spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

Anonymous E2E walk fails on /cpu-dashboard: public route opens staff-gated DashboardHub #427

New Issue
Closed
opened 2026-07-06 02:00:41 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-06 02:00:41 +00:00
Owner
Copy Link
Copy Source

Symptom

The e2e-anonymous CI job fails on master:

[anonymous] › anonymous-walk.spec.ts › loads cpu-dashboard (/cpu-dashboard)
  Error: console errors on /cpu-dashboard
  + "WebSocket connection to 'wss://api.spikersoft.com/hubs/dashboard' failed: HTTP Authentication failed; no valid credentials available"
  + "Error: Failed to start the connection: WebSocket failed to connect..."
  + "[pageerror] WebSocket failed to connect..."

Root cause

/cpu-dashboard was declared public (canActivate: [], manifest access: "public"), but CpuDashboardComponent.ngOnInit() unconditionally calls DashboardMetricsService.initialize(), which opens the DashboardHub (/hubs/dashboard) SignalR connection. That hub was role-gated to authenticated staff in #401. Anonymous visitors send an empty access token → WebSocket auth fails → the SignalR client emits a pageerror + console errors → the anonymous-walk console-error assertion fails.

The route was a leftover // TEMPORARY: CPU Metrics Dashboard for testing scaffold left publicly reachable. This effectively completes #401's intent (a public route was still driving the now-staff-only hub).

Fix

spikersoft-angular PR (branch fix/cpu-dashboard-staff-gate-e2e):

  • Gate the route with [AuthGuard, RoleGuard] + roles: [Admin, admin, Staff, staff] to match the hub.
  • Flip route-manifest.ts access: "public" → "admin" so the anonymous walk skips it and route-coverage's guard/access cross-check (accessMismatches) stays consistent (RoleGuard → admin).

Gating (rather than deleting) preserves the dashboard for authenticated staff; noted in a code comment that it can be removed outright if the team no longer needs it.

Refs #401.

## Symptom The `e2e-anonymous` CI job fails on master: ``` [anonymous] › anonymous-walk.spec.ts › loads cpu-dashboard (/cpu-dashboard) Error: console errors on /cpu-dashboard + "WebSocket connection to 'wss://api.spikersoft.com/hubs/dashboard' failed: HTTP Authentication failed; no valid credentials available" + "Error: Failed to start the connection: WebSocket failed to connect..." + "[pageerror] WebSocket failed to connect..." ``` ## Root cause `/cpu-dashboard` was declared **public** (`canActivate: []`, manifest `access: "public"`), but `CpuDashboardComponent.ngOnInit()` unconditionally calls `DashboardMetricsService.initialize()`, which opens the `DashboardHub` (`/hubs/dashboard`) SignalR connection. That hub was role-gated to authenticated **staff** in #401. Anonymous visitors send an empty access token → WebSocket auth fails → the SignalR client emits a `pageerror` + console errors → the anonymous-walk console-error assertion fails. The route was a leftover `// TEMPORARY: CPU Metrics Dashboard for testing` scaffold left publicly reachable. This effectively completes #401's intent (a public route was still driving the now-staff-only hub). ## Fix spikersoft-angular PR (branch `fix/cpu-dashboard-staff-gate-e2e`): - Gate the route with `[AuthGuard, RoleGuard]` + `roles: [Admin, admin, Staff, staff]` to match the hub. - Flip `route-manifest.ts` `access: "public"` → `"admin"` so the anonymous walk skips it and route-coverage's guard/access cross-check (`accessMismatches`) stays consistent (`RoleGuard → admin`). Gating (rather than deleting) preserves the dashboard for authenticated staff; noted in a code comment that it can be removed outright if the team no longer needs it. Refs #401.
spikerj commented 2026-07-06 02:37:42 +00:00
Author
Owner
Copy Link
Copy Source

Resolved in spikersoft-angular PR #140 (merged to master). Gated /cpu-dashboard with [AuthGuard, RoleGuard] + staff roles to match the staff-only DashboardHub, and flipped the route-manifest access public → admin so the anonymous E2E walk skips it (route-coverage accessMismatches stays consistent, RoleGuard → admin). The anon suite no longer errors on the staff-gated hub. Closing.

Resolved in spikersoft-angular PR #140 (merged to `master`). Gated `/cpu-dashboard` with `[AuthGuard, RoleGuard]` + staff roles to match the staff-only DashboardHub, and flipped the route-manifest access `public` → `admin` so the anonymous E2E walk skips it (route-coverage `accessMismatches` stays consistent, `RoleGuard → admin`). The anon suite no longer errors on the staff-gated hub. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#427