@johnnyboy11234/esg-idea-contest 0.3.1 → 0.3.2

package/frontend/src/shared/ui/copy-button.tsx

@@ -0,0 +1,52 @@
+import { CheckIcon, CopyIcon } from "lucide-react"
+import { useEffect, useState } from "react"
+import { Button } from "./button"
+
+/**
+ * Copies `value` to the clipboard. The button has an accessible name of its own
+ * (`label`); the result is announced in a polite live region (WCAG 4.1.3).
+ */
+export function CopyButton({
+  value,
+  label,
+  copiedText,
+  failedText,
+}: {
+  value: string
+  label: string
+  copiedText: string
+  failedText: string
+}) {
+  const [state, setState] = useState<"idle" | "copied" | "failed">("idle")
+  useEffect(() => {
+    if (state === "idle") return
+    const id = setTimeout(() => setState("idle"), 2000)
+    return () => clearTimeout(id)
+  }, [state])
+
+  const copy = async () => {
+    try {
+      await navigator.clipboard.writeText(value)
+      setState("copied")
+    } catch {
+      setState("failed")
+    }
+  }
+
+  return (
+    <>
+      <Button
+        type="button"
+        variant="outline"
+        size="icon-sm"
+        aria-label={label}
+        onClick={() => void copy()}
+      >
+        {state === "copied" ? <CheckIcon aria-hidden="true" /> : <CopyIcon aria-hidden="true" />}
+      </Button>
+      <span role="status" className="sr-only">
+        {state === "copied" ? copiedText : state === "failed" ? failedText : ""}
+      </span>
+    </>
+  )
+}

package/frontend/src/shared/ui/native-select.tsx

@@ -0,0 +1,27 @@
+import * as React from "react"
+import { ChevronDownIcon } from "lucide-react"
+import { cn } from "./utils"
+
+/** A styled native <select>: keyboard, screen-reader and mobile behaviour stay the browser's. */
+function NativeSelect({ className, ...props }: React.ComponentProps<"select">) {
+  return (
+    <div className="relative w-full">
+      <select
+        data-slot="native-select"
+        className={cn(
+          "h-9 w-full min-w-0 appearance-none rounded-md border border-input bg-transparent py-1 pr-9 pl-3 text-base shadow-xs transition-[color,box-shadow] outline-none disabled:cursor-not-allowed disabled:opacity-50 md:text-sm dark:bg-input/30",
+          "focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
+          "aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40",
+          className
+        )}
+        {...props}
+      />
+      <ChevronDownIcon
+        aria-hidden="true"
+        className="pointer-events-none absolute top-1/2 right-3 size-4 -translate-y-1/2 opacity-50"
+      />
+    </div>
+  )
+}
+
+export { NativeSelect }

package/frontend/src/shared/ui/textarea.tsx

@@ -0,0 +1,19 @@
+import * as React from "react"
+import { cn } from "./utils"
+
+function Textarea({ className, ...props }: React.ComponentProps<"textarea">) {
+  return (
+    <textarea
+      data-slot="textarea"
+      className={cn(
+        "flex field-sizing-content min-h-16 w-full rounded-md border border-input bg-transparent px-3 py-2 text-base shadow-xs transition-[color,box-shadow] outline-none placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50 md:text-sm dark:bg-input/30",
+        "focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
+        "aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40",
+        className
+      )}
+      {...props}
+    />
+  )
+}
+
+export { Textarea }

package/frontend/src/test-setup.ts

@@ -1,6 +1,41 @@
 import '@testing-library/jest-dom/vitest';
+import { File as NodeFile } from 'node:buffer';
+import { FormData as NodeFormData, Response as NodeResponse } from 'undici';
 import { server } from '@/shared/api/mocks/server';
 
-beforeAll(() => server.listen({ onUnhandledFrame: 'error' }));
+/**
+ * jsdom replaces FormData/File with its own classes, which Node's fetch cannot
+ * serialise (the multipart body is never written, so MSW fails with "Premature
+ * close"). Real browsers send a FormData natively; here the jsdom one is encoded
+ * to multipart bytes (by undici's Response) just before the request reaches MSW.
+ * Installed after `server.listen()` so that it sits on top of MSW's own fetch
+ * interceptor.
+ */
+async function encodeMultipart(body: FormData): Promise<{ bytes: ArrayBuffer; contentType: string }> {
+  const out = new NodeFormData();
+  for (const [key, value] of body.entries()) {
+    if (typeof value === 'string') out.append(key, value);
+    else out.append(key, new NodeFile([await value.arrayBuffer()], value.name, { type: value.type }));
+  }
+  const res = new NodeResponse(out);
+  return { bytes: await res.arrayBuffer(), contentType: res.headers.get('content-type') ?? '' };
+}
+
+let mswFetch: typeof fetch;
+
+beforeAll(() => {
+  server.listen({ onUnhandledFrame: 'error' });
+  mswFetch = globalThis.fetch;
+  globalThis.fetch = async (input, init) => {
+    if (!(init?.body instanceof FormData)) return mswFetch(input, init);
+    const { bytes, contentType } = await encodeMultipart(init.body);
+    const headers = new Headers(init.headers);
+    headers.set('Content-Type', contentType);
+    return mswFetch(input, { ...init, headers, body: bytes });
+  };
+});
 afterEach(() => server.resetHandlers());
-afterAll(() => server.close());
+afterAll(() => {
+  globalThis.fetch = mswFetch;
+  server.close();
+});

