From 6426bb99232e16d5e916d31de130b5411b8ecae2 Mon Sep 17 00:00:00 2001 From: Sergey Kozyrenko Date: Mon, 20 Jul 2026 06:20:53 +0700 Subject: [PATCH] fix(e2e): don't disable TLS validation in committed code schema-compat set NODE_TLS_REJECT_UNAUTHORIZED=0 process-wide (CodeQL js/disabling-certificate-validation, high). A real stand has a valid cert; only the local self-signed Tier-2 stack needs it, so the operator now opts in via their own shell env, never in code. Co-Authored-By: Claude Fable 5 --- frontend/docs/e2e.md | 3 ++- frontend/e2e/tools/schema-compat.mjs | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/frontend/docs/e2e.md b/frontend/docs/e2e.md index a4f95159..ce19145c 100644 --- a/frontend/docs/e2e.md +++ b/frontend/docs/e2e.md @@ -114,7 +114,8 @@ Before the browser specs, a **schema-compat pre-flight** validates every frontend operation against it — a renamed or missing field fails once, readably, instead of as dozens of red specs (the deploy-skew class we hit manually). Run it anywhere: `E2E_BASE_URL=https://… node -e2e/tools/schema-compat.mjs`. +e2e/tools/schema-compat.mjs` (against the local self-signed Tier-2 stack, +prefix `NODE_TLS_REJECT_UNAUTHORIZED=0`; a real stand has a valid cert). ## Trends and selective runs diff --git a/frontend/e2e/tools/schema-compat.mjs b/frontend/e2e/tools/schema-compat.mjs index 8606b5c8..db16eef7 100644 --- a/frontend/e2e/tools/schema-compat.mjs +++ b/frontend/e2e/tools/schema-compat.mjs @@ -27,9 +27,9 @@ if (!BASE_URL) { process.exit(2); } -// Node rejects the stack's self-signed cert otherwise; the target is trusted by -// virtue of being the URL we were told to check. -process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'; +// A real stand has a valid cert. Only the local self-signed Tier-2 stack needs +// TLS verification relaxed — the operator opts in for that with +// `NODE_TLS_REJECT_UNAUTHORIZED=0 node …` in their own shell, never in code. // Despite the name, this file holds the frontend's operations (named queries / // mutations / subscriptions + fragments), not a schema.