2 commits

Author	SHA1	Message	Date
Adam Moussa	36fc1120bf	build(deps): upgrade MUI to v9 (material + icons) and group @mui/* in Dependabot (#168) ... Bump @mui/material and @mui/icons-material 7.3.1 -> ^9.1.1 together in /web. They must move in lockstep (icons peer-depends on material), so Dependabot's separate per-package PRs (#145/#146) could never go green individually (ERESOLVE). Adds a 'mui' Dependabot group so future @mui/* updates — including majors — are raised as one PR. MUI v9 migration fixes (v7->v9 spans two majors): - ListItemText: primaryTypographyProps -> slotProps.primary; fontSize moved into sx (Typography system props removed in v9). - Autocomplete renderInput: params.InputProps -> params.slotProps.input; spread ...params.slotProps to retain inputLabel/htmlInput slots. - Icons: @mui/icons-material/ErrorOutline -> ErrorOutlined (the plain ErrorOutline export was removed in v9). - vitest: inline @mui/material + react-transition-group so Vite resolves v9's Transition.mjs directory import (native ESM loader can't). Verified locally on Node 24: npm ci, npm run build, and npm test (26 tests, 3 suites) all pass.	2026-06-22 16:02:43 -04:00
Adam Moussa	d21b1c5edb	test: bootstrap test infrastructure with critical coverage (QA-C1 through QA-C6) ... QA-C1: Create xUnit test project, add to solution, wire dependencies - api/tests/ProposalSystem.Tests with xUnit + FluentAssertions + NSubstitute - InMemory EF Core provider for isolated DB tests QA-C2: Proposal state machine transition tests (16 tests) - Valid: InReview->Approved, Approved->Sent, Sent->Revised - Invalid: InReview->Sent, Approved->Revised, Draft->Approved, etc. - Edge cases: idempotency, missing line items, revision line item copying - Audit and job publisher verification QA-C3: Authorization attribute tests (16 tests) - Controller-level [Authorize] on all controllers except AuthController - Role requirements: admins/sysadmins on admin actions - Dispatcher exclusion from admin/sysadmin routes - SysAdmin-only user management enforcement QA-C4: InternalApiKeyMiddleware tests (8 tests) - Valid key sets claims and calls next - Invalid key passes through to JWT (no 401/403) - Missing key/empty config disables middleware - Documents API-C1 vulnerability (key works on any path) QA-C5: ProtectedRoute and RoleGuard tests (12 tests, vitest) - ProtectedRoute: renders children when authenticated, redirects when not - RoleGuard: role-based access, dispatcher/admin/sysadmin enforcement - authSlice: setUser, logout, expired token handling QA-C6: Lambda SQS handler tests (19 tests, pytest) - pdf-generate: batch processing, failure reporting, malformed body - suggestions: batch processing, proposal-not-found skip, AI item preservation - API key caching, retry helpers Total: 107 tests (76 .NET + 12 web + 19 Python), all passing.	2026-05-27 18:18:44 -04:00