gabriel / musehub public
feat mists task/phase-8-stress-security-docs #1 / 1
gabriel · 163 days ago · Apr 15, 2026 · Diff

feat(mists): Phase 8 — stress tests, security tests, domain reference doc

- tests/test_mists.py: Tier 4 stress suite (concurrent creates, large explore pagination, fork chains) - tests/test_mist_security.py: Tier 7 security suite (filename attacks, XSS, access control, collision resistance, oversized content, fork depth enforcement, tag security) - docs/reference/mist-domain.md: complete domain reference (concepts, URL schema, artifact types, CLI, REST API, MCP tools, embedding, content addressing, security model, limits)

All 43 tests pass.

sha256:9b746a1cb603e7aa36a54fa08ff17b558e605b27a15ad269bdb923306ef1080e sha
sha256:92e743e493e18a2e41bef574e71ee033729e4f5ae86c8fa76fd964771a4697f6 parent
+128 symbols
sha256:3491e3d01d44710f71c2b0d4b9b6402e025506c2601604c4644e6b54aee08b00 snapshot
+128
symbols added
0
dead code introduced
Semantic Changes 128 symbols
~ docs/reference/mist-domain.md .md 53 symbols added
+ Mist Domain — Complete Reference section Mist Domain — Complete Reference L1–428
+ Agent Publishing Workflow section Agent Publishing Workflow L289–327
+ code[bash]@L309 variable variable code[bash]@L309 L309–316
+ code[python]@L293 variable variable code[python]@L293 L293–306
+ Artifact Types section Artifact Types L70–92
+ table@L75 section table@L75 L75–85
+ CLI Reference section CLI Reference L92–157
+ Create section Create L96–123
+ code[bash]@L115 variable variable code[bash]@L115 L115–122
+ code[bash]@L98 variable variable code[bash]@L98 L98–112
+ Delete section Delete L149–157
+ code[bash]@L151 variable variable code[bash]@L151 L151–154
+ Fork section Fork L135–141
+ code[bash]@L137 variable variable code[bash]@L137 L137–140
+ List section List L123–129
+ code[bash]@L125 variable variable code[bash]@L125 L125–128
+ Read section Read L129–135
+ code[bash]@L131 variable variable code[bash]@L131 L131–134
+ Update section Update L141–149
+ code[bash]@L143 variable variable code[bash]@L143 L143–148
+ Concepts section Concepts L28–42
+ table@L30 section table@L30 L30–39
+ Content Addressing section Content Addressing L376–399
+ code[python]@L380 variable variable code[python]@L380 L380–387
+ Contents section Contents L11–28
+ Embedding section Embedding L345–376
+ Script tag section Script tag L362–376
+ code[html]@L364 variable variable code[html]@L364 L364–370
+ iframe section iframe L347–362
+ code[html]@L349 variable variable code[html]@L349 L349–358
+ Forking & Sub-domain Delegation section Forking & Sub-domain Delegation L327–345
+ Limits section Limits L414–428
+ table@L416 section table@L416 L416–428
+ MCP Tools & Resources section MCP Tools & Resources L263–289
+ Resources section Resources L277–289
+ code@L279 variable variable code@L279 L279–283
+ Tools section Tools L265–277
+ table@L267 section table@L267 L267–276
+ REST API section REST API L157–263
+ DELETE /api/mists/{mist_id} section DELETE /api/mists/{mist_id} L232–236
+ GET /api/mists/explore section GET /api/mists/explore L243–263
+ code@L247 variable variable code@L247 L247–250
+ code[json]@L253 variable variable code[json]@L253 L253–260
+ PATCH /api/mists/{mist_id} section PATCH /api/mists/{mist_id} L215–232
+ code[json]@L219 variable variable code[json]@L219 L219–227
+ POST /api/mists section POST /api/mists L161–215
+ code[json]@L167 variable variable code[json]@L167 L167–180
+ code[json]@L183 variable variable code[json]@L183 L183–211
+ POST /api/mists/{mist_id}/fork section POST /api/mists/{mist_id}/fork L236–243
+ Security Model section Security Model L399–414
+ table@L401 section table@L401 L401–411
+ URL Schema section URL Schema L42–70
+ code@L44 variable variable code@L44 L44–67
~ tests/test_mist_security.py .py 52 symbols added
+ TestAccessControl class class TestAccessControl L255–474
+ test_non_owner_delete_returns_404 method async_method test_non_owner_delete_returns_404 L374–402
+ test_non_owner_update_returns_404 method async_method test_non_owner_update_returns_404 L340–371
+ test_owner_can_see_own_secret_mist method async_method test_owner_can_see_own_secret_mist L463–474
+ test_secret_mist_detail_returns_403_for_non_owner method async_method test_secret_mist_detail_returns_403_for_non_owner L307–337
+ test_secret_mist_not_in_explore method async_method test_secret_mist_not_in_explore L292–304
+ test_secret_mist_not_in_other_owners_list method async_method test_secret_mist_not_in_other_owners_list L259–289
+ test_unauthenticated_create_returns_401 method async_method test_unauthenticated_create_returns_401 L405–409
+ test_unauthenticated_delete_returns_401 method async_method test_unauthenticated_delete_returns_401 L438–460
+ test_unauthenticated_update_returns_401 method async_method test_unauthenticated_update_returns_401 L412–435
+ TestCollisionResistance class class TestCollisionResistance L481–528
