Security

tests/market.test.ts

@@ -255,6 +255,37 @@ test('stale listings are removed and changed cards cannot be paid for', async t
   await f.orders(); assert.equal(f.market.browse().listings.length, 0);
 });
 
+test('direct canonical delivery outside the marketplace cannot also produce a refund', async t => {
+  const f = await fixture(t), l = await f.list(), o = await f.buy(l);
+  await f.run(bob, { type: 'mock-pay', orderId: o.id });
+  const tx = f.delivery(o);
+  f.confirm(tx); // No marketplace deliver command or saved transferId.
+  const settling = (await f.orders())[0];
+  assert.equal(settling.status, 'delivery-pending');
+  assert.equal(settling.transferId, transferId(tx));
+  await assert.rejects(f.run(bob, { type: 'refund', orderId: o.id }), /Refund requires/);
+  f.chain.state.blocks.push({ ...f.chain.state.blocks[0], height: 4, transactions: [] });
+  assert.equal((await f.orders())[0].status, 'complete');
+});
+
+test('direct pending delivery is not a conflict, while unpaid delivery never triggers payout', async t => {
+  const f = await fixture(t), l = await f.list(), o = await f.buy(l);
+  await f.run(bob, { type: 'mock-pay', orderId: o.id });
+  f.chain.state.pendingTransfers.push(f.delivery(o));
+  f.advance(48 * 3600_000);
+  assert.equal((await f.orders())[0].status, 'paid');
+  await assert.rejects(f.run(bob, { type: 'refund', orderId: o.id }), /Refund requires/);
+});
+
+test('canonical delivery without mock payment is held for review, not paid out', async t => {
+  const f = await fixture(t), l = await f.list(), o = await f.buy(l);
+  f.confirm(f.delivery(o));
+  f.chain.state.blocks.push({ ...f.chain.state.blocks[0], height: 4, transactions: [] });
+  assert.equal((await f.orders())[0].status, 'review');
+  assert.equal((await f.orders())[0].payout, 'review');
+  assert.equal((await f.orders())[0].additionalFee?.payout, 'review');
+});
+
 test('old open listings require fresh seller fee authorization and cannot be bought', async t => {
   const f = await fixture(t), l = await f.list();
   const db = new DatabaseSync(join(f.dir, 'testnet', 'market.sqlite'));

tests/network.test.ts

@@ -85,3 +85,25 @@ test('mainnet ledger and market files use isolated folders; testnet backup heade
     assert.deepEqual(result, { ledger: true, market: true, testnet: false, rejected: true });
   } finally { await rm(dir, { recursive: true, force: true }); }
 });
+
+test('operator preflight is read-only, fails closed, and does not disclose credentials', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'wikideck-preflight-'));
+  try {
+    const { existsSync } = await import('node:fs');
+    const dataDir = join(dir, 'must-not-be-created');
+    const secret = 'test-only-sensitive-value-must-not-appear';
+    const result = spawnSync(process.execPath, ['--experimental-strip-types', 'server/index.ts', '--launch-preflight'], {
+      env: { ...process.env, WIKIDECK_NETWORK: 'mainnet', WIKIDECK_DATA_DIR: dataDir,
+        WIKIDECK_MAINNET_LAUNCH: '', WIKIDECK_MAINNET_REVIEW_ACK: '', SHKEEPER_API_KEY: secret },
+      encoding: 'utf8', timeout: 30000,
+    });
+    assert.equal(result.status, 1);
+    const report = JSON.parse(result.stdout);
+    assert.equal(report.productionReady, false);
+    assert.equal(report.decision, 'NO-GO');
+    assert.equal(report.paymentMode, 'mock');
+    assert.ok(report.checks.some((c: { id: string; status: string }) => c.id === 'consensus-launch-calibration' && c.status === 'blocked'));
+    assert.equal(result.stdout.includes(secret), false);
+    assert.equal(existsSync(dataDir), false);
+  } finally { await rm(dir, { recursive: true, force: true }); }
+});