package/frontend/vite.config.ts

@@ -5,10 +5,12 @@ import { defineConfig } from 'vitest/config';
 
 const src = fileURLToPath(new URL('./src', import.meta.url));
 const testdata = fileURLToPath(new URL('../testdata', import.meta.url));
+// The backend's bundled common-password list (PRD §6.4): one file for both sides, lazy-loaded by the register page.
+const passwords = fileURLToPath(new URL('../backend/internal/account/internal/passwords', import.meta.url));
 
 export default defineConfig({
   plugins: [react(), tailwindcss()],
-  resolve: { alias: { '@': src, testdata } },
+  resolve: { alias: { '@': src, testdata, passwords } },
   server: {
     fs: { allow: ['..'] },
     // The app calls same-origin /api/v1; in dev the Go backend (ESG_PUBLIC_ADDR, default :8080) answers it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johnnyboy11234/esg-idea-contest",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "ESG Idea Contest registration system: Go backend, React frontend and design documents (source distribution).",
   "license": "MIT",
   "author": "Brian Huang",

package/testdata/password.json

@@ -1,5 +1,5 @@
 {
- "description": "Shared by backend (Go) and frontend (TS). password and empNo are raw strings; empNo is \"\" when the submitted employee ID is malformed (CONTAINS_EMP_NO is then skipped). wantRules lists every violated rule id in PRD 6.4 table order ([] = valid). Rules not implemented yet (SEQUENCE, COMMON_PASSWORD: B1b-03 and later) have no cases here; those cases are added with their rules, and these inputs avoid triggering them. PRD 6.4.",
+ "description": "Shared by backend (Go) and frontend (TS). password and empNo are raw strings; empNo is \"\" when the submitted employee ID is malformed (CONTAINS_EMP_NO is then skipped). wantRules lists every violated rule id in PRD 6.4 table order ([] = valid). One substring may violate several rules (\"1234\" is KEYBOARD_RUN and SEQUENCE). COMMON_PASSWORD uses backend/internal/account/internal/passwords/common-passwords.txt (whole password, case-insensitive, nothing trimmed). PRD 6.4.",
  "cases": [
   {
    "id": "valid-typical",
@@ -9,7 +9,7 @@
   },
   {
    "id": "valid-min-length-12",
-   "password": "Abcdefgh1!xY",
+   "password": "Azkqmvrt1!xY",
    "empNo": "",
    "wantRules": []
   },
@@ -51,7 +51,7 @@
   },
   {
    "id": "length-11",
-   "password": "Abcdefgh1!x",
+   "password": "Azkqmvrt1!x",
    "empNo": "",
    "wantRules": [
     "LENGTH"
@@ -125,7 +125,7 @@
   },
   {
    "id": "complexity-two-classes-lower-digit",
-   "password": "abcdefghij12",
+   "password": "azkqmvrtjx12",
    "empNo": "",
    "wantRules": [
     "COMPLEXITY"
@@ -149,7 +149,7 @@
   },
   {
    "id": "complexity-non-ascii-is-no-class",
-   "password": "abcdefghijk1é",
+   "password": "azkqmvrtjxp1é",
    "empNo": "",
    "wantRules": [
     "CHARSET",
@@ -239,6 +239,7 @@
     "LENGTH",
     "COMPLEXITY",
     "KEYBOARD_RUN",
+    "SEQUENCE",
     "REPEAT",
     "CONTAINS_EMP_NO"
    ]
@@ -251,6 +252,7 @@
     "CHARSET",
     "COMPLEXITY",
     "KEYBOARD_RUN",
+    "SEQUENCE",
     "REPEAT",
     "CONTAINS_EMP_NO"
    ]
@@ -260,7 +262,8 @@
    "password": "Xk9-1234-Pmzj",
    "empNo": "",
    "wantRules": [
-    "KEYBOARD_RUN"
+    "KEYBOARD_RUN",
+    "SEQUENCE"
    ]
   },
   {
@@ -300,7 +303,8 @@
    "password": "Zq-4321-Mj8P",
    "empNo": "",
    "wantRules": [
-    "KEYBOARD_RUN"
+    "KEYBOARD_RUN",
+    "SEQUENCE"
    ]
   },
   {
@@ -418,8 +422,161 @@
    "empNo": "",
    "wantRules": [
     "KEYBOARD_RUN",
+    "SEQUENCE",
     "REPEAT"
    ]
+  },
+  {
+   "id": "sequence-alpha-ascending",
+   "password": "Zq-abcd-M81x",
+   "empNo": "",
+   "wantRules": [
+    "SEQUENCE"
+   ]
+  },
+  {
+   "id": "sequence-alpha-descending",
+   "password": "Zq-dcba-M81x",
+   "empNo": "",
+   "wantRules": [
+    "SEQUENCE"
+   ]
+  },
+  {
+   "id": "sequence-case-insensitive",
+   "password": "Zq-aBcD-M81x",
+   "empNo": "",
+   "wantRules": [
+    "SEQUENCE"
+   ]
+  },
+  {
+   "id": "sequence-digits-not-a-keyboard-run",
+   "password": "Zq-0123-Mkpx",
+   "empNo": "",
+   "wantRules": [
+    "SEQUENCE"
+   ]
+  },
+  {
+   "id": "sequence-digits-descending-not-a-keyboard-run",
+   "password": "Zq-3210-Mkpx",
+   "empNo": "",
+   "wantRules": [
+    "SEQUENCE"
+   ]
+  },
+  {
+   "id": "sequence-longer-run-reported-once",
+   "password": "Zq-abcdefg-M1",
+   "empNo": "",
+   "wantRules": [
+    "SEQUENCE"
+   ]
+  },
+  {
+   "id": "sequence-three-ok",
+   "password": "Zq-abc-M81xPk",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "sequence-alpha-does-not-wrap",
+   "password": "Zq-xyza-M81p",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "sequence-digits-do-not-wrap",
+   "password": "Zq-9012-Mkpx",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "sequence-direction-change-ok",
+   "password": "Zq-abcba-M81x",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "sequence-repeat-breaks-run",
+   "password": "Zq-abbc-M81xP",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "sequence-letters-and-digits-do-not-join",
+   "password": "Zq-89ab-Mkpx",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "sequence-ascii-neighbour-does-not-join",
+   "password": "Zq-xyz{-Mk81",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "common-exact",
+   "password": "password",
+   "empNo": "",
+   "wantRules": [
+    "LENGTH",
+    "COMPLEXITY",
+    "COMMON_PASSWORD"
+   ]
+  },
+  {
+   "id": "common-case-insensitive",
+   "password": "Films+Pic+Galeries",
+   "empNo": "",
+   "wantRules": [
+    "COMMON_PASSWORD"
+   ]
+  },
+  {
+   "id": "common-lower-case-entry",
+   "password": "films+pic+galeries",
+   "empNo": "",
+   "wantRules": [
+    "COMPLEXITY",
+    "COMMON_PASSWORD"
+   ]
+  },
+  {
+   "id": "common-upper-case",
+   "password": "PASSWORD",
+   "empNo": "",
+   "wantRules": [
+    "LENGTH",
+    "COMPLEXITY",
+    "COMMON_PASSWORD"
+   ]
+  },
+  {
+   "id": "common-not-trimmed",
+   "password": " Films+Pic+Galeries",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "common-entry-inside-longer-password-ok",
+   "password": "Films+Pic+Galeries1",
+   "empNo": "",
+   "wantRules": []
+  },
+  {
+   "id": "table-order-common-and-runs",
+   "password": "123456",
+   "empNo": "123456",
+   "wantRules": [
+    "LENGTH",
+    "COMPLEXITY",
+    "COMMON_PASSWORD",
+    "KEYBOARD_RUN",
+    "SEQUENCE",
+    "CONTAINS_EMP_NO"
+   ]
   }
  ]
 }

