 | Major features | Search, CRUD, navigation |
-| P2 | Secondary | Filters, sorting, pagination |
-| P3 | Edge cases | Empty states, max limits |
-
-## Coverage Targets
-
-| Area | Target |
-|------|--------|
-| Critical paths | 100% |
-| Core features | 80-90% |
-| Overall | 75-85% |
-
-**Note:** Coverage as diagnostic, not target. Focus on what's uncovered.
-
-## CI/CD Order
-
-```yaml
-- run: npm run lint          # Gate 0: Static analysis
-- run: npm run test:unit     # Gate 1: Fast fail
-- run: npm run test:integration # Gate 2
-- run: npm run test:e2e      # Gate 3: Pre-merge
-```

package/.opencode/skills/web-testing/references/unit-integration-testing.md

@@ -1,138 +0,0 @@
-# Unit & Integration Testing
-
-## Framework Comparison
-
-| Framework | Speed | Best For |
-|-----------|-------|----------|
-| Vitest | Fastest | Modern projects, Vite |
-| Jest | Fast | React/CRA legacy |
-| Bun test | Ultra-fast | Bun projects |
-
-## Vitest Setup
-
-```typescript
-// vitest.config.ts
-export default defineConfig({
-  test: {
-    environment: 'jsdom', // or 'happy-dom'
-    globals: true,
-    coverage: { reporter: ['text', 'json', 'html'] },
-  },
-});
-```
-
-## Vitest Browser Mode (Real Browser)
-
-```typescript
-// vitest.config.ts - higher fidelity than jsdom
-export default defineConfig({
-  test: {
-    browser: {
-      enabled: true,
-      name: 'chromium',
-      provider: 'playwright',
-    },
-  },
-});
-```
-
-**When to use:** Complex DOM interactions, CSS testing, browser APIs
-
-## Test Structure (AAA)
-
-```typescript
-import { describe, it, expect, beforeEach } from 'vitest';
-
-describe('UserService', () => {
-  let service: UserService;
-
-  beforeEach(() => {
-    service = new UserService();
-  });
-
-  it('creates user with valid data', () => {
-    // Arrange
-    const userData = { email: 'test@example.com' };
-
-    // Act
-    const user = service.create(userData);
-
-    // Assert
-    expect(user.id).toBeDefined();
-    expect(user.email).toBe('test@example.com');
-  });
-
-  it('throws on invalid email', () => {
-    expect(() => service.create({ email: 'invalid' }))
-      .toThrow('Invalid email');
-  });
-});
-```
-
-## Integration Test
-
-```typescript
-describe('User API', () => {
-  let db: Database;
-
-  beforeAll(async () => {
-    db = new Database(':memory:');
-    await db.migrate();
-  });
-
-  afterEach(async () => {
-    await db.clearAllTables();
-  });
-
-  it('persists and retrieves user', async () => {
-    await db.users.insert({ email: 'test@example.com' });
-    const user = await db.users.findOne({ email: 'test@example.com' });
-    expect(user).toBeDefined();
-  });
-});
-```
-
-## Test Naming
-
-```typescript
-// Good - describes behavior
-it('should return 200 when valid token provided');
-it('should throw ValidationError when email invalid');
-
-// Bad - vague
-it('test1');
-it('works');
-```
-
-## Mocking
-
-```typescript
-import { vi } from 'vitest';
-
-// Mock module
-vi.mock('./api', () => ({
-  fetchUser: vi.fn().mockResolvedValue({ name: 'John' })
-}));
-
-// Spy
-const spy = vi.spyOn(console, 'log');
-expect(spy).toHaveBeenCalledWith('message');
-```
-
-## Coverage Targets
-
-| Area | Target |
-|------|--------|
-| Critical paths | 100% |
-| Core features | 80-90% |
-| Overall | 75-85% |
-
-## Commands
-
-```bash
-npx vitest run              # Run all
-npx vitest                  # Watch mode
-npx vitest run --coverage   # Coverage
-npx vitest run -u           # Update snapshots
-npx vitest --browser        # Browser mode
-```