+ test_different_content_different_id method async_method test_different_content_different_id L504–512
+ test_duplicate_content_returns_409 method async_method test_duplicate_content_returns_409 L485–501
+ test_mist_id_deterministic_from_content method async_method test_mist_id_deterministic_from_content L515–528
+ TestContentInjection class class TestContentInjection L195–248
+ test_html_entity_stored_verbatim method async_method test_html_entity_stored_verbatim L216–231
+ test_unicode_content_roundtrips method async_method test_unicode_content_roundtrips L234–248
+ test_xss_script_tag_stored_verbatim method async_method test_xss_script_tag_stored_verbatim L199–213
+ TestFilenameAttacks class class TestFilenameAttacks L65–188
+ test_ansi_escape_sequence method async_method test_ansi_escape_sequence L146–154
+ test_backslash_separator method async_method test_backslash_separator L113–121
+ test_control_character_newline method async_method test_control_character_newline L135–143
+ test_control_character_tab method async_method test_control_character_tab L124–132
+ test_empty_filename_rejected method async_method test_empty_filename_rejected L168–176
+ test_forward_slash_separator method async_method test_forward_slash_separator L102–110
+ test_null_byte method async_method test_null_byte L91–99
+ test_overlong_filename method async_method test_overlong_filename L157–165
+ test_path_traversal_deep method async_method test_path_traversal_deep L80–88
+ test_path_traversal_dotdot method async_method test_path_traversal_dotdot L69–77
+ test_valid_filename_accepted method async_method test_valid_filename_accepted L179–188
+ TestForkDepthEnforcement class class TestForkDepthEnforcement L578–637
+ test_fork_chain_to_max_depth method async_method test_fork_chain_to_max_depth L582–600
+ test_fork_nonexistent_mist_returns_404 method async_method test_fork_nonexistent_mist_returns_404 L628–637
+ test_fork_past_max_depth_returns_422 method async_method test_fork_past_max_depth_returns_422 L603–625
+ TestLargeContentRejection class class TestLargeContentRejection L535–571
+ test_near_limit_content_accepted method async_method test_near_limit_content_accepted L558–571
+ test_oversized_content_returns_413 method async_method test_oversized_content_returns_413 L539–555
+ TestTagSecurity class class TestTagSecurity L644–678
+ test_null_byte_in_tag_rejected method async_method test_null_byte_in_tag_rejected L670–678
+ test_overlong_tag_rejected method async_method test_overlong_tag_rejected L659–667
+ test_too_many_tags_rejected method async_method test_too_many_tags_rejected L648–656
+ _OTHER variable variable _OTHER L40–40
+ _OWNER variable variable _OWNER L39–39
+ _PY_CONTENT variable variable _PY_CONTENT L42–42
+ _create function async_function _create L55–58
+ _payload function function _payload L45–52
+ AsyncClient import import AsyncClient L34–34
+ AsyncSession import import AsyncSession L35–35
+ JSONObject import import JSONObject L37–37
+ annotations import import annotations L29–29
+ pytest import import pytest L33–33
+ uuid import import uuid L31–31
~ tests/test_mists.py .py 23 symbols added
+ TestConcurrentCreates class class TestConcurrentCreates L57–111
+ test_concurrent_creates_all_succeed method async_method test_concurrent_creates_all_succeed L61–76
+ test_concurrent_creates_all_visible_in_list method async_method test_concurrent_creates_all_visible_in_list L79–111
+ TestForkChains class class TestForkChains L270–360
+ test_fork_chain_completes_under_5s method async_method test_fork_chain_completes_under_5s L344–360
+ test_fork_chain_depth_and_parent_ids method async_method test_fork_chain_depth_and_parent_ids L274–303
+ test_fork_count_increments_on_parent method async_method test_fork_count_increments_on_parent L327–341
+ test_fork_inherits_content_and_filename method async_method test_fork_inherits_content_and_filename L306–324
+ TestLargeExplore class class TestLargeExplore L118–263
+ test_200_mist_explore_no_duplicates method async_method test_200_mist_explore_no_duplicates L122–179
+ test_large_explore_total_count_accurate method async_method test_large_explore_total_count_accurate L182–221
+ test_large_explore_under_2s method async_method test_large_explore_under_2s L224–263
+ _OWNER variable variable _OWNER L34–34
+ _create function async_function _create L47–50
+ _payload function function _payload L37–44
+ AsyncClient import import AsyncClient L29–29
+ AsyncSession import import AsyncSession L30–30
+ JSONObject import import JSONObject L32–32
+ annotations import import annotations L22–22
+ asyncio import import asyncio L24–24
+ pytest import import pytest L28–28
+ time import import time L25–25
+ uuid import import uuid L26–26
← Older Oldest on task/phase-8-stress-security-docs
All commits
Newer → Latest on task/phase-8-stress-security-docs

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:9b746a1cb603e7aa36a54fa08ff17b558e605b27a15ad269bdb923306ef1080e --body "your comment"