Add missing granular token specs and drop coverage todo file
What does this MR do and why?
Add missing granular token specs and drop coverage todo file
Count REST permission test coverage per endpoint declaration and boundary type instead of per expanded route. Routes generated from a single decorator (shared concerns mounted at multiple levels, endpoints defined in loops, path aliases) share one code path, so requiring one test per route demanded duplicate tests without extra coverage, for example 153 update_integration routes from one declaration.
Fix two scanner bugs: keyword argument values after a permission array were counted as permissions, and include_examples invocations of the shared example were not recognized.
Add the authorization tests for all permissions that were listed in
config/authz/routes/test_coverage_todo.txt, then delete the file and
its handling in the validation task.
Also fix the vulnerability notes REST endpoints, which returned 500
because NotesFinder#target returns a Vulnerabilities::Read that has no
policy. Map it back to the Vulnerability before the permission check.
References
Screenshots or screen recordings
| Before | After |
|---|---|
How to set up and validate locally
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.