| 1 |
# Mutation scope for the MNW server. |
| 2 |
# |
| 3 |
# Not a tuning knob. Unscoped, this crate generates 9,766 mutants and each one |
| 4 |
# re-runs the test suite, so a single pass is roughly six days of machine. It |
| 5 |
# had consequently never completed once, which meant no mutation data at all for |
| 6 |
# the largest thing we ship. Scoping is what makes the check exist. |
| 7 |
# |
| 8 |
# Two rules decide what is in here, and both are deliberate. |
| 9 |
# |
| 10 |
# 1. Ordered by blast radius: money first, then user data, then the security |
| 11 |
# boundary. A survivor is a line whose behaviour no test observes, so this |
| 12 |
# check answers "where can we be wrong and not find out", and the answer |
| 13 |
# matters most where being wrong costs a creator money or their files. |
| 14 |
# |
| 15 |
# 2. Only files that already have tests. Mutating a file with no test reports |
| 16 |
# every mutant as a survivor, which is noise at a volume that buries the real |
| 17 |
# findings, and it answers a question `grep` answers for free. 41 files in the |
| 18 |
# money and user-data groups still have no test at all, among them |
| 19 |
# db/transactions/purchases.rs (1,375 lines), db/users.rs (1,269) and |
| 20 |
# routes/stripe/webhook/checkout.rs (1,024). Those are filed as GoingsOn |
| 21 |
# problems against mnw-server and frozen by tests/untested_money_paths.rs; |
| 22 |
# they are a coverage gap to close, not a mutation result to compute. |
| 23 |
# |
| 24 |
# Expect survivors in the async half of the files added on 2026-08-04. Their |
| 25 |
# pure helpers gained unit tests that day; the Stripe and database paths around |
| 26 |
# them did not, and those are the filed problems above rather than news. Prune |
| 27 |
# this list by function only if that noise proves louder than the signal. |
| 28 |
# |
| 29 |
# Add a file here when it gains its first test, rather than when it is written. |
| 30 |
# Method, tiers and the untested list: wiki `testing-posture`. |
| 31 |
|
| 32 |
examine_globs = [ |
| 33 |
|
| 34 |
# --- Money. A survivor here is a way the ledger can be wrong without any |
| 35 |
# test noticing. |
| 36 |
# 20 files, 10,397 lines, 256 tests. |
| 37 |
"src/db/creator_tiers/mod.rs", |
| 38 |
"src/db/creator_tiers/storage_quota.rs", |
| 39 |
"src/db/creator_tiers/subscriptions.rs", |
| 40 |
"src/db/promo_codes.rs", |
| 41 |
"src/helpers/billing.rs", |
| 42 |
"src/payments/checkout.rs", |
| 43 |
"src/payments/checkout_metadata.rs", |
| 44 |
"src/payments/connect.rs", |
| 45 |
"src/payments/fan_ops.rs", |
| 46 |
"src/payments/mod.rs", |
| 47 |
"src/payments/synckit_app_pricing.rs", |
| 48 |
"src/payments/synckit_billing.rs", |
| 49 |
"src/payments/webhooks.rs", |
| 50 |
"src/pricing.rs", |
| 51 |
"src/pricing_comparison.rs", |
| 52 |
"src/routes/stripe/checkout/subscriptions.rs", |
| 53 |
"src/routes/stripe/webhook/checkout_helpers.rs", |
| 54 |
"src/routes/stripe/webhook/subscriptions.rs", |
| 55 |
"src/synckit_billing.rs", |
| 56 |
"src/tier_prices.rs", |
| 57 |
|
| 58 |
# --- User data. A survivor here is a way a creator's files, sync state or |
| 59 |
# account can be corrupted or lost silently. |
| 60 |
# 13 files, 8,619 lines, 155 tests. |
| 61 |
"src/db/pending_s3_deletions.rs", |
| 62 |
"src/db/synckit/apps.rs", |
| 63 |
"src/import/csv_converter.rs", |
| 64 |
"src/import/mod.rs", |
| 65 |
"src/import/pipeline.rs", |
| 66 |
"src/routes/storage/gallery.rs", |
| 67 |
"src/routes/storage/media.rs", |
| 68 |
"src/routes/storage/mod.rs", |
| 69 |
"src/routes/synckit/billing.rs", |
| 70 |
"src/routes/synckit/blobs.rs", |
| 71 |
"src/routes/synckit/keys.rs", |
| 72 |
"src/routes/synckit/mod.rs", |
| 73 |
"src/storage.rs", |
| 74 |
|
| 75 |
# --- Auth, access control, input validation and scanning. Every file on this |
| 76 |
# boundary has tests; mutation asks whether they are strong enough. |
| 77 |
# 34 files, 18,514 lines, 593 tests. |
| 78 |
"src/access_gate.rs", |
| 79 |
"src/auth.rs", |
| 80 |
"src/crypto.rs", |
| 81 |
"src/csrf.rs", |
| 82 |
"src/custom_pages/css_sanitizer.rs", |
| 83 |
"src/custom_pages/html_sanitizer.rs", |
| 84 |
"src/custom_pages/mod.rs", |
| 85 |
"src/custom_pages/url_filter.rs", |
| 86 |
"src/db/scan_jobs.rs", |
| 87 |
"src/extractors.rs", |
| 88 |
"src/git_ssh.rs", |
| 89 |
"src/oauth_scope.rs", |
| 90 |
"src/rate_limit.rs", |
| 91 |
"src/scanning/archive.rs", |
| 92 |
"src/scanning/clamav.rs", |
| 93 |
"src/scanning/content_type.rs", |
| 94 |
"src/scanning/hash_lookup.rs", |
| 95 |
"src/scanning/metadefender.rs", |
| 96 |
"src/scanning/mod.rs", |
| 97 |
"src/scanning/signing_linux.rs", |
| 98 |
"src/scanning/signing_macos.rs", |
| 99 |
"src/scanning/signing_windows.rs", |
| 100 |
"src/scanning/spool.rs", |
| 101 |
"src/scanning/structural.rs", |
| 102 |
"src/scanning/urlhaus.rs", |
| 103 |
"src/scanning/worker.rs", |
| 104 |
"src/scanning/yara.rs", |
| 105 |
"src/security_signals.rs", |
| 106 |
"src/synckit_auth.rs", |
| 107 |
"src/validation/items.rs", |
| 108 |
"src/validation/mod.rs", |
| 109 |
"src/validation/payments.rs", |
| 110 |
"src/validation/projects.rs", |
| 111 |
"src/validation/users.rs", |
| 112 |
] |
| 113 |
|