package/testdata/permission-matrix.json

@@ -116,6 +116,29 @@
         "admin": { "status": 403, "code": "FORBIDDEN" }
       }
     },
+    {
+      "id": "download-slides-missing",
+      "operation": "download slides of a missing Idea (uniform 404; cells for an existing Idea are in internal/idea/download_integration_test.go)",
+      "method": "GET",
+      "path": "/api/v1/ideas/00000000-0000-4000-8000-000000000000/slides",
+      "expect": {
+        "visitor": { "status": 401, "code": "UNAUTHENTICATED" },
+        "user": { "status": 404, "code": "NOT_FOUND" },
+        "admin": { "status": 404, "code": "NOT_FOUND" }
+      }
+    },
+    {
+      "id": "download-slides-head",
+      "operation": "HEAD on the slide download: 405, never the GET handler (D47)",
+      "method": "HEAD",
+      "path": "/api/v1/ideas/00000000-0000-4000-8000-000000000000/slides",
+      "outsideSpec": true,
+      "expect": {
+        "visitor": { "status": 401, "code": "UNAUTHENTICATED" },
+        "user": { "status": 405, "code": "METHOD_NOT_ALLOWED" },
+        "admin": { "status": 405, "code": "METHOD_NOT_ALLOWED" }
+      }
+    },
     {
       "id": "order-logout-no-csrf",
       "operation": "check order: a write without a CSRF token",

package/testdata/schema/permission-matrix.schema.json

@@ -18,7 +18,7 @@
         "properties": {
           "id": { "type": "string", "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$" },
           "operation": { "type": "string", "minLength": 1 },
-          "method": { "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"] },
+          "method": { "enum": ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"] },
           "path": { "type": "string", "pattern": "^/api/v1/" },
           "body": { "type": "object" },
           "multipart": {